83 FR 44407 - Privacy Act of 1974; System of Records
DEPARTMENT OF VETERANS AFFAIRS Federal Register Volume 83, Issue 169 (August 30, 2018)
Federal Register Volume 83, Issue 169 (August 30, 2018)
| Page Range | 44407-44414 | |
| FR Document | 2018-18789 |
[Federal Register Volume 83, Number 169 (Thursday, August 30, 2018)] [Notices] [Pages 44407-44414] From the Federal Register Online [www.thefederalregister.org] [FR Doc No: 2018-18789] ======================================================================= ----------------------------------------------------------------------- DEPARTMENT OF VETERANS AFFAIRS Privacy Act of 1974; System of Records AGENCY: Department of Veterans Affairs (VA). ACTION: Notice of modified system of records. ----------------------------------------------------------------------- SUMMARY: As required by the Privacy Act of 1974, the Department of Veterans Affairs (VA) is giving notice that VA is fully republishing an update of the system of records entitled ``Veterans and Uniformed Services Personnel Programs of U.S. Government Life Insurance--VA (36VA29)'' DATES: Comments on this modified system of records must be received no later than 30 days after date of publication in the Federal Register. If no public comment is received during the period allowed for comment or unless otherwise published in the Federal Register by VA, the modified system of records will become effective a minimum of 30 days after date of publication in the Federal Register. If VA receives public comments, VA shall review the comments to determine whether any changes to the notice are necessary. ADDRESSES: Written comments may be submitted through www.Regulations.gov; by mail or hand-delivery to Director, Regulation Policy and Management (00REG), Department of Veterans Affairs, 810 Vermont Ave. NW, Room 1064, Washington, DC 20420; or by fax to (202) 273-9026 (not a toll-free number). Comments should indicate that they are submitted in response to ``SORN (36VA29)''. Copies of comments received will be available for public inspection in the Office of Regulation Policy and Management, Room 1063B, between the hours of 8:00 a.m. and 4:30 p.m., Monday through Friday (except holidays). Please call (202) 461-4902 for an appointment. (This is not a toll-free number.) In addition, comments may be viewed online at www.Regulations.gov. FOR FURTHER INFORMATION CONTACT: Monica Keitt, Chief Privacy Officer, VA Insurance Service, Department of Veterans Affairs Insurance Center, 5000 Wissahickon Avenue, Philadelphia, PA 19144, (215) 842-2000, Ext. 2905. SUPPLEMENTARY INFORMATION: The Department is republishing, in full, the System of Records Notice (SORN) 36VA29 that was last published on October 22, 2010. This republication provides a number of nonsignificant edits added for clarity and brevity, such as minor updates involving the locations and references of the mailing addresses for both onsite and offsite records storage sites, corrected office designations for VA Insurance Center's Director, amendment of website terminology that reflects more accurate nomenclature for access, and includes references to the amended title of the vendor that provides telecommunication services to the Veterans Insurance Phone Section (VIPS). This nonsignificant alteration also eliminates references to the amendments made in the revised and consolidated SORN 36VA29 of October 22, 2010. This amendment also provides for a number of modifications for routine uses that include text changes and additions that are considered to be a significant amendment based on VA requirements. The following are the changes made to the routine uses for SORN 36VA29. The language of routine use number one, which states, ``The record of an individual who is covered by a system of records may be disclosed to a Member of Congress, or a staff person acting for the Member, when the Member or staff person requests the record on behalf of, and at the written request of, the individual'', has been amended to state, ``VA may disclose information from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.'' VA must be able to provide information about individuals to adequately respond to inquiries from Members of Congress at the request of constituents who have sought their assistance. This change to routine use number one is not a new routine use but is amended to reflect the current language used for the release of information to members of Congress. The language of former routine use number seven, which is now designated as routine use number two, reads, ``VA may, on its own initiative, disclose any information or records to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that the integrity or confidentiality of information in the system of records has been compromised; (2) the Department has determined that, as a result of the suspected or confirmed compromise, there is a risk of embarrassment or harm to the reputations of the record subjects, harm to economic or property interests, identity theft or fraud, or harm to the security, confidentiality, or integrity of this system or other systems or programs (whether maintained by the Department or another agency or entity) that rely upon the potentially compromised information; and (3) the disclosure is to agencies, entities, or persons whom VA determines are reasonably necessary to assist or carry out the Department's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm. This routine use permits disclosures by the Department to respond to a suspected or confirmed data breach, including the conduct of any risk analysis or provision of credit protection services as provided in 38 U.S.C. 5724, as the terms are defined in 38 U.S.C 5727'', has been amended to read, ``VA may, on its own initiative, disclose information from this system to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that there has been a breach of the system of records; (2) VA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, VA (including its information systems, programs, and operations), the Federal Government, or national security; and the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with VA's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.''. This change to former routine use number seven, which is now designated as routine use number two, is not a new routine use. This routine use permits disclosures by the Department to respond to a suspected or confirmed data breach, including the conduct of any risk analysis or provision of credit protection services as provided in 38 U.S.C. 5724.'' a. Effective Response. A Federal agency's ability to respond quickly and effectively, in the event of a breach of Federal data, is critical to its efforts to prevent or minimize any consequent [[Page 44408]] harm. An effective response necessitates disclosure of information regarding the breach to those individuals affected by it, as well as to persons and entities in a position to cooperate, either by assisting in notification to affected individuals or by playing a role in preventing or minimizing harm from the breach. b. Disclosure of Information. Often, the information to be disclosed to such persons and entities is maintained by Federal agencies and is subject to the Privacy Act (5 U.S.C. 552a). The Privacy Act prohibits the disclosure of any record in a system of records by any means of communication to any person or agency absent the written consent of the subject individual, unless the disclosure falls within one of twelve statutory exceptions. In order to ensure an agency is in the best position to respond in a timely and effective manner, in accordance with 5 U.S.C. 552a(b)(3) of the Privacy Act, agencies shall publish a routine use for appropriate systems specifically applying to the disclosure of information in connection with response and remedial efforts, in the event of a data breach. The edits made to former routine use number seven, which is now designated as routine use number two, merely reflects the current language used for the release of information related to a data breach(es) and the related remedial efforts. A new routine use, designated as routine use number three, has been added to address VA sharing information with another Federal agency or entity when data breach responses and remedial efforts with another Federal agency or entity are required because of a breach in this VA system. The disclosure is required because the breach may affect the other agency's responses and/or remedial efforts related to data breach. This routine use allows VA to work with another Federal agency in responding to and taking remedial actions in response to the breach. The language of former routine use number five, which is now designated as routine use number four, states, ``VA may, on its own initiative, disclose information in this system, except the names and home addresses of veterans and their dependents, which is relevant to a suspected or reasonably imminent violation of law, whether civil, criminal or regulatory in nature and whether arising by general or program statute or by regulation, rule or order issued pursuant thereto, to a Federal, State, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule or order. On its own initiative, VA may also disclose the names and addresses of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto.'' has been amended to State, ``VA may, on its own initiative, disclose information in this system, except the names and home addresses of veterans and their dependents, which is relevant to a suspected or reasonably imminent violation of law, whether civil, criminal, or regulatory in nature and whether arising by general or program statute or by regulation, rule, or order issued pursuant thereto, to a Federal, State, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule, or order. On its own initiative, VA may also disclose the names and addresses of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal, or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule, or order issued pursuant thereto.'' VA must be able to provide, on its own initiative, information that pertains to a violation of laws to law enforcement authorities in order for them to investigate and enforce those laws. Under 38 U.S.C. 5701(a) and (f), VA may only disclose the names and addresses of veterans and their dependents to Federal entities with law enforcement responsibilities. This is distinct from the authority to disclose records in response to a qualifying request from a law enforcement entity, as authorized by Privacy Act subsection 5 U.S.C. 552a(b)(7). This change to former routine use number five, which is now designated as routine use number four, is not a new routine use but is amended to reflect the current language used for the release of information to law enforcement authorities. The language of former routine use number three, which now is designated as routine use number five, states, ``VA may disclose information from this system of records to the Department of Justice (DoJ), either on VA's initiative or in response to DoJ's request, after either VA or DoJ determines that such information is relevant to DoJ's representation of the United States or any of its components in legal proceedings before a court or adjudicative body, provided that, prior to each disclosure, the agency also determines that release of the records to DoJ is a use of the information contained in the records that is compatible with the purpose for which VA collected them. VA, on its own initiative, may disclose records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected them.'', has been replaced with the following language that states, ``VA may disclose information from this system of records to the Department of Justice (DoJ), either on VA's initiative or in response to DoJ's request for the information, after either VA or DoJ determines that such information is relevant to DoJ's representation of the United States or any of its components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines, prior to disclosure, that release of the records to DoJ is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. VA, on its own initiative, may disclose records, in this system of records, in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected the records.'' To determine whether to disclose records under this routine use, VA will comply with the guidance promulgated by the Office of Management and Budget in a May 24, 1985, memorandum entitled ``Privacy Act Guidance--Update,'' currently posted at http://www.whitehouse.gov/omb/inforeg/guidance1985.pdf. VA must be able to provide information to DoJ in litigation where the United States or any of its components is involved or has an interest. A determination would be made in each instance that under the circumstances involved, the purpose is compatible with the purpose for which VA collected the information. This routine use is distinct from the authority to disclose records in response to a court order under subsection (b)(11) of the Privacy Act, 5 U.S.C. 552(b)(11), or any other provision of subsection (b), in accordance with the court's analysis in Doe v. DiGenova, 779 F.2d 74, 78-85 [[Page 44409]] (D.C. Cir. 1985) and Doe v. Stephens, 851 F.2d 1457, 1465-67 (D.C. Cir. 1988). This change to the former routine use number three, which is now routine use number five, is not a new routine use but is amended to reflect the current language used for the release of information to DoJ. The language of former routine use number four, which is now routine use number six, that reads '' VA may disclose information from this system of records to individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor, subcontractor, public or private agency, or other entity or individual with whom VA has a contract or agreement to perform services under the contract or agreement.'' has been amended to read, ``VA may disclose information from this system of records to individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor, subcontractor, public or private agency, or other entity or individual with whom VA has a contract or agreement to perform services under the contract or agreement.'' This routine use includes disclosures by an individual or entity performing services for VA to any secondary entity or individual to perform an activity that is necessary for individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to provide the service to VA. This routine use, which also applies to agreements that do not qualify as contracts defined by Federal procurement laws and regulations, is consistent with OMB guidance in OMB Circular A-130, App. I, paragraph 5a(1)(b) that agencies promulgate routine uses to address disclosure of Privacy Act-protected information to contractors in order to perform the services contracts for the agency. This change to the former routine use number four, which is now routine use number six, is not a new routine use but is amended to reflect the current language used for the release of information to contractors. New routine uses numbers seven, eight, and nine have been added to address disclosures to the Equal Employment Opportunity Commission (EEOC), the Federal Labor Relations Authority (FLRA), and the Merit Systems Protection Board (MSPB) to meet the language requirements of OMB regarding releases of information by Federal agencies. The new routine use number seven, permits the release of information to the Equal Employment Opportunity Commission (EEOC) and will state, ``VA may disclose information from this system to the EEOC when requested in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or other functions of the Commission as authorized by law or regulation.'' VA must be able to provide information to EEOC to assist it in fulfilling its duties to protect employees' rights, as required by statute and regulation. The new routine use number eight, permits the release of information to the Federal Labor Relations Authority (FLRA) and will state, ``VA may disclose information from this system to the FLRA, including its General Counsel, information related to the establishment of jurisdiction, investigation, and resolution of allegations of unfair labor practices, or in connection with the resolution of exceptions to arbitration awards when a question of material fact is raised; for it to address matters properly before the Federal Service Impasses Panel, investigate representation petitions, and conduct or supervise representation elections.'' VA must be able to provide information to FLRA to comply with the statutory mandate under which it operates. The new routine use number nine, permits the release of information to the Merit Systems Protection Board (MSPB) and will state, ``VA may disclose information from this system to the MSPB, or the Office of the Special Counsel, when requested in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions promulgated in 5 U.S.C. 1205 and 1206, or as authorized by law.'' VA must be able to provide information to MSPB to assist it in fulfilling its duties as required by statute and regulation. The language of former routine use number two, which is now designated as routine use number ten, states ``Disclosure may be made to the National Archives and Records Administration (NARA) and the General Services Administration in records management inspections conducted under authority of title 44 U.S.C.'' will be changed to ``VA may disclose information from this system to the National Archives and Records Administration (NARA) and General Services Administration (GSA) in records management inspections conducted under title 44, U.S.C..'' This amendment does not change routine use. NARA is responsible for archiving old records, which are no longer actively used but may be appropriate for preservation, and for the physical maintenance of the Federal government's records. VA must be able to provide the records to NARA in order to determine the proper disposition of such records. This change to the former routine use number two, which is now number ten, is not a new routine use but is amended to reflect the current language used to release information to NARA and GSA. Signing Authority The Senior Agency Official for Privacy, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. John Buck, Director of the Office of Privacy, Information and Identity Protection, Department of Veterans Affairs approved this document on June 5, 2018 for publication. Dated: August 24, 2018. Kathleen M. Manwell, Program Analyst, VA Privacy Service, Office of Privacy, Information and Identity Protection, Quality, Privacy and Risk, Office of Information and Technology, Department of Veterans Affairs. SYSTEM NAME AND NUMBER ``Veterans and Uniformed Services Personnel Programs of U.S. Government Life Insurance--VA'' (36VA29) SECURITY CLASSIFICATION: Information in this SORN is not classified information. SYSTEM LOCATION: VA Insurance records are maintained as follows: 1. Active Insurance records are located at the VA Insurance Center (VAIC) in Philadelphia, Pennsylvania. (Appendix I at the end of this document provides the complete address.) 2. Inactive Insurance records are also located at the VAIC in Philadelphia, Pennsylvania. In addition, inactive records are stored at various servicing Federal archives and records centers in Northeast Philadelphia, Pennsylvania; Dayton, Ohio; Lee's Summit, Missouri; [[Page 44410]] Lenexa, Kansas; Chicago, Illinois; and Pittsfield, Massachusetts. (See Appendix I for the complete addresses.) 3. Some pre-1968 records pertaining to beneficiaries of deceased veterans are located in local VA regional offices, in claim folders. 4. Insurance file numbers, policies numbers, and folder locations are available to all VA regional offices through the Veterans Service Network (VETSNET). 5. Back up computerized insurance records and automated data, maintained by the Philadelphia Information Technology Center (Philadelphia ITC), the primary computer-processing center, are stored by St. Paul Regional Benefit Office in St. Paul, Minnesota, and by Iron Mountain in Itasca, Illinois. (See Appendix I for the complete addresses of each location.) 6. Records for the supervised programs of Government insurance are maintained by Prudential Insurance Company of America's Office of Servicemembers' Group Life Insurance (OSGLI) in Roseland, New Jersey. (See Appendix I for the address.) SYSTEM MANAGER(S): Official responsible for policies and procedures; Director, VA Insurance Center, 5000 Wissahickon Avenue, Director's Office (29), Philadelphia, PA 19144. The phone number is (215) 381-3029. AUTHORITY FOR MAINTENANCE OF THE SYSTEM: Title 38, United States Code (U.S.C.), chapter 5, section 501; and chapter 3, including sections 303 and 315. Title 38 U.S.C., chapter 19; chapter 21; and section 2106. Title 5 U.S.C. 5514. PURPOSE(S) OF THE SYSTEM: VA gathers or creates these records to administer and supervise statutory Government life insurance programs for veterans, members of the uniformed services, and their spouses, surviving spouses, dependents, and beneficiaries who apply for them. See the statutory provisions cited in ``Authority for Maintenance of the System.'' CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM: The following categories of individuals are covered by this system: 1. Veterans (not including dependents) and members of the uniformed services (including dependents) who have applied for and/or have been issued Government life insurance. 2. Beneficiaries of Government life insurance entitled to or in receipt of insurance proceeds. 3. Attorneys drawing fees for helping to settle VA insurance claims. The individuals noted above are covered by this system based on applications, claims, and notices of eligibility for the following Government life insurance programs provided in 38 U.S.C. chapters 19 and 21: 1. U.S. Government Life Insurance (USGLI) under section 1942. 2. National Service Life Insurance (NSLI) under section 1904. 3. Veterans' Special Life Insurance (VSLI) under section 1923. 4. Veterans' Reopened Insurance (VRI) under section 1925. 5. Service-Disabled Veterans' Insurance (S-DVI) under sections 1922 and 1922A. 6. Veterans' Mortgage Life Insurance (VMLI) under section 2106. 7. Servicemembers' Group Life Insurance (SGLI), including Family Servicemembers' Group Life Insurance (FSGLI), Veterans' Group Life Insurance (VGLI), and Servicemembers' Group Life Insurance Traumatic Injury Protection (TSGLI) under sections 1967 through 1980A. CATEGORIES OF RECORDS IN THE SYSTEM: Life insurance records (or information contained in records) may consist of: 1. Applications for insurance, including: (a) The name and address of the veteran or member of the uniformed services; (b) email address; (c) phone number; (d) correspondence to and from the veteran or member of the uniformed services or their legal representative; (d) date of birth; (e) social security number; (f) military service number; (g) dates of service; (h) military rank; (i) character of discharge; (j) VA file number; (k) plan or type of insurance; (l) disability rating; (m) medical information regarding disability and health history; (n) method of payment; (o) amount of insurance coverage requested; and (p) bank routing and account numbers. 2. Applications for Veterans' Mortgage Life Insurance (VMLI), including: (a) Supporting mortgage documents; (b) address of the mortgaged property; (c) name and address of the mortgagor; (d) the mortgage account number; (e) the rate of interest; (f) the original amount of the mortgage; (g) the current amount of the mortgage; (h) the monthly payment amount; (i) the mortgage payment period; and (j) VA Specially Adapted Grant Card (which contains the veteran's or uniformed services member's name, address, dates of military service, branch of service, method of separation, whether the veteran or member of the uniformed services has VMLI, the name and address of the lender, the legal description and property address, improvements to such property, date applied for disability compensation, date of submission of the initial application, grant information, amount of the grant approved, or whether the grant was denied or canceled). 3. Beneficiary and option designation information, including: (a) The names and addresses of principal and contingent beneficiaries; (b) beneficiary social security number; (c) share amount to each beneficiary; (d) the method of payment; and (e) the designated estate(s) and trust(s). 4. Insurance contract information, including: (a) Authorization of allotment payment; (b) authorization for deduction from VA benefit payments; (c) authorization for deduction from military retired pay; (d) authorization for deduction from employee payroll; (e) paid dividend information; (f) claims for disability or death payments; (g) cash value, policy loan, and lien information; (h) a listing of lapsed actions and unpaid insurance proceeds; (i) payment vouchers; (j) reinstatement information; (k) premium records status, and retired status of the policy; (l) court-martial orders; (m) copies of personal papers of the insured, including birth certificate, marriage license, divorce decree, citizen or naturalization papers, death certificate, adoption decree, and family support documents; (n) correspondence to and from the veteran, member of the uniformed services, legal representative, or payee; (o) employment information; (p) returned check and check tracer information; (q) court documents; and (r) insurance death claims settlement information, including indebtedness, interest, and other credits. 5. Records of checks withheld from delivery to certain foreign countries. 6. Index of payees, including: (a) Central Office (CO) index cards; and (b) premium record cards. 7. Disability Outreach Tracking System (DOTS) records stored in the Veterans Insurance Claims Tracking and Response System (VICTARS), including: (a) The veteran's or uniformed services member's name; (b) address; (c) phone number; (d) disability status; (e) social security number; (f) date of birth; and (g) list of dependents. 8. Policy information and access history from the VA Insurance website self-service-portal stored in VICTARS, which includes: (a) The name of the insured; (b) file number; (c) policy number; (d) address; (e) phone number; (f) email address; (g) loan status (including loan amount requested, denied, or pending); (h) the date of request for information; (i) loan history; [[Page 44411]] (j) policy changes; (k) dividend option changes; and (l) website pages accessed. 9. Information from the VA Insurance website which provides access to veterans for completion of an application for Service-Disabled Veterans Insurance (S-DVI), which includes: (a) The veteran's name; (b) address; (c) social security number; (d) date of birth; (e) phone number; (f) medical history; (g) email address; and (h) beneficiary information (such as the beneficiary's name, address, and social security number). 10. Recordings of incoming calls using software created by NICE Ltd. (hereafter referred to as NICE). Insurance personnel in the Veterans Insurance Phone Section (VIPS) receive these calls from veterans, members of the uniformed services, beneficiaries, personal representatives, members of Congress and their staff, other interested parties, and stakeholders. (The recordings are maintained for quality assurance and training purposes only.) RECORD SOURCE CATEGORIES: The veteran, member of the uniformed services, or someone acting on his/her behalf; the uniformed services, other Federal agencies, including the Department of Defense (DoD); Social Security Administration (SSA); U.S. Treasury Department; Office of Servicemembers' Group Life Insurance (OSGLI); State and local agencies; Federal, State, and local courts; VA records; VA and private physicians; VA and private medical facilities; accredited veterans service organizations and other organizations aiding veterans and members of the uniformed services; VA-approved claims agents; VA fiduciaries; court-appointed guardians/conservators, powers of attorney, and military trustees; financial institutions; beneficiaries; commercial insurance companies; undertakers; lending institutions holding a veteran's or uniformed services member's mortgage; VA Loan Guaranty; contractors remodeling, enlarging, or adding construction to existing homes; relatives and other interested persons; Westlaw and website-based research; Inquiry Routing & Information System (IRIS) (maintained under System of Records 151VA005OP6, by the Office of Information and Technology); and the general public. ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES: 1. VA may disclose information from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. 2. VA may, on its own initiative, disclose information from this system to appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that there has been a breach of the system of records; (2) VA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, VA (including its information systems, programs, and operations), the Federal Government, or national security; and the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with VA's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm. 3. VA may disclose information from this system to another Federal agency or Federal entity, when VA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach. 4. VA may, on its own initiative, disclose information in this system, except the names and home addresses of veterans and their dependents, which is relevant to a suspected or reasonably imminent violation of law, whether civil, criminal or regulatory in nature and whether arising by general or program statute or by regulation, rule or order issued pursuant thereto, to a Federal, state, local, tribal, or foreign agency charged with the responsibility of investigating or prosecuting such violation, or charged with enforcing or implementing the statute, regulation, rule or order. On its own initiative, VA may also disclose the names and addresses of veterans and their dependents to a Federal agency charged with the responsibility of investigating or prosecuting civil, criminal or regulatory violations of law, or charged with enforcing or implementing the statute, regulation, rule or order issued pursuant thereto. 5. VA may disclose information from this system of records to the Department of Justice (DoJ), either on VA's initiative or in response to DoJ's request for the information, after either VA or DoJ determines that such information is relevant to DoJ's representation of the United States or any of its components in legal proceedings before a court or adjudicative body, provided that, in each case, the agency also determines prior to disclosure that release of the records to the DoJ is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. VA, on its own initiative, may disclose records in this system of records in legal proceedings before a court or administrative body after determining that the disclosure of the records to the court or administrative body is a use of the information contained in the records that is compatible with the purpose for which VA collected the records. 6. VA may disclose information from this system of records to individuals, organizations, private or public agencies, or other entities or individuals with whom VA has a contract or agreement to perform such services as VA may deem practicable for the purposes of laws administered by VA, in order for the contractor, subcontractor, public or private agency, or other entity or individual with whom VA has a contract or agreement to perform services under the contract or agreement. 7. VA may disclose information from this system to the EEOC when requested in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or other functions of the Commission as authorized by law or regulation. 8. VA may disclose information from this system to the FLRA, including its General Counsel, information related to the establishment of jurisdiction, investigation, and resolution of allegations of unfair labor practices, or in connection with the resolution of exceptions to arbitration awards when a question of material fact is raised; for it to address matters properly before the Federal Services Impasses Panel, investigate representation petitions, and conduct or supervise representation elections. 9. VA may disclose information from this system to the MSPB, or the Office of the Special Counsel, when requested in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions promulgated in 5 U.S.C. 1205 and 1206, or as authorized by law. 10. VA may disclose information from this system to NARA and GSA in records management inspections conducted under title 44, U.S.C. 11. Disclosure to other Federal agencies may be made to assist such [[Page 44412]] agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs. 12. Any information in this system may be disclosed to a Federal agency, upon its official request, to the extent that it is relevant and necessary to that agency's decision regarding: the hiring, retention, or transfer of an employee; the issuance of a security clearance; the letting of a contract; or the issuance or continuance of a license, grant, or other benefit given by that agency. However, in accordance with an agreement with the U.S. Postal Service, disclosures to the U.S. Postal Service for decisions concerning the employment of veterans will only be made with the veteran's prior written consent. 13. Any information in this system may be disclosed to a State or local agency, upon its official request, to the extent that it is relevant and necessary to that agency's decision on: The hiring, transfer, or retention of an employee; the issuance of a security clearance; the letting of a contract; or the issuance or continuance of a license, grant, or other benefit by that agency; provided, that if the information pertains to a veteran or member of the uniformed services, the name and/or address of the veteran or member of the uniformed services will not be disclosed unless the name and address is provided first by the requesting State or local agency. 14. Any information in this system may be disclosed to a Federal, State or local agency maintaining civil or criminal violation records, or other pertinent information such as prior employment history, prior Federal employment background investigations, and personal or educational background, at the request of the veteran or member of the uniformed services, in order for VA to obtain information relevant to the hiring, transfer, or retention of an employee, the letting of a contract, the granting of a security clearance, or the issuance of a grant or other benefit. 15. Any information in this system may be disclosed to a Federal agency, except for the name and address of a veteran or member of the uniformed services, in order for VA to obtain information relevant to the issuance of a benefit under title 38 U.S.C. The name and address of a veteran or member of the uniformed services may be disclosed to a Federal agency under this routine use if they are required by the Federal agency to respond to a VA inquiry. 16. Except for beneficiary and option designations, any information in this system, including the name and address of a veteran or member of the uniformed services, may be disclosed to any nonprofit organization if the release is directly connected with the conduct of programs and the utilization of benefits under title 38 U.S.C. (such disclosures include computerized lists of names and addresses). 17. Except for medical information and beneficiary and option designations, any information including insurance contract information (e.g., name, address, status of the account, dividends paid, cash value, and policy loans) may be disclosed at the request of a veteran or member of the uniformed services to an attorney acting under a declaration of representation, a VA-approved claims agent, an insurance agency, a trust officer, or to employees or members of an accredited service organization, so that these individuals or organizations can aid veterans or members of the uniformed services in the preparation, presentation, and prosecution of claims under the laws administered by VA. The name and address of a veteran or member of the uniformed services will not, however, be disclosed to these individuals under this routine use if the veteran or member of the uniformed services has not requested the assistance of an accredited service organization, claims agent, trust officer, or an attorney. 18. The name, address, insurance account information of an insured veteran or member of the uniformed services, their beneficiary(ies), legal representatives, or designated payee(s), and the amount of payment may be disclosed to the Treasury Department, upon its official request, in order for the Treasury Department to pay dividends, policy loans, cash surrenders, maturing endowments, insurance refunds, or to issue checks and perform check tracer activities for the veteran or member of the uniformed services, beneficiary(ies), legal representative, or designated payee(s). 19. The name and address of an insured veteran or member of the uniformed services, date and amount of payments made to VA, including specific status of each policy (e.g., premiums paid, dividends issued, cash and loan values) may be disclosed to the Internal Revenue Service (IRS), upon its official request, in order for the IRS to collect tax liens by withholding insurance payments to satisfy unpaid taxes. This purpose is consistent with title 26 of the United States Code, section 7602. 20. The name, address, social security number, date of discharge from the military, medical information concerning the grounds for total disability or the nature of an injury or illness, and dependency- or beneficiary-related information of a member of the uniformed services or veteran may be disclosed to the Office of Servicemembers' Group Life Insurance (OSGLI) at the request of a member of the uniformed services or veteran in order to aid OSGLI in the verification of such information for the purpose of issuing and maintaining insurance policies provided to members of the uniformed services or veterans participating in the Servicemembers' Group Life Insurance (SGLI) and/or Veterans' Group Life Insurance (VGLI) programs, and to pay insurance benefits under these programs. 21. The name, address, and other identifying information, such as a social security number or a military service number, may be disclosed to the Department of Defense (Army, Air Force, Navy, and Marine Corps); the Coast Guard of the Department of Homeland Security; the Commissioned Officers Corps of the U.S. Public Health Service; and the Commissioned Officers Corps of the National Oceanic and Atmospheric Administration of the Department of Commerce, upon their official request to help establish and maintain allotments from active and retired service pay for VA insurance premiums and loan repayments. 22. The face amount and cash and/or loan value of an insurance policy, verification of an existing insurance policy, and the name and address of an insured veteran or member of the uniformed services, may be disclosed at the request of the veteran or member of the uniformed services to a Federal, State, or local agency, in order for these agencies to assist a veteran or member of the uniformed services applying for Medicaid, Medicare, nursing home admittance, welfare benefits, or other benefits provided by the requesting agency to the extent that the information is relevant and necessary to the agency's decision regarding those benefits. 23. The name and address of a veteran or member of the uniformed services and military service information (e.g., dates of service, branch of service) may be disclosed to the Armed Forces Institute of Pathology (AFIP), upon its official request, in order for the AFIP to conduct research for specified official purposes. 24. The name(s) and address(es) of a veteran or member of the uniformed services may be disclosed to another Federal agency or to a contractor of that agency, at the written request of the head of that agency or designee of the head of that agency, for the purpose of conducting Government research necessary to accomplish a statutory purpose of that agency. [[Page 44413]] 25. Any information in this system, including the nature and amount of a financial obligation, may be disclosed to a debtor's employing agency or commanding officer, upon its official request, as a routine use in order to assist VA in the collection of unpaid financial obligations owed to VA so that the debtor-employee may be counseled by his or her Federal employer or commanding officer. This purpose is consistent with 5 U.S.C. 5514; 31 U.S.C. 3701-3702 and sections 3711- 3718. 26. Any information in this system, including available identifying data regarding the debtor, such as the name of the debtor, last known address of the debtor, name of the debtor's spouse, social security number of the debtor, VA insurance number, VA loan number, VA file number, place of birth, date of birth of the debtor, name and address of the debtor's employer or firm, and dates of employment, may be disclosed to other Federal agencies, State probate courts, State drivers' license bureaus, and State automobile title and license bureaus as a routine use in order to obtain current address and credit report assistance for the collection of unpaid financial obligations owed the United States. This purpose is consistent with the Federal Claims Collection Act of 1966 (Pub. L. 89-508), subsequent amendments, and 31 U.S.C. 3701-3702 and 3711-3718. 27. Any information concerning the veteran's or uniformed services member's indebtedness to the United States by virtue of a person's participation in a benefits program administered by VA, including personal information obtained from other Federal agencies through computer matching programs, may be disclosed to any third party, except consumer reporting agencies, in connection with any proceeding for the collection of an amount owed to the United States. Purposes of these disclosures may be to (a) assist VA in collection of title 38 benefit overpayments, overdue indebtedness, and/or costs of services provided individuals not entitled to such services, and (b) initiate legal actions for prosecuting individuals who willfully or fraudulently obtain title 38 benefits without entitlement. This disclosure is consistent with 31 U.S.C. 3701-3702, 3711-3718; and 38 U.S.C. 5701(b)(6). 28. The name and address of a veteran or member of the uniformed services, other information as is reasonably necessary to identify such veteran or member of the uniformed services, including personal information obtained from other Federal agencies through computer matching programs, and any information concerning the veteran's or uniformed services member's indebtedness to the United States by virtue of the person's participation in a benefits program administered by VA, may be disclosed to a consumer reporting agency for purposes of assisting in the collection of such indebtedness, provided that the provisions of 31 U.S.C. 3701-3702 and 3711-3718 and 38 U.S.C 5701(g)(4) have been met. 29. Any information in this system, such as notices of renewal, reinstatements, premiums due, lapsed actions, miscellaneous insurance instructions, disposition of dividends, policy loans, and transfer of records, may be disclosed to VA fiduciaries, court-appointed guardians/ conservators, powers of attorney, or military trustees of incompetent veterans or members of the uniformed services, in order to advise VA fiduciaries, court-appointed guardians/conservators, powers of attorney, or military trustees of current actions to be taken in connection with ownership of U.S. Government life insurance policies and to enable them to properly perform their duties as fiduciaries or guardians, powers of attorney, or military trustees. 30. Any information in this system of records may be disclosed, in the course of presenting evidence in or to a court, magistrate, administrative tribunal, or grand jury, including disclosures to opposing counsel in the course of such proceedings or in settlement negotiations. 31. Identifying information, except for the name and address of a veteran or member of the uniformed services, may be disclosed to a Federal, State, county, or municipal agency for the purpose of conducting computer matches to obtain information to validate the entitlement of a veteran or member of the uniformed services who is receiving, or has received, Government insurance benefits under title 38 of the United States Code. The name and address of a veteran or member of the uniformed services may also be disclosed to a Federal agency under this routine use if they are required by the Federal agency to respond to the VA inquiry. POLICIES AND PRACTICES FOR STORAGE OF RECORDS: Records are stored in two computerized systems called Veterans Insurance Claims Tracking and Response System (VICTARS), and the Insurance Terminal System (ITS). VICTARS utilizes imaging and electronic technology to store paper documents, including applications and correspondence, and it records all processing-related activities involving insurance policies, disability outreach services, and the website self-service portal. ITS provides direct access to insurance records relative to claims processing via computer monitors. Both VICTARS and ITS store and retrieve all information in the insurance records system through the local area network (LAN) maintained through the Philadelphia ITC at the Philadelphia Insurance Center. NICE creates recordings of incoming phone calls received by insurance personnel regarding policy-related issues and stores the calls as part of the LAN maintained through the Philadelphia ITC. Back-up VA insurance records are stored in secured areas by the St. Paul Regional Benefit Office and Iron Mountain. (Appendix I provides the complete addresses for each location.) Inactive records are also stored on microfilm, microfiche, compact disks, CO index cards, premium record cards in hardcopy folders, computer lists, and punch cards, which are kept in locked files and secured areas. POLICIES AND PRACTICES FOR RETRIEVABILITY OF RECORDS: All hardcopy and electronically stored insurance records are retrievable by the Government insurance file number, VA file number, policyholder's name, and social security number. Information input through the VA Insurance website's self-service portal relative to loan applications is retrievable by the use of unique personal identification numbers (PINs), passwords, and insurance file numbers. Approved encryption technology is used to protect personal information. Incomplete S-DVI applications are retrievable on the VA Insurance's secure website through the use of personal passwords, social security numbers, and dates of birth of the veterans. (The completed S-DVI application becomes part of the VICTARS storage system.) Approved encryption technology is used to protect personal information. The Interactive Voice Response (IVR) permits veterans to access audible information about their insurance records, which is stored by VA Insurance's LAN via touch-tone telephone technology utilizing VA Insurance file numbers. POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS: Hardcopy records are retained and disposed of in accordance with disposition authorization approved by the Archivist of the United States. VICTARS, the primary records storage and retrieval system for the Insurance [[Page 44414]] program, maintains imaged insurance records indefinitely through the VA Insurance LAN. Hardcopy records imaged into VICTARS are stored for 31 days prior to destruction. Original copies of imaged beneficiary designation documents are stored indefinitely at the NARA Mid-Atlantic Regional Center. (See Appendix I for the complete address.) Computerized records accessible through ITS are also maintained indefinitely through the VA Insurance LAN. Back-up Philadelphia ITC archive records are stored on tape for one year prior to being erased or over written. NICE recordings, which document incoming phone calls regarding insurance policies, are maintained for a minimum of 13 months after the call and are purged thereafter. ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS: 1. Physical Security. a. All VA facilities are protected by the Federal Protective Service or other security personnel. All Insurance files and processing areas are restricted to authorized personnel on a need-to-know basis. Areas containing paper and computerized records are protected by a sprinkler system. Paper records pertaining to employees and public figures, or otherwise sensitive files, are stored in locked files. Microfilm records and compact disk (CD) back-up files of the payment processing unit (Collections) activities are stored in locked, fireproof, humidity-controlled vaults at the Insurance Center. b. Access to the Philadelphia ITC and Collections is secured by electronic locking devices and is restricted to Philadelphia ITC and Collections employees, custodial personnel, and Federal Protective Service or other security personnel. All other persons gaining access to computer rooms and Collections are escorted by an individual with authorized access. c. Access to records at the Insurance Center through computerized storage systems, including VICTARS, ITS, NICE, and the Philadelphia ITC, is protected by passwords, magnetic card readers, and audible alarms. Electronic keyboard locks are activated upon security errors. Video surveillance is also provided in secured processing and computer protected areas, such as Claims, Collections, and the ITC. An Information Security Officer is assigned responsibility for privacy- security measures, including review of violations logs and local control and distribution of passwords. 2. System Security. a. In the Philadelphia ITC, automated labeling techniques identify computerized tapes and disks containing data. Access to computer programs is controlled at the operations level. b. VICTARS, ITS, and NICE utilize the Insurance Center's LAN as the storage and retrieval conduit, which uses passwords to provide automated recognition of authorized users, their respective access levels, and restrictions. Passwords are changed periodically and are restricted to authorized individuals on a need-to-know basis for system access or security purposes. c. Back-up insurance records and Philadelphia ITC data are stored in a secured site by the St. Paul Regional Benefit Office and by Iron Mountain. d. The VA Insurance website self-service portal, which is used by veterans, their legal representatives, and payees, is only accessible with the use of personal identifiers consisting of PINs, passwords, file numbers, loan numbers, social security numbers, and dates of birth. The access portals utilize LAN-based encryption technology and firewalls to protect personal data. e. The IVR, which is protected as part of the LAN, permits veterans to listen to information from their insurance records via touch-tone telephones, which utilize VA Insurance file numbers to access the records. f. Data exchange by email within the agency or between other Federal agencies is done by means of dedicated communication lines utilizing approved encryption technology. RECORD ACCESS PROCEDURE: Individuals desiring access to, or wishing to contest, VA records and related procedures should write to the VA Insurance Center at 5000 Wissahickon Avenue, Director's Office (29), Philadelphia, Pennsylvania 19144. CONTESTING RECORD PROCEDURES: (See Records Access Procedures above.) NOTIFICATION PROCEDURES: Any individual who wishes to determine whether a record is maintained in this system under his or her name or other personal identifier, who wants to determine the contents of such record, or has a routine inquiry concerning the status of his or her insurance under this system, may contact the VA Insurance Center in Philadelphia, Pennsylvania at (215) 381-3029. Requests concerning the specific content of a record must be made in writing or made in person at the VA Insurance Center in Philadelphia. The inquirer should provide the full name of the veteran or member of the uniformed services; the insurance file number, VA claim number, or social security number; the date of birth of the veteran or member of the uniformed services; and reasonably identify the benefit or system of records involved. If the insurance file number or any of the other identifiers noted above are not available, requestors should provide the service number, and/or location of insurance records that will aid VA personnel in locating the official insurance records. (See Appendix I for the addresses of records storage facilities.) EXEMPTIONS PROMULGATED FOR THE SYSTEM: None. HISTORY: Veterans and Uniformed Services Personnel Programs of U.S. Government Life Insurance-VA (36VA29), published at 75 FR 65405, October 22, 2010, was the last full publication of the VA Insurance Center's SORN 36VA29 which provided updated information regarding VAIC records and consolidated the outdated SORNs 36VA00, 46VA00, and 53VA00 into one SORN. Appendix I: Addresses of VA Insurance Records Facilities 1. VA Insurance Center, 5000 Wissahickon Avenue, Philadelphia, PA 19144 2. St. Paul Regional Benefit Office, 1 Federal Drive, Fort Snelling, St. Paul, MN 55111-4050 3. Iron Mountain, 1397 Glenlake Avenue, Itasca, IL 60143 4. NARA Mid-Atlantic Region (Northeast Philadelphia), 14700 Townsend Road, Philadelphia, PA 19154 5. NARA Great Lakes Region (Dayton Kingsridge), 8801 Kingsridge Drive, Dayton, OH 45458 6. NARA Central Plains Region (Lee's Summit), 200 Space Center Drive, Lee's Summit, MO 64064 7. NARA Central Plains Region (Lenexa), 17501 West 98th Street, Suite 3150, Lenexa, KS 66219 8. NARA Great Lakes Region (Chicago), 7358 South Pulaski Road, Chicago, IL 60629 9. NARA Northeast Region (Pittsfield), 10 Conte Drive, Pittsfield, MA 01201 10. Office of Servicemembers' Group Life Insurance, 80 Livingston Avenue, Roseland, NJ 07068 [FR Doc. 2018-18789 Filed 8-29-18; 8:45 am] BILLING CODE P
![Federal Register / Vol. 83, No. 169 / Thursday, August 30, 2018 / Notices 44407
collection of information; (c) ways to a.m. and 4:30 p.m., Monday through The language of former routine use
enhance the quality, utility, and clarity Friday (except holidays). Please call number seven, which is now designated
of the information to be collected; (d) (202) 461–4902 for an appointment. as routine use number two, reads, ‘‘VA
ways to minimize the burden of the (This is not a toll-free number.) In may, on its own initiative, disclose any
collection of information on addition, comments may be viewed information or records to appropriate
respondents, including through the use online at www.Regulations.gov. agencies, entities, and persons when (1)
of technology; and (e) estimates of VA suspects or has confirmed that the
FOR FURTHER INFORMATION CONTACT:
capital or start-up costs and costs of integrity or confidentiality of
Monica Keitt, Chief Privacy Officer, VA
operation, maintenance, and purchase information in the system of records has
Insurance Service, Department of
of services required to provide been compromised; (2) the Department
Veterans Affairs Insurance Center, 5000
information. has determined that, as a result of the
Wissahickon Avenue, Philadelphia, PA
Authority: 44 U.S.C. 3501 et seq. suspected or confirmed compromise,
19144, (215) 842–2000, Ext. 2905.
there is a risk of embarrassment or harm
Dated: August 27, 2018. SUPPLEMENTARY INFORMATION: The to the reputations of the record subjects,
Spencer W. Clark, Department is republishing, in full, the harm to economic or property interests,
Treasury PRA Clearance Officer. System of Records Notice (SORN) identity theft or fraud, or harm to the
[FR Doc. 2018–18862 Filed 8–29–18; 8:45 am] 36VA29 that was last published on security, confidentiality, or integrity of
BILLING CODE 4810–25–P October 22, 2010. This republication this system or other systems or
provides a number of nonsignificant programs (whether maintained by the
edits added for clarity and brevity, such Department or another agency or entity)
DEPARTMENT OF VETERANS as minor updates involving the that rely upon the potentially
AFFAIRS locations and references of the mailing compromised information; and (3) the
addresses for both onsite and offsite disclosure is to agencies, entities, or
Privacy Act of 1974; System of records storage sites, corrected office persons whom VA determines are
Records designations for VA Insurance Center’s reasonably necessary to assist or carry
AGENCY: Department of Veterans Affairs Director, amendment of website out the Department’s efforts to respond
(VA). terminology that reflects more accurate to the suspected or confirmed
nomenclature for access, and includes compromise and prevent, minimize, or
ACTION: Notice of modified system of
references to the amended title of the remedy such harm. This routine use
records.
vendor that provides permits disclosures by the Department
SUMMARY: As required by the Privacy telecommunication services to the to respond to a suspected or confirmed
Act of 1974, the Department of Veterans Veterans Insurance Phone Section data breach, including the conduct of
Affairs (VA) is giving notice that VA is (VIPS). This nonsignificant alteration any risk analysis or provision of credit
fully republishing an update of the also eliminates references to the protection services as provided in 38
system of records entitled ‘‘Veterans and amendments made in the revised and U.S.C. 5724, as the terms are defined in
Uniformed Services Personnel Programs consolidated SORN 36VA29 of October 38 U.S.C 5727’’, has been amended to
of U.S. Government Life Insurance—VA 22, 2010. read, ‘‘VA may, on its own initiative,
(36VA29)’’ This amendment also provides for a disclose information from this system to
DATES: Comments on this modified number of modifications for routine appropriate agencies, entities, and
system of records must be received no uses that include text changes and persons when (1) VA suspects or has
later than 30 days after date of additions that are considered to be a confirmed that there has been a breach
publication in the Federal Register. If significant amendment based on VA of the system of records; (2) VA has
no public comment is received during requirements. The following are the determined that as a result of the
the period allowed for comment or changes made to the routine uses for suspected or confirmed breach there is
unless otherwise published in the SORN 36VA29. a risk of harm to individuals, VA
Federal Register by VA, the modified (including its information systems,
The language of routine use number programs, and operations), the Federal
system of records will become effective one, which states, ‘‘The record of an
a minimum of 30 days after date of Government, or national security; and
individual who is covered by a system the disclosure made to such agencies,
publication in the Federal Register. If of records may be disclosed to a
VA receives public comments, VA shall entities, and persons is reasonably
Member of Congress, or a staff person necessary to assist in connection with
review the comments to determine acting for the Member, when the
whether any changes to the notice are VA’s efforts to respond to the suspected
Member or staff person requests the or confirmed breach or to prevent,
necessary. record on behalf of, and at the written minimize, or remedy such harm.’’.
ADDRESSES: Written comments may be request of, the individual’’, has been This change to former routine use
submitted through amended to state, ‘‘VA may disclose number seven, which is now designated
www.Regulations.gov; by mail or hand- information from the record of an as routine use number two, is not a new
delivery to Director, Regulation Policy individual in response to an inquiry routine use. This routine use permits
and Management (00REG), Department from the congressional office made at disclosures by the Department to
of Veterans Affairs, 810 Vermont Ave. the request of that individual.’’ VA must respond to a suspected or confirmed
NW, Room 1064, Washington, DC be able to provide information about data breach, including the conduct of
20420; or by fax to (202) 273–9026 (not individuals to adequately respond to any risk analysis or provision of credit
amozie on DSK3GDR082PROD with NOTICES1
a toll-free number). Comments should inquiries from Members of Congress at protection services as provided in 38
indicate that they are submitted in the request of constituents who have U.S.C. 5724.’’
response to ‘‘SORN (36VA29)’’. Copies sought their assistance. This change to a. Effective Response. A Federal
of comments received will be available routine use number one is not a new agency’s ability to respond quickly and
for public inspection in the Office of routine use but is amended to reflect the effectively, in the event of a breach of
Regulation Policy and Management, current language used for the release of Federal data, is critical to its efforts to
Room 1063B, between the hours of 8:00 information to members of Congress. prevent or minimize any consequent
VerDate Sep<11>2014 17:25 Aug 29, 2018 Jkt 244001 PO 00000 Frm 00151 Fmt 4703 Sfmt 4703 E:\FR\FM\30AUN1.SGM 30AUN1](https://thefederalregister.org/doc/83_FR_44576/page/1.svg)
![44414 Federal Register / Vol. 83, No. 169 / Thursday, August 30, 2018 / Notices
program, maintains imaged insurance 2. System Security. 381–3029. Requests concerning the
records indefinitely through the VA a. In the Philadelphia ITC, automated specific content of a record must be
Insurance LAN. Hardcopy records labeling techniques identify made in writing or made in person at
imaged into VICTARS are stored for 31 computerized tapes and disks the VA Insurance Center in
days prior to destruction. Original containing data. Access to computer Philadelphia. The inquirer should
copies of imaged beneficiary programs is controlled at the operations provide the full name of the veteran or
designation documents are stored level. member of the uniformed services; the
indefinitely at the NARA Mid-Atlantic b. VICTARS, ITS, and NICE utilize the insurance file number, VA claim
Regional Center. (See Appendix I for the Insurance Center’s LAN as the storage number, or social security number; the
complete address.) Computerized and retrieval conduit, which uses date of birth of the veteran or member
records accessible through ITS are also passwords to provide automated of the uniformed services; and
maintained indefinitely through the VA recognition of authorized users, their reasonably identify the benefit or system
Insurance LAN. Back-up Philadelphia respective access levels, and of records involved. If the insurance file
ITC archive records are stored on tape restrictions. Passwords are changed number or any of the other identifiers
for one year prior to being erased or over periodically and are restricted to noted above are not available, requestors
written. authorized individuals on a need-to- should provide the service number,
NICE recordings, which document know basis for system access or security and/or location of insurance records
incoming phone calls regarding purposes. that will aid VA personnel in locating
insurance policies, are maintained for a c. Back-up insurance records and the official insurance records. (See
minimum of 13 months after the call Philadelphia ITC data are stored in a Appendix I for the addresses of records
and are purged thereafter. secured site by the St. Paul Regional storage facilities.)
Benefit Office and by Iron Mountain.
ADMINISTRATIVE, TECHNICAL, AND PHYSICAL
SAFEGUARDS:
d. The VA Insurance website self- EXEMPTIONS PROMULGATED FOR THE SYSTEM:
service portal, which is used by None.
1. Physical Security.
a. All VA facilities are protected by veterans, their legal representatives, and
the Federal Protective Service or other payees, is only accessible with the use HISTORY:
security personnel. All Insurance files of personal identifiers consisting of
Veterans and Uniformed Services
and processing areas are restricted to PINs, passwords, file numbers, loan
Personnel Programs of U.S. Government
authorized personnel on a need-to-know numbers, social security numbers, and
Life Insurance–VA (36VA29), published
basis. Areas containing paper and dates of birth. The access portals utilize
at 75 FR 65405, October 22, 2010, was
computerized records are protected by a LAN-based encryption technology and
the last full publication of the VA
sprinkler system. Paper records firewalls to protect personal data.
e. The IVR, which is protected as part Insurance Center’s SORN 36VA29
pertaining to employees and public which provided updated information
figures, or otherwise sensitive files, are of the LAN, permits veterans to listen to
information from their insurance regarding VAIC records and
stored in locked files. Microfilm records consolidated the outdated SORNs
and compact disk (CD) back-up files of records via touch-tone telephones,
which utilize VA Insurance file 36VA00, 46VA00, and 53VA00 into one
the payment processing unit SORN.
(Collections) activities are stored in numbers to access the records.
locked, fireproof, humidity-controlled f. Data exchange by email within the Appendix I: Addresses of VA Insurance
vaults at the Insurance Center. agency or between other Federal Records Facilities
b. Access to the Philadelphia ITC and agencies is done by means of dedicated
1. VA Insurance Center, 5000 Wissahickon
Collections is secured by electronic communication lines utilizing approved Avenue, Philadelphia, PA 19144
locking devices and is restricted to encryption technology. 2. St. Paul Regional Benefit Office, 1 Federal
Philadelphia ITC and Collections Drive, Fort Snelling, St. Paul, MN
RECORD ACCESS PROCEDURE:
employees, custodial personnel, and 55111–4050
Individuals desiring access to, or 3. Iron Mountain, 1397 Glenlake Avenue,
Federal Protective Service or other wishing to contest, VA records and Itasca, IL 60143
security personnel. All other persons related procedures should write to the 4. NARA Mid-Atlantic Region (Northeast
gaining access to computer rooms and VA Insurance Center at 5000 Philadelphia), 14700 Townsend Road,
Collections are escorted by an Wissahickon Avenue, Director’s Office Philadelphia, PA 19154
individual with authorized access. (29), Philadelphia, Pennsylvania 19144. 5. NARA Great Lakes Region (Dayton
c. Access to records at the Insurance Kingsridge), 8801 Kingsridge Drive,
Center through computerized storage CONTESTING RECORD PROCEDURES: Dayton, OH 45458
systems, including VICTARS, ITS, (See Records Access Procedures 6. NARA Central Plains Region (Lee’s
NICE, and the Philadelphia ITC, is Summit), 200 Space Center Drive, Lee’s
above.)
protected by passwords, magnetic card Summit, MO 64064
readers, and audible alarms. Electronic NOTIFICATION PROCEDURES: 7. NARA Central Plains Region (Lenexa),
17501 West 98th Street, Suite 3150,
keyboard locks are activated upon Any individual who wishes to Lenexa, KS 66219
security errors. Video surveillance is determine whether a record is 8. NARA Great Lakes Region (Chicago), 7358
also provided in secured processing and maintained in this system under his or South Pulaski Road, Chicago, IL 60629
computer protected areas, such as her name or other personal identifier, 9. NARA Northeast Region (Pittsfield), 10
Claims, Collections, and the ITC. An who wants to determine the contents of Conte Drive, Pittsfield, MA 01201
amozie on DSK3GDR082PROD with NOTICES1
Information Security Officer is assigned such record, or has a routine inquiry 10. Office of Servicemembers’ Group Life
responsibility for privacy-security concerning the status of his or her Insurance, 80 Livingston Avenue,
measures, including review of violations insurance under this system, may Roseland, NJ 07068
logs and local control and distribution contact the VA Insurance Center in [FR Doc. 2018–18789 Filed 8–29–18; 8:45 am]
of passwords. Philadelphia, Pennsylvania at (215) BILLING CODE P
VerDate Sep<11>2014 17:25 Aug 29, 2018 Jkt 244001 PO 00000 Frm 00158 Fmt 4703 Sfmt 9990 E:\FR\FM\30AUN1.SGM 30AUN1](https://thefederalregister.org/doc/83_FR_44576/page/8.svg)
Document Created: 2018-08-30 01:21:39
Document Modified: 2018-08-30 01:21:39
| Category | Regulatory Information | |
| Collection | Federal Register | |
| sudoc Class | AE 2.7: GS 4.107: AE 2.106: | |
| Publisher | Office of the Federal Register, National Archives and Records Administration | |
| Section | Notices | |
| Action | Notice of modified system of records. | |
| Dates | Comments on this modified system of records must be received no later than 30 days after date of publication in the Federal Register. If no public comment is received during the period allowed for comment or unless otherwise published in the Federal Register by VA, the modified system of records will become effective a minimum of 30 days after date of publication in the Federal Register. If VA receives public comments, VA shall review the comments to determine whether any changes to the notice are necessary. | |
| Contact | Monica Keitt, Chief Privacy Officer, VA Insurance Service, Department of Veterans Affairs Insurance Center, 5000 Wissahickon Avenue, Philadelphia, PA 19144, (215) 842-2000, Ext. 2905. | |
| FR Citation | 83 FR 44407 |
2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR