Attachment 5 SOP for CAPRI Veteran Service Officer VSO.docx

STANDARD OPERATING PROCEDURE (SOP) for Veteran Service Officer (VSO) Compensation & Pension Records Interchange (CAPRI) Forms

1. PURPOSE: This Standard Operating Procedure (SOP) establishes the process/procedure for processing VSO CAPRI Forms for special user access.

2. DEFINITIONS:

· Health Information Access (HIA) Utilities: An internal tool used by NDS to manage, track, and verify required training for CAPRI and JLV users

· Health Information Access Registry: An internal legacy tool used by NDS to create, track, and manage CAPRI and JLV accounts.

· Restricted List: A list of patients loaded onto Claims, limiting a user’s access to the records of specific Veterans.

· Special User Access Request Form: Adobe PDF Access Request Form (ARF) for Operations users, who are not working on a research protocol, used to request access to CAPRI or JLV.

· User Group: Veterans Affairs(VA)/Veterans Health Administration (VHA) employees or contractors who require access to the Electronic Health Record (EHR), through CAPRI or JLV, in the performance of their official duties under the treatment, payment, and/or healthcare operations provisions of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 (for more information visit http://www.hhs.gov/ocr/privacy/hipaa/understanding/index.html). Users requiring EHR access for the same project are considered a User Group (ex: VSO)

· Veteran Service Officers (VSO) Access to VHA Electronic Health Records: A specialized ARF, used only by accredited VSOs to gain access to CAPRI. VSOs get “patient restricted access” because they only need to view the EHR of Veterans they represent.

· Office of General Counsel: A Department of Veterans Affairs (VA) organization designed to meet the legal needs of the VA. One of OGC’s roles is to accredit Attorneys, Claims Agents and Veteran Service Officers to represent Veterans who have signed Power of Attorney (POA) with an attorney or VSO.

· POA Form: VA FORM 21-22 or VA FORM 21-22a which authorizes the VSO access to medical records. The POA will need to grant the VSO unlimited and unrestricted access to the medical records (including sensitive records protected by title 38 U.S.C. section 7332) since CAPRI cannot filter any information or date ranges.

3. RESPONSIBILITIES:

· VSO CAPRI Requester:

· User will submit a request with all required form fields filled out, and with the correct approval signature. Form must be signed by a VBA Change Management Agent (CMA), Management Agent (MA), or ISSO.

· User will be accredited by Office of General Counsel (OGC) to represent Veterans for a Veteran Service Organization, or as a Claims Agent or Attorney.

4. User will have completed the following required trainings for access to the EHR: VA 10203 Privacy & HIPAA training, and VA 10176 VA Privacy & Information Security Awareness & Rules of Behavior training.

· TMS Training Course Acceptable Substitutions:

VHA Mandatory Training for Health Professions Trainees (HPTs)-Trainees include residents, nursing students and any other individuals in a clinical training program.

(VA20152) VHA Mandatory Training for Transient Clinical Staff = covers (VA10203) Privacy and HIPAA Training

(TMS #3192008 & TMS #3185966) VHA Mandatory Training for Trainees & VHA Mandatory Training for Trainees Refresher = acceptable substitution for (VA 10176) VA Privacy and Information Security Awareness/Rules of Behavior

· In the event that access to CAPRI is no longer needed by the user, the user or their supervisor will notify NDS of this change in status via email to hia@va.gov or via submission of a help desk ticket using the Enterprise Service Desk (ESD).

· VHA National Data Systems (NDS):

· NDS will ensure the request submitted contains all required information, including PII, purpose for use statement, and program details.

· NDS will ensure the request is signed by the correct approval authorities: the user’s a VBA Change Management Agent (CMA) - meaning listed in the GAL, or Management Agent (MA).

· NDS will create the user’s CAPRI account once the request has been verified. NDS will notify the user of account creation.

· NDS will terminate the user if notified by the user or the user’s supervisor that the user no longer requires access.

5. PROCEDURES:

Note: Request instructions for VSO CAPRI access can be found on the VHA Data Portal.

1. Locate and save VSO CAPRI Request Form (10-0400) A. VSO CAPRI request forms ready for review, will either be faxed to RightFax, or emailed by encrypted email to the VSO HIA mailbox (HIA.VSO@va.gov). Forms are usually sent in by the VSO requester, or the CMA or MA that signed the request form.

B. Save the request form on the Q drive in the VSO Q drive folder: \\vacohsm01.dva.va.gov\VACO_Workgroups\VHA\10P2\CAPRI\2. Health Care Operations (HCO) - (POAs-MOAs-VSOs)\Docs for VSOs\Completed 10-0400s C. Format: Last Name, First Name ~ Alexsys#

2. Review VSO CAPRI Request Form A. Review the VSO CAPRI form for the following:

· Full Legal Name

· Office Phone Number

· Office Email Address

· Social Security Number (SSN)

· Date of Birth (DOB)

· Veteran Service Organization(s) or Law Firm

· Requester signature in Box 13 on pg 1

· Supervisor Name and Email (Listed as ISO on form, but will by CMA or MA)

· Supervisor signature

· VSO Electronic Health Record Access Agreement signature on page 2

3. Verify requester is OGC Accredited A. Go to the OGC Accreditation look up site B. Select the appropriate bubble/checkbox

· VSO Representative if they listed one or more organization on their form

· Claims Agent if indicated on form

· Attorney if law firm, or Accredited Attorney is selected as the Veteran Service Organization on the form C. Enter Last Name and First Name D. Select Search E. Select Name from list F. Verify Veteran Service Organizations listed on the form match those indicated on the request form. If attorney, verify attorney and law firm information is correct

4. Add User Information into the HIA Registry:

A. Check if user’s name is already in the registry. If not, click Add New B. Enter all pertinent information on the form into the HIA registry.

· Help Desk Ticket (the Alexsys ticket number, once ticket has been created – see step #5 below)

· Name

· SSN and DOB

· User Group: VSO

· Service/Section: Veteran Service Center

· Systems Authorized: CAPRI-Full Access

· Purpose for Access: Operations

· Level of Access: Restricted Patient List

· Title: Veteran Service Officer

· Division

· Office Phone and Email Address C. Pull up the user’s training dates by using Manage Users in HIA Utilities and reviewing the Training Information from TMS. Update training by clicking Info Sec and Privacy buttons in Utilities. The training dates will update in HIA Registry simultaneously.

· If the user’s training does not pull up automatically, use the dates the CMA/MA indicated on the request form. Enter them manually into the Registry. “VHA Privacy Policy Training Date” on form is the Date of Privacy Training in the Registry. “VA CyberSecurity Training Date” on form is the Date of Cybersecurity Training in the Registry.

5. Create the Alexsys ticket:

A. Creating the Alexsys ticket:

· In Alexsys select New to create a new ticket for the user.

a. Select Access Request as the Work Request Type then OK

b. Select Access Request Form as Type of Fax or Email

c. Include user’s name in the Title

d. Verify CAPRI checkbox is selected

e. Make Users Requested one

f. Make the User Groups VSO

g. Select Healthcare Operations as Purpose of Us

h. Fill out Date Completed Form Submitted to NDS (the date the form was faxed or emailed) and select the Access Duration box

i. In the description, if the form was sent by email, copy and paste the email information (remove any PII/PHI), including the sender information.

j. Click Save.

Note: This screenshot is for the client version of Alexsys. The web version will look different, but have the same fields.

6. Create the CAPRI Account A. Hit Make Account button in the HIA Registry and follow prompts B. Go to the Patient Lists tab and select Create Entry (List Entries for User box will turn green). Select the checkbox(es) for the Veteran Service Organization(s) included on the form (on the bottom right of the screen). Select Add Selected. If requester is an attorney, don’t add any organizations.

C. Go to Sites tab and select Yes for Show all sites? and HIA Special User?

D. Go back to the General tab and change Request status from Submitted to Approved

7. Click on Access/Verify Codes to send user their codes. This only works if they have a VA email. Send Notification email to Requester A. Send a notification email to the requester, the secondary signer (CMA or MA), HIA.VSO@va.gov and any other email addresses copied on the original email (or coversheet if faxed).

For organization(s)

For Attorney

8. Close Out Alexsys Form A. Change status to Closed B. Input number of Users Approved: 1 C. Change Owner to your name D. Enter activities completed from Appendix A in Access Request Notes box.

9. Save VSO ARF(s) to appropriate folder in the Q drive.: \\vacohsm01.dva.va.gov\VACO_Workgroups\VHA\10P2\CAPRI\2. Health Care Operations (HCO) - (POAs-MOAs-VSOs)\Docs for VSOs\Completed 10-0400s

APPENDIX A:

Script

If you could not pull up training through Utility Tool:

Could not verify SSN through TMS, but CMA has indicated required training dates on request form.

Verified SSN(s) and OGC accreditation for [organization] Sent email notification stating that access has been granted, and that user may now begin faxing in POAs; copied CMA Sent codes

If you could pull up training:

Verified SSN(s) and OGC accreditation for [organization] Sent email notification stating that access has been granted, and that user may now begin faxing in POAs; copied CMA Sent codes

02/19/2020 version 3 Page 9 of 9 image1.png image2.png image3.png image4.png image5.png image6.png