Notice2023-20044
Privacy Act of 1974; System of Records
Primary source
Metadata and text below are from the Federal Register, a public-domain U.S. government work. Always verify the official published version before relying on it for any legal matter.
Published
September 15, 2023
Issuing agencies
Veterans Affairs Department
Abstract
Pursuant to the Privacy Act of 1974, notice is hereby given that the VA is modifying the system of records entitled, "Customer Relationship Management System (CRMS)-VA" (155VA10NB). This system is used for historical reference, quality assurance, training, and statistical reporting.
Full Text
<html>
<head>
<title>Federal Register, Volume 88 Issue 178 (Friday, September 15, 2023)</title>
</head>
<body><pre>
[Federal Register Volume 88, Number 178 (Friday, September 15, 2023)]
[Notices]
[Pages 63678-63680]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2023-20044]
-----------------------------------------------------------------------
DEPARTMENT OF VETERANS AFFAIRS
Privacy Act of 1974; System of Records
AGENCY: Department of Veterans Affairs (VA), Veterans Health
Administration (VHA).
ACTION: Notice of a modified system of records.
-----------------------------------------------------------------------
SUMMARY: Pursuant to the Privacy Act of 1974, notice is hereby given
that the VA is modifying the system of records entitled, ``Customer
Relationship Management System (CRMS)-VA'' (155VA10NB). This system is
used for historical reference, quality assurance, training, and
statistical reporting.
DATES: Comments on this modified system of records must be received no
later than 30 days after date of publication in the Federal Register.
If no public comment is received during the period allowed for comment
or unless otherwise published in the Federal Register by the VA, the
modified system of records will become effective a minimum of 30 days
after date of publication in the Federal Register. If VA receives
public comments, VA shall review the comments to determine whether any
changes to the notice are necessary.
ADDRESSES: Comments may be submitted through <a href="http://www.Regulations.gov">www.Regulations.gov</a> or
mailed to VA Privacy Service, 810 Vermont Avenue NW, (005X6F),
Washington, DC 20420. Comments should indicate that they are submitted
in response to ``Customer Relationship Management System (CRMS)-VA''
(155VA10NB). Comments received will be available at <a href="http://regulations.gov">regulations.gov</a> for
public viewing, inspection or copies.
FOR FURTHER INFORMATION CONTACT: Stephania Griffin, Veterans Health
Administration (VHA) Chief Privacy Officer, Department of Veterans
Affairs, 810 Vermont Avenue NW, Washington, DC 20420; telephone 704-
245-2492 (Note: this is not a toll-free number) or
<a href="/cdn-cgi/l/email-protection#02517667726a636c6b632c65706b64646b6c4274632c656d74"><span class="__cf_email__" data-cfemail="a0f3d4c5d0c8c1cec9c18ec7d2c9c6c6c9cee0d6c18ec7cfd6">[email protected]</span></a>.
SUPPLEMENTARY INFORMATION: VA is amending the system of records by
revising the System Number; System Location; System Manager; Purpose of
the System; Categories of Records in the System; Records Source
Categories; Routine Uses of Records Maintained in the System; Policies
and Practices for Retention and Disposal of Records; and Administrative
Technical and Physical Safeguards. VA is republishing the system notice
in its entirety.
The System Number is being updated from 155VA10NB to 155VA10 to
reflect the current VHA organizational routing symbol.
The System Location and the Administrative, Technical and Physical
Safeguards sections are being updated to replace Health Resource Center
with VHA Member Services. The System Location will also be updated to
include, ``Information from these records or copies of these records
may be maintained at VA Enterprise Cloud Data Centers/Amazon Web
Services, 1915 Terry Avenue, Seattle, WA 98101.''
The System Manager is updated to replace Chief Business Officer
(10NB), with Deputy Under Secretary for Health and Operations, VHA
Member Services. Also, Director, Health Resource Center is replaced
with Director, VHA Member Services.
The Purpose of the System is being modified to include, ``tracking
and managing inbound and outbound customer contacts across channels
(e.g., telephone, email, mail, chat), and maintaining customer support
history. These records are used by Member Services Call Center agents
to provide customer support to Veterans and their family members by
allowing agents to resolve inbound calls and achieve first-call
resolution as well as provide an efficient desktop, workflow, contact
history and knowledge management capabilities. These records are also
used to answer Veteran questions about VA and their care and enhance
VA's ability to provide timely, valid responses to Veteran inquiries
about benefits, eligibility and other matters.''
The Categories of Records in the System is being updated to include
name and Social Security Number.
The Record Source Categories is being modified to include, ``VA
information systems, including but not limited to, Health Data
Repository, Veterans Experience Integration Solution, VA Profile,
Consolidated Copayment Processing Center System, and Master Person
Index.''
Routine Use number 8 is being removed, which states, ``Disclosure
may be made to those officers and employees of the agency that
maintains the record who have a need for the record in the performance
of their duties.'' Routine use number 8 will now be replaced with a new
routine use to state, ``To another Federal agency or Federal entity,
when VA determines that information from this system of records is
reasonably necessary to assist the recipient agency or entity in (1)
responding to a suspected or confirmed breach or (2) preventing,
minimizing, or remedying the risk of harm to individuals, the recipient
agency or entity (including its information systems, programs and
operations), the Federal Government, or national security, resulting
from a suspected or confirmed breach.''
Policies and Practices for Storage of Records is being updated to
remove the VA Office of Information Technology (OIT) approved location.
Policies and Practices for Retention and Disposal of Records is
being updated to remove, ``Electronic Service Records are purged when
they are no longer needed for current operation.'' This section is
updated to state, ``CRMS records will be maintained and disposed of in
accordance with the schedule approved by the Archivist of the United
States, Records Control Schedule (RCS) 10-1, 1925.1, Destroy 1 year
after resolved, or when no longer needed for business use, whichever is
appropriate.''
Administrative, Technical and Physical Safeguards is being updated
to include number 6, ``VA Enterprise Cloud data storage conforms to
security protocols as stipulated in VA Directives 6500 and 6517. Access
control standards are stipulated in specific agreements with cloud
vendors to restrict and monitor access.''
The Report of Intent to Amend a System of Records Notice and an
advance copy of the system notice have been sent to the appropriate
Congressional committees and to the Director of the Office of
Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy
Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.
Signing Authority
The Senior Agency Official for Privacy, or designee, approved this
document and authorized the
[[Page 63679]]
undersigned to sign and submit the document to the Office of the
Federal Register for publication electronically as an official document
of the Department of Veterans Affairs. Kurt D. DelBene, Assistant
Secretary for Information and Technology and Chief Information Officer,
approved this document on August 7, 2023 for publication.
Dated: September 12, 2023.
Amy L. Rose,
Government Information Specialist, VA Privacy Service, Office of
Compliance, Risk and Remediation, Office of Information and Technology,
Department of Veterans Affairs.
SYSTEM NAME:
``Customer Relationship Management System (CRMS)-VA'' (155VA10).
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
Records and magnetic media are maintained at the Veterans Health
Administration (VHA) Member Services, Topeka, Kansas facility or at
another Office of Information Technology (OIT) approved location.
Magnetic media are also stored at an OIT approved location for
contingency back-up purposes. In addition, information from these
records or copies of these records may be maintained at the Department
of Veterans Affairs (VA) Enterprise Cloud Data Centers/Amazon Web
Services, 1915 Terry Avenue, Seattle, WA 98101.
SYSTEM MANAGER(S):
Official responsible for policies and procedures: Deputy Under
Secretary for Health and Operations, VHA Member Services, VA Central
Office, 810 Vermont Avenue NW, Washington, DC 20420. Telephone number
202-461-4239 (this is not a toll-free number). Official maintaining the
system: Director, VHA Member Services, 3401 SW 21st Street Bldg. 9,
Topeka, Kansas 66604.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
38 U.S.C. 501(a), 1705, 1710, 1722, 1722(a), 1781 and 5 U.S.C.
552(a).
PURPOSE(S) OF THE SYSTEM:
The purpose of these records is used for historical reference,
quality assurance, training, statistical reporting, tracking and
managing inbound and outbound customer contacts across channels (e.g.,
telephone, email, mail, chat), and maintaining customer support
history. These records are used by Member Services Call Center agents
to provide customer support to Veterans and their family members by
allowing agents to resolve inbound calls and achieve first-call
resolution as well as provide an efficient desktop, workflow, contact
history and knowledge management capabilities. These records are also
used to answer Veteran questions about VA and their care and enhance
VA's ability to provide timely, valid responses to Veteran inquiries
about benefits, eligibility and other matters.
CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
These records include information on Veterans, Veteran's family
members, members of the general public, VA customers, and VA employees.
CATEGORIES OF RECORDS IN THE SYSTEM:
The records include name, Social Security Number, address, date of
birth, military identification number and other unique identifiers from
individuals contacting VHA concerning: 1. Veteran health benefits
eligibility and health care appointment request; 2. Veteran medical
claims processing and payments; 3. Co-payments charged for medical care
and prescriptions; 4. General administrative pharmacy inquiries; 5.
General human resources management, (e.g., employee benefits,
recruitment/job applicants, etc.); and 6. Other information related to
Veterans, Veteran's family members, members of the general public, VA
customers, and VA employees.
RECORD SOURCE CATEGORIES:
Information in this system of records may be provided by Veterans,
Veteran's family members, members of the general public, VA customers,
VA employees, and VA information systems, including but not limited to,
Health Data Repository, Veterans Experience Integration Solution, VA
Profile, Consolidated Copayment Processing Center System, and Master
Person Index.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
To the extent that records contained in the system include
information protected by 45 CFR parts 160 and 164, i.e., individually
identifiable health information of VHA or any of its business
associates, and 38 U.S.C. 7332; i.e., medical treatment information
related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia,
or infection with the human immunodeficiency virus, that information
cannot be disclosed under a routine use unless there is also specific
statutory authority in both 38 U.S.C. 7332 and CFR parts 160 and 164
permitting disclosure.
1. Congress: To a Member of Congress or staff acting upon the
Member's behalf when the Member or staff requests the information on
behalf of, and at the request of, the individual who is the subject of
the record.
2. National Archives and Records Administration (NARA): To the NARA
in records management inspections conducted under 44 U.S.C. 2904 and
2906, or other functions authorized by laws and policies governing NARA
operations and VA records management responsibilities.
3. Department of Justice (DoJ), Litigation, Administrative
Proceeding: To the DoJ, or in a proceeding before a court, adjudicative
body, or other administrative body before which VA is authorized to
appear, when:
(a) VA or any component thereof;
(b) Any VA employee in his or her official capacity;
(c) Any VA employee in his or her official capacity where DoJ has
agreed to represent the employee; or
(d) The United States, where VA determines that litigation is
likely to affect the agency or any of its components, is a party to
such proceedings or has an interest in such proceedings, and VA
determines that use of such records is relevant and necessary to the
proceedings.
4. Contractors: To contractors, grantees, experts, consultants,
students and others performing or working on a contract, service,
grant, cooperative agreement, or other assignment for VA, when
reasonably necessary to accomplish an agency function related to the
records.
5. Law Enforcement: To a Federal, state, local, territorial, tribal
or foreign law enforcement authority or other appropriate entity
charged with the responsibility of investigating or prosecuting such
violation or charged with enforcing or implementing such law, provided
that the disclosure is limited to information that, either alone or in
conjunction with other information, indicates a violation or potential
violation of law, whether civil, criminal, or regulatory in nature. The
disclosure of the names and addresses of Veterans and their dependents
from VA records under this routine use must also comply with the
provisions of 38 U.S.C. 5701.
6. Federal Agencies, Fraud and Abuse: To other Federal agencies to
assist such agencies in preventing and detecting possible fraud or
abuse by individuals in their operations and programs.
7. Data Breach Response and Remediation, for VA: To appropriate
agencies, entities and persons when (1)
[[Page 63680]]
VA suspects or has confirmed that there has been a breach of the system
of records; (2) VA has determined that as a result of the suspected or
confirmed breach there is a risk to individuals, VA (including its
information systems, programs and operations), the Federal Government,
or national security; and (3) the disclosure made to such agencies,
entities or persons is reasonably necessary to assist in connection
with VA efforts to respond to the suspected or confirmed breach or to
prevent, minimize or remedy such harm.
8. Data Breach Response and Remediation, for Another Federal
Agency: To another Federal agency or Federal entity, when VA determines
that information from this system of records is reasonably necessary to
assist the recipient agency or entity in (1) responding to a suspected
or confirmed breach or (2) preventing, minimizing, or remedying the
risk of harm to individuals, the recipient agency or entity (including
its information systems, programs and operations), the Federal
Government, or national security, resulting from a suspected or
confirmed breach.
9. Unions: To unions identified in 5 U.S.C. 7114(b)(4) to officials
of labor organizations recognized under 5 U.S.C. Chapter 71 when
relevant and necessary to their duties of exclusive representation
concerning personnel policies, practices and matters affecting working
conditions.
10. Merit Systems Protection Board (MSPB): To the MSPB in
connection with appeals, special studies of the civil service and other
merit systems, review of rules and regulations, investigation of
alleged or possible prohibited personnel practices, and such other
functions promulgated in 5 U.S.C. 1205 and 1206, or as otherwise
authorized by law.
11. Equal Employment Opportunity Commission (EEOC): To the EEOC in
connection with investigations of alleged or possible discriminatory
practices, examination of Federal affirmative employment programs, or
other functions of the Commission as authorized by law.
12. Federal Labor Relations Authority (FLRA): To the FLRA in
connection with the investigation and resolution of allegations of
unfair labor practices, the resolution of exceptions to arbitration
awards when a question of material fact is raised; matters before the
Federal Service Impasses Panel; and the investigation of representation
petitions and the conduct or supervision of representation elections.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records are stored on electronic media.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records in this system are retrieved by name, Social Security
Number or other assigned identifiers of the individuals on whom they
are maintained.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
CRMS records will be maintained and disposed of in accordance with
the schedule approved by the Archivist of the United States, Records
Control Schedule (RCS) 10-1, 1925.1, Destroy one year after resolved,
or when no longer needed for business use, whichever is appropriate.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
1. All entrance doors to the VHA Member Services Topeka, KS and
Waco, TX locations require an electronic pass card to gain entry. Hours
of entry to the facility are controlled based on position held and
special needs. Visitors to the VHA Member Services are required to
sign-in at a specified location and are escorted the entire time they
are in the building or they are issued a temporary visitors badge. At
the end of the visit, visitors are required to turn in their badge. The
building is equipped with an intrusion alarm system which is activated
when any of the doors are forced open or held ajar for a specified
length of time. During business hours, the security system is monitored
by the VA police and Member Services staff. After business hours, the
security system is monitored by the VA telephone operator(s) and VA
police. The VA police conduct visual security checks of the outside
perimeter of the building.
2. Access to the building is generally restricted to Member
Services staff and VA police, specified custodial personnel,
engineering personnel, and canteen service personnel.
3. Access to computer rooms is restricted to authorized VA OIT
personnel and requires entry of a personal identification number (PIN)
with the pass card swipe. PINs must be changed periodically. All other
persons gaining access to computer rooms are escorted. Information
stored in the computer may be accessed by authorized VA employees at
remote locations including the Health Eligibility Center in Atlanta,
GA; Health Administration Center in Denver, CO; Consolidated Patient
Accounting Center in Ashville, NC; and VA health care facilities.
4. All Member Services employees receive information security and
privacy awareness training and sign the Rules of Behavior; training is
provided to all employees on an annual basis. The Member Services
Information System Security Officer performs an annual information
security audit and periodic reviews to ensure the security of the
system.
5. For contingency purposes, database backups on magnetic media are
stored off-site at an approved VA OIT location.
6. VA Enterprise Cloud data storage conforms to security protocols
as stipulated in VA Directives 6500 and 6517. Access control standards
are stipulated in specific agreements with cloud vendors to restrict
and monitor access.
RECORD ACCESS PROCEDURE:
Individuals seeking information on the existence and content of a
related record in this system pertaining to them should contact the
system manager in writing as indicated above or may write or visit the
VA facility location where they normally receive their care.
CONTESTING RECORD PROCEDURES:
Individuals seeking to contest or amend records in this system
pertaining to them should contact the system manager in writing as
indicated above or inquire in person at the VA health care facility
they normally receive their care. A request to contest or amend records
must state clearly and concisely what record is being contested, the
reasons for contesting it, and the proposed amendment to the record.
NOTIFICATION PROCEDURE:
Generalized notice is provided by the publication of this notice.
For specific notice, see Record Access Procedure, above.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
73 FR 72123 (November 26, 2008), 80 FR 11531 (March 3, 2015).
[FR Doc. 2023-20044 Filed 9-14-23; 8:45 am]
BILLING CODE P
</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>Indexed from Federal Register on September 15, 2023.
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.