|
System of Records (SOR)
79VA19 - Veterans Health Information Systems and Technology Architecture (VistA) Records-VA
System location:
Records are maintained at each VA health care facility (in most
cases, back-up computer tape information is stored at off-site
locations). Address locations for VA facilities are listed in VA
Appendix 1. In addition, information from these records or copies of
records may be maintained at the Department of Veterans Affairs, 810
Vermont Avenue, NW., Washington, DC, VA Data Processing Centers, VA
Chief Information Officer (CIO) Field Offices, Veterans Integrated
Service Network (VISN) Offices, and Employee Education Systems.
Categories of individuals covered by the system:
The records include information concerning current and former
employees, applicants for employment, trainees, contractors, sub-
contractors, contract personnel, students, providers and consultants,
patients and members of their immediate family, volunteers,
maintenance personnel, as well as individuals working collaboratively
with the VA.
Categories of records in the system:
The records may include information related to:
- Workload such as orders entered, verified, and edited (e.g.,
engineering work orders, doctors' orders for patient care including
nursing care, the scheduling and delivery of medications,
consultations, radiology, laboratory and other diagnostic and
therapeutic examinations); results entered; items checked out and
items in use (e.g., library books, keys, x-rays, patient medical
records, equipment, supplies, reference materials); work plans
entered and the subsequent tracking (e.g., construction projects,
engineering work orders and equipment maintenance and repairs
assigned to employees and status, duty schedules, work assignments,
work requirements); reports of contact with individuals or groups;
employees (including volunteers) work performance information (e.g.,
duties and responsibilities assigned and completed, amount of
supplies used, time used, quantity and quality of output,
productivity reports, schedules of patients assigned and treatment to
be provided);
- Administrative procedures, duties, and assignments of certain
personnel;
- Computer access authorizations, computer applications
available and used, information access attempts, frequency and time
of use; identification of the person responsible for, currently
assigned, or otherwise engaged in various categories of patient care
or support of health care delivery; vehicle registration (motor
vehicles and bicycles) and parking space assignments; community and
special project participants/attendees (e.g., sports events,
concerts, National Wheelchair Games); employee work-related
accidents. The record may include identifying information (e.g.,
name, date of birth, age, sex, social security number, taxpayer
identification number); address information (e.g., home and/or
mailing address, home telephone number, emergency contact information
such as name, address, telephone number, and relationship);
information related to training (e.g., security, safety, in-service),
education and continuing education (e.g., name and address of schools
and dates of attendance, courses attended and scheduled to attend,
grades, type of degree, certificate, etc.); information related to
military service and status; qualifications for employment (e.g.,
license, degree, registration or certification, experience); vehicle
information (e.g., type make, model, license, and registration
number); evaluation of clinical and/or technical skills; services or
products purchased (e.g., vendor name and address, details about and/
or evaluation of service or product, price, fee, cost, dates
purchased and delivered, employee workload, and productivity data);
employee work-related injuries (cause, severity, type of injury, body
part affected);
- Financial information, such as service line and clinic
budgets, projected and actual costs;
- Supply information, such as services, materials and equipment
ordered;
- Abstract information (e.g., data warehouses, environmental and
epidemiological registries, etc.) is maintained in auxiliary paper
and automated records;
- Electronic messages; and
- The social security number and universal personal
identification number of health care providers.
Authority for maintenance of the system:
Title 38, United States Code, section 7301(a).
Purpose(s):
The records and information may be used for statistical analysis
to produce various management, workload tracking and follow-up
reports; to track and evaluate the ordering and delivery of
equipment, services and patient care; the planning, distribution and
utilization of resources; the possession and/or use of equipment or
supplies; the performance of vendors, equipment, and employees; and
to provide clinical and administrative support to patient medical
care. The data may be used for research purposes. The data may be
used also for such purposes as assisting in the scheduling of tours
of duties and job assignments of employees; the scheduling of patient
treatment services, including nursing care, clinic appointments,
surgery, diagnostic and therapeutic procedures; the repair and
maintenance of equipment and for follow-up to determine that the
actions were accomplished and to evaluate the results; the
registration of vehicles and the assignment and utilization of
parking spaces; to plan, schedule, and maintain rosters of patients,
employees and others attending or participating in sports,
recreational or other events (e.g., National Wheelchair Games,
concerts, picnics); for audits, reviews, and investigations conducted
by staff of the health care facility, the Network Directors Office,
VA Central Office, and the VA Office of Inspector General (OIG); for
quality assurance audits, reviews, investigations and inspections;
for law enforcement investigations; and for personnel management,
evaluation and employee ratings, and performance evaluations.
Routine uses of records maintained in the system, including
categories of users and the purposes of such uses:
To the extent that records contained in the system include
information protected by 45 CFR parts 160 and 164, i.e.,
individually-identifiable health information, and 38 U.S.C. 7332,
i.e., medical treatment information related to drug abuse, alcoholism
or alcohol abuse, sickle cell anemia or infection with the human
immunodeficiency virus, that information cannot be disclosed under a
routine use unless there is also specific statutory authority in 38
U.S.C. 7332 and regulatory authority in 45 CFR parts 160 and 164
permitting disclosure.
- VA may disclose on its own initiative any information in this
system, except the names and home addresses of veterans and their
dependents, which is relevant to a suspected or reasonably imminent
violation of law, whether civil, criminal or regulatory in nature and
whether arising by general or program statute or by regulation, rule
or order issued pursuant thereto, to a Federal, state, local, tribal,
or foreign agency charged with the responsibility of investigating or
prosecuting such violation, or charged with enforcing or implementing
the statute, regulation, rule or order. On its own initiative, VA may
also disclose the names and addresses of veterans and their
dependents to a Federal agency charged with the responsibility of
investigating or prosecuting civil, criminal or regulatory violations
of law, or charged with enforcing or implementing the statute,
regulation, rule or order issued pursuant thereto.
- Disclosure may be made to an agency in the executive,
legislative, or judicial branch, or the District of Columbia
government in response to its request, in connection with the hiring
of an employee, the issuance of a security clearance, the conducting
of a security or suitability investigation of an individual, the
letting of a contract, the issuance of a license, grant, or other
benefits by the requesting agency, or the lawful statutory,
administrative, or investigative purpose of the agency to the extent
that the information is relevant and necessary to the requesting
agency's decision.
- Disclosure may be made to a Congressional office from the
record of an individual in response to an inquiry from the
Congressional office made at the request of that individual.
- Disclosure may be made to the National Archives and Records
Administration (NARA) in records management inspections conducted
under authority of 44 U.S.C.
- Disclosure may be made to the Department of Justice and United
States attorneys in defense or prosecution of litigation involving
the United States, and to Federal agencies upon their request in
connection with review of administrative tort claims filed under the
Federal Tort Claims Act, 28 U.S.C.
- Hiring, performance, or other personnel-related information
may be disclosed to any facility with which there is or there is
proposed to be an affiliation, sharing agreement, contract, or
similar arrangement for purposes of establishing, maintaining, or
expanding any such relationship.
- Disclosure may be made to inform a Federal agency, licensing
boards or the appropriate non-government entities about the health
care practices of a terminated, resigned or retired health care
employee whose professional health care activity so significantly
failed to conform to generally accepted standards of professional
medical practice as to raise reasonable concern for the health and
safety of patients receiving medical care in the private sector or
from another Federal agency. These records may also be disclosed as
part of an ongoing computer matching program to accomplish these
purposes.
- For program review purposes, and the seeking of accreditation
and/or certification, disclosure may be made to survey teams of the
Joint Commission on Accreditation of Healthcare Organizations
(JCAHO), College of American Pathologists, American Association of
Blood Banks, and similar national accreditation agencies or boards
with whom VA has a contract or agreement to conduct such reviews but
only to the extent that the information is necessary and relevant to
the review.
- Disclosure may be made to a state or local government entity
or national certifying body which has the authority to make decisions
concerning the issuance, retention or revocation of licenses,
certifications or registrations required to practice a health care
profession, when requested in writing by an investigator or
supervisory official of the licensing entity or national certifying
body for the purpose of making a decision concerning the issuance,
retention or revocation of the license, certification or registration
of a named health care professional.
- Disclosure may be made to officials of labor organizations
recognized under 5 U.S.C. chapter 71 when relevant and necessary to
their duties of exclusive representation concerning personnel
policies, practices, and matters affecting working conditions.
- Disclosure may be made to the representative of an employee,
including all notices, determinations, decisions, or other written
communications issued to the employee in connection with an
examination ordered by VA under medical evaluation (formerly fitness-
for-duty) examination procedures or Department-filed disability
retirement procedures.
- Disclosure may be made to officials of the Merit Systems
Protection Board, and the Office of the Special Counsel, when
requested in connection with appeals, special studies of the civil
service and other merit systems, review of rules and regulations,
investigation of alleged or possible prohibited personnel practices,
and such other functions, promulgated in 5 U.S.C. 1205 and 1206, or
as may be authorized by law.
- Disclosure may be made to the Equal Employment Opportunity
Commission when requested in connection with investigations of
alleged or possible discrimination practices, examination of Federal
affirmative employment programs, compliance with the Uniform
Guidelines of Employee Selection Procedures, or other functions
vested in the Commission by the President's Reorganization Plan No. 1
of 1978.
- Disclosure may be made to the Federal Labor Relations
Authority, including its General Counsel, when requested in
connection with investigation and resolution of allegations of unfair
labor practices, in connection with the resolution of exceptions to
arbitrator awards when a question of material fact is raised and
matters before the Federal Service Impasses Panel.
- Disclosure may be made in consideration and selection of
employees for incentive awards and other honors and to publicize
those granted. This may include disclosure to other public and
private organizations, including news media, which grant or publicize
employee awards or honors.
- Disclosure may be made to consider employees for recognition
through administrative and quality step increases and to publicize
those granted. This may include disclosure to other public and
private organizations, including news media, which grant or publicize
employee recognition.
- Identifying information such as name, address, social
security number and other information as is reasonably necessary to
identify such individual, may be disclosed to the National
Practitioner Data Bank at the time of hiring and/or clinical
privileging/re-privileging of health care practitioners and at other
times as deemed necessary by VA in order for VA to obtain information
relevant to a Department decision concerning the hiring, privileging/
re-privileging, retention or termination of the applicant or
employee.
- Relevant information may be disclosed to the National
Practitioner Data Bank and/or State Licensing Board in the state(s)
in which a practitioner is licensed, in which the VA facility is
located, and/or in which an act or omission occurred upon which a
medical malpractice claim was based when VA reports information
concerning: (1) Any payment for the benefit of a physician, dentist,
or other licensed health care practitioner which was made as the
result of a settlement or judgment of a claim of medical malpractice
if an appropriate determination is made in accordance with agency
policy that payment was related to substandard care, professional
incompetence or professional misconduct on the part of the
individual; (2) a final decision which relates to possible
incompetence or improper professional conduct that adversely affects
the clinical privileges of a physician or dentist for a period longer
than 30 days; or, (3) the acceptance of the surrender of clinical
privileges or any restriction of such privileges by a physician or
dentist either while under investigation by the health care entity
relating to possible incompetence or improper professional conduct,
or in return for not conducting such an investigation or proceeding.
These records may also be disclosed as part of a computer matching
program to accomplish these purposes.
- Disclosure of medical record data, excluding name and
address, unless name and address is furnished by the requester, may
be made to epidemiological and other research facilities for research
purposes determined to be necessary and proper, and approved by the
Under Secretary for Health.
- Disclosure of name(s) and address(es) of present or former
personnel of the Armed Services, and/or their dependents, may be made
to: (a) a Federal department or agency, at the written request of the
head or designee of that agency; or (b) directly to a contractor or
subcontractor of a Federal department or agency, for the purpose of
conducting Federal research necessary to accomplish a statutory
purpose of an agency. When disclosure of this information is made
directly to a contractor, VA may impose applicable conditions on the
department, agency, and/or contractor to ensure the appropriateness
of the disclosure to the contractor.
- The social security number, universal personal identification
number and other identifying information of a health care provider
may be disclosed to a third party where the third party requires the
agency to provide that information before it will pay for medical
care provided by VA.
- Relevant information may be disclosed to individuals,
organizations, private or public agencies, etc., with whom VA has a
contract or agreement to perform such services as VA may deem
practical for the purposes of laws administered by VA, in order for
the contractor and/or subcontractor to perform the services of the
contract or agreement.
- Disclosure of relevant health care information may be made to
individuals or organizations (private or public) with whom VA has a
contract or sharing agreement for the provision of health care,
administrative or financial services.
Policies and practices for storing, retrieving, accessing,
retaining, and disposing of records in the system:
Storage:
Records are maintained on paper, microfilm, magnetic tape, disk,
or laser optical media. In most cases, copies of back-up computer
files are maintained at off-site locations.
Retrievability:
Records are retrieved by name, social security number or other
assigned identifiers of the individuals on whom they are maintained.
Safeguards:
- Access to VA working and storage areas is restricted to VA
employees on a ``need-to-know'' basis. Strict control measures are
enforced to ensure that disclosure to these individuals is also based
on this same principle. Generally, VA file areas are locked after
normal duty hours and the facilities are protected from outside
access by the Federal Protective Service or other security personnel.
- Access to computer rooms at health care facilities is
generally limited by appropriate locking devices and restricted to
authorized VA employees and vendor personnel. Automated Data
Processing (ADP) peripheral devices are placed in secure areas (areas
that are locked or have limited access) or are otherwise protected.
Information in VistA may be accessed by authorized VA employees.
Access to file information is controlled at two levels. The systems
recognize authorized employees by series of individually unique
passwords/codes as a part of each data message, and the employees are
limited to only that information in the file which is needed in the
performance of their official duties. Information that is downloaded
from VistA and maintained on personal computers is afforded similar
storage and access protections as the data that is maintained in the
original files. Access to information stored on automated storage
media at other VA locations is controlled by individually unique
passwords/codes. Access by remote data users such as Veteran Outreach
Centers, Veteran Service Officers (VSO) with power of attorney to
assist with claim processing, Veteran Benefits Administration (VBA)
Regional Office staff for benefit determination and processing
purposes, OIG staff conducting official audits, investigations or
inspections at the health care facility, or an OIG office location
remote from the health care facility and other authorized individuals
is controlled in the same manner.
- Information downloaded from VistA and maintained by the OIG
headquarters and Field Offices on automated storage media is secured
in storage areas for facilities to which only OIG staff have access.
Paper documents are similarly secured. Access to paper documents and
information on automated storage media is limited to OIG employees
who have a need for the information in the performance of their
official duties. Access to information stored on automated storage
media is controlled by individually unique passwords/codes.
Retention and disposal:
Paper records and information stored on electronic storage media
are maintained and disposed of in accordance with records disposition
authority approved by the Archivist of the United States.
System manager(s) and address:
The official responsible for policies and procedures is the
Director, Health Systems Design and Development (192), Department of
Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420. The
local official responsible for maintaining the system is the Director
of the facility where the individual is or was associated.
Notification procedure:
Individuals who wish to determine whether this system of records
contains information about them should contact the VA facility
location at which they are or were employed or made or have contact.
Inquiries should include the person's full name, social security
number, dates of employment, date(s) of contact, and return address.
RECORD ACCESS PROCEDURE:
Individuals seeking information regarding access to and
contesting of records in this system may write, call or visit the VA
facility location where they are or were employed or made contact.
Contesting record procedures:
(See Record Access Procedures, above.)
Record source categories:
Information in this system of records is provided by the
individual, supervisors, other employees, personnel records, or
obtained from their interaction with the system.
Back to Index
[back to top]
|
