[Federal Register Volume 85, Number 26 (Friday, February 7, 2020)]
[Notices]
[Pages 7395-7400]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-02477]
-----------------------------------------------------------------------
DEPARTMENT OF VETERANS AFFAIRS
Privacy Act of 1974; System of Records
AGENCY: Veterans Health Administration (VHA).
ACTION: Notice of a modified system of records.
-----------------------------------------------------------------------
SUMMARY: As required by the Privacy Act of 1974, notice is hereby given
that the Department of Veterans Affairs (VA) is amending the system of
records entitled, ``Health Care Provider Credentialing and Privileging
Records--VA'' (77VA10A4) as set forth in the Federal Register 80 FR
36595. VA is amending the system of records by revising the System
Number; Routine Uses of Records Maintained in the System and Policies;
and Practices for Retention and Disposal of Records. VA is republishing
the system notice in its entirety.
DATES: Comments on the amendment of this system of records must be
received no later than March 9, 2020. If no public comment is received
during the period allowed for comment or unless otherwise published in
the Federal Register by VA, the amended system will become effective
March 9, 2020.
ADDRESSES: Written comments may be submitted through
www.Regulations.gov; by mail or hand-delivery to Director, Regulation
Policy and Management (00REG), Department of Veterans Affairs, 810
Vermont Ave. NW, Room 1064, Washington, DC 20420; or by fax to (202)
273-9026 (not a toll-free number). Comments should indicate that they
are submitted in response to ``Health Care Provider Credentialing and
Privileging Records--VA''. Copies of comments received will be
available for public inspection in the Office of Regulation Policy and
Management, Room 1063B, between the hours of 8:00 a.m. and 4:30 p.m.,
Monday through Friday (except holidays). Please call (202) 461-4902 for
an appointment. (This is not a toll-free number.) In addition, comments
may be viewed online at www.Regulations.gov.
FOR FURTHER INFORMATION CONTACT: Veterans Health Administration (VHA)
Privacy Officer, Department of Veterans Affairs, 810 Vermont Ave. NW,
Washington, DC 20420, (704) 245-2492.
SUPPLEMENTARY INFORMATION: The System Number is being changed from
(77VA10A4 to 77VA10E2E) to reflect the current organizational
alignment.
The Routine Uses of Records Maintained in the System is amending
the language in Routine Use #8 which states that disclosure of the
records to the DoJ is a use of the information contained in the records
that is compatible with the purpose for which VA collected the records.
VA may disclose records in this system of records in legal proceedings
before a court or administrative body after determining that the
disclosure of the records to the court or administrative body is a use
of the information contained in the records that is compatible with the
purpose for which VA collected the records. This routine use will now
state that release of the records to the DoJ is limited to
circumstances where relevant and necessary to the litigation. VA may
disclose records in this system of records in legal proceedings before
a court or administrative body after determining that release of the
records to the court or administrative body is limited to circumstances
where relevant and necessary to the litigation.
Routine Use #22 has been amended by clarifying the language to
state, ``VA may disclose any information or records to appropriate
agencies, entities, and persons when (1) VA suspects or has confirmed
that there has been a breach of the system of records; (2) VA has
determined that as a result of the suspected or confirmed breach there
is a risk to individuals, VA (including its information systems,
programs, and operations), the Federal Government, or national
security; and (3) the disclosure made to such agencies, entities, or
persons is reasonably necessary to assist in connection with VA efforts
to respond to the suspected or confirmed breach or to prevent,
minimize, or remedy such harm.''
Routine Use #25 which states, ``VA may disclose information to the
Department of Defense (DoD) from the joint platform electronic
credentialing system being shared with DoD for credentialing/
privileging purposes.'' VA needs the ability to disclose limited
information concerning the health care provider's professional
qualifications (professional education, training and current licensure/
certification status), professional employment history, and current
clinical privileges.
Routine use #26 is being added to state, ``VA may disclose
information to a former VA employee or contractor, as well as the
authorized representative of a current or former employee or contractor
of VA, in connection with or in consideration of the reporting of:
(a) Any payment for the benefit of the former VA employee or
contractor that was made as the result of a settlement or judgment of a
claim of medical malpractice, if an appropriate determination is made
in accordance with Department policy that payment was related to
substandard care, professional incompetence, or professional misconduct
on the part of the individual;
(b) A final decision which relates to possible incompetence or
improper professional conduct that adversely affects the former
employee's or contractor's clinical privileges for a period longer than
30 days; or
[[Page 7396]]
(c) The former employee's or contractor's surrender of clinical
privileges or any restriction of such privileges while under
investigation by the health care entity relating to possible
incompetence or improper professional conduct to the National
Practitioner Data Bank or the state licensing board in any state in
which the individual is licensed, the VA facility is located, or an act
or omission occurred upon which a medical malpractice claim was
based.'' VA needs the ability to release medical record information to
former employees for purposes of evidence files and Fair Hearing
Process.
Routine use #27 is being added to state, ``VA may disclose
information to a former VA employee or contractor, as well as the
authorized representative of a current or former employee or contractor
of VA, in connection with or in consideration of reporting that the
individual's professional health care activity so significantly failed
to conform to generally accepted standards of professional medical
practice as to raise reasonable concern for the health and safety of
patients, to a Federal agency, a State or local government licensing
board, or the Federation of State Medical Boards or a similar
nongovernmental entity which maintains records concerning individuals'
employment histories or concerning the issuance, retention, or
revocation of licenses, certifications, or registration necessary to
practice an occupation, profession, or specialty.'' VA needs the
ability to release medical record information to former employees for
purposes of evidence files and Fair Hearing Process.
Routine use #28 is being added to state, ``VA may disclose
information from this system of records to another Federal agency or
Federal entity, when VA determines that information from this system of
records is reasonably necessary to assist the recipient agency or
entity in (1) responding to a suspected or confirmed breach or (2)
preventing, minimizing, or remedying the risk of harm to individuals,
the recipient agency or entity (including its information systems,
programs, and operations), the Federal Government, or national
security, resulting from a suspected or confirmed breach.''
The Policies and Practices for Retention and Disposal of Records is
being amended to include the merging of Service Level Files with the
two-part Paper Credentialing and Privileging Records for VA Employees
when a provider departs from VA (i.e., State Licensure Board Evidence
Files, Exit Review Forms, Focused Professional Practice Evaluation
(FPPE) and Ongoing Professional Practice Evaluations (OPPE) data
collection). Exit Review forms, Service Level documentation, etc. must
be maintained for 3 years after the individual separates and the files
must be kept on site for 3 years. After the individual separates from
VA employment or after reporting and retired to the Federal Records
Center, they are maintained for 30 years and then destroyed.
Signing Authority: The Senior Agency Official for Privacy, or
designee, approved this document and authorized the undersigned to sign
and submit the document to the Office of the Federal Register for
publication electronically as an official document of the Department of
Veterans Affairs. James P. Gfrerer, Assistant Secretary for Information
and Technology and Chief Information Officer, Department of Veterans
Affairs, approved this document on September 5, 2019 for publication.
Dated: February 4, 2020.
Amy L. Rose,
Program Analyst VA Privacy Service, Department of Veterans Affairs.
SYSTEM NAME AND NUMBER:
Health Care Provider Credentialing and Privileging Records-VA
(77VA10E2E).
SECURITY CLASSIFICATION:
Unclassified.
SYSTEM LOCATION:
Records are maintained at each Department of Veterans Affairs (VA)
health care facility. Address locations for VA facilities are listed in
VA Appendix 1 biennial publication of VA system of records. In
addition, information from these records or copies of records may be
maintained at the Department of Veterans Affairs, 810 Vermont Avenue
NW, Washington, DC 20420 and/or Veterans Integrated Service Network
(VISN) Offices. Records for those health care providers who are
contractors in a VA health care facility or to VA for the delivery of
health care to veterans and are credentialed by the contractor in
accordance with Veterans Health Administration (VHA) policy, where
credentialing information is received by VHA facilities, it will be
maintained in accordance with this notice and VHA policy. Electronic
copies of records may be maintained by VHA Office of Quality, Safety
and Value (OQSV), a component thereof, or a contractor or subcontractor
of VHA/OQSV. Backup copies of the electronic data warehouse are
maintained at off-site locations.
SYSTEM MANAGER(S):
Official responsible for policies and procedures: Director,
Credentialing and Privileging Program, Office of Quality, Safety and
Value (OQSV), Veterans Health Administration, Department of Veterans
Affairs, 810 Vermont Avenue NW, Washington, DC 20420. The System
Manager is Marianne Chick, Director of Medical Staff Affairs,
[email protected], 919-474-3937. Officials maintaining the system:
(1) The chief of staff at the VA health care facility where the
provider made application, is employed, or otherwise utilized; (2) the
credentialing coordinator of the VA health care facility for
individuals who made application for employment or other utilization,
or providers currently or previously employed or otherwise utilized at;
(3) human resources management offices of the VA health care facility
for individuals who made application for employment or other
utilization, or providers currently or previously employed or otherwise
utilized; (4) VA Central Office or at a VISN location; The electronic
data will be maintained by VHA/OQSV, a component thereof, or a
contractor or subcontractor of VHA/OQSV.
AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
Title 38 U.S.C. 501(a) and section 7304(a)(2).
PURPOSE(S) OF THE SYSTEM:
The information may be used for: Verifying the individual's
credentials and qualifications for employment or utilization,
appointment to the professional staff, and/or clinical privileges;
advising prospective health care entity employers, health care
professional licensing or monitoring bodies, the National Practioner
Data Bank (NPDB), or similar entities or activities of individuals
covered by this system; accreditation of a facility by an entity such
as the Joint Commission; audits, reviews and investigations conducted
by staff of the health care facility, the Veterans Integrated Service
Network (VISN) Directors and Division Offices, VA Central Office, VHA
program offices, and the VA Office of Inspector General; law
enforcement investigations; quality assurance audits, reviews and
investigations; personnel management and evaluations; employee ratings
and performance evaluations; and, employee disciplinary or other
adverse action, including discharge. The records and information may be
used for statistical analysis, to produce various management reports,
evaluate services, collection, distribution and utilization of
resources, and provide clinical and
[[Page 7397]]
administrative support to patient medical care.
CATEGORIES OF INDIVIDUALS COVERED BY THIS SYSTEM:
The records include information concerning health care providers
currently or formerly employed or otherwise utilized by VHA and
individuals who apply to VHA for employment and are considered for
employment or appointment as health care providers. These records will
include information concerning individuals who through a contractual or
other agreement may be, or are, providing health care to VA patients.
This may include, but is not limited to, audiologists, dentists,
dietitians, expanded-function dental auxiliaries, licensed practical or
vocational nurses, nuclear medicine technologists, nurse anesthetists,
nurse practitioners, registered nurses, occupational therapists,
optometrists, clinical pharmacists, licensed physical therapists,
registered kinesiotherapists, physician assistants, physicians,
podiatrists, psychologists, registered respiratory therapists,
certified respiratory therapy technicians, diagnostic and therapeutic
radiology technologists, social workers, and speech pathologists.
CATEGORIES OF RECORDS IN THE SYSTEM:
The records in the system consist of information related to:
(1) The credentialing (the review and verification of an
individual's qualifications for employment or utilization, which
includes licensure, registration or certification, professional
education and training, employment history, experience, appraisals of
past performance, health status, etc.) of applicants who are considered
for employment and/or appointment, for providing health services under
a contract or other agreement, and/or for appointment to the
professional staff at a VHA health care facility.
(2) The privileging (the process of reviewing and granting or
denying a provider's request for clinical privileges to provide medical
or other patient care services, within well-defined limits, which are
based on an individual's professional license, registration or
certification, experience, training, competence, health status,
ability, and clinical judgment) health care providers who are permitted
by law and by the medical facility to provide patient care
independently and individuals whose duties and responsibilities are
determined to be beyond the normal scope of activities for their
profession;
(3) The periodic reappraisal of health care providers' professional
credentials and the reevaluation of the clinical competence of
providers who have been granted clinical privileges; and/or
(4) Records generated as part or result of accessing and reporting
to the NPDB, and the Federation of State Medical Boards (FSMB).
The records may include individually identifiable information
(e.g., name, date of birth, gender, Social Security number, national
provider identification number and associated taxonomy codes, and/or
other personal identification number), address information (e.g., home
mailing address, home telephone number, email address, facsimile
number), biometric data, information related to education and training
(e.g., name of medical or professional school attended and date of
graduation, name of training program, type of training, dates attended,
and date of completion).
The records may also include information related to: The
individual's license, registration or certification by a State
licensing board and/or national certifying body (e.g., license number,
expiration date, name and address of issuing office, status including
any actions taken by the issuing office or any disciplinary board to
include previous or current restrictions, suspensions, limitations, or
revocations); citizenship; honors and awards; type of appointment or
utilization; service/product line; professional society membership;
professional performance, experience, and judgment (e.g., documents
reflecting work experience, appraisals of past and current performance
and potential); educational qualifications (e.g., name and address of
institution, level achieved, transcript, information related to
continuing education); Drug Enforcement Administration and/or State
controlled dangerous substance certification (e.g., current status, any
revocations, suspensions, limitations, restrictions); information about
mental and physical status; evaluation of clinical and/or technical
skills; involvement in any administrative, professional or judicial
proceedings, whether involving VA or not, in which professional
malpractice on the individual's part is or was alleged; any actions,
whether involving VA or not, which result in the limitation, reduction,
revocation, or acceptance of surrender or restriction of the
individual's clinical privileges; and, clinical performance information
that is collected and used to support a determination of an
individual's request for clinical privileges. Some information that is
included in the record may be duplicated in an employee's official
personnel folder.
RECORD SOURCE CATEGORIES:
Information in this system of records is provided by the applicant/
employee, or obtained from State licensing boards, Federation of State
Medical Boards, National Council of State Boards of Nursing, National
Practitioner Data Bank, professional societies, national certifying
bodies, current or previous employers, other health care facilities and
staff, references, educational institutions, medical schools, VA staff,
patient, visitors, and VA patient medical records.
ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES
OF USERS AND THE PURPOSES OF SUCH USES:
1. A record from this system of records may be disclosed to any
source from which additional information is requested (to the extent
necessary and to identify the type of information requested), when
necessary to obtain information relevant to a Department decision
concerning the hiring or retention of an employee, the issuance or
reappraisal of clinical privileges, the issuance of a security
clearance, the conducting of a security or suitability investigation of
an individual, the letting of a contract, the issuance of a license,
grant, or other benefits; or in response to scarce or emergency needs
of the Department or other entities when specific skills are required.
2. A record from this system of records may be disclosed to an
agency in the executive, legislative, or judicial branch, or the
District of Columbia's Government in response to its request, or at the
initiation of VA, information in connection with the hiring of an
employee, appointment to the professional staff, the issuance of a
security clearance, the conducting of a security or suitability
investigation of an individual, the letting of a contract, the issuance
of a license, grant, or other benefit by the agency, or the lawful
statutory or administrative purpose of the agency to the extent that
the information is relevant and necessary to the requesting agency's
decision; or at the initiative of VA, to the extent the information is
relevant and necessary to an investigative purpose of the agency.
3. Disclosure may be made to a Congressional office from the record
or an individual in response to an inquiry from the Congressional
office made at the request of that individual.
4. Disclosure may be made to NARA (National Archives and Records
Administration) in records management
[[Page 7398]]
inspections conducted under authority of title 44 United States Code.
5. Information from this system of records may be disclosed to a
Federal agency or to a State or local government licensing board and/or
to the Federation of State Medical Boards or a similar non-government
entity which maintains records concerning individuals' employment
histories or concerning the issuance, retention or revocation of
licenses, certifications, or registration necessary to practice an
occupation, profession or specialty, in order for the Department to
obtain information relevant to a Department decision concerning the
hiring, utilization, appointment, retention or termination of
individuals covered by this system or to inform a Federal agency or
licensing boards or the appropriate nongovernment entities about the
health care practices of a currently employed, appointed, otherwise
utilized, terminated, resigned, or retired health care employee or
other individuals covered by this system whose professional health care
activity so significantly failed to meet generally accepted standards
of clinical practice as to raise reasonable concern for the safety of
patients. These records may also be disclosed as part of an ongoing
computer-matching program to accomplish these purposes.
6. Information may be disclosed to non-Federal sector (i.e., State,
or local governments) agencies, academic affiliates, organizations,
boards, bureaus, or commissions (e.g., the Joint Commission). Such
disclosures may be made only when: (1) The records are properly
constituted in accordance with VA requirements; (2) the records are
accurate, relevant, timely, and complete; and (3) the disclosure is in
the best interest of the Government (e.g., to obtain accreditation or
other approval rating). When cooperation with the non-Federal sector
entity, through the exchange of individual records, directly benefits
VA's completion of its mission, enhances personnel management
functions, or increases the public confidence in VA's or the Federal
Government's role in the community, then the Government's best
interests are served. Further, only such information that is clearly
relevant and necessary for accomplishing the intended uses of the
information as certified by the receiving entity is to be furnished.
7. Information may be disclosed to a State or national certifying
body which has the authority to make decisions concerning the issuance,
retention or revocation of licenses, certifications or registrations
required to practice a health care profession, when requested in
writing by an investigator or supervisory official of the licensing
entity or national certifying body for the purpose of making a decision
concerning the issuance, retention or revocation of the license,
certification or registration of a named health care professional.
8. VA may disclose information in this system of records to the
Department of Justice (DoJ), either on VA's initiative or in response
to DoJ's request for the information, after either VA or DoJ determines
that such information is relevant to DoJ's representation of the United
States or any of its components in legal proceedings before a court or
adjudicative body, provided that, in each case, the agency also
determines prior to disclosure that release of the records to the DoJ
is limited to circumstances where relevant and necessary to the
litigation. VA may disclose records in this system of records in legal
proceedings before a court or administrative body after determining
that release of the records to the court or administrative body is
limited to circumstances where relevant and necessary to the
litigation.
9. Hiring, appointment, performance, or other personnel
credentialing related information may be disclosed to any facility or
agent with which there is, or there is proposed to be, an affiliation,
sharing agreement, partnership, contract, or similar arrangement, where
required for establishing, maintaining, or expanding any such
relationship.
10. Information concerning a health care provider's professional
qualifications and clinical privileges may be disclosed to a VA
patient, or the representative or guardian of a patient who due to
physical or mental incapacity lacks sufficient understanding and/or
legal capacity to make decisions concerning his/her medical care, who
is receiving or contemplating receiving medical or other patient care
services from the provider when the information is needed by the
patient or the patient's representative or guardian in order to make a
decision related to the initiation of treatment, continuation or
discontinuation of treatment, or receiving a specific treatment that is
proposed or planned by the provider. Disclosure will be limited to
information concerning the health care provider's professional
qualifications (professional education, training and current licensure/
certification status), professional employment history, and current
clinical privileges.
11. VA may disclose any information in this system, except the
names and home addresses of veterans and their dependents, which is
relevant to a suspected or reasonably imminent violation of law,
whether civil, criminal or regulatory in nature and whether arising by
general or program statute or by regulation, rule or order issued
pursuant thereto, to a State, local or foreign agency charged with the
responsibility of investigating or prosecuting such violation, or
charged with enforcing or implementing the statute, regulation, rule or
order. VA may also disclose the names and addresses of veterans and
their dependents to a Federal agency charged with the responsibility of
investigating or prosecuting civil, criminal or regulatory violations
of law, or charged with enforcing or implementing the statute,
regulation, rule or order issued pursuant thereto.
12. To disclose to the Federal Labor Relations Authority (including
its General Counsel) information related to the establishment of
jurisdiction, the investigation and resolution of allegations of unfair
labor practices, or information in connection with the resolution of
exceptions to arbitration awards when a question of material fact is
raised; to disclose information in matters properly before the Federal
Service Impasses Panel, and to investigate representation petitions and
conduct or supervise representation elections.
13. To disclose to the VA-appointed representative of an employee
all notices, determinations, decision, or other written communications
issued to the employee in connection with an examination ordered by VA
under fitness-for-duty examination procedures or Agency-filed
disability retirement procedures.
14. To disclose information to officials of the Merit Systems
Protection Board, when requested in connection with appeals, special
studies of the civil service and other merit systems, review of rules
and regulations, investigation of alleged or possible prohibited
personnel practices, and such other functions, promulgated in 5 U.S.C.
1205 and 1206, or as may be authorized by law.
15. To disclose information to the Equal Employment Opportunity
Commission when requested in connection with investigations of alleged
or possible discriminatory practices, examination of Federal
affirmative employment programs, or the other functions of the
Commission as authorized by law or regulation.
16. To disclose the information listed in 5 U.S.C. 7114(b)(4) to
officials of labor organizations recognized under 5 U.S.C., chapter 71
when relevant and necessary to their duties of exclusive
[[Page 7399]]
representation concerning personnel policies, practices, and matters
affecting working conditions.
17. Identifying information in this system, including name,
address, social security number and other information as is reasonably
necessary to identify such individual, may be disclosed to the NPDB at
the time of hiring, appointment, utilization, and/or clinical
privileging/re-privileging of physicians, dentists and other health
care practitioners, and other times as deemed necessary by VA, in order
for VA to obtain information relevant to a Department decision
concerning the hiring, appointment, utilization, privileging/re-
privileging, retention or termination of the individual.
18. Relevant information from this system of records may be
disclosed to the NPDB and/or State Licensing Board in the State(s) in
which a practitioner is licensed, in which the VA facility is located,
and/or in which an act or omission occurred upon which a medical
malpractice claim was based when VA reports information concerning: (1)
Any payment for the benefit of a physician, dentist, or other licensed
health care practitioner which was made as the result of a settlement
or judgment of a claim of medical malpractice if an appropriate
determination is made in accordance with agency policy that payment was
related to substandard care, professional incompetence or professional
misconduct on the part of the individual; (2) a final decision which
relates to possible incompetence or improper professional conduct that
adversely affects the clinical privileges of a physician or dentist for
a period longer than 30 days; or, (3) the acceptance of the surrender
of clinical privileges or any restriction of such privileges by a
physician or dentist either while under investigation by the health
care entity relating to possible incompetence or improper professional
conduct, or in return for not conducting such an investigation or
proceeding. These records may also be disclosed as part of a computer-
matching program to accomplish these purposes.
19. In response to a request about a specifically identified
individual covered by this system from a prospective Federal or non-
Federal health care entity employer, the following information may be
disclosed: (a) Relevant information concerning the individual's
professional employment history including the clinical privileges held
by the individual; (b) relevant information concerning a final decision
that results in a voluntary or involuntary limitation, reduction or
loss of clinical privileges; and (c) relevant information concerning
any payment that is made in settlement (or partial settlement) of, or
in satisfaction of a judgment in, a medical malpractice action or claim
and, when through a peer review process that is undertaken pursuant to
VA policy, negligence, professional incompetence, responsibility for
improper care, and/or professional misconduct has been assigned to the
individual.
20. Disclosure may be made to any Federal, State, local, tribal or
private entity in response to a request concerning a specific provider
for the purposes of credentialing providers who provide health care at
multiple sites or move between sites. Such disclosures may be made only
when: (1) The records are properly constituted in accordance with VA
requirements; (2) the records are accurate, relevant, timely, and
complete; and (3) disclosure is in the best interests of the Government
(i.e., to meet the requirements of contracts, sharing agreements,
partnerships, etc.). When exchange of credentialing information through
the exchange of individual records, directly benefits VA's completion
of its mission, enhances public confidence in VA's or Federal
Government's role in the delivery of health care, then the best
interests of the Government are served.
21. Disclosure may be made to individuals, organizations, private
or public agencies, or other entities or individuals with whom VA has a
contract or agreement to perform such services as VA may deem
practicable for the purposes of laws administered by VA, in order for
the contractor, subcontractor, public or private agency, or other
entity or individual with whom VA has an agreement or contract to
perform the services of the contract or agreement. This routine use
includes disclosures by the individual or entity performing the service
for VA to any secondary entity or individual to perform an activity
that is necessary for individuals, organizations, private or public
agencies, or other entities or individuals with whom VA has a contract
or agreement to provide the service to VA.
22. VA may disclose any information or records to appropriate
agencies, entities, and persons when (1) VA suspects or has confirmed
that there has been a breach of the system of records; (2) VA has
determined that as a result of the suspected or confirmed breach there
is a risk to individuals, VA (including its information systems,
programs, and operations), the Federal Government, or national
security; and (3) the disclosure made to such agencies, entities, or
persons is reasonably necessary to assist in connection with VA efforts
to respond to the suspected or confirmed breach or to prevent,
minimize, or remedy such harm.
23. Disclosure to other Federal agencies may be made to assist such
agencies in preventing and detecting possible fraud or abuse by
individuals in their operations and programs.
24. VA may disclose information concerning a health care provider's
professional qualification which may be published on publicly facing VA
owned or managed internet websites. Information to be displayed include
the name of provider, gender, name of professional school, post-
graduate training program, State of licensure, and board certification.
25. VA may disclose information to DoD from the joint platform
electronic credentialing system being shared with DoD for
credentialing/privileging purposes.
26. VA may disclose information to a former VA employee or
contractor, as well as the authorized representative of a current or
former employee or contractor of VA, in connection with or in
consideration of the reporting of:
(a) Any payment for the benefit of the former VA employee or
contractor that was made as the result of a settlement or judgment of a
claim of medical malpractice, if an appropriate determination is made
in accordance with Department policy that payment was related to
substandard care, professional incompetence, or professional misconduct
on the part of the individual;
(b) A final decision which relates to possible incompetence or
improper professional conduct that adversely affects the former
employee's or contractor's clinical privileges for a period longer than
30 days; or (c) The former employee's or contractor's surrender of
clinical privileges or any restriction of such privileges while under
investigation by the health care entity relating to possible
incompetence or improper professional conduct to the NPDB or the state
licensing board in any state in which the individual is licensed, the
VA facility is located, or an act or omission occurred upon which a
medical malpractice claim was based.
27. VA may disclose information to a former VA employee or
contractor, as well as the authorized representative of a current or
former employee or contractor of VA, in connection with or in
consideration of reporting that the individual's professional health
care activity so significantly failed to
[[Page 7400]]
conform to generally accepted standards of professional medical
practice as to raise reasonable concern for the health and safety of
patients, to a Federal agency, a State or local government licensing
board, or the Federation of State Medical Boards or a similar
nongovernmental entity which maintains records concerning individuals'
employment histories or concerning the issuance, retention, or
revocation of licenses, certifications, or registration necessary to
practice an occupation, profession, or specialty.
28. VA may disclose information from this system to another Federal
agency or Federal entity, when VA determines that information from this
system of records is reasonably necessary to assist the recipient
agency or entity in (1) responding to a suspected or confirmed breach
or (2) preventing, minimizing, or remedying the risk of harm to
individuals, the recipient agency or entity (including its information
systems, programs, and operations), the Federal Government, or national
security, resulting from a suspected or confirmed breach.
POLICIES AND PRACTICES FOR STORAGE OF RECORDS:
Records are maintained on paper documents or in electronic format.
Information included in the record may be stored on microfilm, magnetic
tape or disk. Records are maintained at the employing VHA health care
facility. If the individual transfers to another VHA health care
facility, the record is transferred to the new location, if
appropriate.
POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:
Records are retrieved by the names and Social Security number or
other assigned identifiers, e.g., the National Provider Identifier
(NPI), of the individuals on whom they are maintained.
POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:
Paper records are retired to the VA Records Center and Vault (VA
RC&V) 3 years after the individual separates from VA employment or when
no longer utilized by VA (in some cases, records may be maintained at
the facility for a longer period of time) and are destroyed 30 years
after separation. Paper records for applicants who are not selected for
VA employment or appointment are destroyed 2 years after non-selection
or when no longer needed for reference, whichever is sooner. Electronic
records are transferred to the Director, Credentialing and Privileging
Program, Office of Quality, Safety and Value, VA Central Office, when
the provider leaves the facility. Information stored on electronic
storage media is maintained and disposed of in accordance with records
disposition authority approved by the Archivist of the United States.
The merge of Service Level Files with the two-part Paper Credentialing
and Privileging Records for VA Employees when a provider departs from
VA (i.e., State Licensure Board Evidence Files, Exit Review Forms, and
Focused Professional Practice Evaluation (FPPE)/Ongoing Professional
Practice Evaluations (OPPE) data collection). Exit Review forms,
Service Level documentation etc. must be maintained for 3 years after
the individual separates and the files must be kept on site for 3
years. After the individual separates from VA employment or after
reporting and retired to the Federal Records Center, they are
maintained for 30 years and then destroyed.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:
1. Access to VA working and storage areas in VA health care
facilities is restricted to VA employees on a ``need to know'' basis;
strict control measures are enforced to ensure that disclosure to these
individuals is also based on this same principle. Generally, VA file
areas are locked after normal duty hours and the health care facilities
are protected from outside access by the Federal Protective Service or
other security personnel.
2. Access to computer room within the health care facilities is
generally limited by appropriate locking devices and restricted to
authorized VA employees and vendor personnel. Automated data processing
peripheral devices are generally placed in secure areas (areas that are
locked or have limited access) or are otherwise protected. Information
in the Veterans Information Systems Technology Architecture (VistA)
system may be accessed by authorized VA employees. Access to file
information is controlled at two levels; the system recognizes
authorized employees by a series of individually unique passwords/codes
as a part of each data message, and the employees are limited to only
that information in the file that is needed in the performance of their
official duties.
3. Access to records in VA Central Office and the VISN directors
and division offices is only authorized to VA personnel on a ``need-to-
know'' basis. There is limited access to the building with visitor
control by security personnel.
4. The automated system is internet enabled and will conform to all
applicable Federal Regulations concerning information security. The
automated system is protected by a generalized security facility and by
specific security techniques used within the application that accesses
the data file and may include individually unique passwords/codes and
may utilize Public Key Infrastructure (PKI) personal certificates. Both
physical and system security measures will meet or exceed those
required to provide an adequate level of protection for host systems.
Access to file information is limited to only that information in the
file that is needed in the performance of official duties. Access to
computer rooms is restricted generally by appropriate locking devices
to authorized operational personnel. Information submitted to the
automated electronic system is afforded the same protections as the
data that are maintained in the original files. Remote on-line access
from other agencies to the data storage site is controlled in the same
manner. Access to the electronic data is supported by encryption and
the internet server is insulated by a firewall.
RECORD ACCESS PROCEDURE:
Individuals seeking information regarding access to and contesting
of records in this system may write, call or visit the VA facility
location where they made application for employment or appointment, or
are or were employed.
CONTESTING RECORD PROCEDURES:
(See Record Access Procedures).
NOTIFICATION PROCEDURE:
Individuals who wish to determine whether this system of records
contains information about them should contact the VA facility location
at which they made application for employment or appointment or are or
were employed.
Inquiries should include the employee's full name, social security
number, date of application for employment or appointment or dates of
employment or appointment and return address.
EXEMPTIONS PROMULGATED FOR THE SYSTEM:
None.
HISTORY:
Last full publication provided in 80 FR 36596 dated Jun 25, 2015.
[FR Doc. 2020-02477 Filed 2-6-20; 8:45 am]
BILLING CODE 8320-01-P