Directive 6300 21 Sep 2018 V1.pdf

September 21, 2018 VA Directive 6300

RECORDS AND INFORMATION MANAGEMENT

1. REASON FOR ISSUE: To revise Department-wide records and information management policy.

2. SUMMARY OF CONTENTS: This directive contains the policies and responsibilities for the Department of Veterans Affairs' (VA) Records and Information Management Program which includes the Federal Records Act, the Privacy Act (PA), the Freedom of Information Act (FOIA), the Computer Matching and Privacy Protection Act, and the Release of Names and Addresses (RONA). This directive:

a. Consolidates policy relating to information created, received, collected, processed, maintained, released, disclosed, or disposed of by or for the VA, in any medium or form, including information managed by VA or a third party on behalf of VA.

b. Provides policy direction for the Data Integrity Board (DIB), which oversees and approves all VA computer matching activities in accordance with the requirements of the Computer Matching and Privacy Protection Act and the Office of Management and Budget

(OMB).

c. Provides policy for obtaining approvals from the Department of Defense (DOD) military service branches to access military records.

d. Authorizes VA administrations and program offices procedures for loan and exchange of records or information with other Federal agencies and the National Personnel Records Center (NPRC).

e. Authorizes Veterans Benefits Administration (VBA) procedures for requesting sensitive documents from the DOD when such documents are needed to process a veteran’s claim for benefits.

f. Authorizes VA administrations and program offices, the establishment and maintenance of legal and financial rights essential records schedules.

g. Provides policy for electronic records created or received.

h. Provides policy for storage of VA’s essential records.

Department of Veteran Affairs VA Directive 6300 Washington, DC 20420 Transmittal Sheet September 21, 2018

September 21, 2018 VA Directive 6300VA Directive 6300ECTIVE 6300

3. RELATED DIRECTIVES AND HANDBOOKS:

a. VA Handbook 6300.1, Records Management Procedures.

b. VA Handbook 6300.2/1, Management of the Vital Records Program.

c. VA Handbook 6300.3, Procedures for Implementation of the Freedom of Information Act.

d. VA Handbook 6300.4, Procedures for Processing Requests for Records Subject to the

Privacy Act.

e. VA Handbook 6300.5, Procedures for Establishing and Managing Privacy Act Systems of Records.

f. VA Handbook 6300.6, Procedures for Releasing Lists of Veterans and Dependents Names and Addresses.

g. VA Handbook 6300.7, Procedures for Computer Matching Programs.

h. VA Handbook 6300.8, Procedures for Shipment of Records to the VA Records Center &Vault in Neosho, Missouri.

i. VA Directive 6301, Electronic Mail Records.

j. VA Handbook 6301, Procedures for Handling Electronic Mail Records.

k. VA Directive 6309, Collections of Information.

l. VA Handbook 6309, Collections of Information.

m. VA Directive 6361, Ensuring Quality of Information Disseminated by VA.

n. VA Handbook 6361, Ensuring Quality of Information Disseminated by VA.

o. VA Handbook 6371, Destruction of Temporary Paper Records.

p. VA Directive 6500, Managing Information Security Risk: VA Information

Security Program.

q. VA Handbook 6500, Risk Management Framework for VA Information Systems -

Tier 3: VA Information Security Program.

r. VA Directive 6600, Responsibility of Employees and Others supporting VA In

Protecting Personally Identifiable Information (PII).

s. VA Directive 6609, Mailing of Sensitive Personal Information.

4. RESPONSIBLE OFFICE(S): Office of the Assistant Secretary for Information and Technology, Office of Quality, Privacy and Risk, Enterprise Risk Management Service, is responsible for the material contained in this directive.

5. RESCISSIONS: VA Directive 6300, Records and Information Management, dated February 26, 2009

Certified By: BY DIRECTION OF THE SECRETARY OF

VETERANS AFFAIRS:

/s/ /s/ Melissa S. Glynn, Ph.D. Camilo Sandoval Assistant Secretary Executive in Charge for for Enterprise Integration Office of Information and Technology

Distribution: Electronic Only

RECORDS AND INFORMATION MANAGEMENT

1. PURPOSE

a. This directive provides policy for the VA Records Management (RM) program, which includes adherence to the Federal Records Act, the Privacy Act (PA), the Freedom of Information Act, the Computer Matching and Privacy Protection Act, and the Release of Names and Addresses. The provisions of this directive are applicable to all elements of VA.

b. Records include all books, papers, maps, photographs, machine-readable materials, or other documentary materials, regardless of physical form or characteristics, made or received by an agency of the United States Government under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or because of the informational value of the data in them (44 U.S.C.§ 3301).

2. POLICY

a. The information contained in VA records will be managed as national assets. VA will establish and maintain an active RM program and effective management controls for the economical and efficient management of records throughout their life cycle. Records regardless of media will be created maintained and used, disposed, and preserved to document the transaction of business the Department. Records are evidence of VA organization, functions, policies, procedures, decisions, and activities pursuant to the federal law, Title 44 United States Code, and federal regulations governing Records Management, 36 C.F.R. Chapter XII, Subchapter B, Parts 1220 -1234, and will be maintained in accordance with guidance issued by the National Archives and Records Administration (NARA), and (OMB) and NARA Memo M-12-18, “Managing Government Records Directive,” and OMB Circular A- 130, “Managing Information as a Strategic Resource.”

b. VA will create and preserve records, in any medium, that document the historical functions, policies, decisions, procedures and essential transactions of the agency. VA will maintain and preserve records necessary to protect the legal and financial rights of the Government and of persons directly affected by these activities.

c. All VA records will be covered by either a NARA General Records Schedule or NARA approved VA records control schedule. Approval of the schedules must be obtained from NARA in accordance with 36 C.F.R. Chapter XII, Subchapter B. Space devoted to records and information will be kept to a minimum through an aggressive program of records disposition and application of records storage technologies. VA will collaborate with NARA and other regulatory agencies in applying standards, procedures, and techniques to improve the management of records, promote the maintenance of those records of continuing value, and facilitate the segregation and disposal of temporary records.

VA Directive 6300 September 21, 2018

d. VA will ensure that the RM program provides adequate and proper documentation of VA’s activities and ensure records in any medium can be accessed as needed and authorized.

e. All VA records, including paper, electronic, microform, media, and information subject to the provisions of PA, FOIA, HIPAA, or VA's confidentiality statutes (38 U.S.C.

§§ 5701, 5705, and 7332), including the Release of Names and Addresses (RONA) program, will be maintained, protected, and released in accordance with applicable law and regulations. Information on veterans, beneficiaries, employees, and others having dealings with VA, including proprietary information, will be collected only when legally authorized and will be protected from unauthorized disclosure.

f. All permanent electronic records will be managed electronically for eventual transfer and accessioning to NARA in an electronic format. VA will use NARA regulations (36 CFR § 1234.6) for managing electronic records. Standards and procedures are contained in NARA Guide entitled managing Electronic Records.

Permanent records in formats other than electronic shall be maintained and dispositioned in accordance with (36 CFR § 1226.24).

g. Sound records management principles must be incorporated into VA business processes in accordance with the NARA Federal Enterprise Architecture Records Management Profile, and statutory requirements. Records management requirements will be integrated into all VA information technology (IT) governance processes for portfolio management, risk management, capital planning, enterprise architecture, business process design, and system development.

h. The acquisition, development, and enhancement of electronic information systems (EIS) and IT services must incorporate records management and preservation considerations, and any records contained in the systems or IT services must be managed in accordance with NARA- approved records disposition schedules.

(1) For new EIS and IT services, records will be managed electronically by recordkeeping functionality provided by the EIS or IT service, or by transferring records to an electronic recordkeeping repository, such as a records management solution that is compliant with NARA Bulletin 2008-07.

(2) For existing systems EIS and IT services, records will be managed electronically, manually or a combination of both. To manage records electronically, recordkeeping functionality will be built into the system provided by EIS or IT service, or records will be transferred to an electronic recordkeeping repository or records management solution that is, compliant with OMB Circular A-130.

(3) In accordance with NARA Bulletin 2008-07, VA will use as a baseline, version 3 of the Department of Defense (DOD) Electronic Records Management Software

Application (RMA) Design Criteria Standard (DOD 5015.2-STD, April 2007) or its successor upon certification by NARA when implementing a records management solution or electronic management solution or electronic recordkeeping repository

i. Records created, sent or received using electronic messaging accounts must be managed electronically, including the capability to identify, retrieve, and retain records for as long as they are needed, in accordance with 36 CFR § 1236.22 and NARA Bulletin 2012-02, Managing Content on Shared Drives, or NARA Bulletin 2013-02, “Guidance on a New Approach to Managing Email Records as applicable.

j. Unstructured electronic records, other than electronic messages, must be managed in a records management solution that is compliant with NARA Bulletin 2012-02. This includes records created using any electronic application.

k. Electronic records, EIS and IT services must be interoperable at the VA intragency and interagency levels where data shared or transferred to another federal agency. Metadata, standards, and/or mediation will be used to the extent practicable.

l. Records and non-record materials are government owned and cannot be copied or removed from government custody or destroyed, except as authorized in accordance with federal law and regulation. This applies to electronic records used to conduct VA business as those messages include both record and non-record material and cannot be copies, transferred, or removed as personal files. Non-record materials will be destroyed when no longer needed for business at the discretion of the custodian.

m. VA personnel will receive records management training annually in order to understand their responsibilities in managing VA information as records and how to carry out these responsibilities.

n. Non-official, electronic messaging accounts will not be used to conduct official VA business transactions. If a VA employee uses a non-official electronic messaging account, the employee must copy the message to his/her official electronic messaging account when the record is first transmitted, or must forward a complete copy of the record to their official electronic messaging account within 20 days of the record’s original creation or transmission pursuant to 44 U.S.C.§ 2209. Electronic messaging accounts includes personal or non-VA.gov email as well as Chat/instant messaging, text messaging, voicemail messaging, and other messaging platforms or applications such as social media or mobile device applications.

o. Records or information obtained on loan (without transference of ownership) from other Government agencies will be maintained in accordance with VA records management policies and VA information security policies. VA will comply with the rules, regulations, and restrictions of other agencies regarding VA’s use of their respective records.

p. Original military personnel/health records on loan to VA (without transference of ownership) will be maintained and safeguarded in such a manner that they can be returned when requested. No original military personnel/health records will be destroyed or removed for any reason from the custody of VA without obtaining permission from the military service to which the records belong.

q. Copies of VA's vital/essential records will be identified, protected, and secured in locations geographically separated from the original records in accordance with the policies and procedures set forth in VA Directive 6500, Managing Information Security Risk: VA Information Security Program, Handbook 6500, Information Security Program, Risk Management Framework for VA Information Systems-Tier 3. VA Information Security Program, and VA Handbook 6300.2/1 Management of the Vital records Program. VA will utilize a NARA-approved commercial facility or maintain an internal NARA-approved storage capability for storage of vital records to protect the legal and financial rights of the Government, VA and its employees, veterans and their dependents, and other organizations or entities who have business with VA, in a manner that permits them to be available in the event of an emergency. VA’s legal and financial rights vital/essential records shall be stored at a NARA approved commercial facility or maintain an internal NARA approved storage facility. Plans for automated information systems should include provisions for reasonable continuity of support should their normal operations be disrupted.

r. The laws, regulations, and policies that apply to records and information maintained and used by VA also apply to VA records and information maintained and used on VA’s behalf by VA contractors. All records created by VA contractors shall remain the property of the VA unless otherwise expressly agreed and cannot be used except as explicitly authorized in writing by the VA.

s. VA will maintain a DIB to ensure that computer-matching agreements comply with the requirements of the Computer Matching and Privacy Protection Act of 1988 and the Office of Management and Budget (OMB). The board will be comprised of select VA leadership representatives as defined in this directive.

3. RESPONSIBILITIES

a. Secretary of Veterans Affairs. The Secretary or Deputy Secretary will:

(1) Ensure that an effective VA RM program is established and maintained.

(2) Notify the Archivist of the United States of any actual, impending, or threatened unlawful removal, defacing, alteration, corruption, deletion, erasure, or other destruction of records in the custody of the Department or program office pursuant to 44 U.S.C.

§ 3106. With the assistance of the Archivist, initiate action through the United States Attorney General for the recovery of records.

b. The VA Chief Information Officer will:

(1) Establish policies and procedures for administering the RM program and serves as the Senior Agency Official (SAO) for the National Archives and Records Administration records management program.

(2) Issue revisions to this directive that are necessary to improve and manage the RM program.

(3) Establish, coordinate, and maintain a VA-wide RM program to ensure that all records, including electronic and microform media, and information are received, created, maintained, and protected, according to NARA regulations and VA policy.

(4) Serves as the VA Senior Agency Official for Records Management (SAORM) pursuant to OMB M-12-18, and NARA Bulletin 2017-02, “Guidance on Senior Agency Officials for Records Management”, ensuring compliance with federal law and regulation.

(5) Designate an individual(s) to serve as VA Records Officer.

(6) Under the RONA program, receive and process all requests for lists of names and addresses of veterans and their dependents, except for lists of educationally disadvantaged veterans. Monitor the use of such lists of names and addresses, and refer allegations of possible unauthorized use of such VA-supplied lists to the Assistant Inspector General for Investigations.

(7) Advise and assist Under Secretaries, Assistant Secretaries, and other key officials on matters relating to the RM program.

(8) Training and Certification: Provides records management training, as required, to educate VA personnel of their records management responsibilities, in accordance with NARA Bulletin 2017- 01, “Agency Records Management Training Requirements and pursuant OMB M-12-18. Maintains this VA-wide training to ensure its relevancy and timeliness, and provides the training to VA Administrations and program offices for execution

(9) Ensure that all information management policies, procedures, or guidelines that relate to the creation or collection of records and information, adequacy of documentation, and maintenance, use, and preservation or destruction of records, are coordinated with affected Under Secretaries, Assistant Secretaries, and other key officials.

(10) Ensure that all records and information management policies, procedures, or guidelines that relate to national security or to emergency management functions are coordinated with the Assistant Secretary for Operations, Security, and Preparedness and those vital/essential records activities are coordinated with organizational Records Officers.

(11) Serve as Chairperson of the VA DIB, which is responsible for overseeing and approving all VA computer matching activities.

(12) Establish and maintain a list of VA employees who are designated as Records

Officers/Records Liaison Officers, and ensure that the listing is kept current and p to date. Identifies VA components that are required to have their designated records officer hold the NARA certificate of Federal Records Management training pursuant to

OMB M-12-18.

(13) Ensure that VA implements a program for managing audiovisual records in accordance with Federal regulations (36 CFR Part 1237).

(14) Ensure that VA implements a program for managing electronic records in accordance with Federal regulations (36 CFR Part 1236).

(15) Implement policies to ensure that departing VA employees do not remove

Federal records from VA custody (36 CFR Part 1230).

(16) Inform and notify officials and employees that there are criminal penalties for the unlawful removal or destruction of Federal records (18 U.S.C.§§ 641 and 2071 and 36 CFR. § 1230.12) and the unlawful disclosure of national security information (18 U.S.C. §§ 793, 794, and 798).

(17) Provide guidance on the handling of records containing other information exempt from disclosure under FOIA (5 U.S.C. § 552) and PA (5 U.S.C. § 522a) or other information restricted by law.

(18) Coordinates and collaborates with VA entities on VA-wide assessments of the

RM program to ensure that policies and procedures are effectively carried out in accordance with (44 U.S.C. § 3506, & 36 CFR § 1220.34).

c. Assistant Secretary for Management (AS/M) (re-delegated to the Deputy

Assistant Secretary for Finance) will: establish, publish, and maintain a Records Control Schedule (RCS) covering all VA budget and financial management records, consistent with the Government Accountability Office requirements.

d. Principal Executive Director, Office of Acquisition Logistics and Construction.

(1) The Principal Executive Director, Office of Acquisition, Logistics and Construction (re-delegated to the Deputy Assistant Secretary for Acquisition and Logistics will:

(a) Integrate records management obligations into the existing VA procurement processes.

NARA has developed language to be included as an agency-specific term and condition in

Federal contracts for a variety of services and products. The majority of contracts should include language on records management obligations, but each contract should be evaluated individually. Such notification and clauses will conform to those prescribed by the Federal Acquisition Regulation (FAR) and VA Acquisition Regulation (VAAR). In addition, contract language will be included to help ensure that any VA contractor who is provided VA records or information, protected by a VA confidentiality laws, complies with those laws and implementing VA regulations. (See 38 U.S.C §§ 5701, 5705, 5721-5728 and 7332; 38 CFR. §§ 1.460-1.496, 1.500-1.527; and 17.500-17.511.)

(b) Develop VA-wide procedures to ensure that contracts dealing with the destruction of temporary records or information by sale or salvage conform to NARA regulations (36 CFR. § 1226.24).

(c) Develop VA-wide procedures to ensure that records and information created or received and maintained for VA by contractors are maintained in accordance with NARA regulations (36 CFR. §§ 1222.32 and 1234.10).

e. Under Secretaries, Assistant Secretaries, and Other Key Officials. These individuals will:

(1) Establish procedures, as required, to implement the provisions of this directive, VA regulations, and related directives at an organizational level of sufficient authority to ensure this Directive, Title 44 of U.S. Code, and 36 CFR. Chapter XII, Subchapter B are efficiently and effectively implemented. Designate a Records Officer and alternate(s).

Report the names, mail routing symbols, and telephone numbers of the designated officials to the Director, Records Management Service. Notify that office of all additions, changes, and deletions in a timely manner. As directed by the VA CIO, ensure the designated records officer holds the NARA Certificate of Federal Records Management Training within 1 year of designation pursuant to OMB M-12-18.

(2) Initiate investigations of any allegation of noncompliance with the FRA, FOIA, PA, HIPAA, or a VA confidentiality statute. Certain substantiated allegations, i.e., willful and intentional violations, must be reported to the Inspector General pursuant to 38 CFR §§ 1.200 – 1.203. The OGC or appropriate District Counsel will be contacted for such violations.

(3) Maintain an essential records program to include identification, maintenance, and storage of legal and financial vital/essential records at the NARA Federal Center of internal NARA-approved facility. The program will include retention schedules of vital/essential records that may be needed during and following a national emergency or local natural or technological disaster to ensure continuance of essential VA activities.

(4) Inventory and appraise all records, including electronic records and microform media, which the organization authorizes or requires to be created, collected, or maintained.

(5) Ensure that all employees complete annual records training and are aware of the provisions of this directive and its related handbooks, VA regulations, and laws governing the receipt, maintenance, disposition, and release of records and information.

Particular effort will be made to ensure that all employees are familiar with the criminal and civil penalties for willfully violating the PA, or any other applicable Federal confidentiality statutes, or willfully destroying records and information that are not authorized for destruction.

(6) Seek advice and assistance, as needed, from the Senior Agency Official for VA, Privacy (SAOP) and/or Agency Records Official concerning problems or questions of an administrative nature that arise during implementation or operation of the program established by this directive.

(7) Seek legal advice and assistance from OGC and the appropriate District Counsel as needed to ensure legal compliance with the provisions of the laws affecting the creation, receipt, maintenance, and release of information.

(8) Ensure that officials are designated in each VA field facility to serve as the facility records manager; facility alternate records manager and appropriate records liaisons.

These individuals are responsible for assisting the facility Director in ensuring that their facility is in compliance with the provisions of this directive.

(9) Establish procedures, as required, to implement a program of loan and exchange of records or information with other Government agencies and the NPRC.

(10) Establish, publish, and maintain a Records Control Schedule (RCS) covering all records, except budget and finance records, to include field facilities that are not covered by another RCS.

(11) Ensure that the life cycle of the records and information is considered in planning for manual or automated information systems associated records are properly scheduled, and are disposed of properly.

(12) Ensure that the standards and procedures contained in the NARA Guide entitled Managing Micrographic Records are used to manage records in microform media.

(13) Ensure that the standards and procedures contained in the NARA Guide entitled “NARA Guidelines for Digitizing Archival Materials for Electronic Access” and “The Selection and Preparation of records for Publication on Microfilm” are used to manage microform media. Managing Electronic Records are used to manage all electronic records created.

(14) Ensure that all unscheduled records are retained until an approved disposition instruction is received from NARA.

(15) Implement a compliance-monitoring program that provides ongoing independent monitoring of the RM, Privacy and FOIA programs’ compliance and reports Administration-level performance of the VA CIO or designee for compliance monitoring.

f. Additional Responsibilities of Selected Officials. In addition to the responsibilities in paragraph 3b, the Under Secretary for Health, the Under Secretary for Benefits, the Under Secretary for Memorial Affairs; the Assistant Secretary for Operations, Security, and Preparedness; the Assistant Secretary for Human resources and Administration; the Chairman for Board of Veterans’ Appeals, the Inspector General, and the General Counsel Board of Veterans’ Appeals, the Inspector General, and the General Counsel have the following specific to their respective areas.

(1) Assistant Secretary for Human Resources and Administration (AS/HR&A).

The AS/HR&A (re-delegated to the Deputy Assistant Secretary for Administration) will:

(a) Designate an official(s) and an alternate(s) to serve as VACO Central Office (VACO) Records Officer with responsibility to assist Records Officers of other organizations in identifying, appraising, and maintaining their Central Office records.

(b) Develop procedures and guidelines necessary to implement policies established by this directive and its related handbooks for staff offices located VACO, provide records disposition service at a staff office level, land establish files management standards and procedures for records maintained by said elements, and provide records management training for VACO Records Officers.

(c) Establish, publish, and maintain an RCS covering all records except budget and financial records. RCS must include electronic mail and microform media, located in VACO, unless the records are covered in another records schedule due to program responsibilities.

(d) The AS/HR&A (re-delegated to the Deputy Assistant Secretary for Human Resources Management) will develop procedures to ensure the transfer of Federal civilian personnel, health, and payroll records to the NPRC for Civilian Personnel Records (36 C.F.R. §§ 1233.14 and 1233.16).

(2) The Assistant Secretary for Operations, Security and Preparedness

(AS/OSP). The AS/OSP (re-delegated to the Deputy Assistant Secretary for Security and Law Enforcement will:

(a) Be familiar with Federal and VA requirements relating to the management of vital/essential records and information.

(b) Ensure that the official designated to serve as the VA liaison with other Federal agencies for coordination of VA's emergency preparedness activities, including the information needs related to those activities, are familiar with Federal and VA requirements relating to the management of vital records and information.

(c) Ensure that Under Secretaries, Assistant Secretaries key officials, and the Deputy Assistant Secretaries develop procedures for the selection, maintenance and disposition of those records series or electronic information systems (or portions of them) most critical to emergency operations or the preservation of legal or financial rights should also be designated.

(d) Responsible for overseeing the VA Continuity of Operations (COOP) relevant vital records and coordinating with the VA CIO or designee.

(3) Under Secretary for Health. The Under Secretary for Health will:

(a) Serve as a member of the VA DIB.

(b) Follow established policies and procedures to obtain approvals from Department of Defense military service branches to access military records located at the military branch headquarters or at the NPRC when research studies are approved necessitating access to military service records

(c) Designate an individual to serve as VA liaison with the NPRC to assist this office in replying to VA requests for records or information contained in military personnel/health records or civilian personnel records and to resolve problems; to observe, analyze, and appraise procedures and practices followed by VA field activities in requesting records; to make recommendations for changes in policy or procedures relating to VA requests; and to perform surveys or studies that may be needed to ensure that VA requests for records are answered in a timely and efficient manner.

(4) Under Secretary for Benefits. The Under Secretary for Benefits will:

(a) Serve as a member of the VA DIB.

(b) Follow established procedures for requesting from other agencies records and information relating to the military service of Veterans, for maintaining such records in VA files, and for returning the records to the originator when requested.

(c) Designate an individual to serve as VA liaison with the NPRC to assist this office in replying to VA requests for records or information contained in military personnel/health records or civilian personnel records and to resolve problems; to observe, analyze, and appraise procedures and practices followed by VA field activities in requesting records; to make recommendations for changes in policy or procedures relating to VA requests; and to perform surveys or studies that may be needed to ensure that VA requests for records are answered in a timely and efficient manner.

(d) Establish procedures for requesting classified documents from the Department of

Defense when such documents are required to process a veteran’s claim.

(5) Under Secretary, for Memorial Affairs: The Under Secretary for Memorial Affairs will:

(a) Establish and maintain a burial eligibility activity to assist NCA field and Central

Office staff in verifying military service data to confirm eligibility. The information will be obtained through VA, NPRC, or other record sources when sufficient data is not otherwise available.

(b) Establish procedures and guidelines for requesting military records or information from VA regional offices, NPRC, or other record sources when such information is needed to establish eligibility for burial in National and State cemeteries or for approving applications for headstones and markers.

(6) Chairman, Board of Veterans' Appeals (BVA): The Chairman, BVA will make decisions of the Board available to members of the public in a form that will permit public access through electronic text searches but which will avoid disclosure of the name, address or other information that would identify the claimant or which would cause an unwarranted invasion of personal privacy.

(7) Inspector General (IG). The IG will serve as a member of the VA DIB.

(8) General Counsel (GC). The GC will:

(a) Provide legal advice and assistance to ensure that VA complies with the provisions of PA, FOIA, the Computer Matching and Privacy Protection Act, and applicable confidentiality statutes.

(b) Review and clear all requests for records disposition rulings (SF-115) from

NARA.

(c) Opine on initial decisions to approve or deny requests for the release of lists of claimant names and addresses under the provisions of PA or VA’s confidentiality statutes, and provide a written decision on any appeal from a denial.

(d) Ensure that recommend changes in policies and procedures relating to the RM program, including the maintenance and release of records, are legally sufficient and incorporate all legal requirements.

4. REFERENCES

a. 5 U.S.C. § 552, Freedom of Information Act.

b. 5 U.S.C. § 552a, Privacy Act of 1974.

c. 18 U.S.C. § 641, Public money, property or records.

d. 18 U.S.C. § 2071, Unlawful access to stored communications.

e. 38 U.S.C. § 5701, VA Claims Confidentiality Statute.

f. 3 U.S.C. § 5705, Confidentiality of Medical Quality Assurance Review Records.

g. 38 U.S.C. § 7332, Confidentiality of Drug Abuse, Alcoholism and Alcohol Abuse, Human Immunodeficiency Virus (HIV) Infection, and Sickle Cell Anemia Health Records.

h. 41 U.S.C. Public Contracts.

i. 44 U.S.C. Chapters 21, 29, 31, 33 and 35, Federal Records Act of 1950, as amended and codified.

j. 44 U.S.C. Chapter 35, Paperwork Reduction Act of 1995.

k. 44 U.S.C. §§ 3551-58, Federal Information Security Modernization Act (FISMA) of 2014.

l. Health Insurance Portability and Accountability Act (HIPAA), Pub. L. 104-191, 110 Stat. 1936 (1996) as amended by Health Information Technology for Economic and Clinical Health (HITECH) Act, Pub. L. 111-5, 123 Stat. 226, 260 (2009), codified at 42 U.S.C. § 17932.

5. Regulations

a. 36 C.F.R. Parts 1220, 1222, 1228, 1230, 1232, 1234, and 1236, National Archives and Records Administration Regulations.

b. 38 C.F.R. §§ 1.575 through 584, Safeguarding Personal Information in VA Records.

c. 38 C.F.R. §§ 1.460-1.499, Release of Information from VA Records Relating to Drug Abuse, Alcoholism or Alcohol Abuse, Infection with HIV or Sickle Cell Anemia.

d. 38 C.F.R. §§ 1.500 through 1.527, Release of Information from VA Claimant Records.

e. 38 C.F.R. §§ 1.550 through 1.559, Release of Information from VA Records Other Than Claimant Records.

f. 38 C.F.R. §§ 17.500 through 17.511, Confidentiality of Healthcare Quality Assurance Review Records.

g. 41 C.F.R. Part 102-193, Creation, Maintenance, and Use of Records.

h. 48 C.F.R. §§ 24.104, 52.224-1, and 52.224-2, Federal Acquisition Regulation.

6. Executive Orders

a. Executive Order 12656, Responsibilities of Federal Departments and Agencies for National Security Emergency Preparedness, November 18, 1988.

b. Executive Order 13589 Of November 9, 2011. Promoting Efficient Spending, 76 Fed. Reg. 70863, November 15, 2011.

c. Presidential Memorandum of November 28, 2011- Managing Government Records; 76 Fed. Reg. 75423, December 1, 2011.

7. Office of Management and Budget Publications

a. OMB Final Guidance Interpreting the Provisions of Public Law 100-503, Computer Matching and Privacy Protection Act of 1988, 54 Fed. Reg. 25818, June 19, 1989.

b. Office of Management and Budget (OMB) Circular No. A-130, Managing Information as a Strategic Resource.

c. OMB Circular No. A–108, ‘‘Federal Agency Responsibilities for Review, Reporting, and Publication Under the Privacy Act’’.

d. OMB Privacy Act Implementation, Guidelines and Responsibilities; 40 Fed Regulation 28948, July 9, 1975.

e. Managing Government Records Directive (M-12-18).

8. NARA Bulletins

a. NARA Bulletin 2017- 01, “Agency Records Management Training Requirements.

b. NARA Bulletin 2017-02,” Guidance on Senior Agency Officials for Records Management.”

c. NARA Bulletin 2013-02, “Guidance on a New Approach to Managing Email Records.

d. NARA Bulletin 2012-02, Guidance on Managing Content on Shared Drives.

e. NARA Bulletin 2008-07, “Endorsement of DoD Electronic Records Management Software Applications Design Criteria Standard, Version 3”.

5. DEFINITIONS: None.