### **CHAPTER 57—RECORDS AND INVESTIGATIONS**

#### SUBCHAPTER I—RECORDS

Sec.
5701.
Confidential nature of claims.
5702.
Furnishing of records.
5703.
Certification of records of District of Columbia.
5704.
Transcript of trial records.
5705.
Confidentiality of medical quality-assurance records.
5706.
Veterans identification card.

#### SUBCHAPTER II—INVESTIGATIONS

5711.
Authority to issue subpoenas.
5712.
Validity of affidavits.
5713.
Disobedience to subpoena.

#### SUBCHAPTER III—INFORMATION SECURITY

5721.
Purpose.
5722.
Policy.
5723.
Responsibilities.
5724.
Provision of credit protection and other services.
5725.
Contracts for data processing or maintenance.
5726.
Reports and notice to Congress on data breaches.
5727.
Definitions.
5728.
Authorization of appropriations.

#### **Editorial Notes**

#### Amendments

**2015**—Pub. L. 114–31, §2(c), July 20, 2015, 129 Stat. 430, added item 5706.

**2006**—Pub. L. 109–461, title IX, §902(b), Dec. 22, 2006, 120 Stat. 3460, added item for subchapter III and items 5721 to 5728.

**1991**—Pub. L. 102–54, §14(d)(5)(B), (6)(C), June 13, 1991, 105 Stat. 286, amended table of sections at beginning of chapter as in effect immediately before the enactment of Pub. L. 102–40 by substituting "subpoenas" for "subpenas" in item 3311 and "subpoena" for "subpena" in item 3313.

Pub. L. 102–40, title IV, §402(c)(1), May 7, 1991, 105 Stat. 239, renumbered items 3301 to 3313 as 5701 to 5713, respectively.

**1980**—Pub. L. 96–385, title V, §505(b), Oct. 7, 1980, 94 Stat. 1537, added item 3305.

#### **Statutory Notes and Related Subsidiaries**

#### Removal of Dependents From Award of Compensation or Pension

Pub. L. 116–315, title II, §2008, Jan. 5, 2021, 134 Stat. 4977, provided that: "Beginning not later than 90 days after the date of the enactment of this Act [Jan. 5, 2021], the Secretary of Veterans Affairs shall ensure that—

"(1) the recipient of an award of compensation or pension may remove any dependent from an award of compensation or pension to the individual using the eBenefits system of the Department of Veterans Affairs, or a successor system; and

"(2) such removal takes effect not later than 60 days after the date on which the recipient elects such removal."

#### Updating Dependent Information

Pub. L. 115–407, title V, §502, Dec. 31, 2018, 132 Stat. 5376, provided that: "The Secretary of Veterans Affairs shall make such changes to such information technology systems of the Department of Veterans Affairs, including the eBenefits system or successor system, as may be necessary so that whenever the Secretary records in such systems information about a dependent of a person, the person is able to review and revise such information."

#### Oversight of Electronic Health Record Modernization Program

Pub. L. 115–407, title V, §503, Dec. 31, 2018, 132 Stat. 5376, as amended by Pub. L. 117–154, §2(a), June 23, 2022, 136 Stat. 1303, provided that:

"(a) Program Documents.—Not later than 30 days after the date of the enactment of this Act [Dec. 31, 2018], the Secretary of Veterans Affairs shall submit to the appropriate congressional committees the following documents concerning the Electronic Health Record Modernization Program:

"(1) Integrated Master Plan.

"(2) Integrated Master Schedule.

"(3) Program Management Plan.

"(4) Annual and lifecycle cost estimates, including, at a minimum, cost elements relating to—

"(A) Federal Government labor;

"(B) contractor labor;

"(C) hardware;

"(D) software; and

"(E) testing and evaluation.

"(5) Cost baseline.

"(6) Risk Management Plan.

"(7) Health IT Strategic Architecture Plan.

"(8) Transition Plan for implementing updated architecture.

"(9) Data Migration Plan.

"(10) System and Data Security Plan.

"(11) Application Implementation Plan.

"(12) System Design Documents.

"(13) Legacy Veterans Information Systems and Technology Architecture Standardization, Security Enhancement, and Consolidation Project Plan.

"(14) Health Data Interoperability Management Plan.

"(15) Community Care Vision and Implementation Plan, including milestones and a detailed description of how complete interoperability with non-Department health care providers will be achieved.

"(b) Quarterly Updates.—Not later than 30 days after the end of each fiscal quarter during the period beginning with the fiscal quarter in which this Act is enacted and ending on the date on which the Electronic Health Record Modernization Program is completed, the Secretary shall submit to the appropriate congressional committees the most recent updated versions, if any exist, of the following documents:

"(1) Integrated Master Schedule.

"(2) Program Management Plan, including any written Program Management Review material developed for the Program Management Plan during the fiscal quarter covered by the submission.

"(3) Each document described in subsection (a)(4).

"(4) Performance Baseline Report for the fiscal quarter covered by the submission or for the fiscal quarter ending the fiscal year prior to the submission.

"(5) Budget Reconciliation Report.

"(6) Risk Management Plan and Risk Register.

"(c) Contracts.—Not later than 5 days after awarding a contract, order, or agreement, including any modifications thereto, under the Electronic Health Record Modernization Program, the Secretary shall submit to the appropriate congressional committees a copy of the entire such contract, order, agreement, or modification.

"(d) Notification.—

"(1) Requirement.—Not later than 10 days after an event described in paragraph (2) occurs, the Secretary shall notify the appropriate congressional committees of such occurrence, including a description of the event and an explanation for why such event occurred.

"(2) Event described.—An event described in this paragraph is any of the following events regarding the Electronic Health Record Modernization Program:

"(A) The delay of any milestone or deliverable by 30 or more days.

"(B) A request for equitable adjustment, equitable adjustment, [sic] or change order exceeding $1,000,000 (as such terms are defined in the Federal Acquisition Regulation).

"(C) The submission of any protest, claim, or dispute, and the resolution of any protest, claim, or dispute (as such terms are defined in the Federal Acquisition Regulation).

"(D) A loss of clinical or other data.

"(E) A breach of patient privacy, including any—

"(i) disclosure of protected health information that is not permitted under regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (Public Law 104–191; 42 U.S.C. 1320d–2 note); and

"(ii) breach of sensitive personal information (as defined in section 5727 of title 38, United States Code).

"(e) Quarterly Reports.—

"(1) Reports on costs of ehrm program.—Not later than 90 days after the date of the enactment of the VA Electronic Health Record Transparency Act of 2021 [June 23, 2022], and every 30 days after the last day of each fiscal quarter thereafter until the termination date specified in paragraph (3), the Secretary of Veterans Affairs shall submit to the Committees on Veterans' Affairs of the Senate and House of Representatives a report on the costs of the Electronic Health Record Modernization program of the Department of Veterans Affairs. Each such report shall include, for the period covered by the report and for the total period beginning on the date of the enactment of the VA Electronic Health Record Transparency Act of 2021 and ending on the date of the submittal of the report, a description of all actual expenses of, and driven by, such program, including any such expenses paid using—

"(A) any funds appropriated for the Department of Veterans Affairs, for any source or account, expended by any organizational element of the Department or by the Federal Electronic Health Record Modernization Office for the Electronic Health Record Modernization Program;

"(B) any funds, from any source or account, expended by any organizational element of the Department for physical or technology infrastructure modifications, enhancements, improvements, or expansions at a facility of the Department necessitated by, or related or pertaining to, the Electronic Health Record Modernization Program; and

"(C) any funds, from any source or account, expended by any organizational element of the Department or by the Federal Electronic Health Record Modernization Office for consultants, support contractors, or experts related or pertaining to the Electronic Health Record Modernization Program.

"(2) Reports on performance metrics and outcomes.—Not later than 90 days after the date of the enactment of the VA Electronic Health Record Transparency Act of 2021, and every 30 days after the last day of each fiscal quarter thereafter until the termination date specified in paragraph (3), the Secretary of Veterans Affairs shall submit to the Committees on Veterans' Affairs of the Senate and House of Representatives a report on the performance metrics and outcomes of the Electronic Health Record Modernization Program. Each such report shall include, for the period covered by the report—

"(A) a list of the quality, performance, safety, or value metrics, key performance indicators, and other diagnostic or evaluation criteria in use to assess the Electronic Health Record Modernization Program and the electronic health record system, in general and at individual facilities, with respect to veterans, employees of the Department, and Departmental operations;

"(B) an explanation of any change to any of such metrics, indicators, and criteria compared to the metrics, indicators, and criteria included in any previous report submitted under this paragraph;

"(C) the data supporting or demonstrating each such metric, indicator, and criteria compared to the data supporting or demonstrating such metric, indicator, or criteria as included in the previous report submitted under this paragraph; and

"(D) a list of patient safety reports, incidents, alerts, or disclosures at each facility of the Department where the electronic health record system has been implemented.

"(3) Termination date.—The requirement to submit a report under paragraph (1) shall terminate on the date that is 90 days after the date on which the Secretary submits to the Committees on Veterans' Affairs of the Senate and House of Representatives certification that the Electronic Health Record Modernization program has been fully implemented.

"(f) Definitions.—In this section:

"(1) The term 'appropriate congressional committees' means—

"(A) the Committees on Veterans' Affairs of the House of Representatives and the Senate; and

"(B) the Committees on Appropriations of the House of Representatives and the Senate.

"(2) The term 'Electronic Health Record Modernization Program' means—

"(A) any activities by the Department of Veterans Affairs to procure or implement an electronic health or medical record system to replace any or all of the Veterans Information Systems and Technology Architecture, the Computerized Patient Record System, the Joint Legacy Viewer, or the Enterprise Health Management Platform; and

"(B) any contracts or agreements entered into by the Secretary of Veterans Affairs to carry out, support, or analyze the activities under subparagraph (A).

"(3) The term 'electronic health record system' means the electronic health record system implemented pursuant to the Electronic Health Record Modernization Program.

"(4) The term 'Federal Electronic Health Record Management Office' means the office established under section 1635(b) of the Wounded Warrior Act (title XVI of Public Law 110–181; 10 U.S.C. 1071 note).

"(5) The term 'facility of the Department' includes a joint facility of the Department of Veterans Affairs and the Department of Defense."

#### Discontinuation of Use of Social Security Numbers To Identify Individuals in Department of Veterans Affairs Information Systems

Pub. L. 118–42, div. A, title II, §237, Mar. 9, 2024, 138 Stat. 55, provided that:

"(a) The Secretary of Veterans Affairs, in consultation with the Secretary of Defense and the Secretary of Labor, shall discontinue collecting and using Social Security account numbers to authenticate individuals in all information systems of the Department of Veterans Affairs for all individuals not later than September 30, 2024.

"(b) The Secretary of Veterans Affairs may collect and use a Social Security account number to identify an individual, in accordance with section 552a of title 5, United States Code, in an information system of the Department of Veterans Affairs if and only if the use of such number is necessary to:

"(1) obtain or provide information the Secretary requires from an information system that is not under the jurisdiction of the Secretary;

"(2) comply with a law, regulation, or court order;

"(3) perform anti-fraud activities; or

"(4) identify a specific individual where no adequate substitute is available.

"(c) The matter in subsections (a) and (b) shall supersede section 237 of division J of Public Law 117–328 [see below]."

Similar provisions were contained in the following acts:

Pub. L. 117–328, div. J, title II, §237, Dec. 29, 2022, 136 Stat. 4965.

Pub. L. 117–103, div. J, title II, §237, Mar. 15, 2022, 136 Stat. 556.

Pub. L. 116–260, div. J, title II, §237, Dec. 27, 2020, 134 Stat. 1681.

Pub. L. 116–94, div. F, title II, §238, Dec. 20, 2019, 133 Stat. 2804.

Pub. L. 115–244, div. C, title II, §239, Sept. 21, 2018, 132 Stat. 2972.

Pub. L. 115–141, div. J, title II, §240, Mar. 23, 2018, 132 Stat. 822.