VBA - Private Medical Records Portal Assessing (PMR(DOMA))

Privacy Impact Assessment for the VA IT System called:

VBA Private Medical Records Portal

VBA Compensation Service

Veterans Benefits Administration

Date PIA submitted for review:

February 6, 2023

System Contacts:

System Contacts

Name

E-mail

Phone Number

Privacy Officer

Jean-Claude Wicks

Jean-

Claude.Wicks@va.gov

(202) 502-0084

Information System

Security Officer (ISSO)

George L. Ragland III

George.Ragland@va.gov

973-297-3348

Information System

Owner

Shaun Chelgreen

Shaun.Chelgreen1@va.gov

314-253-6876

Version Date: October 1, 2022

Page 1 of 29

Abstract

The abstract provides the simplest explanation for “what does the system do?” and will be published

online to accompany the PIA link.

VBA Private Medical Records Portal is currently assigned the acronym DOMA. The vendor

“DOMA Technologies, LLC (DOMA)” supports operations for the Private Medical Records

(PMR) Retrieval Program. For that reason, the vendor will be referred in this document as

“the vendor” rather than by name.

The program is deployed nationally and provides development assistance to VA Regional

Offices (VARO) and Pension Maintenance Centers (PMC) in obtaining private medical records

required to substantiate benefit claims for Veterans and their beneficiaries. The vendor's

proprietary technology platform is Electronic Knowledge Database (EKDB), formerly known

by VA as "iCharts." EKDB is commonly referred to by Veterans Benefits Administration

(VBA) users as the "PMR Portal" and provides a centralized, single point of entry for all

electronically date stamped requests to obtain private treatment records. EKDB resides outside

of VA's network firewall. It does not interface with any VBA system or application. DOMA

Technologies has established MOUs with Veterans Claims Intake (VCI) vendors, Systems

Made Simple (SMS) and GENERAL DYNAMICS INFORMATION TECHNOLOGY (GDIT)

to create bi-directional exchanges of information to automate transmission of requests at scan

for immediate processing, and to ingest the treatment records (and other related documents)

into the VBMS eFolder at completion of development.

Overview

The overview is the most important section of the PIA. A thorough and clear overview gives the reader

the appropriate context to understand the responses in the PIA. The overview should contain the

following elements:

1 General Description

A. The IT system name and the name of the program office that owns the IT system.

Please provide response here

VBA Private Medical Records Portal (DOMA); VBA Compensation Service

B. The business purpose of the program, IT system, or technology and how it relates to the

program office and agency mission.

Please provide response here

DOMA is deployed nationally and provides development assistance to VA Regional Offices

(VARO) and Pension Maintenance Centers (PMC) in obtaining private medical records

required to substantiate benefit claims for Veterans and their beneficiaries.

C. Indicate the ownership or control of the IT system or project.

Veterans Benefits Administration, VBA Compensation Service

Version Date: October 1, 2022

Page 2 of 29

2. Information Collection and Sharing

D. The expected number of individuals whose information is stored in the system and a brief

description of the typical client or affected individual.

There are approximately 50,000 individuals with PII stored in the system. The

typical client is a Veteran

E. A general description of the information in the IT system and the purpose for collecting this

information.

Private medical records required to substantiate benefit claims for Veterans and

their beneficiaries

F. Any information sharing conducted by the IT system. A general description of the modules

and subsystems, where relevant, and their functions.

DOMA does not directly interface with any VBA system or application. The

vendor has established MOUs with Veterans Claims Intake (VCI) vendors, SMS, and

GDIT creating bi-directional information exchanges to automate transmission requests

at scan for immediate processing and ingest the treatment records (and other related

documents) into the VBMS eFolder at development completion

G. Whether the system is operated in more than one site, and if so, a description of how use of

the system and PII is maintained consistently in all sites and if the same controls are used

across sites.

DOMA resides outside of VA's network firewall/network at the Vendor’s QTS

Datacenter

3. Legal Authority and SORN

H. A citation of the legal authority to operate the IT system.

The legal authority to operate this system are SORN 58VA21/22/28; Title 10 U.S.C.

chapters 106a, 510, 1606 and 1607; and Title 38, U.S.C., section 501(a) and Chapters 11, 13,

15, 18, 23, 30, 31, 32, 33, 34, 35, 36, 39, 51, 53, and 55

The Privacy Act of 1974, set forth at 5 U.S.C. 552a, states the legal authority to utilize

this information. As per the SORN, The U.S. government is authorized to ask for this

information under Executive Orders 9397, 10450, 10865, 12333, and 12356; sections 3301 and

9101 of title 5, U.S. Code; sections 2165 and 2201 of title 42, U.S. Code; sections 781 to 887 of

title 50, U.S. Code; parts 5, 732, and 736 of title 5, Code of Federal Regulations; and Homeland

Security Presidential Directive 12.

I. If the system is in the process of being modified and a SORN exists, will the SORN require

amendment or revision and approval? If the system is using cloud technology, does the SORN

for the system cover cloud usage or storage?

The system is not in process of modification; it will be replaced by a cloud-based

SaaS from the same vendor, with a separate ATO

Version Date: October 1, 2022

Page 3 of 29

J. Whether the completion of this PIA will result in circumstances that require changes to

business processes

Completion of this PIA will not result in processing changes

K. Whether the completion of this PIA could potentially result in technology changes

Completion of this PIA will not result in technology changes

Section 1. Characterization of the Information

The following questions are intended to define the scope of the information requested and collected as

well as the reasons for its collection as part of the program, IT system, or technology being developed.

1.1 What information is collected, used, disseminated, created, or maintained in the system?

Identify and list all Sensitive Personal Information (SPI) that is collected and stored in the system,

including Individually Identifiable Information (III), Individually Identifiable Health Information (IIHI),

Protected Health Information (PHI), and Privacy- Protected Information. For additional information on

these information types and definitions, please see VA Directives and Handbooks in the 6500 series

(https://vaww.va.gov/vapubs/). If the system creates information (for example, a score, analysis, or

report), list the information the system is responsible for creating.

If a requesting system receives information from another system, such as a response to a background

check, describe what information is returned to the requesting system.

This question is related to privacy control AP-1, Authority To Collect, and AP-2, Purpose Specification.

The information selected below must match the information provided in question 2.1 as well as the data

elements columns in 4.1 and 5.1.

Please check any information listed below that your system collects, uses, disseminates, creates, or

maintains. If additional SPI is collected, used, disseminated, created, or maintained, please list those in

the text box below:

☒ Name

☒ Social Security Number

☒ Date of Birth

Mother’s Maiden Name

☒ Personal Mailing

Address

☒ Personal Phone

Number(s)

Personal Fax Number

☒ Personal Email

Address

Emergency Contact

Information (Name, Phone

Number, etc. of a different

individual)

Financial Information

Health Insurance

Beneficiary Numbers

Account numbers

☒ Certificate/License

numbers*

Vehicle License Plate

Number

Internet Protocol (IP)

Address Numbers

Medications

☒ Medical Records

Race/Ethnicity

Tax Identification

Number

Medical Record

Number

Gender

Integrated Control

Number (ICN)

Military

History/Service

Connection

Next of Kin

Other Data Elements

(list below)

Version Date: October 1, 2022

Page 4 of 29

• Photographic

Images

PII Mapping of Components (Servers/Database)

DOMA consists of 2 key components (servers/databases). Each component has been analyzed to

determine if any elements of that component collect PII. The type of PII collected by DOMA and the

reasons for the collection of the PII are in the table below.

Note: Due to the PIA being a public facing document, please do not include the server names in the table.

The first table of 3.9 in the PTA should be used to answer this question.

Internal Database Connections

Database Name of

the information

system

collecting/storing PII

Does this

system collect

PII? (Yes/No)

Does

this

system

store

PII?

(Yes/No)

Type of PII

(SSN, DOB,

etc.)

Reason for

Collection/

Storage of PII

Safeguards

Batch File Import

Yes

VAF 21-

4142 &

Private

Medical

Records

(Name, SSN,

DOB,

Medical

Records)

(1) Obtain

Veterans

private

medical

records and

(2) return

them for

upload to the

Veterans

eFolder for

evaluating

disability

claims.

Secure File

Transfer

Protocol

Document

Repository

Yes

VAF 21-

4142, Private

Medical

Records

(Name, SSN,

DOB,

Medical

Records), &

Other

Medical

Records

Development

Documents

Records are

held 1 yr

after

transmission

to VBMS,

then

destroyed.

System is

operating

with an

ATO

Version Date: October 1, 2022

Page 5 of 29

1.2 What are the sources of the information in the system?

These questions are related to privacy controls DI-1, Data Quality, and IP-1, Consent.

1.2a List the individual, entity, or entities providing the specific information identified above. For

example, is the information collected directly from the individual as part of an application for a

benefit, or is it collected from other sources such as commercial data aggregators?

Information is collected from sources internal to VA, such as Veteran’s Private Health

Providers (PHP) data uploaded to VBMS. Data can potentially be collected directly from

the VAF 21-4142 request, a manual process. The VAF 21-4142 process is no longer used by

VA but has not been removed from DOMA capabilities

1.2b Describe why information from sources other than the individual is required. For example, if a

program’s system is using data from a commercial aggregator of information or data taken from

public Web sites, state the fact that this is where the information is coming from and then in question

indicate why the system is using this source of data.

Data is required so the VA’s Veteran benefits record has pertinent, updated medical

information for providing the entitlement to benefits.

1.2c If the system creates information (for example, a score, analysis, or report), list the system as a

source of information.

DOMA does not create data

1.3 How is the information collected?

These questions are related to privacy controls DI-1, Data Quality, and IP-1, Consent.

1.3a This question is directed at the means of collection from the sources listed in question 1.2.

Information may be collected directly from an individual, received via electronic transmission from

another system, or created by the system itself. Specifically, is information collected through

technologies or other technologies used in the storage or transmission of information in identifiable

form?

Data in DOMA is collected from other VA sources via electronic transmission, not directly

from Veterans. Transmission follows VA requirements (de-identification and/or

encryption.

1.3b If the information is collected on a form and is subject to the Paperwork Reduction Act, give the

form’s OMB control number and the agency form number.

Information is not collected directly by DOMA

Version Date: October 1, 2022

Page 6 of 29

1.4 How will the information be checked for accuracy? How often will it be checked?

These questions are related to privacy controls DI-1, Data Quality, and DI-2, Data Integrity and

Integrity Board.

1.4a Discuss whether and how often information stored in the system is checked for accuracy. Is

information in the system checked against any other source of information (within or outside your

organization) before the information is used to make decisions about an individual? For example, is

there a computer matching agreement in place with another government agency? For systems that

receive data from internal data sources or VA IT systems, describe the system checks to ensure that

data corruption has not occurred during transmission.

The information stored in the system is verified by DOMA using VBA’s Share a pplication.

DOMA verifies the Veteran’s profile information (SSN, DOB, etc.) on the VAF 21 -4142

against VBA’s Corporate database to ensure accuracy before processing the request. Once

medical record development (letters, treatment records, reports of contact) is complete the

data is transmitted to VCI, CM for subsequent upload into VBMS. DOMA returns a

metadata file with the development documents for each Veteran record that is validated for

accuracy against the corporate database.

1.4b If the system checks for accuracy by accessing a commercial aggregator of information,

describe this process and the levels of accuracy required by the contract.

DOMA does not access commercial information aggregators

1.5 What specific legal authorities, arrangements, and agreements defined the collection of

information?

List the full legal authority for operating the system, specifically the authority to collect the

information listed in question 1.1. Provide the authorities in a manner understandable to any

potential reader, i.e., do not simply provide a legal citation; use statute names or regulations in

addition to citations. Legal authorities include Federal laws, regulations, statutes, and Executive

Orders. This question is related to privacy control AP-1, Authority to Collect

The claimant’s SSN is included on source materials provided by VA. As part of the

Veterans Benefit Act, 38 U.S. Code § 7703 governed by the Code of Federal Regulations, 38

CFR §§ 1.575(b), 3.216 requires assisting claimants with adjudication, including obtaining

private medical records on their behalf. Records are stored in VA’s existing system of

records ‘‘Compensation, Pension, Education, and Rehabilitation Records”—VA

(58VA21/22/28). Authority for system maintenance falls under Title 10 United States Code

(U.S.C.) chapters 106a, 510, 1606 and 1607; and Title 38, U.S.C., section 501(a) and

Chapters 11, 13, 15, 18, 23, 30, 31, 32, 33, 34, 35, 36, 39, 51, 53, and 55. VA’s gathering and

creating these records enables it to administer statutory benefits programs to veterans,

Version Date: October 1, 2022

Page 7 of 29

service members, reservists, their spouses, surviving spouses, and dependents. Claims are

filed claims for a wide variety of Federal benefits administered by VA.

Office of Management and Budget (OMB) Memorandum 07-16 “Safeguarding Against and

Responding to the Breach of Personally Identifiable Information”, directs all Federal

agencies to review and minimize use of SSNs. The President’s Task Force on Identity Theft

report “Combating Identity Theft: A Strategic Plan”, released April 23, 2007, recommends

reducing SSNs use by Federal agencies. The Administrations and Staff Offices developed

and implemented plans to reduce or eliminate the collection and use of SSNs except where

a compelling business need is shown or the collection and use is authorized by law or

deemed necessary to the mission of the Department, as described by the Secretary. VA

Handbook 6507.1 “Acceptable Uses of the SSN”, Paragraph 2, authorizes VA to co llect the

SSN to aid the retrieval of medical records from providers.

The Privacy Act of 1974, set forth at 5 U.S.C. 552a, states the legal authority to utilize this

information. As per the SORN, The U.S. government is authorized to ask for this

information under Executive Orders 9397, 10450, 10865, 12333, and 12356; sections 3301

and 9101 of title 5, U.S. Code; sections 2165 and 2201 of title 42, U.S. Code; sections 781 to

887 of title 50, U.S. Code; parts 5, 732, and 736 of title 5, Code of Federal Regulations; and

Homeland Security Presidential Directive 12.

1.6 PRIVACY IMPACT ASSESSMENT: Characterization of the information

Consider the specific data elements collected and discuss the potential privacy risks and what steps,

if any are currently being taken to mitigate those identified risks. (Work with your System ISSO to

complete this section)

Consider the following Fair Information Practice Principles (FIPPs) when assessing the risk to

individual privacy:

Principle of Purpose Specification: Explain how the collection ties with the purpose of the

underlying mission of the organization and its enabling authority.

Principle of Minimization: Is the information directly relevant and necessary to accomplish the

specific purposes of the program?

Principle of Individual Participation: Does the program, to the extent possible and practical, collect

information directly from the individual?

Principle of Data Quality and Integrity: Are there policies and procedures for VA to ensure that

personally identifiable information is accurate, complete, and current?

This question is related to privacy control AR-1, Governance and Privacy Program, and AR-2,

Privacy Impact and Risk Assessment.

Follow the format below when entering your risk assessment:

Version Date: October 1, 2022

Page 8 of 29

Privacy Risk: Personally Identifiable Information (PII) and other Sensitive Personal

Information (SPI) contained on the system could potentially be accessed by unauthorized

users.

Mitigation: The vendor maintains all paper or private medical records provided by the

PHP. The requests, letters and private medical records are kept for at least 1 year after

confirming the documents were successfully uploaded to VBMS. After 1 year, the following

minimum guidelines are followed in destruction: paper records are pulped, macerated, or

shredded to a degree definitively ensuring they are not readable or reconstructable (no

longer used). Final destruction must be performed by a National Association for

Information Destruction (NAID) certified, bonded, and insured recycler or paper mill. Any

intermediary processes must protect the records until final destruction is complete.

DOMA electronic records storage encrypts data on the system and retains the data for at

least 1 year after confirming the documents were successfully uploaded to VBMS. The

contractor is required to follow guidelines found in VA Handbook 6500 and 6371. All data

and reports shall be transferred to VBA upon contract completion. Before termination or

completion of this contract, Contractor will not destroy information received from VA, or

gathered / created by the Contractor while performing this contract, without prior written

approval by the VA / Contracting Officer. A Contractor destroying data VA data must do

so in accordance with National Archives and Records Administration (NARA)

requirements found in VA Directive 6300 “Records and Information Management”,

Handbook 6300.1, “Records Management Procedures”, applicable VA Records Control

Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by

the Contractor that the data destruction requirements above have been met must be sent to

the VA Contracting Officer within 30 days of contract termination. The guidance

documents are available at: VA Publications Search List

https://vaww.va.gov/vapubs/search_action.cfm?dType=1

Section 2. Uses of the Information

The following questions are intended to clearly delineate the use of information and the accuracy of

the data being used.

2.1 Describe how the information in the system will be used in support of the program’s

business purpose.

Identify and list each use (both internal and external to VA) of the information collected or

maintained. This question is related to privacy control AP-2, Purpose Specification.

Name: identify and track individual(s) in VA systems Address: identify and track

individual(s) in VA systems. SSN: identify and track individual(s) in VA systems. DoB:

identify and track individual(s) in VA systems. Mailing Address: identify and track

Version Date: October 1, 2022

Page 9 of 29

individual(s) in VA systems. Zip Code: identify and track individual(s) in VA systems.

Previous Medical Records: identify and track individual(s) in VA systems; evidence for

benefits claims. Death Certificate: identify and track individual(s) in VA systems

2.2 What types of tools are used to analyze data and what type of data may be produced?

These questions are related to privacy controls DI-1, Data Quality, DI-2, Data Integrity and

Integrity Board, and SE-1, Inventory of Personally Identifiable Information.

2.2a Many systems sift through large amounts of information in response to a user inquiry or

programmed functions. Systems may help identify areas that were previously not obvious and need

additional research by agents, analysts, or other employees. Some systems perform complex

analytical tasks resulting in, among other types of data, matching, relational analysis, scoring,

reporting, or pattern analysis. Describe any type of analysis the system conducts and the data that is

created from the analysis.

DOMA does not perform analysis of information within records. Medical records requests

are provided to DOMA through electronic transmission from VCI, CM. Veteran profile

information is provided to DOMA through a metadata file. Metadata can also be found on

the medical records request. DOMA provides this form to PHPs for retrieval of medical

records. After receiving the medical record package from the PHP DOMA verifies data

against the original request for accuracy. All documents are returned to VCI, CM for

storage in VBMS.

2.2b If the system creates or makes available new or previously unutilized information about an

individual, explain what will be done with the newly derived information. Will it be placed in the

individual's existing record? Will a new record be created? Will any action be taken against or for

the individual identified because of the newly derived data? If a new record is created, will the newly

created information be accessible to Government employees who make determinations about the

individual? If so, explain fully under which circumstances and by whom that information will be

used.

DOMA does not create data

2.3 How is the information in the system secured?

These questions are related to security and privacy controls SC-9, Transmission Confidentiality, and

SC-28, Protection of Information at Rest.

2.3a What measures are in place to protect data in transit and at rest?

The PMR Portal and supporting servers reside on AWS GovCloud. As an AWS Advanced

Partner, DOMA follows AWS Best Practices for safeguarding customer data. All data in

transit is encrypted using Transport Layer Security (TLS) v1.2 and systems reside behind

load balancers and web application firewalls (never directly accessible). All data at rest is

encrypted with the Advanced Encryption Standard using 256-bit keys (AES-256).

Version Date: October 1, 2022

Page 10 of 29

2.3b If the system is collecting, processing, or retaining Social Security Numbers, are there

additional protections in place to protect SSNs?

Customer data entered into the PMR Portal Database is stored as encrypted strings using

AES-128 encryption; this would include SSNs.

2.3c How is PII/PHI safeguarded in accordance with OMB Memorandum M-06-15?

DOMA follows the rule of least privilege and access to the PMR Portal is restricted

to business use only. The use of PII/PHI within the portal is outlined in contractual

requirements and business units’ access to specific metadata elements is restricted

by role and task areas.

2.4 PRIVACY IMPACT ASSESSMENT: Use of the information.

Describe any types of controls that may be in place to ensure that information is handled in

accordance with the uses described above. Example: Describe if training for users of the project

covers how to appropriately use information. Describe the disciplinary programs or system

controls (i.e. denial of access) that are in place if an individual is inappropriately using the

information.

Consider the following FIPPs below to assist in providing a response:

Principle of Transparency: Is the PIA and SORN, if applicable, clear about the uses of the

information?

Principle of Use Limitation: Is the use of information contained in the system relevant to the mission

of the project?

This question is related to privacy control AR-4, Privacy Monitoring and Auditing, AR-5, Privacy

Awareness and Training, and SE-2, Privacy Incident response.

2.4a How is access to the PII determined?

The information can only be accessed by DOMA employees who have background

investigations completed at the correct level and have completed annual VA TMS security

and privacy awareness training / rules of behavior. DOMA monitors and audit access by

DOMA employees.

2.4b Are criteria, procedures, controls, and responsibilities regarding access documented?

Yes (AC-2)

2.4c Does access require manager approval?

Version Date: October 1, 2022

Page 11 of 29

Access to the VA network and DOMA requires ISO / COR approval (AC-2.22), monitored

by the vendor.

2.4d Is access to the PII being monitored, tracked, or recorded?

Access for DOMA personnel is monitored by monthly AD audits performed and recorded

at access-hosting facilities; and by quarterly audits of Elevated Privileges performed and

recorded by access-hosting facility and VA Strong Authentication (oversees all Elevated

Privileges). In addition, the vendor monitors, performs, and records access for personnel

directly controlled by the vendor. Tracking and recording is made available to the ISO.

2.4e Who is responsible for assuring safeguards for the PII?

The vendor monitors and assures PII safeguards. Information transmitted to DOMA is the

responsibility of the transmitter.

Section 3. Retention of Information

The following questions are intended to outline how long information will be retained after the initial

collection.

3.1 What information is retained?

Identify and list all information collected from question 1.1 that is retained by the system.

This question is related to privacy controls DM-1, Minimization of Personally Identifiable

Information, and DM-2, Data Retention and Disposal

DOMA retains: all private medical records and media (CD, USB, etc.) containing copies of

PHP-provided medical records; and requests, letters and private medical records.

3.2 How long is information retained?

In some cases VA may choose to retain files in active status and archive them after a certain period

of time. State active file retention periods, as well as archived records, in number of years, for the

information and record types. For example, financial data held within your system may have a

different retention period than medical records or education records held within your system,

please be sure to list each of these retention periods. The VA records officer should be consulted

early in the development process to ensure that appropriate retention and destruction schedules are

implemented. If the system is using cloud technology, will it be following the NARA approved

retention length and schedule? This question is related to privacy control DM-2, Data Retention and

Disposal.

Version Date: October 1, 2022

Page 12 of 29

Requests and records are kept for at least one year after confirming the documents were

successfully uploaded to VBMS.

3.3 Has the retention schedule been approved by the VA records office and the National

Archives and Records Administration (NARA)?

An approved records schedule must be obtained for any IT system that allows the retrieval of a

record via a personal identifier. The VA records officer will assist in providing a proposed schedule.

The schedule must be formally offered to NARA for official approval. Once NARA approves the

proposed schedule, the VA records officer will notify the system owner. Please work with the system

Privacy Officer and VA Records Officer to answer these questions.

This question is related to privacy control DM-2, Data Retention and Disposal.

3.3a Are all records stored within the system of record indicated on an approved disposition

authority?

The vendor database which stores DOMA data is not a system of record; and the system of

record for ingest of DOMA-related documents is VBMS.

3.3b Please indicate each records retention schedule, series, and disposition authority.

The retention length is a contract requirement between VA and the vendor.

3.4 What are the procedures for the elimination or transfer of SPI?

Explain how records are destroyed, eliminated or transferred to NARA at the end of their mandatory

retention period. Please give the details of the process. For example, are paper records shredded

on site, or by a shredding company and accompanied by a certificate of destruction, etc.? This

question is related to privacy control DM-2, Data Retention and Disposal.