Attachment 4 SOP for CAPRI Joint Longitudanal Viewer JLV.docx

STANDARD OPERATING PROCEDURE (SOP) FOR COMPENSATION & PENSION INTERCHANGE (CAPRI) / JOINT LONGITUDINAL VIEWER (JL

August 2023 August 2023

Revision History

Document Title: STANDARD OPERATING PROCEDURE (SOP) CAPRI FOR JLV

8/17/2023

8/31/2023

9/14/2023

10/25/2023

10/31/2023

Table of Contents:

STANDARD OPERATING PROCEDURE (SOP) for Compensation & Pension Records Interchange (CAPRI)/ Joint Longitudinal Viewer (JLV) Forms

I. PURPOSE: This Standard Operating Procedure (SOP) establishes the process/procedure for processing CAPRI/JLV Forms for special user access.

II. DEFINITIONS:

· Health Information Access (HIA) Utilities: An internal tool used by NDS to manage, track, and verify required training for CAPRI and JLV users.

· Health Information Access Registry: An internal Longitudinal tool used by NDS to create, track, and manage CAPRI and JLV accounts.

· National Call Center for Homeless Veterans (NCCHV) Memo: Memo that exempts staff of the NCCHV who provide assistance and resources to Homeless Veterans and Veterans at-risk of becoming homeless from NDS Secondary signature. (Click here to see Memo)

· Office of General Counsel (OGC) Super Collaborative (SC) Tort Pilot Project: S C Tort Pilot Project conducted by Subject Matter Experts (SMEs) in the OGC. The SMEs investigate and adjudicate medical malpractice claims filed under the Federal Torts Claim Act. Users of the project are exempt from HIG Director’s or designee (NDS Secondary) signature when requesting National Access to CAPRI. (Click here to see Memo)

· Reduction Act Memo: Memo signed by the Director of Health Information Governance (HIG), to eliminate Director’s signature for established CAPRI/JLV user groups. The memo exempts staff members of seven specific user groups, who routinely require access to the Electronic Health Record (EHR) by nature of their job positions. (Click here to see Memo)

· Restricted List: A list of patients loaded onto Claims, limiting a user’s access to the records of specific Veterans.

· Special User Access Request Form: Adobe PDF Access Request Form (ARF) for Operations users, who are not working on a research protocol, used to request access to CAPRI or JLV.

· User Group: Veterans Affairs(VA)/Veterans Health Administration (VHA) employees or contractors who require access to the Electronic Health Record (EHR), through CAPRI or JLV, in the performance of their official duties under the treatment, payment, and/or healthcare operations provisions of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 (for more information visit http://www.hhs.gov/ocr/privacy/hipaa/understanding/index.html). Users requiring EHR access for the same project are considered a User Group (ex: Suicide Hotline, Health Resource Center). Electronic Permission Access System (ePAS) Form: ePAS facilitates the submission, approval and completion of an electronic document for operational users, who are not working on a research protocol, to request access to CAPRI or JLV.

· Veteran Service Officers (VSO) Access to VHA Electronic Health Records: A specialized ARF, used only by accredited VSOs to gain access to CAPRI. VSOs get “patient restricted access” because they only need to view the EHR of Veterans they represent. *See VSO CAPRI SOP for instructions.

III. RESPONSIBILITIES:

· CAPRI/JLV Requester:

· User will submit a request with all required form fields filled out, and with the correct approval signatures. Form must be signed by the user’s supervisor.

· User will provide an appropriate purpose for use to justify access to EHR, which explains how the user will be using veteran patient data for their job duties.

· User will have completed the following required trainings for access to the EHR: Privacy & HIPAA training, and VA Privacy & Information Security Awareness & Rules of Behavior training.

· In the event that access to CAPRI or JLV is no longer needed by the user, the user or their supervisor will notify NDS of this change in status via email to hia@va.gov or via submission of a help desk ticket using the Enterprise Service Desk (ESD).

· VHA National Data Systems (NDS):

· NDS will ensure the request submitted contains all required information, including PII, purpose for use statement, and program details.

· NDS will ensure the request is signed by the correct approval authorities: the user’s Supervisor and the user’s Program Director or Chief of Staff.

· NDS will create the user’s CAPRI or JLV account once the request has been verified. NDS will notify the user of account creation.

· NDS will terminate the user if notified by the user or the user’s supervisor that the user no longer requires access.

IV. PROCEDURES:

Note: These are instructions for ePAS CAPRI and JLV requests. Instructions for emailed ARFs are in Appendix B.

1. Review Electronic Permissions access System (ePAS) Request Form When an ePAS form is ready for review, an ePAS notification is sent directly to a reviewer’s VA email account and to hia@va.gov. The reviewer can access the ePAS form via the ePAS link and view all entries under ‘Approval’ for your queue at https://epas.r02.med.va.gov/ or by opening the ePAS form by clicking the link in the automated email alert.

A. Review the ePAS form for the following:

· Full Legal Name*

· Job Title*

· Email Address *

· Employee Agency

· Employee Type

· Contractor Name (if applicable)

· Contractor Business Address (if applicable)

· Supervisor Name and Email

· Purpose of Use (as selected)

· Data Sources – CAPRI/JLV Tab

· Duration of Access

· Acknowledgement

· Signatures: Ensure ePAS form is signed by the appropriate personnel

NOTE: If no purpose for use is provided, or purpose for use is unclear, contact the user directly and ask for more information. If the user is a new user group, request that the user complete the template questions (included in the table below) so a summary (“one pager”) outlining the group’s project can be created.

1. Health Information Access needs to clearly document where you belong in the organization. Please provide the VHA mail code (mail code http://vaww1.va.gov/health/programs.asp) , Name of your program, and the project or job duty that requires expanded access. If you are not part of the VHA please clearly list your organization and department.

1. Please describe how the access to the CAPRI system will be used, providing an overview of purpose of use which details why your group will need access and what information will be accessed. Also please include the Director and Service Chief.

1. Will any data be used to formulate spreadsheets, databases, or external applications?

1. Please provide an estimate of new initial user requests and the number of expected users in the future?

1. How long will the users need access, i.e. 6 months, 1 year, 2 years? How long will the project last?

1. Who will be the primary contact when coordinating with HIA and who will be authorizing officials from your team or project that will sign the Access Request Forms?

1. Do the users require National access, Site restricted or patient restricted access (access to specific patients)? Are the requester’s contractors, VA employees or a combination both?

1. Are the requesters located at a Medical Center, Regional Office or remotely accessing via VPN?.

2. Create the Alexsys ticket:

A. Creating the Alexsys ticket:

· When an ePAS form is routed to NDS, create an Alexsys ticket for the user.

a. Create new ticket. Select Access Request as the Work Request Type. Select ePAS as Type of Fax or Email.

b. Include user’s name in the Title, Enter the ePAS ID Number. Choose the System (CAPRI and/or JLV) and User Groups.

c. Include link to ePAS form in the Description.

d. Fill out required ticket fields including AD Domain/Username, Employee Type, Station Number, Purpose of Use, and Date Completed Form Submitted to NDS.

e. Click Save.

3. Verify if Secondary NDS Approval is Needed: All requests must be approved by the HIG Director designee before users receive CAPRI/JLV access. However, the method of HIG approval depends on the requestor’s User Group. Some users require HIG Director Designee’s signature and some users are approved by memo (see Definitions). The processes for both types of HIG approval are outlined below.

A. The following outlines the user groups that do not require second level approval.

· Reduction Act Memo, covers the following seven User Groups Health Resource Center (HRC), ESD, Veterans Crisis Line (Suicide Hotline), Regional Counsel, Office of Inspector General (OIG)-Audit Division, OIG-Healthcare Operations, OIG-Fugitive Felon, & National Teleradiology.

· Other Memos: Office of General Counsel (OGC) torts, and OGC – TPJI.

· On the CAPRI/JLV Tab of the ePAS form select “No” for the Secondary NDS Approval Needed question.

B. All other users, who do not fall under any of the above-mentioned memos, require a second level signature.

· On the CAPRI/JLV Tab of the ePAS form select “Yes” for the Secondary NDS Approval Needed question.

· Approve the ePAS Request

· Once the ePAS request is approved by the HIG Director/designee this request will be routed back to the queue as Final Review. Proceed to Step 4 after secondary approval is approved.

4. Add User Information into the HIA Registry:

A. Check if user’s name is already in the registry. If not, click Add New B. Enter all pertinent information on the form into the HIA registry.

· Help Desk Ticket (the Alexsys ticket number)

· Name When a user’s name has a space or dash in it, pull up his/her SSN in Utilities before creating a new account. If they already have an account, use that one in Registry. Be sure to update (if needed) the name to mirror what it shows in the GAL. If the name differs between TMS and the GAL, notate this under the Comments tab in HIA Registry (TMS has last name as xxx).

· SSN and DOB

· User Group and Service/Section. If only JLV is selected please email the requester first to see if they can already log into JLV. If they can, reject the ePAS request (if HCO data sources are also selected, do not reject until the HCO portion is approved).

· Systems Authorized

· Purpose for Access: Operations

· Level of Access

· Title and Division

· Office Phone and Email Address

· Access Expiry Date (if applicable) C. Pull up the user’s training dates by using Manage Users in HIA Utilities and reviewing the Training Information from TMS. Update training by clicking Info Sec and Privacy buttons in Utilities. The training dates will update in HIA Registry simultaneously.

· If the user’s training does not pull up automatically, contact user, and request certificates of completion for the required trainings. Upload the certificate(s) onto the Q drive HIA Request Scan folders, and manually enter the training dates (note: Date Signed ROB is same as Date of Cybersecurity training) in HIA Utilities. Enter a note into the comments tab in HIA Registry indicating training dates were updated manually.

· If the TMS training does not pull up with the spelling of the last name as shown in the GAL (this happens often with hyphenated names/spaced names such as “Jones-Smith vs Jones Smith or Okeefe vs O’Keefe), try typing it with/without the hyphen or space before reaching out to the user.

· VHA Mandatory Training for Trainees TMS course can be accepted in place of the Info and Sec course.

· VHA Directive 1605.1 states that “If personnel have access to protected health information, they are required to take the Privacy and HIPAA Focused training.”

D. Create the CAPRI\JLV Account

1) Hit Make Account button in the HIA Registry and follow prompts

2) Change Request status from Submitted to Approved

3) Ensure appropriate Sites are selected in the Sites tab in the HIA Registry

4) Click on Access/Verify Codes to send user their codes

2. Create Alexsys Ticket A. Create new ticket. Select Access Request as the Work Request Type. Select ePAS as Type of Fax or Email.

B. Include user’s name in the Title, Enter the ePAS ID Number. Choose the System (CAPRI and/or JLV) and User Groups.

C. Fill out required ticket fields including AD Domain/Username, Employee Type, Station Number, Purpose of Use, and Date Completed Form Submitted to NDS.

a. Click Save.

b. Copy Alexsys Number to Help Desk Field of the Registry.

3. Approve ePAS form.

Ensure Secondary NDS Approval Needed question is answered correctly.

USER GROUP Information

Veteran Crisis Line (VCL)/Suicide Hotline User Group – Suicide Hotline Title – Administrative Support Staff Division – Canandaigua VAMC Service/Section – Suicide Hotline Primary Menu (pre-populated): XMUSER Secondary Menus (pre-populated): CAPRI IDENT, DVBA CAPRI GUI Keys (pre-populated): DVBA CAPRI READ ONLY

Enterprise Service Desk (ESD) User Group – Enterprise Service Desk Title – IT Specialist Division – on ePAS Service/Section – Enterprise Service Desk Add Primary Menu: AR3 NSD MAIN MENU Secondary Menus pre-populate as: HIA UTILS GUI, WEBG WEBVRAM GUI, KPA VRAM GUI Keys: DVBA RESTRICTED REMOTE USER, HIA UTILS GUI – TMS QRY, HIA UTILS GUI – UML NPF, HIA UTILS GUI – USER MGT, and WEBG AV PUSH

Health Resource Center User Group – Health Resource Center Title – Contact Representative Division – VACO ORGS W/VSC HR SVC Service/Section – Health Resource Center Add Primary Menu that is listed on ePAS Form, unless Homeless Veterans Contact Rep

National Cemetery Administration User Group – National Cemetery Administration Title - PROGRAM SUPPORT ASSISTANT Division - VACO ORGS W/VSC HR SVC Service Section - NCA-FNOD

OGC TPJI

User Group – REGIONAL COUNSEL Title - PARALEGAL Division - VACO ORGS W/VSC HR SVC Service Section – OGC-TPJI Add Primary Menu: IBJ THIRD PARTY JOINT INQUIRY Add Secondary Menus: CAPRI IDENT, DVBA CAPRI GUI, IBJ THIRD PARTY JOINT INQUIRY, JLV WEB SERVICES, KPA FB MENU OPTIONS, WEBG WEBVRAM GUI Removed DVBA CAPRI READ ONLY key Add WEBG AV PUSH key

Standard Set of Menus and Keys Primary Menu - XMUSER Secondary Menus – DVBA CAPRI GUI, CAPRI IDENT Keys – DVBA CAPRI Read Only, DVBA ALLOW JLV COMM DATA

V. TEMPLATE RESPONSES:

CAPRI:

You have been authorized National access to CAPRI.

You will receive an automated message from HIA Auto Responder, sent to your VA email, with access and verify codes for the CAPRI application.

The latest version of CAPRI no longer needs to be pushed to your workstation through System Center Configuration Manager (SCCM). CAPRI can now be found on your desktop through VA Applications Consolidated Servers (VACS), also known as “goldstar”. After launching “goldstar”, CAPRI can be launched from the network share.

Please visit the VHA Data Portal at http://vaww.vhadataportal.med.va.gov/Home.aspx for additional information on other available data sources and how to request access.

NDS wants your feedback! Your participation is voluntary. Please click the link to participate in our customer satisfaction questionnaire. NDS Customer Satisfaction Questionnaire

CAPRI & JLV:

The following have been authorized National access to CAPRI and JLV.

If you do not already have an active CAPRI account, you will receive an automated message from HIA Auto Responder, sent to your VA email, with access and verify codes for the CAPRI application.

The latest version of CAPRI no longer needs to be pushed to your workstation through System Center Configuration Manager (SCCM). CAPRI can now be found on your desktop through VA Applications Consolidated Servers (VACS), also known as “goldstar”. After launching “goldstar”, CAPRI can be launched from the network share.

JLV

Joint Legacy Viewer (JLV) is included in the CAPRI application. If you need to view the standalone version of JLV, you will be able to use your CAPRI access and verify codes to log in by following the steps in the JLV Login Instructions and Login Help.

Please visit the VHA Data Portal at http://vaww.vhadataportal.med.va.gov/Home.aspx for additional information on other available data sources and how to request access.

NDS wants your feedback! Your participation is voluntary. Please click the link to participate in our customer satisfaction questionnaire. NDS Customer Satisfaction Questionnaire

JLV:

You have been authorized JLV access.

Please refer to the JLV login instructions for how to access JLV. If you have a CPRS account, you will be able to use your local CPRS codes to log into JLV. If you do not have a CPRS account, you will need to use the CAPRI access and verify codes I sent you through an email from HIA Auto Responder to first log into the National CAPRI application and change your verify code before logging into JLV.

The latest version of CAPRI no longer needs to be pushed to your workstation through System Center Configuration Manager (SCCM). CAPRI can now be found on your desktop through VA Applications Consolidated Servers (VACS), also known as “goldstar”. After launching “goldstar”, CAPRI can be launched from the network share.

Please visit the VHA Data Portal at http://vaww.vhadataportal.med.va.gov/Home.aspx for additional information on other available data sources and how to request access.

NDS wants your feedback! Your participation is voluntary. Please click the link to participate in our customer satisfaction questionnaire. NDS Customer Satisfaction Questionnaire

Duplicate Request:

You have already been granted access to CAPRI/JLV. This is a duplicate request.

Training Certificate(s) Needed:

Please complete the VA 10203 Privacy and HIPAA Focused training TMS training course, so I can create your National CAPRI account.

Please send me the certificates of completion dated within the last 365 days for the following TMS training courses, so I can enable your National CAPRI account:

1. VA 10176 VA Privacy and Information Security Awareness/Rules of Behavior training

2. VA 10203 Privacy and HIPAA Focused training

Please send me the certificate of completion dated within the last 365 days for the TMS training course VA 10203 Privacy and HIPAA Focused training, so I can enable your National CAPRI account.

Removal of CAPRI/JLV as Data Source:

You can use your CPRS access codes to access JLV. Please remove CAPRI/JLV as a data source on this form. Below is a link that provides additional information on JLV: http://vaww.vhadataportal.med.va.gov/ToolsApplications/JLV.aspx

CAPRI Requests for VBA Employees:

NDS is prohibited from provisioning CAPRI accounts for VBA employees. Please refer to the link below to request CAPRI access from VBA: https://vbaw.vba.va.gov/bl/21/DEMO/capri.htm

VSO Requests:

For VSO CAPRI requests (10-0400s), visit the VSO SOP in Sharepoint.

VI. TMS Training Course Acceptable Substitutions:

VHA Mandatory Training for Health Professions Trainees (HPTs)-Trainees include residents, nursing students and any other individuals in a clinical training program.

(VA20152) VHA Mandatory Training for Transient Clinical Staff = covers (VA10203) Privacy and HIPAA Training

(TMS #3192008 & TMS #3185966) VHA Mandatory Training for Trainees & VHA Mandatory Training for Trainees Refresher = acceptable substitution for (VA 10176) VA Privacy and Information Security Awareness/Rules of Behavior

01/31/2020 version 3 Page 9 of 9 image1.wmf image2.png