36C24218R0013-004.pdf

Attachment 17

VA amended this system of records at 69 Fed. Reg. 18428 (April 7, 2004)

24VA19

System name: Patient Medical Records—VA.

System location:

Paper records are maintained at VA health care facilities and Federal record centers. Address locations for VA facilities are listed in VA Appendix 1 at the end of this document. Paper record abstract information is stored in automated storage media records that are maintained at the health facilities (in most cases, back-up computer tape information is stored at off-site locations); VA Central Office, Washington, DC; VA Central Office files maintained at the National Institutes of Health Computer Center, Bethesda, MD; the VA Boston Development Center, Braintree, MA; the Information Systems Centers; the Regional Directors and Division Offices; and the VA Data Processing Center, Austin, TX. Active paper records are generally maintained by the last health care facility where care was rendered. In some cases, copies of paper records, or copies of parts of these records, may be maintained at VA Central Office and/or Regional Directors and Division Offices. The Regional Directors are located at:

Eastern Region, Baltimore, MD, with Regional Division Offices at Albany, NY, Baltimore, MD, Bedford, MA, and Pittsburgh, PA; Central Region, Ann Arbor, MI, with Regional Division Offices at Ann Arbor, MI, Indianapolis, IN, Minnesota, MN, and St. Louis, MO; Southern Region, Jackson, MS, with Regional Division Offices at Atlanta, GA, Dallas, TX, Jackson, MS, and Tampa Bay, FL; and the Western Region, San Francisco, CA, with Regional Division Offices at Palo Alto, CA, Phoenix, AZ, Portland, OR, and Salt Lake City, UT.

Categories of individuals covered by the system:

1. Veterans who have applied for health care services under title 38, United States Code, chapter 17, and in certain cases members of their immediate families.

2. Spouse, surviving spouse, and children of certain veterans who have applied for health care services under title 38, United States Code, chapter 17.

3. Beneficiaries of other Federal agencies.

4. Individuals examined or treated under contract or resourse sharing agreements.

5. Individuals examined or treated for research or donor purposes.

6. Individuals who have applied for title 38 benefits but who do not meet the requirements under title 38 to receive such benefits.

7. Individuals who were provided medical care under emergency conditions for humanitarian reasons.

8. Pensioned members of allied forces who are provided health care services under Title 38, United States Code, Chapter I.

Categories of records in the system:

http://vaww.gc.va.gov/../ogcdenstonec.DVA/Local%20Settings/Temp/FEDERAL%20REG%20NOTICES/24VA136%20amendment%2004-07-04.pdf

The patient medical record is a consolidated health record (CHR) which may include an administrative record folder (e.g., medical benefit application and eligibility information including information obtained from Veterans Benefits Administration automated records such as the Veterans and Beneficiaries Identification and Records Location Subsystem-VA (38VA23) and the Compensation, Pension, Education and Rehabilitation Records-VA (58VA21/22), correspondence about the individual), medical record folder (a cumulative account of sociological, diagnostic, counseling, rehabilitation, drug and alcohol, dietetic, medical, surgical, dental, psychological, and/or psychiatric information compiled by VA professional staff and non-VA health care providers), and subsidiary record information (e.g., tumor registry, dental, prosthetic, pharmacy, nuclear medicine, dietetic, social work, clinical laboratory, radiology, patient scheduling information, information related to funds that are deposited at the health care facility for safekeeping). The consolidated health record may include identifying information (e.g., name, address, date of birth, VA claim number, social security number), military service information (e.g., dates, branch and character of service, service number, medical information), family information (e.g., next of kind and person to notify in emergency address information, name, social security number and date of birth for veteran’s spouse and dependents, family medical history information), employment information (e.g., occupation, employer name and address), financial information (e.g., family income, assets, expenses, debts, amount and source of income for veteran, spouse and dependents), third-party health plan contract information (e.g., health insurance carrier name and address, policy number, amounts billed and paid), and information pertaining to the individual’s medical, surgical, psychiatric, dental, and/or psychological examination, evaluation, and/or treatment (e.g., information related to the chief complaint and history of present illness and information related to physical, diagnostic, therapeutic, and special examinations, clinical laboratory, pathology and x-ray findings, operations, medical history, medications prescribed and dispensed, treatment plan and progress, consultations, photographs taken for identification and medical treatment, education and research purposes, facility locations where treatment is provided, observations and clinical impressions of health care providers (and identity of providers) to include, as appropriate, the present state of the patient’s health, an assessment of the patient’s emotional, behavioral, and social status, as well as an assessment of the patient’s rehabilitation potential and nursing care needs).

Patient medical record abstract information is maintained in auxiliary paper and automated records (e.g., Patient Treatment File (PTF) (data from inpatient episodes of care), Agent Orange Registry (veterans examined for Agent Orange exposure), Former Prisoner of War Tracking System (former POW’s who have received a medical evaluation), outpatient visit file (OPC) (data relating to outpatient visits of patients and collaterals), Annual Patient Census File (data on a cross-section of patients in VA health care facilities, cardiac pacemaker registry (patients implanted with a cardiac pacemaker), Hospital Based Home Care Program (patients provided medical services at home), Spinal Cord Injury (SCI) registry (SCI patients who have been examined or treated), AIDS (Acquired

Immunodeficiency Syndrome) registry (patients examined or treated for AIDS or AIDS Related Complex)).

A perpetual medical record is established and maintained at the health care facility when a consolidated health record is transferred to a Federal record center for storage. The perpetual medical record consists of the application(s) for medical benefits, hospital summary(ies), operation report(s), and tissue examination(s) for all episodes of care, and if applicable, autopsy report and certain Freedom of Information and Privacy Acts related records. Records related to ionizing radiation and agent orange claimants include ionizing radiation registry and agent orange registry code sheets, progress notes, laboratory reports, and follow-up letters.

Purpose(s):

The paper and automated records may be used for such purposes as:

Producing various management and patient follow-up reports; responding to patient and other inquiries; for epidemiological research and other health care related studies; statistical analysis, resource allocation and planning; providing clinical and administrative support to patient medical care; determining entitlement and eligibility for VA benefits; processing and adjudicating benefit claims by VBA (Veterans Benefits Administration) RO (Regional Office) staff; for audits, reviews and investigations conducted by staff of the health care facility, the Regional Directors and Division Offices, VA Central Office, and the VA OIG (Office of Inspector General); law enforcement investigations; quality assurance audits, reviews and investigations; personnel management and evaluation;

employee ratings and performance evaluations, and employee disciplinary or other adverse action, including discharge; advising health care professional licensing or monitoring bodies or similar entities of activities of VA and former VA health care personnel; accreditation of a facility by an entity such as the Joint Commission on Accreditation of Healthcare Organizations; and, notifying medical schools of medical students’ performance.

Authority for maintenance of the system:

Title 38, United States Code, chapter 3, section 210(c)(1) and chapter 73, section 4115.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

To the extent that records contained in the system include information protected by 38 U.S.C. 4132, i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia or infection with the human immunodeficiency virus, that information cannot be disclosed under a Routine Use unless there is also specific statutory authority permitting disclosure.

1. Disclosure of medical record data as deemed necessary and proper to Federal, State and local government agencies and national health organizations in order to assist in the development of programs that will be beneficial to claimants and to protect their rights under law and assure that they are receiving all benefits to which they are entitled.

2. Disclosure of medical care furnished and the period of care, as deemed necessary and proper to accredited service organization representatives and other approved agents, attorneys, and insurance companies to aid claimants in the preparation, presentation and prosecution of claims under laws administered by the VA, State or local agencies.

3. In the event that a system of records maintained by this agency to carry out its functions indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program statute, or by regulation, rule or order issued pursuant thereto, the relevant records in the system of records may be referred, as a routine use, to the appropriate agency, whether Federal, State, local or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.

4. A record from this system of records may be disclosed to a Federal agency, in response to its request, in connection with the hiring or retention of an employee, the issuance of a security clearance, the reporting of an investigation of an employee, the letting of a contract, or the issuance of a license, grant, or other benefit by the requesting agency, to the extent that the information is relevant and necessary to the requesting agency’s decision on the matter.

5. A record from this system of records may be disclosed as a ‘routine use’ to a Federal, State or local agency maintaining civil, criminal or other relevant information, such as current licenses, if necessary to obtain information relevant to an agency decision concerning the hiring or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant or other health, educational or welfare benefit.

6. Disclosure of information from this system of records may be made by appropriate VA personnel to the extent necessary and on a need-to-know basis consistent with good medical-ethical practices to the next of kin and/or the person(s) with whom the patient has a meaningful relationship.

7. In response to an inquiry about a named individual from a member of the general public, disclosure of information may be made from this system of records to establish the patient’s presence (and location when needed for visitation purposes) in a medical facility, to report the patient’s general condition while hospitalized (e.g., satisfactory, seriously ill), or to report the amount of monthly VA monetary benefits being received by the patient.

8. Relevant information from this system of records may be disclosed as a routine use: In the course of presenting evidence to a court, magistrate or administrative tribunal, in matters of guardianship, inquests and commitments; to private attorneys representing veterans rated incompetent in conjunction with issuance of Certificates of Incompetency; and to probation and parole officers in connection with Court required duties.

9. Relevant information from this system of records, including the nature and amount of a financial obligation, may be disclosed as a routine use, in order to assist the Veterans Administration in the collection of unpaid financial obligations owed the VA, to a debtor’s employing agency or commanding officer so that the debtor-employee may be counseled by his or her Federal employer or commanding officer. This purpose is consistent with 5 U.S.C. 5514, 4 CFR 102.5, and section 206 of Executive Order 11222 of May 8, 1965 (30 FR 6469).

10. Release of information to a guardian ad litem in relation to his or her representation of a claimant in any legal proceeding.

11. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.

12. A record containing the name(s) and address(es) of present or former members of the armed services and/or their dependents may be released from this system of records under certain circumstances: (1) To any nonprofit organization if the release is directly connected with the conduct of programs and the utilization of benefits under Title 38, and (2) to any criminal or civil law enforcement governmental agency or instrumentality charged under applicable law with the protection of the public health or safety if a qualified representative of such organization, agency or instrumentality has made a written request that such name(s) or address(es) be provided for a purpose authorized by law;

provided, further, that the record(s) will not be used for any purpose other than that stated in the request and that organization, agency or instrumentality is aware of the penalty provision of 38 U.S.C. 3301(f).

13. For the purpose of justifying emergency leave, disclosure to the Red Cross of the nature of the patient’s illness, probable prognosis, estimated life expectancy and need for the presence of the related service member.

14. Any relevant information may be disclosed to attorney’s, insurance companies, employers, third parties liable or potentially liable under health plan contracts, and to courts, boards, or commissions; such disclosures may be made only to the extent necessary to aid the Veterans Administration in preparation, presentation, and prosecution of claims authorized under Federal, State, or local laws, and regulations promulgated thereunder.

15. Disclosure of medical record data, excluding name and address, (unless name and address is furnished by the requester) for research purposes determined to be necessary and proper, to epidemiological and other research facilities approved by the Chief Medical Director.

16. In order to conduct Federal research necessary to accomplish a statutory purpose of an agency, at the written request of the head of the agency, or designee of the head of that agency, the name(s) and address(s) of present or former personnel of the Armed Services and/or their dependents may be disclosed (a) to a Federal department or agency or (b) directly to a contractor of a Federal department or agency. When a disclosure of this information is to be made directly to the contractor, the VA may impose applicable conditions on the department, agency and/or contractor to insure the appropriateness of the disclosure to the contractor.

17. Any relevant information may be disclosed to the Department of Justice and United States Attorneys in defense or prosecution of litigation involving the United States, and to Federal agencies upon their request in connection with review of administrative tort claims filed under the Federal Tort Claims Act, 28 U.S.C. 2672.

18. Disclosure of information from the record of an individual may be made by the examining VA physician to a non-VA physician, when that non-VA physician has referred the individual to the VA for medical care.

19. Disclosure may be made to NARA (National Archives and Records Administration) GSA (General Services Administration) in records management inspections conducted under authority of 44 U.S.C. 2904 and 2906.

20. Any medical data concerning a nonjudicially declared incompetent patient may be disclosed by appropriate VA personnel to a third party upon the written authorization of the patient’s next of kin in order for the patient, or, consistent with the best interest of the patient, a member of the patient’s family, to receive a benefit to which the patient or family member is entitled, or, to arrange for the patient’s discharge from a VA medical facility. Sufficient data to make an informed determination will be made available to such next of kin by appropriate VA personnel. If the patient’s next of kin are not reasonably accessible, disclosure of medical data for these purposes may be made by the Chief of Staff, Director, or designee of the VA medical facility where the records are maintained.

21. Any information in this system of records, including personal information obtained from other Federal agencies through computer matching programs, may be disclosed for the purposes identified below to any third party, except consumer reporting agencies, in connection with any proceeding for the collection of an amount owed to the United States by virtue of a person’s participation in any benefit program administered by the Veterans Administration.

Information may be disclosed under this routine use only to the extent that it is reasonably necessary for the following purposes: (a) To assist the VA in collection of title 38 overpayments, overdue indebtedness, and/or costs of services provided individuals not entitled to such services; and (b) to initiate civil or criminal legal actions for collecting amounts owed to the United States and/or for prosecuting individuals who willfully or fraudulently obtain title 38 benefits without entitlement. This disclosure is consistent with 38 U.S.C. 3301(b)(6).

22. The name and address of a veteran, other information as is reasonably necessary to identify such veteran, including personal information obtained from other Federal agencies through computer matching programs, and any information concerning the veteran’s indebtedness to the United States by virtue of the person’s participation in a benefits program administered by the VA may be disclosed to a consumer reporting agency for purposes of assisting in the collection of such indebtedness, provided that the provisions of 38 U.S.C.

3301(g)(4) have been met.

23. Any information in this system may be disclosed to a Federal grand jury, a Federal court or a party in litigation, or a Federal agency or party to an administrative proceeding being conducted by a Federal agency, in order for the VA to respond to and comply with the issuance of a Federal subpoena.

24. Any information in this system may be disclosed to as State or municipal grand jury, a State or municipal court or a party in litigation, or to a State or municipal administrative agency functioning in a quasi-judicial capacity or a party to a proceeding being conducted by such agency, in order for the VA to respond to and comply with the issuance of a State or municipal subpoena; provided, that any disclosure of claimant information made under this routine use must comply with the provisions of 38 CFR 1.511.

25. The individual’s name, address, social security number and amount (excluding interest) of any indebtedness in an amount of 600 dollars or more which is waived under 38 U.S.C. 3102, compromised under 4 CFR Part 103, otherwise forgiven, or for which the applicable statute of limitations for enforcing collection has expired, may be disclosed to the Treasury Department, Internal Revenue Service, as a report of income under 26 U.S.C. 61(a)(12).

26. Records from this system of records may be disclosed to a Federal Agency or to a State or local government licensing board and/ or to the Federation of State Medical Boards or a similar nongovernment entity which maintains records concerning individuals’ employment histories or concerning the issuance, retention or revocation of licenses, certifications, or registration necessary to practice an occupation, profession or specialty , in order for the Agency to obtain information relevant to an Agency decision concerning the hiring, retention or termination of an employee or to inform a Federal Agency or licensing boards or the appropriate nongovernment entities about the health care practices of a terminated, resigned or retired health care employee whose professional health care activity so significantly failed to conform to generally accepted standards of professional medical practice as to raise reasonable concern for the health and safety of patients in the private sector or from another Federal Agency. These records may also be disclosed as part of an ongoing computer matching program to accomplish these purposes.

27. In the case of any record which is maintained in connection with the performance of any program or activity relating to infection with the Human Immunodeficiency Virus (HIV), information may be disclosed to a Federal, State, or local public health authority that is charged under Federal or State law with the protection of the public health, and to which Federal or State law requires disclosure of such record, if a qualified representative of such authority has made a written request that such record be provided as required pursuant to such law for a purpose authorized by such law. The person to whom information is disclosed should be advised that they may not redisclose or use such information for a purpose other than that for which the disclosure was made (38 U.S.C.

4132(b)(2)(C). The disclosure of patient name and address under this routine use must comply with the provisions of 38 U.S.C. 3301(f)(2).

28. Information indicating that a patient or subject is infected with the Human Immunodeficiency Virus (HIV) may be disclosed by a physician or professional counselor to the spouse of the patient or subject or to an individual whom the patient or subject has, during the process of professional counseling or of testing to determine whether the patient or subject is infected with the virus, identified as being a sexual partner of the patient or subject. Disclosures may be made only if the physician or counselor, after making reasonable efforts to counsel and encourage the patient or subject to provide the information to the spouse or sexual partner and that the disclosure is necessary to protect the health of the spouse or sexual partner. Such disclosures should, to the extent feasible, be made by the patient’s or subject’s treating physician or professional counselor.

Before any patient or subject gives consent to being tested for the HIV, as part of pre-testing counseling, the patient or subject must be informed fully about these notification procedures.

29. The name of a veteran, or other beneficiary, other information as is reasonably necessary to identify such individual, and any information concerning the individual’s indebtedness by virtue of a person’s participation in a medical care and treatment program administered by VA, may be disclosed to the Treasury Department, Internal Revenue Service, for the collection of indebtedness arising from such program by the withholding of all or a portion of the person’s Federal income tax refund. These records may be disclosed as part of a computer matching program to accomplish these purposes.

30. Relevant information (excluding medical treatment information related to drug or alcohol abuse, infection with the human immunodeficiency virus or sickle cell anemia) may be disclosed to the Department of Health and Human Services (HHS) for the purpose of identifying improper duplicate payments made by Medicare fiscal intermediaries where VA authorized and was responsible for payment for medical services obtained at non-VA health care facilities. The purpose of the review is for HHS to identify duplicate payments and initiate recovery of identified overpayments and, where warranted, initiate fraud investigations, or, to seek reimbursement from VA for those services which were authorized by VA and for which no payment, or partial payment, was made by VA. The information to be disclosed to HHS for those patients authorized by VA to obtain medical services from non-VA health care facilities includes patient identifying information to include name, address, Social Security number, and date of birth, and dates of admission and discharge, diagnostic, surgical and procedures codes, and state and county of residence and zip code. These records may also be disclosed as part of an ongoing computer matching program to accomplish these purposes.

31. Identifying information in this system, including name, address, social security number and other information as is reasonably necessary to identify such individual, may be disclosed to the National Practitioner Data Bank at the time of hiring and/or clinical privileging/reprivileging of health care practitioners, and other times as deemed necessary by VA, in order for VA to obtain information relevant to a Department decision concerning the hiring, privileging/reprivileging, retention or termination of the applicant or employee.

32. Relevant information from this system of records may be disclosed to the National Practitioner Data Bank and/or State Licensing Board in the State(s) in which a practitioner is licensed, in which the VA facility is located, and/or in which an act or omission occurred upon which a medical malpractice claim was based when VA reports information concerning: (1) Any payment for the benefit of a physician, dentist, or other licensed health care practitioner which was made as the result of a settlement or judgment of a claim of medical malpractice if an appropriate determination is made in accordance with agency policy that payment was related to substandard care, professional incompetence or professional misconduct on the part of the individual; (2) a final decision which relates to possible incompetence or improper professional conduct that adversely affects the clinical privileges of a physician or dentist for a period longer than 30 days; or, (3) the acceptance of the surrender of clinical privileges or any restriction of such privileges by a physician or dentist either while under investigation by the health care entity relating to possible incompetence or improper professional conduct, or in return for not conducting such an investigation or proceeding. These records may also be disclosed as part of a computer matching program to accomplish these purposes.

33. Relevant medical record treatment information (excluding medical treatment information related to drug or alcohol abuse, infection with the human immunodeficiency virus or sickle cell anemia) may be disclosed to a State veterans home for the purpose of medical treatment and/or follow-up at the State home when VA makes payment of a per diem rate to the State home for the patient receiving care at such home and the patient receives VA medical care.

34. Relevant medical record treatment information (excluding medical treatment information related to drug or alcohol abuse, infection with the human immunodeficiency virus or sickle cell anemia) may be disclosed to (1) a Federal agency or non-VA health care provider or institution when VA refers a patient for hospital or nursing home care or medical services or authorizes a patient to obtain non-VA medical services and the information is needed by the Federal agency or non-VA institution on provider to perform the services; or (2) a Federal agency or to a non-VA hospital (Federal, State and local public or private) or other medical installation having hospital facilities, organ banks, blood banks, or similar institutions, medical schools or clinics, or other groups or individuals that have contracted or agreed to provide medical services or share the use of medical resources under the provisions of 38 U.S.C. 213, 4117, 5011, or 5053, when treatment is rendered by VA under the terms of such contract or agreement or the issuance of an authorization and the information is needed for purposes of medical treatment and/or follow-up, determining entitlement to a benefit, or, for VA to effect recovery of the costs of the medical care.

35. For program review purposes and the seeking of accreditation and/or certification, record information may be disclosed to survey teams of the Joint Commission on Accreditation of Healthcare Organizations, College of American Pathologists, American Association of Blood Banks, and similar national accreditation agencies or boards with who VA has a contract or agreement to conduct such reviews, but only to the extent that the information is necessary and relevant to the review.

36. Relevant medical record information (excluding medical treatment information related to drug or alcohol abuse, infection with the human immunodeficiency virus or sickle cell anemia) concerning a patient being considered for outplacement by VA may be disclosed to a non-VA nursing home facility that is considering the patient for admission when information concerning the individual’s medical care is needed for the purpose of preadmission screening under 42 CFR 483.20(f) for the purpose of identifying patients who are mentally ill or mentally retarded so they can be evaluated for appropriate placement.

37. Information from a named patient’s VA medical record which relates to the performance of a health care student or provider may be disclosed to a medical or nursing school or other health care related training institution on other facility with which there is an affiliation, sharing agreement, contract, or similar arrangement when the student or provider is enrolled at or employed by the school or training institution or other facility and the information is needed for personnel management, rating and/or evaluation purposes.

38. Relevant patient medical record information may be disclosed to individuals, organizations, private or public agencies, etc., with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor to perform the services of the contract or agreement.

39. Identifying information, including social security number, concerning veterans, spouse(s) of veterans, and the dependents of veterans, may be disclosed to other Federal agencies for purposes of conducting computer matches to obtain information to determine or verify eligibility of certain veterans who are receiving VA medical care under Title 38, U.S.C..

40. The name and social security number of a veteran, spouse and dependent, and other identifying information as is reasonably necessary may be disclosed to the Social Security Administration, Department of Health and Human Services, for the purpose of conducting a computer match to obtain information to validate the social security numbers maintained in VA records.

41. The patient name and relevant medical record treatment information concerning an adverse drug reaction of a patient may be disclosed to the Food and Drug Administration, Department of Health and Human Services for purposes of quality of care management including detection, treatment, monitoring, reporting, analysis and follow-up actions relating to adverse drug reactions

42. Patient identifying information may be disclosed from this system of records to Federal agencies such as the Department of Defense, Office of Personnel Management and Department of Health and Human Services and VA and government-wide third-party insurers responsible for payment of the cost of medical care for the identified patients in order for VA to seek recovery of the medical care costs. These records may also be disclosed as part of a computer matching program to accomplish these purposes.

43. Pursuant to 38 U.S.C. 7464 and notwithstanding sections 5701 and 7332, when requested by a VA employee or former VA employee (or a representative of the employee) whose case is under consideration by VA Disciplinary Appeals Board, in connection with the considerations of the Board, records or information may be reviewed by or disclosed to the employee or former employee (or representative) to the extent the Board considers appropriate for purposes of the proceedings of the Board in that case, when authorized by the chairperson of the Board.

Policies and practices for storing, retrieving, accessing, retaining and disposing of records in the system:

Storage:

Records (or information in records) are maintained on paper documents in the consolidated heath record at the last VA health care facility where care was rendered and at Federal records centers. Subsidiary record information is maintained at the various respective services within the health care facility (e.g., Pharmacy, Fiscal, Dietetic, Clinical Laboratory, Radiology, Social Work, Psychology, etc.) and by individuals, organizations, and/or agencies with whom VA has a contract or agreement to perform such services as VA may deem practicable. All or portions of the consolidated health record is stored or maintained on-line in VISTA or DHCP (Veterans Information Systems Technology Architecture or Decentralized Hospital Computer Program) computer systems in each VA health care facility and back-up computer files maintained at off-site locations, and may also be stored, in part, at VA Central Office, the National Institutes of Health, the VA Boston Development Center, Chief Information Officer Field Offices (CIOFOs), VA regional offices (VAROs), and the Austin Automation Center (AAC), Austin, Texas.

Retrievability:

Patient medical record folders are indexed by name and social security number and maintained in terminal digit order. Automated records are indexed by name and social security number.

Safeguards:

1. Access to working spaces and patient medical record storage areas in VA health care facilities is restricted to VA employees on a “need-to-know” basis.

Generally, file areas are locked after normal duty hours and the health care facilities are protected from outside access by the Federal Protective Service or other security personnel. Access to patient medical records is restricted to VA employees who have a need for the information in the performance of their official duties. Employee patient medical records and records of public figures or otherwise sensitive patient medical records are generally stored in separate locked files. Strict control measures are enforced to ensure that access to and disclosures from these patient medical records are limited to a “need-to-know” basis.

2. Access to the VISTA or/and DHCP computer rooms within the health care facilities is generally limited by appropriate locking devices and restricted to authorized VA employees and vendor personnel. ADP peripheral devices are generally placed in secure areas (areas that are locked or have limited access) or are otherwise protected. Information in DHCP and VISTA systems may be accessed only by authorized VA employees. Access to file information is controlled at two levels: The system recognizes authorized employees by a series of individually unique passwords/codes as a part of each data message, and the employees are limited to only that information in the file which is needed in the performance of their official duties. Information that is downloaded from PTF, OPC, DHCP and VISTA files and maintained on personal computers must be afforded similar storage and access protections as the data that is maintained in the original files.

3. Authorized Veterans Benefits Administration (VBA) regional office personnel are provided direct, on-line remote access to VHA patient treatment records maintained on DHCP or VISTA systems at VA health care facilities for the purposes of reading and downloading veterans’ medical record relevant to the development and adjudication of the veterans’ claims. To the extent that medical treatment records do not exist in electronic format, VBA will continue to access treatment records via AMIE (Automated Medical Information Exchange) software.

4. Access to the Austin Automation Center (AAC) is generally restricted to AAC employees, custodial personnel, Federal Protective Service and other security personnel. Access to computer rooms is restricted to authorized operational personnel through electronic locking devices. All other persons gaining access to computer rooms are escorted. Information stored in the AAC databases may be accessed by authorized VA employees at remote locations including VA health care facilities, VA Central Office, VISN (Veterans Integrated Service Network) Offices, and OIG headquarters and field staff. Access is controlled by individually unique passwords/codes which must be changed periodically by the employee.

5. Access to records maintained at VA Central Office, the VA Boston Development Center, the CIOFOs, and the VISN Offices is restricted to VA employees who have a need for the information in the performance of their official duties. Access to information stored in electronic format is controlled by individually unique passwords/ codes. Records are maintained in manned rooms during working hours. The facilities are protected from outside access during non-working hours by the Federal Protective Service or other security personnel.

6. Information stored on computers at the CIOFOs may be accessed by authorized VA employees at remote locations including VA health care facilities and VISN Offices. Access to electronically stored information is controlled by individually unique passwords/codes. Records are maintained in manned rooms during working hours. The facilities are protected from outside access during non-working hours by the Federal Protective Service or other security personnel.

7. Access to PTF information stored by VA Central Office at the National Institutes of Health Computer Center is limited to quality assurance program staff at VA Central Office and the VISN Offices. VA Central Office staff may access the nationwide data and staff of the VISN Offices may access data for their network area. Access to file information is controlled by individually unique passwords/codes.

8. Information downloaded from OPC, PTF and VISTA/DHCP files and maintained by the OIG headquarters and field offices on automated storage media is secured in storage areas or facilities to which only OIG staff have access. Paper documents are similarly secured. Access to paper documents and information on automated storage media is limited to OIG employees who have a need for the information in the performance of their official duties. Access to information stored electronically is controlled by individually unique passwords/codes.

Retention and disposal:

Consolidated health records are retained at health care facilities for a minimum of 3 years after the last episode of care. After the third year of inactivity the paper record is transferred to the nearest Federal record center for 72 more years of storage. Information stored on electronic storage media is retained and disposed of in accordance with disposition authorization approved by the Archivist of the United States.

System manager(s) and address:

Director, Medical Administration Service (161B), VA Central Office, Washington, DC 20420.

Notification procedure:

An individual who wishes to determine whether a record is being maintained in this system under his or her name or other personal identifier, or wants to determine the contents of such record, should submit a written request or apply in person to the last VA health care facility where care was rendered. Addresses of VA health care facilities may be found in VA Appendix 1 at the end of this document. All inquiries must reasonably identify the portion of the medical record involved and the place and approximate date that medical care was provided. Inquiries should include the patient’s full name, social security number and return address.

Record access procedures:

Individuals seeking information regarding access to and contesting of VA medical records may write, call or visit the last VA facility where medical care was provided.

Contesting record procedures:

(See Record Access Procedures above.)

Record source categories:

The patient, family members or accredited representative, and friends, employers or other third parties when otherwise unobtainable from the patient or family; military service departments; health insurance carriers; private medical facilities and health care professionals; State and local agencies; other Federal agencies; VA regional offices, Veterans Benefits Administration automated record systems (including Veterans and Beneficiaries Identification and Records Location Subsystem-VA (38VA23) and the Compensation, Pension, Education and Rehabilitation Records-VA (58VA21/22); and, various automated systems providing clinical and managerial support at VA health care facilities.