SUPPLEMENTARY INFORMATION:

VA is modifying the system by revising the System Name; System Number; System Location; System Manager; Authority for Maintenance of the System; Purpose; Categories of Records in the System; Records Source Categories; Routine Uses of Records Maintained in the System; Policies and Practices for Storage of Records; Policies and Practices for Retrieval of Records; Policies and Practices for Retention and Disposal of Records; Administrative, Technical and Physical Safeguards; Record Access Procedures; Contesting Record Procedures; and Notification Procedure.

The System Name will be changed from “Automated Safety Incident Surveillance and Tracking System (ASISTS)-VA” to “Performance Logic-Employee Safety Incident Investigation Platform (ESIIP) Records-VA.”

The System Number will be changed from 99VA13 to 99VA10 to reflect the current VHA organizational routing symbol.

The System Location is being updated to replace the current language with: “Records are maintained electronically or on paper at Department of Veterans Affairs (VA) Medical Centers (address locations are listed in VA Appendix 1 of the biennial Privacy Act Issuance publication), Veterans Integrated Service Networks (VISN), and VA Data Processing Centers. Information from these records or copies of these records may be maintained by Performance Logic and the Veterans Health Administration (VHA) Central Office at 811 Vermont Avenue NW, Washington, DC 20571. Records are also located at the VA Enterprise Cloud at participating servers in the United States.”

The System Manager is being updated to replace “Office of Public Health and Environmental Hazards (13), Department of Veterans Affairs, 810 Vermont Avenue NW., Washington, DC 20420, Officials maintaining the system: Director at the facility where the employee was associated” with “Director, VHA Office of Occupational Safety and Health, vhaoccsafetyandhealthaction@va.gov, 811 Vermont Avenue NW, Washington, DC 20571.”

The Authority for Maintenance of the System is being updated to include 29 CFR 1960; 29 CFR 1904; and 29 CFR 1910.1030.

The Purpose is being updated to remove references to Workers' Compensation as the updated system has no function for submitting Workers' Compensation claims. This section is being rewritten to state, “The records and information may be used for managing work-related injuries and illnesses by identifying, characterizing, and tracking occupational injuries and illnesses and the progress of injured or ill current and former employees, trainees, contractors, subcontractors, volunteers, and other individuals working with or performing services for VHA.

With respect to occupational safety, information regarding a workplace injury or illness, including the description of the incident, any correction action taken, results of any investigation, and recommendations for employees' safety and health, is entered into ESIIP by the supervisor of an injured or ill employee and/or the health and safety personnel of the facility. These records are used to identify specific incidents of work- related injuries and illnesses; track and evaluate services and medical care of injured or ill workers; and determine emerging causes, clusters of incidents, and outbreaks. In addition, VHA uses the information to identify system-wide problems and opportunities for focused education; evaluate through statistical analysis the effectiveness health and ( printed page 45879) safety systems; develop and manage the planning, distribution, and utilization of resources; and support further research in the area of occupational medicine. Some of these data are then compiled for reporting to the Occupational Safety and Health Administration (OSHA) of the Department of (DoL), in accordance with 29 CFR part 1960. Further, the records may be used by institutional members of an accident review board or an incident review board, a multidisciplinary group of health and safety professionals and representatives from human resources, safety, occupational health, and unions/labor representatives and infection control to determine root causes of injuries and illnesses; and by VA hospitals and regional offices, VA Central Office, and the VA Office of the Inspector General for audits, reviews, and investigations of such events.

The records will be used to identify specific cases of work-related injuries and illnesses; track and evaluate medical care of and services provided to injured or ill workers, and determine emerging causes, clusters of incidents, and outbreaks. The records will also be used to identify system-wide problems and opportunities for focused education and intervention; evaluate the effectiveness of health and safety systems performance, especially after interventions, through statistical analysis; to develop and manage the planning, distribution, and utilization of resources; and support further research in the area of occupational medicine. The data may also be used for the review of root causes of injuries, for audits, reviews, and investigations of incidents involving workplace injuries and illnesses.

Data may be accessed locally, at the VISN level and Program Office level through Performance Logic directly. Nationally, data may be accessed through the rolled-up master file and data use agreements with the System Manager.

ESIIP users are at the facility, VISN and national level. At the facility level: safety and occupational health staff and safe patient handling and mobility coordinators, VHA supervisory, and VHA management staff. At the VISN level: VISN safety staff. At the national level: VHA Occupational Safety and Health.”

The Categories of Records in the System section is being updated to remove Social Security number from #1. Being added to #2 is employee, contractor, volunteer, trainee. “Health officer” is added to #5 and “medical treatment beyond first aid” is added to #7. “8. Information required for filing a workers' compensation claim with the DoL Office of Workers' Compensation Programs (OWCP) under the Federal Employee Compensation Act (FECA), 5 U.S.C. 8101 et seq. ASISTS does not contain, in whole or in part, workers' compensation claim forms filed under the FECA, any duplicates or copies of such documents, or any information that is derived from claim records” is being removed from #8 and replaced with “8. Forms attached to emails include information for the OSHA 301 form, OSHA 300 Log and VA Form 2162”. Being added is #9, Information required for annual occupational injury and illness data submission to the Bureau of Labor statistics including employee name, occupation, date of birth, date of hire, sex, and incident details.

The Records Source Categories section will clarify that these are VA employees. This section is being updated to include “Information can also be provided by the ASISTS legacy system (previous system); ESIIP has replaced ASISTS.”

Routine Uses of Records Maintained in the System section is being updated to clarify Routine Use #13 to state Federal Agencies, for Fraud and Abuse Preventing and Detecting: To other Federal agencies, such as CMS or USPS, to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs, such as detecting duplicate payments for care, or mail fraud related to delivery of VA medications.

The following Routines Uses are being added:

Routine Use #14, “Data Breach Response and Remediation, for Another Federal Agency: To another Federal agency or Federal entity, when VA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.”

Routine Use #15, “Former Employee or Contractor, Representative, for Litigation Involving Individual: To a former VA employee or contractor, as well as the authorized representative of a current or former employee or contractor of VA, in pending or reasonably anticipated litigation against the individual regarding health care provided during the period of their employment or contract with VA.”

The Policies and Practices for Storage of Records section is being updated to remove and replace, “Records are maintained magnetic tape, disk, or laser optical media with copies of back-up computer files maintained at off-site locations in most cases” with “Records are maintained on paper and stored into the VA Azure cloud.”

The Policies and Practices for Retrieval of Records section is being updated to remove the Social Security number.

The Policies and Practices for Retention and Disposal of Records section is being updated to remove, “At the current time, VA does not have records disposition authority for these records that has been approved by the Archivist of the United States. The System Manager has initiated action to seek and obtain such disposition authority in accordance with VA Handbook 6300.1, Records Management Procedures. The records will not be destroyed until VA obtains a National Archives and Records Administration (NARA) approved records disposition authority. Once VA has obtained NARA-approved records disposition authority, the agency will amend this notice to reflect that authority, and any destruction of electronic records will occur when no longer needed for administrative, legal, audit, or other operational purposes.” This section is being updated to include “General Records Schedule 2.7, item 020” at the end of the sentence “Records in this system are retained and disposed of in accordance with the schedule approved by the Archivist of the United States”.

The Administrative, Technical and Physical Safeguards section is being updated to include #4. VA Enterprise Cloud data storage conforms to security protocols as stipulated in VA Directives 6500 and 6517 as a service cloud computing environment that has been authorized at the high-impact level under the Federal Risk and Authorization Management Program. Access control standards are stipulated in specific agreements with cloud vendors to restrict and monitor access. The secure site-to-site encrypted network connection is limited to access via the VA trusted internet connection.

The Record Access Procedures section is being amended to state, “Individuals seeking information on the existence and content of records in this system pertaining to them should contact the system manager in writing as indicated above or may write or visit the VA medical facility location where they normally receive their care. A request for access to records must contain the requester's full name, address, ( printed page 45880) telephone number, be signed by the requester, and describe the records sought in sufficient detail to enable VA personnel to locate them with a reasonable amount of effort.”

The Contesting Record Procedures section is being amended to state, “Individuals seeking to contest or amend records in this system pertaining to them should contact the system manager in writing as indicated above or may write or visit the VA medical facility location where they normally receive their care. A request to contest or amend records must state clearly and concisely what record is being contested, the reasons for contesting it, and the proposed amendment to the record.”

The Notification Procedure section is being amended to state, “Generalized notice is provided by the publication of this notice. For specific notice, see Record Access Procedure, above.”

The Report of Intent to Amend a System of Records Notice and an advance copy of the system notice have been sent to the appropriate Congressional committees and to the Director of the Office of Management and Budget (OMB) as required by 5 U.S.C. 552a(c) (Privacy Act) and guidelines issued by OMB (65 FR 77677), December 12, 2000.

Signing Authority

The Senior Agency Official for Privacy, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Eddie Pool, Assistant Secretary for Information and Technology and Chief Information Officer, Department of Veterans Affairs approved this document on September 12, 2025 for publication.

SYSTEM NAME AND NUMBER:

“Performance Logic-Employee Safety Incident Investigation Platform (ESIIP) Records-VA” (99VA10)

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Records are maintained electronically or on paper at Department of Veterans Affairs (VA) Medical Centers (address locations are listed in VA Appendix 1 of the biennial Privacy Act Issuance publication), Veterans Integrated Service Networks (VISN), and VA Data Processing Centers. Information from these records or copies of these records may be maintained by Performance Logic and the Veterans Health Administration (VHA) Central Office at 811 Vermont Avenue NW, Washington, DC, 20571. Records are also located at the VA Enterprise Cloud at participating servers in the United States.

SYSTEM MANAGER(S):

Official responsible for policies and procedures: Director, VHA Office of Occupational Safety and Health, vhaoccsafetyandhealthaction@va.gov, 811 Vermont Avenue NW, Washington, DC 20571.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

5 U.S.C. Chapters 11, 31, 33,

43, 61, 63, and 83; 38 U.S.C. 501; 38 U.S.C. Chapter 74; 29 CFR 1960; 29 CFR 1904;

and 29 CFR 1910.1030.

PURPOSE(S) OF THE SYSTEM:

The records and information may be used for managing work-related injuries and illnesses by identifying, characterizing, and tracking occupational injuries and illnesses and the progress of injured or ill current and former employees, trainees, contractors, subcontractors, volunteers, and other individuals working with or performing services for VHA.

With respect to occupational safety, information regarding a workplace injury or illness, including the description of the incident, any correction action taken, results of any investigation, and recommendations for employees' safety and health, is entered into ESIIP by the supervisor of an injured or ill employee and/or the health and safety personnel of the facility. These records are used to identify specific incidents of work- related injuries and illnesses; track and evaluate services and medical care of injured or ill workers; and determine emerging causes, clusters of incidents, and outbreaks. In addition, VHA uses the information to identify system-wide problems and opportunities for focused education; evaluate through statistical analysis the effectiveness of health and safety systems; develop and manage the planning, distribution, and utilization of resources; and support further research in the area of occupational medicine. Some of these data are then compiled for reporting to the Occupational Safety and Health Administration (OSHA) of the Department of (DoL), in accordance with 29 CFR part 1960. Further, the records may be used by institutional members of an accident review board or an incident review board, a multidisciplinary group of health and safety professionals and representatives from human resources, safety, occupational health, and unions/labor representatives and infection control to determine root causes of injuries and illnesses; and by VA hospitals and regional offices, VA Central Office, and the VA Office of the Inspector General for audits, reviews, and investigations of such events.

The records will be used to identify specific cases of work-related injuries and illnesses; track and evaluate medical care of and services provided to injured or ill workers, and determine emerging causes, clusters of incidents, and outbreaks. The records will also be used to identify system-wide problems and opportunities for focused education and intervention; evaluate the effectiveness of health and safety systems performance, especially after interventions, through statistical analysis; to develop and manage the planning, distribution, and utilization of resources; and support further research in the area of occupational medicine. The data may also be used for the review of root causes of injuries, for audits, reviews, and investigations of incidents involving workplace injuries and illnesses.

Data may be accessed locally, at the VISN level and Program Office level through Performance Logic directly. Nationally, data may be accessed through the rolled-up master file and data use agreements with the System Manager.

ESIIP users are at the facility, VISN and national level. At the facility level: safety and occupational health staff and safe patient handling and mobility coordinators, VHA supervisory, and VHA management staff. At the VISN level: VISN safety staff. At the national level: VHA Occupational Safety and Health.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

The records include information concerning current and former employees, trainees, contractors, subcontractors, volunteers, and other individuals working with or performing services for VA. For the purpose of this system of records, these individuals are characterized collectively as employees.

CATEGORIES OF RECORDS IN THE SYSTEM:

The records in this system include:

1. Personal identifiers, including the injured or ill employee's name, date of birth, age, and sex;

2. Residential and professional contact data, including home and/or ( printed page 45881) mailing address, home telephone number, emergency contact information, personnel status ( i.e. employee, contractor, volunteer, trainee), and duty station;

3. Employment information, including personnel status, occupation, grade and step, date of hire, and station number;

4. Information about injuries and illnesses attributed to work, including the location of injury, cause, severity, type of injury, body parts affected, risk, and contributing factors;

5. Information from reviews and investigation of incidents conducted by the employee's supervisor and the safety personnel of that facility, including any corrective actions taken by the supervisor and the findings of the health officer;

6. Abstract information, including environmental and epidemiological registries, studies of effectiveness of health and safety systems, and further research in the area of occupational medicine;

7. Information required for reporting to OSHA of DoL, including the name of the treating physician or other health care professional, hospitalization, medical treatment beyond first aid, safety device;

8. Forms attached to emails include information for the OSHA 301 form, OSHA 300 Log and VA Form 2162; and

9. Information required for annual occupational injury and illness data submission to the Bureau of Labor Statistics, including employee name, occupation, date of birth, date of hire, sex, and incident details.

RECORD SOURCE CATEGORIES:

Information in this system of records is provided by VA employees, trainees, contractors, subcontractors, volunteers, and other affected individuals; supervisors; health and safety professionals at facilities; clinical personnel; workers' compensation personnel; and human resources staff. Information can also be provided by the ASISTS legacy system (previous system); ESIIP has replaced ASISTS.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

1. Law Enforcement, for Reporting Violations of Law: To a Federal, state, local, territorial, tribal, or foreign law enforcement authority or other appropriate entity charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing such law, provided that the disclosure is limited to information that, either alone or in conjunction with other information, indicates a violation or potential violation of law, whether civil, criminal, or regulatory in nature. The disclosure of the names and addresses of Veterans and their dependents from VA records under this routine use must also comply with the provisions of 38 U.S.C. 5701(f).

2. Congress: To a Member of Congress or staff acting upon the Member's behalf when the Member or staff requests the information on behalf of, and at the request of, the individual who is the subject of the record.

3. National Archives and Records Administration (NARA): To NARA in records management inspections conducted under 44 U.S.C. 2904 and 2906, or other functions authorized by laws and policies governing NARA operations and VA records management responsibilities.

Department of Justice (DoJ) for Litigation or Administrative Proceeding: To the DoJ, or in a proceeding before a court, adjudicative body, or other administrative body before which VA is authorized to appear, when any of the following is a party to such proceedings or has an interest in such proceedings, and VA determines that use of such records is relevant and necessary to the proceedings:

(a) VA or any component thereof;

(b) Any VA employee in his or her official capacity;

(c) Any VA employee in his or her official capacity where DoJ has agreed to represent the employee; or

(d) The United States, where VA determines that litigation is likely to affect the agency or any of its components.

4. The Joint Commission, for Accreditation: To survey teams of the Joint Commission, College of American Pathologists, American Association of Blood Banks, and similar national accreditation agencies or boards with which VA has a contract or agreement to conduct such reviews, as relevant and necessary for the purpose of program review or the seeking of accreditation or certification.

5. Merit Systems Protection Board (MSPB): To the MSPB in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions promulgated in 5 U.S.C. 1205 and 1206, or as authorized by law.

6. Equal Employment Opportunity Commission (EEOC): To the EEOC in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or other functions of the Commission as authorized by law.

Federal Labor Relations Authority (FLRA): To the FLRA in connection with the investigation and resolution of allegations of unfair labor practices, the resolution of exceptions to arbitration awards when a question of material fact is raised; matters before the Federal Service Impasses Panel; and the investigation of representation petitions and the conduct or supervision of representation elections.

7. Contractors: To contractors, grantees, experts, consultants, students, and others performing or working on a contract, service, grant, cooperative agreement, or other assignment for VA, when reasonably necessary to accomplish an agency function related to the records.

8. Unions: To labor unions operating at the facility level as members of institutional review boards, also known as accident review boards, to review root causes of injuries.

9. DoL: To the DoL for the electronic filing of workers compensation claims, as provided by 5 U.S.C. 8121.

10. Data Breach Response and Remediation, for VA: To appropriate agencies, entities, and persons when (1) VA suspects or has confirmed that there has been a breach of the system of records; (2) VA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, VA (including its information systems, programs, and operations), the Federal Government, or national security; and (3) the disclosure made to such agencies, entities, or persons is reasonably necessary to assist in connection with VA efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

11. Federal Agencies, for Preventing and Detecting Fraud and Abuse: To other Federal agencies, such as CMS or USPS, to assist such agencies in preventing and detecting possible fraud or abuse by individuals in their operations and programs, such as detecting duplicate payments for care, or mail fraud related to delivery of VA medications.

12. Data Breach Response and Remediation, for Another Federal Agency: To another Federal agency or Federal entity, when VA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (1) responding to a suspected or confirmed breach or (2) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or ( printed page 45882) entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

13. Former Employee or Contractor, Representative, for Litigation Involving Individual: To a former VA employee or contractor, as well as the authorized representative of a current or former employee or contractor of VA, in pending or reasonably anticipated litigation against the individual regarding health care provided during the period of their employment or contract with VA.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are maintained on paper and electronically. The records and backup records are stored in the VA Azure Cloud.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records are retrieved

by name or other assigned identifiers of the individuals on whom they are maintained.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records in this system are retained and disposed of in accordance with the schedule approved by the Archivist of the United States, General Records Schedule 2.7, item 020. Records in this system are retained and disposed of in accordance with the schedule approved by the Archivist of the United States.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Access to VA working space and record storage areas is restricted to VA employees on a “need-to-know” basis. Generally, VA file areas are locked after normal duty hours and are protected from outside access by the Federal Protective Service. Strict control measures are enforced to ensure that disclosure is limited to a “need to know” basis.

1. Access to records maintained at facilities, VA Headquarters, and VISN offices is restricted to VA employees who have a need for the information in the performance of their official duties. Access to information stored on automated storage media is controlled by individually unique passwords/codes that must be changed periodically by the employee. Authorized VA employees at remote locations including VA health care facilities may access information stored in the computer. Access is controlled by individually unique passwords/codes. Records are maintained in manned rooms during nonworking hours. The facilities are protected from outside access during working hours by security personnel.

2. Access to information that populates workers' compensation claim forms submitted to DOL is accessible to only the employee filing the claim, his or her supervisor, and the workers' compensation personnel of the facility.

3. VA Enterprise Cloud data storage conforms to security protocols as stipulated in VA Directives 6500 and 6517 as a service cloud computing environment that has been authorized at the high-impact level under the Federal Risk and Authorization Management Program. Access control standards are stipulated in specific agreements with cloud vendors to restrict and monitor access. The secure site-to-site encrypted network connection is limited to access via the VA trusted internet connection.

RECORD ACCESS PROCEDURES:

Individuals seeking information on the existence and content of records in this system pertaining to them should contact the System Manager in writing as indicated above or write or visit the VA facility location where they normally receive their care. A request for access to records must contain the requester's full name, address, and telephone number, be signed by the requester, and describe the records sought in sufficient detail to enable VA personnel to locate them with a reasonable amount of effort.

CONTESTING RECORD PROCEDURES:

Individuals seeking to contest or amend records in this system pertaining to them should contact the System Manager in writing as indicated above or may write or visit the VA facility location where they normally receive their care. A request to contest or amend records must state clearly and concisely what record is being contested, the reasons for contesting it, and the proposed amendment to the record.

NOTIFICATION PROCEDURES:

Individuals who wish to be notified if a record in this system of records pertains to them should submit the request following the procedures described in “Record Access Procedures,” above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

74 FR 14613 (March 31, 2009).

91 FR 45878