VA Sets Ethics Standards for Protecting Veteran Data 

A Veteran opens their device and logs into VA.gov. In a few clicks, they can review their medical data, check the status of their disability claim, or confirm the terms of their VA home loan. But, most importantly, they can trust that VA is protecting their privacy, confidentiality, and autonomy in the services VA provides or supports. VA earns Veterans’ trust by promoting and strictly adhering to its core values of integrity, commitment, advocacy, respect, and excellence, better known as I-CARE. These core values are the foundation of VA’s Principle-based Ethics Framework for Access to and Use of Veteran Data.

VA runs the largest healthcare system in the United States and is the nation’s largest benefits provider. The agency is also undergoing a complex digital transformation, led by VA’s Office of Information and Technology (OIT), but this transformation is much broader than investments in the cloud, equipment, and new services. Veterans are accustomed to a digital experience — whether depositing a check from their phone, accessing their auto insurance card from an app, or chatting with a customer service rep via text — and they expect the same options from VA. Yet those seamless, exceptional customer experiences we’re trying to create with our products and services rely on Veteran data to ensure Veterans receive accurate, timely, and relevant information, care, and access to services. VA collects, stores, monitors, and protects a massive amount of Veteran data, and we safeguard and ensure the ethical use of this data is in the best interest of Veterans.

What is VA’s Principle-based Data Ethics Framework?

VA’s ethics framework is a proactive data management and privacy approach that sets standards for access, use, or sharing of Veteran data. The framework is VA’s standard for individuals, groups, or entities who access or use Veterans’ data and keeps VA at the forefront of organizational best practices in ethical data management. VA applies the framework to all data initiatives, including those tied to VA’s COVID-19 response, our modernization efforts, and our mobile application development. It also supports VA’s massive modernization of its legacy electronic health record system and guides this work as VA expands data access and uses to various new applications. 

The framework establishes nine principles as VA’s standard for retrieving and using Veterans’ data. Adopted VA-wide in February 2020, the principles set uniform ethics standards that promote ethically strong practices for privacy and data management by VA staff and partners that directly align with VA’s mission and values, as well as the priorities and concerns of Veterans.

Why did we create the Ethics Framework?

Veterans must trust their information is safe and has clearly articulated, transparent limits on its use in ways that provide them the most benefit. To clarify expectations for access, sharing, and use of Veteran data, the VA Interoperability Leadership Team (VAIL) partnered with the Veterans Health Administration’s (VHA’s) National Center for Ethics in Health Care and developed the ethics framework with Veterans’ input. National Center Senior Ethicist Dr. Kenneth Berkowitz and VA Chief Interoperability and Veteran Access Officer Dr. Helga Rippen of OIT’s Office of Technical Integration co-led its development. Both are working with leaders across VA to operationalize the framework’s principles through the VA Data Ethics Work Group, part of VA’s Data Governance Council. 

What are the nine principles, and why are they important?

1. The primary goal for use of Veteran data is for the good of Veterans. Veteran data is personal and sensitive.
2. Veteran data should be used in a manner that ensures equity to Veterans. 
3. The sharing of Veteran data should be based on the Veteran’s meaningful choice.
4. Access to and exchange of Veteran data should be transparent and consistent. 
5. De-identified Veteran data should not be re-identified without authorization. 
6. There is an obligation of reciprocity for gains made using Veteran data.
7. All parties are obligated to ensure data security, quality, and integrity of Veteran data. 
8. Veterans should be able to access their own information. 
9. Veterans have the right to request amendments to their own information. 

The framework is vital because trust is critical. “Veterans trust VA to promote and respect their privacy, confidentiality, and autonomy in the services we provide or support,” says Dr. Berkowitz. “We earn this trust by adhering to VA’s core values of integrity, commitment, advocacy, respect, and excellence. Consistent application of this data ethics framework will ensure the integrity and trustworthiness Veterans and other stakeholders expect and deserve when Veteran data is accessed or used.”

For example, Veterans who use a mobile app to connect to VA information or services deserve a fast, efficient, and safe experience. In addition, Veterans must also trust that apps that access VA data are operating consistent with VA’s principle-based ethics standards. Mobile apps created by OIT or its vendor partners use VA’s Lighthouse Application Programming Interface (API) Platform to link with VA. The Lighthouse API Platform is the first service line in VA to incorporate the ethics framework into its business processes. This team works closely with VA’s Data Ethics Work Group to verify the management of these standards.

“OIT is moving this effort forward in an amazing way, and the Lighthouse API is a prime example,” Dr. Rippen says. “Vendors who build interfaces to the VA review and implement development guidelines tied directly to our principles. We serve Veterans first, demonstrating leadership’s commitment to our framework.”

As VA continues to modernize its technology and systems to enhance users’ experience with the latest digital tools, we remain steadfast in our commitment to protecting Veterans’ data using solid data management and privacy practices. On June 30, 2022, VA Secretary Denis McDonough approved the framework submission to the Office of the Federal Register for publication as an official VA document. The Congressional Research Service states federal rulemaking is an essential mechanism through which the federal government implements policy.

In July, The Federal Register codified the VA’s Principle-Based Ethics Framework for Access and Use of Veteran Data as a final rule. VA’s framework is one of the government’s and the tech industry’s strongest statements on ethical data practices, privacy, confidentiality, autonomy, and use of Veteran data. The Federal Registry Summary Docket #VA-2022-OTHER-0017 declares the ruling is for all parties who oversee accessing, sharing, or using Veteran data. It also applies to all individuals who retrieve, share, or use Veteran data in the context of all other specific clinical, technical, fiscal, regulatory, professional, and industry standards.

How were the ethics principles developed?

While laws, regulations, and policies set essential data access, sharing, and use standards, they don’t always direct how VA and its partners should manage data usage when regulation and policy permit organizational discretion. To mitigate this issue, the VAIL established a Data Ethics Work Group co-led by VHA’s National Center for Ethics in Health Care to draft VA’s ethical principles in 2019. The workgroup presented its concept to VA’s Data Governance Council in July 2019, and the council chartered a standing Data Ethics Workgroup as the formal VA body coordinating data ethics practices for the enterprise. In June 2020, the VA Secretary formally approved the ethical principles and released the framework VA-wide. 

The Data Ethics Workgroup includes representatives from OIT, VHA, Veterans Benefits Administration, National Cemetery Administration, VA Office of Human Resources and Administration, VA Office of Security and Preparedness, Board of Veterans Appeals, Veterans Experience Office, Office of Management, Office of Small and Disadvantage Business Utilization, VA Office of Acquisition and Logistics, VA Office of Research and Development, VA Open Data Group, VA Privacy Service, VHA Privacy Office, VHA Office of Research Oversight, and VA Office of Connected Care. Advisors include the VA Office of General Counsel, Office of the Inspector General, the Data Governance Council Secretariat, the Office of Enterprise Integration, and the Defense Health Agency.

Who should follow the principles?

VA’s framework is a dynamic approach to ethical data management and privacy and sets clear standards for VA staff and its business partners to follow. The principles apply to anyone viewing or using Veterans’ data. Having VA’s ethics framework codified in federal regulation conveys our clear expectations on how Veteran data will be viewed and used and serves as a model for other organizations to prioritize ethical data practices. 

The framework is an integral part of VA’s data governance strategy. It ensures uniform ethics standards for data practices and addresses concerns beyond traditional privacy and confidentiality practices. Given the expansion of retrieving and using VA data, the ethics framework allows efficient access, sharing, and use of VA data to support and improve Veteran health and wellness, the delivery of services to Veterans, and the overall public health. 

About the Office of the Federal Register

The National Archives Office of the Federal Register prepares and publishes various public documents. Additionally, each Federal workday, the office publishes the Federal Register, which contains current Presidential proclamations and Executive orders, Federal agency regulations having general applicability and legal effect, proposed agency rules, and documents required by statute to be published. All Federal regulations in force are codified annually in the Code of Federal Regulations.