U.S. flag
          An official website of the United States Government  Main navigation
  

        

              Data Initiatives
                              Regulations
                                                                        Row 1
                                              FAR FAR
                              Smart Matrix Smart Matrix
                              Chapter 99 (CAS) Chapter 99 (CAS)
                              Row 2
                                              DFARS DFARS
                              DFARSPGI DFARSPGI
                              AFARS AFARS
                              DAFFARS DAFFARS
                              DAFFARS MP DAFFARS MP
                              DARS DARS
                              DLAD DLAD
                              NMCARS NMCARS
                              Row 3
                                              SOFARS SOFARS
                              TRANSFARS TRANSFARS
                              AGAR AGAR
                              AIDAR AIDAR
                              CAR CAR
                              DEAR DEAR
                              DIAR DIAR
                              DOLAR DOLAR
                              Row 4
                                              DOSAR DOSAR
                              DTAR DTAR
                              EDAR EDAR
                              EPAAR EPAAR
                              FEHBAR FEHBAR
                              GSAM/R GSAM/R
                              HHSAR HHSAR
                              HSAR HSAR
                              Row 5
                                              HUDAR HUDAR
                              IAAR IAAR
                              JAR JAR
                              LIFAR LIFAR
                              NFS NFS
                              NRCAR NRCAR
                              TAR TAR
                              VAAR VAAR
                              Tools
                                                                        Archives
                              Smart Matrix
                              Regulations Search
                              Acquisition Regulation Comparator (ARC)
                              Policy Network
                                                                        CAOC
                              CAAC
                              FAR Council
                              ISDC
 Breadcrumb
        Home
                            Regulations
                            VAAR
                            PART 824 - PROTECTION OF PRIVACY AND FREEDOM OF INFORMATION
        
                  HTML
VAARPart Number: 824
        
                  

                                
                  
        Veterans Affairs Acquisition Regulations
« PreviousNext »
PART 824 - PROTECTION OF PRIVACY AND FREEDOM OF INFORMATIONPART 824 - PROTECTION OF PRIVACY AND FREEDOM OF INFORMATION       Authority:                            5 U.S.C. 552a; 38 U.S.C. 5723-5724, 5725(a)-(c); 40 U.S.C. 121(c); 41 U.S.C. 1121(c), 1702; 38 CFR 1.550 through 1.562 and 1.575 through 1.584; and 48 CFR 1.301 through 1.304.          Source:                            73 FR 2717, Jan. 15, 2008, unless otherwise noted.                                       Subpart 824.1 - Protection of Individual Privacy                                                         824.102 General.                                                            824.103 Procedures.                                                            824.103-70 Protection of privacy - general requirements and procedures related to Business Associate Agreements.                                                            824.103-71 Liquidated damages - protection of information.                                                                             Subpart 824.2 - Freedom of Information Act                                                         824.203 Policy.    **Parent topic:**  SUBCHAPTER D - SOCIOECONOMIC PROGRAMSSubpart 824.1 - Protection of Individual Privacy    824.102 General.       VA rules implementing the Privacy Act of 1974 are in 38 CFR 1.575 through 1.584, Safeguarding Personal Information in Department of Veterans Affairs Records.824.103 Procedures.       (c) The contracting officer shall reference the following documents in solicitations and contracts that require the design, development, or operation of a system of records -          (1) VA Handbook 6500.6, Contract Security;          (2) VA Handbook 6508.1, Procedures for Privacy Threshold Analysis and Privacy Impact Assessment;          (3) VA Handbook 6510, VA Identity and Access Management -          (i) The contracting officer will ensure that statements of work or performance work statements that require the design, development, or operation of a system of records include procedures to follow in the event of a Personally Identifiable Information (PII) breach; and          (ii) The contracting officer shall ensure that Government surveillance plans for contracts that require the design, development, or operation of a system of records include monitoring of the contractor's adherence to Privacy Act/PII regulations. The assessing official should document contractor-caused breaches or other incidents related to PII in past performance reports. Such incidents include instances in which the contractor did not adhere to Privacy Act/PII contractual requirements.824.103-70 Protection of privacy - general requirements and procedures related to Business Associate Agreements.       To ensure compliance with unique responsibilities to protect protected health information (PHI), contractors performing under VA contracts subject to unique PHI and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) shall comply with requirements and the clause (852.204-71, Information and Information Systems Security) prescribed at 804.1903.          (a) *HIPAA Business Associate Agreement requirement.* Under the HIPAA Privacy and Security Rules (see 45 CFR part 160), a covered entity (Veterans Health Administration (VHA)) must have a satisfactory assurance that its PHI will be safeguarded from misuse. To do so, a covered entity enters into a Business Associate Agreement (BAA) with a contractor (now the business associate), which obligates the business associate to only use the covered entity's PHI for the purposes for which it was engaged, provide the same protections and safeguards as is required from the covered entity, and agree to the same disclosure restrictions to PHI that is required of the covered entity in situations where a contractor -          (1) Creates, receives, maintains, or transmits VHA PHI or that will store, generate, access, exchange, process, or utilize such PHI in order to perform certain health care operations activities or functions on behalf of the covered entity; or          (2) Provides one or more of the services specified in the HIPAA Privacy Rule to or for the covered entity.          (b) *Veterans Health Administration (VHA) - a HIPAA covered entity.* VHA is the only administration of the Department of Veterans Affairs that is a HIPAA covered entity under the HIPAA Privacy Rule.          (c) *Contractors or entities required to execute BAAs for contracts and other agreements become VHA business associates.* BAAs are issued by VHA or may be issued by other VA programs in support of VHA. The HIPAA Privacy Rule requires VHA to execute compliant BAAs with persons or entities that create, receive, maintain, or transmit VHA PHI or that will store, generate, access, exchange, process, or utilize such PHI in order to perform certain activities, functions or services to, for, or on behalf of VHA.          (1) There may be other VA components or staff offices which also provide certain services and support to VHA and must receive PHI in order to do so. If these components award contracts or enter into other agreements, purchase/delivery orders, modifications, and issue Governmentwide purchase card transactions to help in the delivery of these services to VHA, they will also fall within the requirement to obtain a satisfactory assurance from these contractors by executing a BAA.          (2) Contractors or other entities supporting VHA required to create, receive, maintain, or transmit VHA PHI shall be required to execute a BAA as mandated by the HIPAA Privacy Rule and requested by the contracting officer, the contracting officer's representative (COR) or the cognizant privacy officer -          (i) Whether via a contract or agreement with VHA; or          (ii) Whether provided from or through another VA administration or staff activity contract for supplies, services or support that involves performing a certain activity, function or service to, for, or on behalf of VHA (*see* VA Directive 6066, Protected Health Information (PHI) and Business Associate Agreements Management).          (d) *BAA requirement flow down to subcontractors.* A prime contractor required to execute a BAA shall also obtain a satisfactory assurance, in the form of a BAA, that any of its subcontractors who will also create, receive, maintain, or transmit VHA PHI or that will store, generate, access, exchange, process, or utilize such PHI will comply with HIPAA requirements to the same degree as the contractor. A contractor employing a subcontractor who creates, receives, maintains, or transmits VHA PHI or that will store, generate, access, exchange, process, or utilize such VHA PHI under a contract or agreement is required to execute a BAA with each of its subcontractors which also obligates the subcontractor (*i.e.,* also a business associate) to provide the same protections and safeguards and agree to the same disclosure restrictions to VHA's PHI that is required of the covered entity and the prime contractor.824.103-71 Liquidated damages - protection of information.       (a) *Purpose.* As required by 38 U.S.C. 5725 any contracts where sensitive personal information such as PHI must be disclosed to the contractor for the contractor to perform certain functions or services on behalf of VHA shall include a liquidated damages clause as prescribed at 811.503-70.          (b) *Applicability to contracts requiring Business Associate Agreements.* A liquidated damages clause is required (*see* 811.503-70) when performance under a contract requires a contractor to enter into a Business Associate Agreement with VHA because the contractor or its subcontractor is required to create, receive, maintain, or transmit VHA PHI or that will store, generate, access, exchange, process, or utilize such PHI, for certain services or functions, on behalf of VHA. The liquidated damages clause shall be added even in situations where the prime contractor never directly receives VA's sensitive personal information and the same flows directly to the prime contractor's subcontractor.Subpart 824.2 - Freedom of Information Act    824.203 Policy.       (a) VA rules implementing the Freedom of Information Act (FOIA) are in 38 CFR 1.550 through 1.562.          (b) Upon receipt of a request, the contracting officer shall provide the requester with the name of the cognizant VA FOIA Service Office. The VA FOIA Service Office (see *http://www.oprm.va.gov/foia/*) is the focal point for all FOIA requests and official information may only be released through the cognizant FOIA Service or their authorized designee.
« PreviousNext »
FavoriteX

      VAAR Parts
            Regulations Vaar Menu
  

        
      Index
                              800
                              801
                              802
                              803
                              804
                              805
                              806
                              807
                              808
                              809
                              810
                              811
                              812
                              813
                              814
                              815
                              816
                              817
                              819
                              822
                              823
                              824
                              825
                              826
                              828
                              829
                              830
                              831
                              832
                              833
                              835
                              836
                              837
                              839
                              841
                              842
                              843
                              844
                              845
                              846
                              847
                              849
                              852
                              853
                              870
                              871
                              873
                              874

      ×
        Data Initiatives
                                                              Regulations
                                                              Tools
                                              Archives
                                                              Smart Matrix
                                                              Regulations Search
                                                              Acquisition Regulation Comparator (ARC)
                                                              Policy Network
                                              CAO.gov
                                                        CAO Home
                                                              Council Member
                                                                    Large Agencies
                                                              Small Agencies
                                                              Council Defining Documents
                                                                    CAOC History
                                                              CAOC Charter
                                                              Civilian Agency Acquisition Council (CAAC)
                                                              Federal Acquisition Regulatory Council
                                                              Interagency Suspension and Debarment Committee (ISDC)
                                                              Search
 ˄ Top Sign up for FAR News

                            Share the FAR
                        Upper Footer Menu
  

        
      Useful Links
                              FAR Resources
                              Training
                              Acquisition Systems
            
                            **Contact Us/FAQs**
                        **Privacy and Security Notice**
                        **Accessibility Aids**
                        **Last Updated 03/29/2024**
 ACQUISITION.GOV
                An official website of the General Services Administration About GSA
                Accessibility support
                FOIA requests
                No FEAR Act data
                Office of the Inspector General
                Performance reports
                Privacy policy Looking for U.S. government information and services?
            Visit USA.gov
 «
    
    Tt