BVA Admits they violated Laws
Subject: BVA Admits they violated Laws In a message dated 9/17/00
9:46:53 PM Eastern Daylight Time, veteransresources@switchboardmail.com
writes:
Dear Readers,
You may remember that Veterans Resources Network uncovered and had published
evidence that the VA's Board of Veterans Appeals was publishing Board
decisions which contained veterans personal information, in violation of
Federal laws. See our egroups archive of articles at:
257.
I have just received the VA Inspector General's report, wherein the BVA
regret's the information being placed on the CD-ROM's and the internet. Also
that thousand's of CD-ROM's have been destroyed and recalled as a result of
this investigation. Below is the complete text of VAOIG case number 2000
HL-0715 issued August 16, 2000.
Veterans Resources Network is always vigilant in pursuit of News and
Information concerning the VA, and claims issues. Doing our fair share to
protect and defend the United States Constitution; Mom; apple pie; and the
American way. The last line of the report states that the BVA
"is grateful
to have had the flaw in its reviewing process revealed". To that I say:
"You
are welcome Mr. Standefer".
Your Editor,
Ray B. Davis, Jr.
##### START #####
(page 1)
Memorandum
Department of
Veterans Affairs
Date: August 16, 2000
From: Vice Chairman, Board of Veterans' Appeals (011)
Subj: Hotline Case Number 2000 HL-0715, Board of Veterans'
Appeals
To: VA OIG Hotline Section (53EH)
1. The above-referenced complaint alleges that the Board of Veterans'
Appeals has violated the Privacy Act by publishing on the internet documents
containing veteran's names, addresses, social security numbers and claim
numbers. The Board acknowledges that documents containing protected
information were improperly released along with the published decisions of
the Board. This release of information was inadvertent. The Board deeply
regrets the error, is doing everything possible to remove the information
from public access and has taken steps to prevent a repeat occurrence.
2. The complainant noted five specific documents that contained protected
information. Upon investigation the Board identified twelve documents in the
compilations of 1999 and 2000 decisions of the Board that were not decisions
and should not have been made available to the public. These documents were
included among the Board's decisions in error and were removed from the VA
web site, its internal network and from the LEXIS-NEXIS database within
hours of their being discovered. A recall of the CD-ROMs published by the
Board that contain these documents has been initiated. The Board is very
concerned with protecting the privacy of veterans and all appellants. As a
result of the discovery of this error, the Board has reexamined the
procedures by which decisions are prepared for publication.
3. The Board is required by the Freedom of Information Act to make its final
decisions available to the public. This responsibility includes ensuring
that no personal identifiers remain in the decisions when they are
published. The Board takes this responsibility very seriously and takes many
precautions before releasing decisions. Initially, Board attorneys and Board
members who draft and sign decisions are instructed to avoid using names or
other specifics that would permit a person to identify the subject of the
decision. This instruction appears in the Board's style manual, Handbook
8430.2 at 1.03 Safeguarding Personal Information in BVA Decisions, and at
2.04 (d), Citations to Opinions of the United States Court of Veterans
Appeals. The importance of avoiding the use of personal identifiers in
decisions was also a topic of review at the latest "Grand Rounds," a
training session for all BVA attorneys and Board members, held on May 23 and
24, 2000. (VA OIG Hotline Section (53EH) Page 2)
4. A review of how the Board prepares decisions for publication is necessary
in order to understand how the documents were mistakenly included in the
Board's decisions. When the Board generates a decision, remand or other
correspondence with an appellant, an electronic copy of that document is
attached to the appellant's file in the Board's computerized case
tracking system, the Veterans Appeals Control
and Locator System (VACOLS). When a document is attached it is assigned a
code to indicate its nature, whether decision, hearing transcript,
reconsideration or one of several categories of correspondence.
5. At the end of each month, the Board's Management Information Systems
office (MIS) runs a program that pulls all of the documents attached in
VACOLS in that period that are identified as decisions. This process removes
the personal identifiers that are formatted into Board decisions and puts
copies of the now redacted
decisions in that month's archive file. Because personal identifiers such as
names, addresses, places of employment, and others sometimes appear in the
text of decisions, further review is necessary before they can be
published.
6. The Board produces an average of 2800 decisions per month. It would be
prohibitively time consuming and impractical to have support personnel do a
line by line review of each decision for possible Privacy Act violations. A
program has been created by MIS that selects decisions in each month's archive
that contain certain
terms that might indicate the presence of individualized information.
Examples of these terms are the honorifics Mr., Mrs., Ms.; the
abbreviations"'C," "SS," "FV" and "RH"
that might be followed by identifying numbers; words indicating a
familial relationship,
child, son, daughter, mother, father, etc.; words indicating that an address
may be present such as Road, Street, Avenue; and words that might indicate
that a document other than a decision has been labeled incorrectly and
included in the archive by
mistake. For that purpose the words "Dear" and the surname of the
official
who most commonly signs correspondence sent to appellants are included.
7. This program generates a report that lists phrases containing suspect
terms along with citation numbers of the documents in which they appear.
Under the supervision of the Board's Freedom of Information Act/Privacy Act
officer (FOIA/PA), Board personnel review that report and check the decisions
that are indicated. If
personal identifiers are found, they are removed and replaced with the term
"redacted]." If a document in the archive file is found to be
something
other than a decision, reviewing person
nel are to delete the document entirely. Some personal identifiers may be
missed in this process. For example, a name that should be redacted may not
be preceded by one of the honorifics listed above. Places of employment do
not lend themselves to identifying (VA OIG Hotline Section
(53EH) Page 3)
terms and are consequently difficult to pick up. The Board is unaware of any
programmatic method for locating specifics in these instances.
8. After the reviewing process is complete, the FOIA/PA officer notifies
MIS. Every three months, after receiving notice that the last month's
decisions have been reviewed and properly redacted, MIS compiles the
decisions from that quarter and posts them on the Board's internal
network and on the VA Internet web site. The
decisions are also delivered to LEXIS-NEXIS quarterly for inclusion in its
system. The Board compiles its decisions on at least a yearly, and often on
a quarterly, basis for publication on CD-ROMs that are available for sale
through the Government Printing
Office (GPO).
9. In order to produce the CD-ROMs, the Board sends a master to the GPO.
GPO
records indicate that 728 of the 2nd quarter 1999 CD-ROM were produced; 713
of the 3rd quarter 1999 CD-ROM and 678 of the 1st quarter 2000 CD-ROM. GPO
has been unable to locate the print order for the 1999 full year CD-ROM and so
the exact count is
currently unknown. However, those to whom the copies were distributed have
been alerted to hold and destroy those CD-ROMs as well as the others. Copies
of each of the CD-ROMs were distributed to 80 persons on a mailing list
provided by the Board, to the Board
itself, to GPO's Depository Library Program, to the GPO Sales Documents
Warehouse, and to the Library of Congress.
10. The 80 address mailing list provided by the Board consists of 59
Department of Veterans Affairs Regional Offices (VAROs) and 21 Veterans
Service Organizations (VSOs). On July 20, 2000, the Board sent a letter or
an E-mail message to each of the 80 recipients asking that they either destroy
or return the CD-ROMs to the Board.
To date, 34 VAROs and 5 VSOs have responded. If necessary, a second
notification will be sent to non-responsive offices. The copies returned to
the Board for its own use have been identified and await destruction.
11. Within GPO, copies were distributed to its sales office and to the
Federal Depository Library Program. On July 13, 2000, the Board contacted
the sales department and requested that all sales and deliveries of these
CD-ROMs immediately cease. At that time the GPO's inventory system
partial year CD-ROMs from 1999. There was
no record of the GPO having stocks of the full year CD-ROM or the first
quarter decisions of 2000. Records indicated that 8 copies of the 9-month
CD-ROM and 18 of the 6-month CD-ROM
had been sold. Where an address of a purchaser is available, GPO will
provide it to the Board so that the individual can be contacted and asked to
return the CD-ROM in return for a corrected one. Where a copy was purchased
through the bookstore with cash, no record of the name or address was kept and
it is not possible to
contact the purchaser.
(VA OIG Hotline Section (53EH) Page 4)
12. The Chief of GPO's Depository Administration Branch, Library Programs
Service, was contacted on July 19, 2000. She undertook to have the
Superintendent of Documents send letters to each of the depository libraries
that had received any of the CD-ROMs
. These letters will inform them of the need to withdraw the CD-ROMs from
public access and request that they either return or destroy them.
13. GPO also delivered fifteen copies of each of the CD-ROMs to the Library
of Congress (LOC). GPO's contact at the LOC has been contacted and will
return the CD-ROMs that are still in its possession. That includes all 15 of
the first quarter 2000 CD-ROMs. Copies of the 1999 CD-ROMs have been
distributed worldwide and will be
difficult to recover. Along with the copies being returned, the LOC will
include addresses and contacts for copies that were distributed and the
Board will attempt to retrieve them
.
14. As soon as electronic access to these documents had been blocked and
attempts to retrieve the CD-ROMs initiated, the Board began an inquiry into
the cause of the error. It is apparent that it was caused by a breakdown in
communication between the personnel responsible for reviewing the documents
and those who compile them
for electronic distribution. The offending documents had been mislabeled in
VACOLS as decisions and included in the archive file in error. The program
that identifies documents for review did identify these letters. However
the FOIA/Privaçy Act officer's
instructions to the personnel responsible for deleting them were inadequate.
The reviewer thought that MIS would delete the documents and MIS assumed
that the reviewer had already done so. Ultimate responsibility rests with the
Board's FOIA/PA officer who
notified MIS that the decisions were ready for publication.
Board deeply regrets this inadvertent release of protected
information
but is grateful to have had the flaw in its reviewing process revealed. The
personnel charged with reviewing the pre-publication decisions have been
properly instructed and the procedure clarified. In the future, the MIS
program that identifies decisions
for review will be run against each archive file a second time after
redaction is complete to ensure that all suspect terms have been examined
and, if necessary, removed.
Richard B. Standefer
The opinions and postings do not reflect those of NVOA.
Please respond in private mail to the sender if you have
an issue with a posting and not a comment relative to the
list.To remove yourself from this list, please go to:
to the list.
NVOA reserves the right to deny or remove anyone from the
list.