Notice2023-10726
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
May 19, 2023
Issuing agencies
Veterans Affairs Department
Abstract
The Privacy Act of 1974 requires that all agencies publish in the Federal Register a notice of the existence and character of their systems of records. Notice is hereby given that the Department of Veterans Affairs (VA) is establishing a new system of records entitled, "PAWS Portal-VA" (212VA10). "PAWS" is an acronym for "Puppies Assisting Wounded Servicemembers".
Full Text
<html>
<head>
<title>Federal Register, Volume 88 Issue 97 (Friday, May 19, 2023)</title>
</head>
<body><pre>
[Federal Register Volume 88, Number 97 (Friday, May 19, 2023)]
[Notices]
[Pages 32292-32296]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2023-10726]
-----------------------------------------------------------------------
DEPARTMENT OF VETERANS AFFAIRS
Privacy Act of 1974; System of Records
AGENCY: Department of Veterans Affairs (VA), Office of Mental Health
and Suicide Prevention (OMHSP).
ACTION: Notice of a new system of records.
-----------------------------------------------------------------------
SUMMARY: The Privacy Act of 1974 requires that all agencies publish in
the Federal Register a notice of the existence and character of their
systems of records. Notice is hereby given that the Department of
Veterans Affairs (VA) is establishing a new system of records entitled,
``PAWS Portal-VA'' (212VA10). ``PAWS'' is an acronym for ``Puppies
Assisting Wounded Servicemembers''.
DATES: Comments on this new system of records must be received no later
than 30 days after date of publication in the Federal Register. If no
public comment is received during the period allowed for comment or
unless otherwise published in the Federal Register by VA, the new
system of records will become effective a minimum of 30 days after date
of publication in the Federal Register. If VA receives public comments,
VA shall review the comments to determine whether any changes to the
notice are necessary.
ADDRESSES: Comments may be submitted through <a href="http://www.Regulations.gov">www.Regulations.gov</a> or
mailed to VA Privacy Service, 810 Vermont Avenue NW, (005R1A),
Washington, DC 20420. Comments should indicate that they are submitted
in response to ``PAWS Portal-VA'' (212VA10). Comments received will be
available at <a href="http://www.Regulations.gov">www.Regulations.gov</a> for public viewing, inspection or
copies.
FOR FURTHER INFORMATION CONTACT: Stephania Griffin, Veterans Health
Administration (VHA) Privacy Officer, Department of Veterans Affairs,
810 Vermont Avenue NW, Washington, DC 20420, <a href="/cdn-cgi/l/email-protection#6c1f18091c040d02050d420b1e050a0a05022c1a0d420b031a"><span class="__cf_email__" data-cfemail="75060110051d141b1c145b12071c13131c1b3503145b121a03">[email protected]</span></a>,
telephone number 704-245-2492 (Note: This is not a toll-free number).
SUPPLEMENTARY INFORMATION:
I. Description of Proposed Systems of Records
Information in this system of records is used to establish and
maintain records of individuals participating in the Puppies Assisting
Wounded Servicemembers for Veterans (PAWS) program. The Puppies
Assisting Wounded Servicemembers for Veterans Therapy Act (hereinafter
referred to as ``the Act'') was signed into law by the President on
August 25, 2021 (Pub. L. 117-37, 125, Stat. 329). Section (2) of the
Act requires VA to conduct a pilot program to provide canine training
to eligible Veterans. Section 2(h) establishes VA's reporting
requirements associated with the five-year pilot. Information is
maintained in the PAWS Portal. The Portal will be the administrative
repository of information required to support the program with ongoing
assessment and monitoring. Designated VA staff will enter the contact
and assessment information into the portal for each Veteran. This
information will be available to service dog organizations (SDOs) to
track attendance. Additionally, de-identified data generated from the
PAWS Portal will be used in reports to OMHSP, VA Central Office and
Congress on the effectiveness of the program. The PAWS Portal will
collect Veteran patient demographic data to evaluate the success of the
program.
II. Proposed Routine Use Disclosures of Data in the System
We are proposing to establish the following routine use disclosures
of information maintained in the system.
1. Congress: VA may disclose information to a Member of Congress or
staff acting upon the Member's behalf when the Member or staff requests
the information on behalf of, and at the request of, the individual who
is the subject of the record.
2. Data breach response and remediation, for VA: VA may disclose
information to appropriate agencies,
[[Page 32293]]
entities, and persons when (1) VA suspects or has confirmed that there
has been a breach of the system of records,[middot] (2) VA has
determined that as a result of the suspected or confirmed breach there
is a risk of harm to individuals, VA (including its information
systems, programs, and operations), the Federal Government, or national
security; and (3) the disclosure made to such agencies, entities, and
persons is reasonably necessary to assist in connection with VA's
efforts to respond to the suspected or confirmed breach or to prevent,
minimize, or remedy such harm.
3. Data breach response and remediation, for another Federal
agency: VA may disclose information to another Federal agency or
Federal entity, when VA determines that the information from this
system of records is reasonably necessary to assist the recipient
agency or entity in (1) responding to a suspected or confirmed breach
or (2) preventing, minimizing, or remedying the risk of harm to
individuals, the recipient agency or entity (including its information
systems, programs, and operations), the Federal Government, or national
security, resulting from a suspected or confirmed breach.
4. Law Enforcement: VA may disclose information to a Federal,
state, local, territorial, tribal, or foreign law enforcement authority
or other appropriate entity charged with the responsibility of
investigating or prosecuting such violation or charged with enforcing
or implementing such law, provided that the disclosure is limited to
information that, either alone or in conjunction with other
information, indicates a violation or potential violation of law,
whether civil, criminal, or regulatory in nature. The disclosure of the
names and addresses of Veterans and their dependents from VA records
under this routine use must also comply with the provisions of 38
U.S.C. 5701.
5. DoJ for Litigation or Administrative Proceeding: VA may disclose
information to the Department of Justice (DoJ), or in a proceeding
before a court, adjudicative body, or other administrative body before
which VA is authorized to appear, when:
(a) VA or any component thereof;
(b) Any VA employee in his or her official capacity;
(c) Any VA employee in his or her individual capacity where DoJ has
agreed to represent the employee; or
(d) The United States, where VA determines that litigation is
likely to affect the agency or any of its components, is a party to
such proceedings or has an interest in such proceedings, and VA
determines that use of such records is relevant and necessary to the
proceedings.
6. Contractors: VA may disclose information to contractors,
grantees, experts, consultants, students, and others performing or
working on a contract, service, grant, cooperative agreement, or other
assignment for VA, when reasonably necessary to accomplish an agency
function related to the records.
7. OPM: VA may disclose information to the Office of Personnel
Management (OPM) in connection with the application or effect of civil
service laws, rules, regulations, or OPM guidelines in particular
situations.
8. EEOC: VA may disclose information to the Equal Employment
Opportunity Commission (EEOC) in connection with investigations of
alleged or possible discriminatory practices, examination of Federal
affirmative employment programs, or other functions of the Commission
as authorized by law.
9. FLRA: VA may disclose information to the Federal Labor Relations
Authority (FLRA) in connection with: the investigation and resolution
of allegations of unfair labor practices, the resolution of exceptions
to arbitration awards when a question of material fact is raised;
matters before the Federal Service Impasses Panel; and the
investigation of representation petitions and the conduct or
supervision of representation elections.
10. MSPB: VA may disclose information to the Merit Systems
Protection Board (MSPB) in connection with appeals, special studies of
the civil service and other merit systems, review of rules and
regulations, investigation of alleged or possible prohibited personnel
practices, and such other functions promulgated in 5 U.S.C. 1205 and
1206, or as authorized by law.
11. NARA: VA may disclose information to the National Archives and
Records Administration (NARA) in records management inspections
conducted under 44 U.S.C. 2904 and 2906, or other functions authorized
by laws and policies governing NARA operations and VA records
management responsibilities.
12. Health Care Providers, for Referral by VA: VA may disclose
information to: (1) a Federal agency or health care provider when VA
refers a patient for medical and other health services, or authorizes a
patient to obtain such services and the information is needed by the
Federal agency or health care provider to perform the services; or (2)
a Federal agency or to health care provider under the provisions of 38
U.S.C. 513, 7409, 8111, or 8153, when treatment is rendered by VA under
the terms of such contract or agreement or the issuance of an
authorization, and the information is needed for purposes of medical
treatment or follow-up, determination of eligibility for benefits, or
recovery by VA of the costs of the treatment.
13. Health Care Providers, for Referral to VA: VA may disclose
information to a non-VA health care provider when that health care
provider has referred the individual to VA for medical or other health
services.
14. Covered Entities, for their Health Care Operations: VA may
disclose information to a covered entity for their health care
operations, provided that the entity either has or had a relationship
with the individual, and the disclosure is for the purpose of:
(a) Conducting quality assessment and improvement activities;
patient safety activities as defined in 42 CFR 3.20; population-based
activities relating to improving health or reducing health care costs,
protocol development, case management, and care coordination;
contacting of health care providers and patients with information about
treatment alternatives; and related functions that do not include
treatment;
(b) Reviewing the competence or qualifications of health care
professionals; evaluating practitioner and provider performance, health
plan performance; conducting training programs for health care
practitioners, trainees, and students; training of non-health care
professionals; accreditation, certification, licensing, or
credentialing activities; or
(c) Health care fraud and abuse detection or compliance.
15. Federal Agencies, for Research: VA may disclose information to
a Federal agency for the purpose of conducting research and data
analysis to perform a statutory purpose of that Federal agency upon the
written request of that agency.
16. Researchers, for Research: VA may disclose information to
epidemiological and other research facilities approved by the Under
Secretary for Health for research purposes determined to be necessary
and proper, provided that the names and addresses of Veterans and their
dependents will not be disclosed unless those names and addresses are
first provided to VA by the facilities making the request.
17. OMB: VA may disclose information to the Office of Management
and Budget (OMB) for the performance of its statutory
[[Page 32294]]
responsibilities for evaluating Federal programs.
18. Nonprofits, for Release of Name and/or Address (RONA): VA may
disclose information to a nonprofit organization if the release is
directly connected with the conduct of programs and the utilization of
benefits under title 38, provided that the disclosure is limited the
names and addresses of present or former members of the armed services
or their beneficiaries, the records will not be used for any purpose
other than that stated in the request, and the organization is aware of
the penalty provision of 38 U.S.C. 5701(f).
Signing Authority
The Senior Agency Official for Privacy, or designee, approved this
document and authorized the undersigned to sign and submit the document
to the Office of the Federal Register for publication electronically as
an official document of the Department of Veterans Affairs. Kurt D.
DelBene, Assistant Secretary for Information and Technology and Chief
Information Officer, approved this document on April 7, 2023 for
publication.
Dated: May 16, 2023.
Amy L. Rose,
Program Analyst, VA Privacy Service, Office of Information Security,
Office of Information and Technology, Department of Veterans Affairs.
SYSTEM NAME AND NUMBER: ``PAWS PORTAL-VA'' (212VA10)
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
These records are the responsibility of the Office of Mental Health
and Suicide Prevention (OMHSP), Veterans Health Administration,
Department of Veterans Affairs. The OMHSP is located at 810 Vermont
Avenue NW, Washington, DC 20420. Records are maintained in the
Microsoft Government Cloud at the Boydton Data Center in Boydton,
Virginia.
SYSTEM MANAGER(S):
Stacey Pollack, Ph.D., National Mental Health Director, Program
Policy Implementation, Office of Mental Health and Suicide Prevention,
810 Vermont Avenue NW, Washington, DC 20420, telephone number 202-738-
2932 (Note: This is not a toll-free number).
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
The Puppies Assisting Wounded Servicemembers for Veterans Therapy
Act (hereinafter referred to as ``the Act'') was signed into law by the
President on August 25, 2021 (Pub. L. 117-37, 125, Stat. 329).
PURPOSE(S) OF THE SYSTEM:
The ``PAWS Portal-VA'' will be used to store information that is
shared between the VA medical centers (VAMCs) participating as the
pilot sites, and the service dog organizations (SDOs) providing the
training. The Portal will be used to track Veteran attendance in the
program as well as the management and effectiveness of the program. The
Portal may also be used to determine the impact on Veteran care and
capture information on Veteran satisfaction with the program.
Additionally, de-identified data generated from the PAWS Portal will be
used in reports to OMHSP, VA Central Office and Congress on the
effectiveness of the program.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
The records in the system are on Veterans who have received VA
health care benefits under 38 U.S.C, Chapter 17, and SDO trainers
participating in the program.
CATEGORIES OF RECORDS IN THE SYSTEM:
Information entered into the PAWS Portal includes demographic
information, such as name, address, phone number, email address, and
the last four of the Veteran's Social Security number. In addition,
information regarding the Veteran's attendance in the program is
collected, such as date of trainings and location of trainings. SDO
trainer names and their email addresses are collected in this system.
Eligibility-related information may also be collected, such as
referrals, VA staff evaluations, correspondence, and documentation of
phone calls, and any information regarding a safety issue around
Veterans, SDO trainers, or dogs.
RECORD SOURCE CATEGORIES:
Information in this system of records is provided by Veteran
participants in the pilot program, the PAWS Portal VA staff, and by the
SDO and their trainers.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND PURPOSES OF SUCH USES:
To the extent that records contained in the system include
information protected by 45 CFR parts 160 and 164, i.e., individually
identifiable health information of VHA or any of its business
associates, and 38 U.S.C. 7332, i.e., medical treatment information
related to drug abuse, sickle cell anemia, or infection with the human
immunodeficiency virus, that information cannot be disclosed under a
routine use unless there is also specific disclosure authority in both
38 U.S.C. 7332 and 45 CFR parts 160 and 164.
1. Congress: VA may disclose information to a Member of Congress or
staff acting upon the Member's behalf when the Member or staff requests
the information on behalf of, and at the request of, the individual who
is the subject of the record.
2. Data breach response and remediation, for VA: VA may disclose
information to appropriate agencies, entities, and persons when (1) VA
suspects or has confirmed that there has been a breach of the system of
records; (2) VA has determined that as a result of the suspected or
confirmed breach there is a risk of harm to individuals, VA (including
its information systems, programs, and operations), the Federal
Government, or national security; and (3) the disclosure made to such
agencies, entities, and persons is reasonably necessary to assist in
connection with VA's efforts to respond to the suspected or confirmed
breach or to prevent, minimize, or remedy such harm.
3. Data breach response and remediation, for another Federal
agency: VA may disclose information to another Federal agency or
Federal entity, when VA determines that the information from this
system of records is reasonably necessary to assist the recipient
agency or entity in (1) responding to a suspected or confirmed breach
or (2) preventing, minimizing, or remedying the risk of harm to
individuals, the recipient agency or entity (including its information
systems, programs, and operations), the Federal Government, or national
security, resulting from a suspected or confirmed breach.
4. Law Enforcement: VA may disclose information to a Federal,
state, local, territorial, tribal, or foreign law enforcement authority
or other appropriate entity charged with the responsibility of
investigating or prosecuting such violation or charged with enforcing
or implementing such law, provided that the disclosure is limited to
information that, either alone or in conjunction with other
information, indicates a violation or potential violation of law,
whether civil, criminal, or regulatory in nature. The disclosure of the
names and addresses of Veterans and their dependents from VA records
under this routine use must also comply with the provisions of 38
U.S.C. 5701.
5. DoJ for Litigation or Administrative Proceeding: VA may disclose
information to the Department of Justice (DoJ), or in a proceeding
before a court, adjudicative body, or other administrative body before
which VA is authorized to appear, when:
[[Page 32295]]
(a) VA or any component thereof;
(b) Any VA employee in his or her official capacity;
(c) Any VA employee in his or her individual capacity where DoJ has
agreed to represent the employee; or
(d) The United States, where VA determines that litigation is
likely to affect the agency or any of its components, is a party to
such proceedings or has an interest in such proceedings, and VA
determines that use of such records is relevant and necessary to the
proceedings.
6. Contractors: VA may disclose information to contractors,
grantees, experts, consultants, students, and others performing or
working on a contract, service, grant, cooperative agreement, or other
assignment for VA, when reasonably necessary to accomplish an agency
function related to the records.
7. OPM: VA may disclose information to the Office of Personnel
Management (OPM) in connection with the application or effect of civil
service laws, rules, regulations, or OPM guidelines in particular
situations.
8. EEOC: VA may disclose information to the Equal Employment
Opportunity Commission (EEOC) in connection with investigations of
alleged or possible discriminatory practices, examination of Federal
affirmative employment programs, or other functions of the Commission
as authorized by law.
9. FLRA: VA may disclose information to the Federal Labor Relations
Authority (FLRA) in connection with: the investigation and resolution
of allegations of unfair labor practices, the resolution of exceptions
to arbitration awards when a question of material fact is raised;
matters before the Federal Service Impasses Panel; and the
investigation of representation petitions and the conduct or
supervision of representation elections.
10. MSPB: VA may disclose information to the Merit Systems
Protection Board (MSPB) in connection with appeals, special studies of
the civil service and other merit systems, review of rules and
regulations, investigation of alleged or possible prohibited personnel
practices, and such other functions promulgated in 5 U.S.C. 1205 and
1206, or as authorized by law.
11. NARA: VA may disclose information to the National Archives and
Records Administration (NARA) in records management inspections
conducted under 44 U.S.C. 2904 and 2906, or other functions authorized
by laws and policies governing NARA operations and VA records
management responsibilities.
12. Health Care Providers, for Referral by VA: VA may disclose
information to: (1) a Federal agency or health care provider when VA
refers a patient for medical and other health services, or authorizes a
patient to obtain such services and the information is needed by the
Federal agency or health care provider to perform the services; or (2)
a Federal agency or to health care provider under the provisions of 38
U.S.C. 513, 7409, 8111, or 8153, when treatment is rendered by VA under
the terms of such contract or agreement or the issuance of an
authorization, and the information is needed for purposes of medical
treatment or follow-up, determination of eligibility for benefits, or
recovery by VA of the costs of the treatment.
13. Health Care Providers, for Referral to VA: VA may disclose
information to a non-VA health care provider when that health care
provider has referred the individual to VA for medical or other health
services.
14. Covered Entities, for their Health Care Operations: VA may
disclose information to a covered entity for their health care
operations, provided that the entity either has or had a relationship
with the individual, and the disclosure is for the purpose of:
(a) Conducting quality assessment and improvement activities;
patient safety activities as defined in 42 CFR 3.20; population-based
activities relating to improving health or reducing health care costs,
protocol development, case management, and care coordination;
contacting of health care providers and patients with information about
treatment alternatives; and related functions that do not include
treatment;
(b) Reviewing the competence or qualifications of health care
professionals; evaluating practitioner and provider performance, health
plan performance; conducting training programs for health care
practitioners, trainees, and students; training of non-health care
professionals; accreditation, certification, licensing, or
credentialing activities; or
(c) Health care fraud and abuse detection or compliance.
15. Federal Agencies, for Research: VA may disclose information to
a Federal agency for the purpose of conducting research and data
analysis to perform a statutory purpose of that Federal agency upon the
written request of that agency.
16. Researchers, for Research: VA may disclose information to
epidemiological and other research facilities approved by the Under
Secretary for Health for research purposes determined to be necessary
and proper, provided that the names and addresses of Veterans and their
dependents will not be disclosed unless those names and addresses are
first provided to VA by the facilities making the request.
17. OMB: VA may disclose information to the Office of Management
and Budget (OMB) for the performance of its statutory responsibilities
for evaluating Federal programs.
18. Nonprofits, for Release of Name and/or Address (RONA): VA may
disclose information to a nonprofit organization if the release is
directly connected with the conduct of programs and the utilization of
benefits under title 38, provided that the disclosure is limited the
names and addresses of present or former members of the armed services
or their beneficiaries, the records will not be used for any purpose
other than that stated in the request, and the organization is aware of
the penalty provision of 38 U.S.C. 5701(f).
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
These records are maintained in electronic storage media.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records are retrieved by the Veteran's name, phone number, email
address, the last four of their Social Security number, program
attendance records or by any combination of these identifiers. Records
are also retrieved by the name and email address of the SDO trainers
participating in the program.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Records will be retained and destroyed in accordance with the VA
Records Control Schedule, RCS 10-1, 6400.2: Temporary, records are to
be filed within the Veteran's electronic health records (DAA-0015-2015-
0005-0003) and 6400.3: Temporary, cutoff originals and copies at the
end of calendar year. Destroy 7 years after cutoff (DAA-0015-2015-0005-
0004).
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
1. On an annual basis, employees are required to sign a computer
access agreement acknowledging their understanding of confidentiality
requirements. In addition, all employees receive annual privacy
awareness and information security training. 2. Access to electronic
records is deactivated when no longer required for official duties.
Recurring monitors are in place to ensure compliance with nationally
and locally established security
[[Page 32296]]
measures. 3. Strict control measures are enforced to ensure that access
to and disclosure from all records are limited to VA and the SDO
employees whose official duties warrant access to those files. 4.
Access to the PAWS Portal is restricted and requires approval prior to
access. Restricted access will be provided to enable workflow
management to administer, monitor and track services delivered via the
PAWS Portal.
RECORD ACCESS PROCEDURES:
Individuals seeking information regarding access to and contesting
of the PAWS Portal records may write or visit the VA health care
facility where the PAWS program was attended or the VA health care
facility that referred the Veteran to participate in the PAWS program
offsite.
CONTESTING RECORD PROCEDURES:
(See Record Access Procedures above.)
NOTIFICATION PROCEDURES:
An individual who wishes to determine whether a record is being
maintained in this system under his or her name or other personal
identifier, or wants to review the contents of such record, should
submit a written request, or apply in person to the VA health care
facility where the PAWS program was attended or to the VA health care
facility that referred the Veteran to participate in the PAWS program
offsite. All inquiries must reasonably describe the portion of the
medical record involved and the place and approximate date that medical
care was provided. Inquiries should include the patient's full name,
Social Security number, and return address.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
None.
[FR Doc. 2023-10726 Filed 5-18-23; 8:45 am]
BILLING CODE P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on May 19, 2023.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.