Department of Veterans Affairs (VA).
Notice of Amendment to System of Records.
As required by the Privacy Act of 1974, 5 U.S.C. 552a(e), notice is hereby given that the Department of Veterans Affairs (VA) is amending the system of records currently entitled “My Health
Comments on the amendment of this system of records must be received no later than December 17, 2010. If no public comment is received, the amended system will become effective December 17, 2010.
Written comments may be submitted through
Veterans Health Administration (VHA) Privacy Officer, Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420; telephone (704) 245–2492.
Electronic copies of health information are not considered VA authoritative records, nor are they considered part of the VA system of records once they are downloaded into the Veteran's secure and private health space. The Veteran's self-entered health information is also owned and maintained by the Veteran in the My Health
Certain applications of My Health
Certain applications of My Health
My Health
VA does not provide access to the Veteran's personal health information maintained in My Health
Delegation of My Health
In order to administer the My Health
The My Health
The more comprehensive repository of administrative information is maintained at a central location. This information is used to support My Health
The information needed to support My Health
We are proposing to establish the following Routine Use disclosures of information maintained in the system:
6. Disclosure to other Federal agencies may be made to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs.
This routine use permits disclosures by the Department to report a suspected incident of identity theft and provide information or documentation related to or in support of the reported incident.
7. VA may, on its own initiative, disclose any information or records to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that the integrity or confidentiality of information in the system of records has been compromised; (2) the Department has determined that as a result of the suspected or confirmed compromise, there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security, confidentiality, or integrity of this system or other systems or programs (whether maintained by the
8. Disclosure of administrative data including information about My Health
The Privacy Act permits VA to disclose information about individuals without their consent for a routine use when the information, in this case administrative information, will be used for a purpose that is compatible with the purpose for which VA collected it. In all of the routine use disclosures described above, either the recipient of the administrative information will use the information in connection with the My Health
The Report of Intent to Amend a System on Records Notice and an advance copy of the system notice have been sent to the appropriate Congressional committees and to the Director of the Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.
“My Health
Veterans Health Administration (VHA) local facilities, VA National Data Centers, and VA Health Data Repository (HDR) located at the VA National Data Centers. Address locations for VA facilities are listed in VA Appendix 1 of the biennial publications of the VA systems of records.
Individuals covered encompass: (1) All individuals who successfully register for a My Health
The records include personally identifiable information, such as an individual's full name; My Health
Title 38, United States Code, § 501.
The information in the My Health
To the extent that records contained in the system include information protected by 45 CFR Parts 160 and 164, i.e., individually identifiable health information, and 38 U.S.C. 7332, i.e., medical treatment information related to drug abuse, alcoholism or alcohol abuse, sickle cell anemia or infection with the human immunodeficiency virus, that information cannot be disclosed under a routine use unless there is also specific statutory authority in 38 U.S.C. 7332 and regulatory authority in 45 CFR Parts 160 and 164 permitting disclosure.
1. Disclosure of information in this system of records may be made to private or public sector organizations, individuals, agencies, etc., with whom VA has a contract or agreement, including subcontractors, in order to administer the My Health
2. VA may disclose on its own initiative any information in the system, except the names and home addresses of Veterans and their dependents, that is relevant to a suspected or reasonably imminent violation of the law whether civil, criminal, or regulatory in nature and whether arising by general or program statute or by regulation, rule, or order issued pursuant thereto, to a Federal, state, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule, or order. VA may also disclose on its own initiative the names and addresses of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal, or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, or order issued pursuant thereto.
3. Disclosure may be made to National Archives and Records Administration (NARA) and the General Services Administration (GSA) to support its records management inspections responsibilities and its role as Archivist of the United States under authority of title 44 United States Code (U.S.C).
4. Any information in this system of records may be disclosed to the United States Department of Justice or United States Attorneys in order to prosecute or defend litigation involving or pertaining to the United States, or in which the United States has an interest.
5. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
6. Disclosure to other Federal agencies may be made to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs.
7. Disclosure of information may be made when (1) it is suspected or confirmed that the integrity or confidentiality of information in the system of records has been compromised; (2) the Department has determined that as a result of the suspected or confirmed compromise there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security or integrity of this system or other systems or programs (whether maintained by the Department or another agency or entity) that rely upon the compromised information; and (3) the disclosure is to agencies, entities, and persons whom VA determines are reasonably necessary to assist or carry out the Department's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. This routine use permits disclosure by the Department to respond to a suspected or confirmed data breach, including the conduct of any risk analysis or confirmed data breach, including the conduct of any risk analysis or provision of credit protection services as provided in 38 U.S.C. 5724, as the terms are defined in 38 U.S.C. 5727.
8. Disclosure of information may be made to VA to approved researchers to enhance, advance and promote both the function and the content of the My Health
These administrative records are maintained on paper and electronic media, including hard drive disks, which are backed up to tape at regular intervals.
Records may be retrieved by an individual's name, user ID, date of registration for My Health
1. Access to and use of the My Health
2. Physical access to computer rooms housing the My Health
3. Data transmissions between operational systems and My Health
4. Copies of back-up computer files are maintained at secure off-site locations.
Records are maintained and disposed of in accordance with the records disposition authority approved by the Archivist of the United States. Records from this system that are needed for audit purposes will be disposed of 6 years after a user's account becomes inactive. Routine records will be disposed of when the agency determines they are no longer needed for administrative, legal, audit, or other operational purposes. These retention and disposal statements are pursuant to NARA General Records Schedules GRS 20, item 1c and GRS 24, item 6a.
Official responsible for policies and procedures: Deputy Chief Information Officer for Health (19), Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 20420. Officials maintaining this system of records: The local VA facility (Address locations for VA facilities are listed in VA Appendix 1 of the biennial publications of the VA systems of records) and the Chief, Technical Infrastructure Division (31), Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772.
Individuals who wish to determine whether a record is being maintained under their name in this system or wish to determine the contents of such records have two options:
1. Submit a written request or apply in person to the VA facility where the records are located. VA facility location information can be found in the Facilities Locator section of VA's Web site at
2. Submit a written request or apply in person to the Chief of the Technical Infrastructure Division (31), Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772.
Inquiries should include the person's full name, user ID, date of birth and return address.
Individuals seeking information regarding access to and contesting of records in this system may write or call their local VA facility and/or the Chief of the Technical Infrastructure Division (31), Austin Automation Center, 1615 Woodward Street, Austin, Texas 78772, or call (512) 326–6780 to reach the VA Austin Automation Center Help Desk speak with the Chief of the Technical Infrastructure Division.
(
The sources of information for this system of records include the
(1) All individuals who successfully register for a My Health
(2) Representatives of the above individuals who have been provided access to the private health space by the Veteran user, including but not limited to, family members, friends, or VA and non-VA health care providers;
(3) VA health care providers;
(4) VHA IT staff and/or their contractors and subcontractors who may need to enter information into the system to initiate, support and maintain My Health
(5) VistA systems and
(6) VA researchers fulfilling VA required authorization procedures (