48 CFR Part 824 — Protection of Privacy and Freedom of Information

PART 824—PROTECTION OF PRIVACY AND FREEDOM OF INFORMATION Authority: 5 U.S.C. 552a; 38 U.S.C. 5723-5724, 5725(a)-(c); 40 U.S.C. 121(c); 41 U.S.C. 1121(c), 1702; 38 CFR 1.550 through 1.562 and 1.575 through 1.584; and 48 CFR 1.301 through 1.304. Source: 73 FR 2717, Jan. 15, 2008, unless otherwise noted. Subpart 824.1—Protection of Individual Privacy 824.102 General. VA rules implementing the Privacy Act of 1974 are in 38 CFR 1.575 through 1.584, Safeguarding Personal Information in Department of Veterans Affairs Records. [84 FR 45681, Aug. 30, 2019] 824.103 Procedures. (c) The contracting officer shall reference the following documents in solicitations and contracts that require the design, development, or operation of a system of records— (1) VA Handbook 6500.6, Contract Security; (2) VA Handbook 6508.1, Procedures for Privacy Threshold Analysis and Privacy Impact Assessment; (3) VA Handbook 6510, VA Identity and Access Management— (i) The contracting officer will ensure that statements of work or performance work statements that require the design, development, or operation of a system of records include procedures to follow in the event of a Personally Identifiable Information (PII) breach; and (ii) The contracting officer shall ensure that Government surveillance plans for contracts that require the design, development, or operation of a system of records include monitoring of the contractor's adherence to Privacy Act/PII regulations. The assessing official should document contractor-caused breaches or other incidents related to PII in past performance reports. Such incidents include instances in which the contractor did not adhere to Privacy Act/PII contractual requirements. [84 FR 45681, Aug. 30, 2019] 824.103-70 Protection of privacy—general requirements and procedures related to Business Associate Agreements. To ensure compliance with unique responsibilities to protect protected health information (PHI), contractors performing under VA contracts subject to unique PHI and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) shall comply with requirements and the clause (852.204-71, Information and Information Systems Security) prescribed at 804.1903. (a) HIPAA Business Associate Agreement requirement. (1) Creates, receives, maintains, or transmits VHA PHI or that will store, generate, access, exchange, process, or utilize such PHI in order to perform certain health care operations activities or functions on behalf of the covered entity; or (2) Provides one or more of the services specified in the HIPAA Privacy Rule to or for the covered entity. (b) Veterans Health Administration (VHA)—a HIPAA covered entity. (c) Contractors or entities required to execute BAAs for contracts and other agreements become VHA business associates. (1) There may be other VA components or staff offices which also provide certain services and support to VHA and must receive PHI in order to do so. If these components award contracts or enter into other agreements, purchase/delivery orders, modifications, and issue Governmentwide purchase card transactions to help in the delivery of these services to VHA, they will also fall within the requirement to obtain a satisfactory assurance from these contractors by executing a BAA. (2) Contractors or other entities supporting VHA required to create, receive, maintain, or transmit VHA PHI shall be required to execute a BAA as mandated by the HIPAA Privacy Rule and requested by the contracting officer, the contracting officer's representative (COR) or the cognizant privacy officer— (i) Whether via a contract or agreement with VHA; or (ii) Whether provided from or through another VA administration or staff activity contract for supplies, services or support that involves performing a certain activity, function or service to, for, or on behalf of VHA ( see (d) BAA requirement flow down to subcontractors. i.e., [88 FR 4746, Jan. 25, 2023] 824.103-71 Liquidated damages—protection of information. (a) Purpose. (b) Applicability to contracts requiring Business Associate Agreements. see [88 FR 4746, Jan. 25, 2023] Subpart 824.2—Freedom of Information Act 824.203 Policy. (a) VA rules implementing the Freedom of Information Act (FOIA) are in 38 CFR 1.550 through 1.562. (b) Upon receipt of a request, the contracting officer shall provide the requester with the name of the cognizant VA FOIA Service Office. The VA FOIA Service Office (see http://www.oprm.va.gov/foia/ [84 FR 45681, Aug. 30, 2019]

Related documents

• 48 CFR Part 2124 — Protection of Privacy and Freedom of Information#511498
• 48 CFR Part 1324 — Protection of Privacy and Freedom of Information#511280
• 48 CFR Part 2924 — Protection of Privacy and Freedom of Information#511601
• 48 CFR Part 324 — Protection of Privacy and Freedom of Information#510980
• 48 CFR Part 624 — Protection of Privacy and Freedom of Information#511075