[Federal Register Volume 69, Number 13 (Wednesday, January 21, 2004)]
[Notices]
[Pages 2962-2966]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 04-1164]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Department of Veterans Affairs (VA).

[[Page 2963]]


ACTION: Notice of amendment to system of records.

-----------------------------------------------------------------------

SUMMARY: The Privacy Act of 1974 (5 U.S.C. 552a(e)(4)) requires that 
all agencies publish in the Federal Register a notice of the existence 
and character of their systems of records. Notice is hereby given that 
the Department of Veterans Affairs (VA) is amending the system of 
records entitled, ``Gulf War Registry--VA'' (93VA131) as set forth in 
the Federal Register 66 FR 64072-64075, December 11, 2001. VA is 
amending the system by revising the System Location, Categories of 
Records in the System, the Authority for Maintenance of the System, the 
Purpose(s) of the System, the Routine Uses of Records Maintained in the 
System, including Categories of Users and the Purposes of Such Uses, 
and the Policies and Practices for Storing, Retrieving, Accessing, 
Retaining and Disposing of Records in the System. VA is republishing 
the system notice in its entirety.

DATES: Comments on the establishment of this system of records must be 
received no later than February 20, 2004. If no public comment is 
received, the amended system will become effective February 20, 2004.

ADDRESSES: You may mail or hand-deliver written comments concerning the 
proposed amended system of records to the Director, Regulations 
Management (00REG1), Department of Veterans Affairs, 810 Vermont 
Avenue, NW., Washington, DC 20420; or fax comments to (202) 273-9026; 
or email comments to ``[email protected]''. All relevant 
material received before February 20, 2004 will be considered. Comments 
will be available for public inspection at the above address in the 
Office of Regulations Management, Room 1063B, between the hours of 8 
a.m. and 4:30 p.m., Monday through Friday (except holidays).

FOR FURTHER INFORMATION CONTACT: Veterans Health Administration (VHA) 
Privacy Act Officer (19F2), Department of Veterans Affairs, 810 Vermont 
Avenue, NW., Washington, DC 20420, (727) 320-1839.

SUPPLEMENTARY INFORMATION: The Gulf War Registry (GWR), located at the 
Austin Automation Center (AAC), Austin, Texas, is an automated 
integrated system. The registry contains demographic and medical data 
of registry examinations from August 2, 1990, until such time as 
Congress by law ends the Gulf War, for veterans serving in the 
Southwest Asia theatre of operations during the Gulf War who may have 
been exposed to a toxic substance or environmental hazard. There is 
also registry data on veteran's spouse or children suffering from an 
illness or disorder (including birth defects, miscarriages, or 
stillbirth) that cannot be disassociated from the veteran's service in 
the Southwest Asia theatre of operations.
    These data are entered manually on code sheets by VA facility staff 
or, in the case of veterans' spouses and children, by VA or non-VA 
clinicians. Hard copies of these code sheets then are sent to the AAC 
for entry into the GWR data set. The principal identifiers in these GWR 
records are the Social Security Number and veteran's name. The GWR 
system of records located at VA Central Office, Washington, DC, is an 
optical disk system containing images of paper records, i.e., Gulf War 
(GW) code sheets. Once these paper records are scanned on optical 
disks, they are disposed of in accordance with VHA Records Control 
Schedule (RCS) 10-1.
    The System Location has been amended to include the GWR system's 
change to a secure web-based data entry procedure. The process moved to 
a secure web-based data entry system at each VA facility during the 
first quarter of calendar year 2003. The secure web-based data entry 
system is maintained by the AAC and provides retrievable images to 
users. The optical disk system is currently being utilized where there 
is no access to the secure web-based system. However, the optical disk 
system for images of paper records, i.e., GW code sheets, is scheduled 
to be discontinued in 2004 and all access to the GWR system will be 
through the secure web-based data entry system.
    The Categories of Records in the System has been amended to change 
the phrase ``signature of examiner'' to ``signature of examiner/
environmental health clinician'' and to delete the phrase ``whether 
veteran consented to having the DU questionnaire data shared with the 
Department of Defense'' as the Department of Defense no longer requires 
this information from the Department of Veterans Affairs.
    The Authority for Maintenance of the System has been amended to 
delete a duplicate reference to U.S.C. 1710(e)(1)(B).
    The Purpose(s) of this GWR system of records has been amended to 
add a reference to examinations by VA clinicians. The purpose of the 
system is to provide information about veterans who have had a GWR 
examination at a VA facility, and their spouses and/or children who 
have had examinations by VA or non-VA clinicians. The records may be 
used to assist researchers in generating hypotheses for research 
studies; to enable management to track patient demographics; to assist 
in planning the delivery of health care services, including the 
associated costs; and, to possibly be used in the adjudication of 
claims perhaps related to exposure to a toxic substance or 
environmental hazard.
    VA is proposing to amend the following routine use disclosures of 
information to be maintained in the system:
    [sbull] Routine use number seven (7) is being amended in its 
entirety. VA must be able to comply with the requirements of agencies 
charged with enforcing the law and conducting investigations. VA must 
also be able to provide information to state or local agencies charged 
with protecting the public's health as set forth in state law. The 
routine use will be as follows:
    On its own initiative, VA may disclose information, except for the 
names and home addresses of veterans and their dependents, to a 
Federal, state, local, tribal or foreign agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto. On its 
own initiative, VA may also disclose the names and addresses of 
veterans and their dependents to a Federal agency charged with the 
responsibility of investigating or prosecuting civil, criminal or 
regulatory violations of law, or charged with enforcing or implementing 
the statute, regulation, rule or order issued pursuant thereto.
    The Privacy Act permits VA to disclose information about 
individuals without their consent for a routine use when the 
information will be used for a purpose that is compatible with the 
purpose for which VA collected the information. In all of the routine 
use disclosures described above, the recipient of the information will 
use the information in connection with a matter relating to one of VA's 
programs, will use the information to provide a benefit to VA, or 
disclosure is required by law.
    Under section 264, Subtitle F of Title II of the Health Insurance 
Portability and Accountability Act of 1996 (HIPAA) Public Law 104-191, 
100 Stat. 1936, 2033-34 (1996), the United States Department of Health 
and Human Services (HHS) published a final rule, as amended, 
establishing Standards for Privacy of Individually-Identifiable Health 
Information, 45 CFR parts 160 and 164. VHA may not disclose 
individually-identifiable health information (as defined in HIPAA and

[[Page 2964]]

the Privacy Rule, 42 U.S.C. 1320(d)(6) and 45 CFR 164.501) pursuant to 
a routine use unless either: (a) the disclosure is required by law, or 
(b) the disclosure is also permitted or required by the HHS Privacy 
Rule. The disclosures of individually-identifiable health information 
contemplated in the routine uses published in this amended system of 
records notice are permitted under the Privacy Rule or required by law. 
However, to also have authority to make such disclosures under the 
Privacy Act, VA must publish these routine uses. Consequently, VA is 
publishing these routine uses and is adding a preliminary paragraph to 
the routine uses portion of the system of records notice stating that 
any disclosure pursuant to the routine uses in this system of records 
notice must be either required by law or permitted by the Privacy Rule 
before VHA may disclose the covered information.
    The Storage section of Policies and Practices for Storing, 
Retrieving, Accessing, Retaining and Disposing of Records in the System 
has been amended to address the data collection process move to a web-
based system.
    References throughout the system notice to VA Headquarters have 
been amended to VA Central Office.
    The Report of Intent to Publish an Amended System of Records and an 
advance copy of the system notice have been sent to the appropriate 
Congressional committees and to the Director of Office of Management 
and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and 
guidelines issued by OMB (65 FR 77677), December 12, 2000.

    Approved: December 29, 2003.
Anthony J. Principi,
Secretary of Veterans Affairs.
93VA131

SYSTEM NAME:
    Gulf War Registry-VA.

SYSTEM LOCATION:
    Character-based data from Gulf War Registry Code Sheets are 
maintained in a registry dataset at the Austin Automation Center (AAC), 
1615 Woodward Street, Austin, Texas 78772. Since the dataset at the AAC 
is not all-inclusive, i.e., narratives, signatures, noted on the code 
sheets are not entered into this system, images of the code sheets are 
maintained at the Department of Veterans Affairs (VA), Environmental 
Agents Service (131), 810 Vermont Avenue, NW., Washington, DC 20420. 
These are electronic images of paper records, i.e., code sheets and 
questionnaires that are stored on optical disks. With the transition to 
a web-based data entry system, this optical disk system will be 
discontinued in 2004. Images of code sheets are accessible in the web-
based data entry system.

CATEGORIES OF INDIVIDUALS COVERED BY THIS SYSTEM:
    Veterans who may have been exposed to toxic substances or 
environmental hazard while serving in the Southwest theatre of 
operations during the Gulf War from August 2, 1990, until such time as 
Congress by law ends the Gulf War, and have had a Gulf War Registry 
(GWR) examination at a VA medical facility. Also, a spouse or child 
suffering from an illness or disorder (including birth defects, 
miscarriages, or stillbirth), which cannot be disassociated from the 
veteran's service in the Southwest Asia theatre of operations and who 
has had a GWR examination performed by a VA or non-VA clinician.

CATEGORIES OF RECORDS IN THE SYSTEM:
    These records consist of code sheet records recording VA facility 
code identifier where veteran was examined or treated; veteran's name; 
address; social security number; date of birth; race/ethnicity; marital 
status; sex; branch of service; periods of service; hospital status, 
i.e., inpatient; outpatient; areas of service in the Gulf War theatre 
of operations; list of military units where veteran served; military 
occupation specialty; names of units in which veteran served; veteran's 
reported exposure to environmental factors; any traumatic experiences 
while in the Gulf War; veteran's self-assessment of health; veteran's 
functional impairment; report of birth defects and infant death(s) 
among veteran's children and/or problems with pregnancy and 
infertility; date of registry examination; veteran's complaints/
symptoms; consultations; diagnoses; disposition (hospitalized, referred 
for outpatient treatment, etc.); whether veteran had an unexplained 
illness and had further tests and consultations and diagnoses as part 
of a Phase II, Uniform Case Assessment Examination; and name and 
signature of examiner/clinician coordinator, when provided. Similar 
responses for spouse and children of Gulf War veterans examined by non-
VA physicians are contained in the records.
    Another category of data entries is obtained from depleted uranium 
(DU) questionnaires, a supplement to the Gulf War code sheet. The data 
entries may contain the facility identifier where the information was 
completed; demographic information (name and social security number); 
daytime and evening phone numbers; date of questionnaire completion; 
date of arrival in and departure from the Gulf War theatre of 
operations; source of referral to VA medical center for evaluation; 
where veteran served (i.e., Iraq, Kuwait, Saudi Arabia, the neutral 
zone [between Iraq and Saudi Arabia], Bahrain, Qatar, the United Arab 
Emirates, Oman, Gulf of Aden, Gulf of Oman and the Waters of the 
Persian Gulf, Arabian Sea and Red Sea); capacity in which veteran 
served; questions relating to potential inhalation exposures to DU 
including those on, in, or near vehicles hit with friendly fire or 
enemy fire, entering burning vehicles, individuals near fires involving 
DU munitions, individuals salvaging damaged vehicles, and those near 
burning vehicles; whether veteran was wounded, retained DU fragments in 
veteran's body, handled DU penetrator rounds or any other exposures to 
DU; whether a 24-hour urine collection for uranium was performed; name, 
title and signature of examiner/environmental health clinician, when 
provided, and results of urine uranium tests, expressed per microgram 
per gram creatinine.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Title 38, United States Code (U.S.C.) 1710(e)(1)(B) and Sec.  
1720E.

PURPOSE(S):
    The records will be used for the purpose of providing information 
about: Veterans who have had a GWR examination at a VA facility and 
their spouses and/or children who have had examinations by VA or non-VA 
clinicians to assist in generating hypotheses for research studies; 
providing management with the capability to track patient demographics; 
reporting birth defects among veterans' children and grandchildren; 
planning the delivery of health care services and associated cost; and 
assisting in the adjudication of claims possibly related to exposure to 
a toxic substance or environmental hazard.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    VA may disclose protected health information pursuant to the 
following routine uses where required by law, or required or permitted 
by 45 CFR parts 160 and 164.
    1. The record of an individual who is covered by this system may be 
disclosed to a member of Congress or staff person acting for the member 
when the member or staff person requests the record on

[[Page 2965]]

behalf of, and at the written request of, that individual.
    2. Disclosure of records covered by this system, as deemed 
necessary and proper to named individuals serving as accredited service 
organization representatives, and other individuals named as approved 
agents or attorneys for a documented purpose and period of time, to aid 
beneficiaries in the preparation and presentation of their cases during 
the verification and/or due process procedures, and in the presentation 
and prosecution of claims under laws administered by VA.
    3. A record containing the name(s) and address(es) of present or 
former members of the armed services and/or their dependents may be 
released from this system of records under certain circumstances:
    a. To any nonprofit organization if the release is directly 
connected with the conduct of programs and the utilization of benefits 
under Title 38, and
    b. To any criminal or civil law enforcement governmental agency or 
instrumentality charged under applicable law with the protection of the 
public health or safety if a qualified representative of such 
organization, agency or instrumentality has made a written request that 
such name(s) or address(es) be provided for a purpose authorized by 
law; provided, further, that the record(s) will not be used for any 
purpose other than that stated in the request and that the 
organization, agency or instrumentality is aware of the penalty 
provision of 38 U.S.C. 5701(f).
    4. Disclosure may be made to the National Archives and Record 
Administration (NARA) in records management inspections conducted under 
authority of Title 44 United States Code.
    5. Disclosure of information, excluding name and address (unless 
name and address is furnished by the requestor) for research purposes 
determined to be necessary and proper, to epidemiological and other 
research facilities approved by the Under Secretary for Health.
    6. In order to conduct Federal research necessary to accomplish a 
statutory purpose of an agency, at the written request of the head of 
the agency, or designee of the head of that agency, the name(s) and 
address(es) of present or former personnel or the Armed Services and/or 
their dependents may be disclosed
    a. to a Federal department or agency, or
    b. directly to a contractor of a Federal department or agency. When 
a disclosure of this information is to be made directly to the 
contractor, VA may impose applicable conditions on the department, 
agency, and/or contractor to ensure the appropriateness of the 
disclosure to the contractor.
    7. VA may disclose on its own initiative any information in this 
system, except the names and home addresses of veterans and their 
dependents, which is relevant to a suspected or reasonably imminent 
violation of law, whether civil, criminal or regulatory in nature and 
whether arising by general or program statute or by regulation, rule or 
order issued pursuant thereto, to a Federal, state, local, tribal, or 
foreign agency charged with the responsibility of investigating or 
prosecuting such violation, or charged with enforcing or implementing 
the statute, regulation, rule or order. On its own initiative, VA may 
also disclose the names and addresses of veterans and their dependents 
to a Federal agency charged with the responsibility of investigating or 
prosecuting civil, criminal or regulatory violations of law, or charged 
with enforcing or implementing the statute, regulation, rule or order 
issued pursuant thereto.
    8. For program review purposes and the seeking of accreditation 
and/or certification, disclosure may be made to survey teams of the 
Joint Commission on Accreditation of Healthcare Organizations (JCAHO), 
College of American Pathologists, American Association of Blood Banks, 
and similar national accreditation agencies or boards with whom VA has 
a contract or agreement to conduct such reviews but only to the extent 
that the information is necessary and relevant to the review.
    9. Records from this system of records may be disclosed to the 
Department of Justice (DOJ) or in a proceeding before a court, 
adjudicative body, or other administrative body before which the 
Department is authorized to appear when: (a) The Department, or any 
component thereof; or (b) any employee of the Department in his or her 
official capacity where the DOJ or the Department has agreed to 
represent the employee; or (c) the U.S., when the Department determines 
that litigation is likely to affect the Department or any of its 
components; is a party to litigation, and has an interest in such 
litigation, and the use of such records by the DOJ or the Department is 
deemed by the Department to be relevant and necessary to the litigation 
provided, however, that the disclosure is compatible with the purpose 
for which the records were collected.
    10. Relevant information may be disclosed to individuals, 
organizations, private or public agencies, etc., with whom VA has a 
contract or agreement to perform such services as VA may deem practical 
for the purposes of laws administered by VA, in order for the 
contractor to perform the services of the contract or agreement.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    In 2003, the data collection process moved to a secure web-based 
system. Data previously recorded manually and converted to electronic 
format is now input through the secure VA Intranet system. Data is 
stored on a web server hosted by the AAC and is retrievable by the 
facility. Three levels of access are provided for the data that is 
input, using password security linked to the AAC Top Secret Security 
system, with mandated changes every 90 days. Data from individual 
facilities is uploaded nightly and stored on Direct Access Storage 
Devices at the AAC, Austin, Texas, and on optical disks at VA Central 
Office, Washington, DC. AAC stores registry tapes for disaster back up 
at an off-site location. VA Central Office also has back-up optical 
disks stored off-site. In addition to electronic data, registry reports 
are maintained on paper documents and microfiche.
    The optical disk system is currently being utilized where there is 
no access to the secure web-based system. The optical disk system is 
scheduled to be discontinued in 2004 and all access to the GWR system 
will be through the secure web-based data entry system. Records will be 
maintained and disposed of in accordance with records disposition 
authority approved by the Archivist of the United States.

RETRIEVABILITY:
    Records are indexed by name of veteran and social security number.

SAFEGUARDS:
    Access to records at VA Central Office is only authorized to VA 
personnel on a ``need to know'' basis. Records are maintained in manned 
rooms during working hours. During non-working hours, there is limited 
access to the building with visitor control by security personnel. 
Registry data maintained at the AAC can only be updated by authorized 
AAC personnel.
    Data is securely located behind the VA firewall and only accessible 
from the VA Local Area Network (LAN) through the VA Intranet. Read 
access to the data is granted through a telecommunications network to 
authorized VA Central Office staff. AAC reports are also accessible 
through a

[[Page 2966]]

telecommunications network on a read-only basis to the owner (VA 
facility) of the data. Access is limited to authorized employees by 
individually unique access codes which are changed periodically.
    Physical access to the AAC is generally restricted to AAC staff, VA 
Central Office staff, custodial personnel, Federal Protective Service 
and authorized operational personnel through electronic locking 
devices. All other persons gaining access to the computer rooms are 
escorted. Backup records stored off-site for both the AAC and VA 
Central Office are safeguarded in secured storage areas. A disaster 
recovery plan is in place and system recovery is tested at an off-site 
facility in accordance with established schedules.

RETENTION AND DISPOSAL:
    Records will be maintained and disposed of in accordance with 
records disposition authority approved by the Archivist of the United 
States.

SYSTEM MANAGER(S) AND ADDRESS:
    Director, Environmental Agents Service (131), Office of Public 
Health and Environmental Hazards, (clinical issues) and Management/
Program Analyst, Environmental Agents Service (131) (administrative 
issues), VA Central Office, 810 Vermont Avenue, NW., Washington, DC 
20420.

NOTIFICATION PROCEDURE:
    An individual who wishes to determine whether a record is being 
maintained in this system under his or her name or other personal 
identifier, or wants to determine the contents of such record, should 
submit a written request or apply in person to the last VA facility 
where medical care was provided or submit a written request to the 
Director, Environmental Agents Service (131), Office of Public Health 
and Environmental Hazards or the Management/Program Analyst, 
Environmental Agents Service (131), VA Central Office, 810 Vermont 
Avenue, NW., Washington, DC 20420. Inquiries should include the 
veteran's name, social security number, and return address.

RECORD ACCESS PROCEDURES:
    An individual who seeks access to records maintained under his or 
her name may write or visit the nearest VA facility or write to the 
Director, Environmental Agents Service (131) or the Management/Program 
Analyst, Environmental Agents Service (131), VA Central Office, 810 
Vermont Avenue, NW., Washington, DC 20420.

CONTESTING RECORDS PROCEDURES:
    (See ``Record Access Procedures.'')

RECORD SOURCE CATEGORIES:
    VA patient medical records, various automated record systems 
providing clinical and managerial support to VA health care facilities, 
the veteran, family members, and records from the Veterans Benefits 
Administration, Department of Defense, Department of the Army, 
Department of the Air Force, Department of the Navy and other Federal 
agencies.

[FR Doc. 04-1164 Filed 1-20-04; 8:45 am]
BILLING CODE 8320-01-P