Privacy Act of 1974; System of Records

DEPARTMENT OF VETERANS AFFAIRS

[Docket No. VA-2026-VACO-0001]

Privacy Act of 1974; System of Records

AGENCY:

Debt Management Center (DMC), Department of Veterans Affairs (VA).

ACTION:

Notice of a modified system of records.

SUMMARY:

Pursuant to the Privacy Act of 1974, notice is hereby given that VA is modifying the system of records titled “Centralized Accounts Receivable System/Centralized Accounts Receivable On-Line System (CARS/CAROLS)” (88VA244). This system is used to collect and maintain information on individuals that have an accounts receivable resulting from participating in a VA benefit program. It is designed to assist in the collection of government overpayments (debts). The system reflects the accounts receivable under the jurisdiction of the VA DMC. The system displays debts which are generated from four main areas in the Veterans Benefits Administration: Education, Compensation, Pension, and Loan Guaranty. The system also houses some debts relating to the Veterans Health Administration but does not directly contain medical records.

DATES:

Comments on this modified system of records must be received no later than 30 days after publication in the

Federal Register

. If no public comment is received during the period allowed for comment or unless otherwise published in the

Federal Register

by VA, the modified system of records will become effective a minimum of 30 days after date of publication in the

Federal Register

. If VA receives public comments, VA shall review the comments to determine whether any changes to the notice are necessary.

ADDRESSES:

Comments may be submitted through

www.regulations.gov

under docket number VA-2026-VACO-0001 or mailed to VA Privacy Service (005X6F), 810 Vermont Avenue NW, Washington, DC 20420. Comments should indicate that they are submitted in response to “Centralized Accounts Receivable System/Centralized Accounts Receivable On-Line (CARS/CAROLS)” (88VA244). Instructions for accessing agency documents, submitting comments, and viewing the docket are available on

www.regulations.gov

under “FAQ.”

FOR FURTHER INFORMATION CONTACT:

Morgen Egesdal, Management Analyst, FOIA, Privacy and Records Officer, Debt Management Center, Office of Management,

Morgan.Egesdal@va.gov

.

SUPPLEMENTARY INFORMATION:

VA is modifying the systems of records by revising the following sections: System Name, System Location, System Manager, Categories of Records in the System, Routine Uses, Policies and Practices for Storage of Records, Policies and Practices for Retrieval of Records, Policies and Practices for Retention and Disposal of Records, Administrative, Technical, and Physical Safeguards, Record Access Procedures, Contesting Records Procedures, Notification Procedures, and History.

System Name is being changed to “Benefits Accounts Receivable Records (BARR)—VA.”

System Location is being updated to “Applications servers, external interface, and databases located at the VA Austin Information Technology Center (AITC) in Austin, TX.”

System Manager email is being updated to

“DMC_SSOD_Questions@va.gov.”

Categories of Records in the System is being updated in part to “VA file number, social security number, Receivable ID, Tax Identification Number (TIN), name, date of birth, mailing address, loan reference number, phone number, email address, financial information, and VA benefit overpayment (debt) information.”

Routine Uses are being updated to align with VA standard practices.

Routine uses 1-16 and 19-23 remain the same in substance, if not exact verbiage.

The former routine use 17 is being removed, as it is covered under routine use 5.

The former routine use 18 is being split into routine uses 17 and 18, respectively, to state “Treasury, for Payment or Reimbursement—To the

Department of the Treasury to facilitate payments to veterans for reimbursement of authorized expenses, as well as to collect, by set off or otherwise, debts owed the United States.” and “Treasury, for Withholding—To the Department of the Treasury for the collection of title 38 benefit overpayments, overdue indebtedness, or costs of services provided to an individual not entitled to such services, by the withholding of all or a portion of the person's Federal income tax refund, provided that the disclosure is limited to information concerning an individual's indebtedness by virtue of a person's participation in a benefits program administered by VA.”

The title of routine use 23 is being updated to “Third Party Collection Agencies, for Debt Collection Purposes,” while the text it precedes remains the same.

The Do Not Pay routine use number 24 is being added to comply with OMB disclosure requirements.

The Policies and Practices for Storage of Records is being updated to “Records are maintained electronically on computer storage devices such as servers and cloud storage. The computer storage devices are located at the AITC. Computer records are maintained in a secure password protected environment.”

Policies and Practices for Retrieval of Records is being updated to “Records may be retrieved or identified using any combination of the following: VA file number, VA Receivable ID, social security number, full name, date of birth, address, phone number.”

Policies and Practices for Retention and Disposal of Records is being updated to “Records in this system are retained and disposed of in accordance with the schedule approved by the Archivist of the United States, General Records Schedule 1.1, Item number 10.”

Administrative, Technical, and Physical Safeguards is being updated to “Access to these records is restricted to authorized VA employees or contractors, on a “need to know” basis. Offices where these records are maintained are locked after working hours and are protected from outside access by the Federal Protective Service, other security officers, and alarm systems. Access to computerized records is restricted to authorized VA employees or contractors, by means of Single Sign-On Integration (SSOI) and two factor authentication via the use of employee PIV cards and unique PIN. Security controls used to protect personal sensitive data are commensurate with those required for an information system rated moderate for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, “Recommended Security Controls for Federal Information Systems,” Revision 4. Administrative controls include the policies and procedures governing the agency program and systems operated within, background investigations for privileged users, and rules of behavior. Technical controls include role-based, user access controls and data encryption.”

Record Access Procedures is being updated to “Individuals seeking information on the existence and content of records in this system pertaining to them should contact the system manager in writing as indicated above. A request for access to records must contain the requester's full name, address, telephone number, be signed by the requester, and describe the records sought in sufficient detail to enable VA personnel to locate them with a reasonable amount of effort.”

Contesting Records Procedures is being updated to “Individuals seeking to contest or amend records in this system pertaining to them should contact the system manager in writing as indicated above. A request to contest or amend records must state clearly and concisely what record is being contested, the reasons for contesting it, and the proposed amendment to the record.”

Notification Procedures is being updated to “Individuals who wish to be notified if a record in this system of records pertains to them should submit the request following the procedures described in “Record Access Procedure, above.”

History is being updated to “63 FR 16864 (April 6, 1998); 83 FR 40140 (August 13, 2018).”

Signing Authority:

The Senior Agency Official for Privacy, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Paul Lawrence, Assistant Secretary for Information and Technology and Chief Information Officer, Department of Veterans Affairs approved this document on May 26, 2026 for publication.

Dated: June 30, 2026.

Crystal Drakeford,

Government Information Specialist, VA Privacy Service, Office of Information and Technology, Department of Veterans Affairs.

SYSTEM NAME AND NUMBER:

Benefits Accounts Receivable Records/(BARR)—VA—88VA244.

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Applications servers, external interface, and databases are located at the VA Austin Information Technology Center (AITC) in Austin, TX.

SYSTEM MANAGER(S):

Executive Director, Debt Management Center (189/00), U.S. Department of Veterans Affairs, Bishop Henry Whipple Federal Building, 1 Federal Drive, Ft. Snelling, MN 55111. Phone: 612-725-4353. Email:

DMC_SSOD_Questions@va.gov

.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

31 U.S.C. Chapter 37; 5 U.S.C. Chapter 55; and 5 U.S.C. Chapter 53.

PURPOSE(S) OF THE SYSTEM:

The purpose of this system is to maintain records of individuals, organizations and other entities: (1) indebted to the United States as a result of their participation in benefit and health care programs administered by VA; (2) indebted as a result of erroneous pay administration; (3) indebted under any other program administered by any agency of the United States Government and whose indebtedness record has been referred to VA for Government-wide cross-servicing under 31 U.S.C. 3711(g)(4); and (4) indebted under any Federal, state, or local government program and whose debt was referred to VA for collection under any valid interagency agreement. Information in this system of records is used for the administrative management and collection of debts owed the United States and any state or local government and for which records are maintained in accordance with the preceding sentence.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Persons indebted to the United States Government as a result of their participation in benefit programs (including health care programs) administered by VA under title 38, United States Code, chapters 11, 13, 15, 17, 18, 21, 30, 31, 32, 33, 34, 35, 36 and 37, including persons indebted to the United States Government by virtue of their ownership, contractual obligation or rental of property owned by the Government or encumbered by a VA- guaranteed, insured, direct or vendee loan. The individuals covered are persons indebted to the United States Government as a result of their participation in a benefit program administered by VA, but who did not meet the requirements for receipt of such benefits or services. Persons

indebted to the United States, a state or local government whose debts are referred to the Department of Veterans Affairs for Government-wide cross-servicing under 31 U.S.C. 3711(g)(4) or any valid interagency agreement. Persons indebted to the United States as the result of erroneous payment of pay or allowances or as the result of erroneous payment of travel, transportation or relocation expenses and allowances (previously and hereinafter referred to as “pay administration”) under the provisions of title 5, United States Code, part III, subpart D.

CATEGORIES OF RECORDS IN THE SYSTEM:

Identifying information for a person indebted to the VA may include VA file number, social security number, Tax Identification Number (TIN), Receivable ID, name, date of birth, mailing address, loan reference number, phone number, email address, financial information, and VA benefit overpayment (debt) information. These data elements may be obtained from: indebtedness records of Federal agencies other than VA and the following Privacy Act systems of records: “Debt Collection Operations System—Treasury/Financial Management Service” (Treasury/FMS.014); “Compensation, Pension, Education and Vocational Rehabilitation Records—VA” (58VA21/22/28); “Loan Guaranty Home, Condominium and Manufactured Home Loan Applicant Records, Specially Adapted Housing Applicant Records, and Vendee Loan Applicant Records—VA” (55VA26); “Patient Medical Records—VA” (24VA10A7); and, “Veterans and Beneficiaries Purchased Care Community Health Care Claims, Correspondence, Eligibility, Inquiry and Payment Files—VA” (54VA10NB3); initial indebtedness amount, amounts claimed for reimbursement, type of benefit from which the debt arose, identifying number of the VA regional office with jurisdiction over the underlying benefit claim or property subject to default or foreclosure, station number of the VA health care facility rendering services, name of co-obligor, and property address of the defaulted home loan from 58VA21/22/28, 55VA26, 24VA10A7, and 54VA10NB3, history of debt collection activity on the person, organization or entity includes correspondence, telephone calls, referrals to other Federal, state, or local agencies, VA regional counsel, private collection and credit reporting agencies, payments received, refunds made, interest amount, current balance of debt and indication of status of current VA benefit payments, Federal employment status obtained by computer matching with Government agencies and the United States Postal Service, among other sources. No personal medical information concerning the nature of disease, injury or disability is transmitted to or maintained in this system of records.

RECORD SOURCE CATEGORIES:

The records in this system are derived from the five other systems of records as set forth above in “Categories Of Records In The System”, persons indebted to the United States by virtue of their participation in programs administered by VA or other Government agencies, dependents of those persons, fiduciaries for those persons (VA or court appointed), other Federal agencies, state and local agencies, private collection agencies, consumer reporting agencies, state, local and county courts and clerks, other third parties and other VA records.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

1.

Congress:

To a Member of Congress or staff acting upon the Member's behalf when the Member or staff requests the information on behalf of, and at the request of, the individual who is the subject of the record.

2.

Data Breach Response and Remediation, for VA:

To appropriate agencies, entities, and persons when: (a) VA suspects or has confirmed that there has been a breach of the system of records; (b) VA has determined that as a result of the suspected or confirmed breach there is a risk of harm to individuals, VA (including its information systems, programs, and operations), the Federal Government, or national security; and (c) the disclosure made to such agencies, entities, and persons is reasonably necessary to assist in connection with VA's efforts to respond to the suspected or confirmed breach or to prevent, minimize, or remedy such harm.

3.

Data Breach Response and Remediation, for Another Federal Agency:

To another Federal agency or Federal entity, when VA determines that information from this system of records is reasonably necessary to assist the recipient agency or entity in (a) responding to a suspected or confirmed breach or (b) preventing, minimizing, or remedying the risk of harm to individuals, the recipient agency or entity (including its information systems, programs, and operations), the Federal Government, or national security, resulting from a suspected or confirmed breach.

4.

Law Enforcement Authorities, for Reporting Violations of Law:

To a Federal, state, local, territorial, tribal, or foreign law enforcement authority or other appropriate entity charged with the responsibility of investigating or prosecuting a violation or potential violation of law, whether civil, criminal, or regulatory in nature, or charged with enforcing or implementing such law, provided that the disclosure is limited to information that, either alone or in conjunction with other information, indicates such a violation or potential violation. A disclosure of information about veterans or their dependents from VA claims files under this routine use must also comply with the requirements of 38 U.S.C. 5701(f).

5.

Department of Justice, Litigation, Administrative Proceeding:

To the Department of Justice (DoJ), or in a proceeding before a court, adjudicative body, or other administrative body before which VA is authorized to appear, when any of the following is a party to such proceedings or has an interest in such proceedings, and VA determines that use of such records is relevant and necessary to the proceedings:

(a) VA or any component thereof;

(b) Any VA employee in their official capacity;

(c) Any VA employee in their individual capacity where DoJ has agreed to represent the employee; or

(d) The United States, where VA determines that litigation is likely to affect the agency or any of its components.

6.

Contractors:

To contractors, grantees, experts, consultants, students, and others performing or working on a contract, service, grant, cooperative agreement, or other assignment for VA, when reasonably necessary to accomplish an agency function related to the records.

7.

Equal Employment Opportunity Commission:

To the Equal Employment Opportunity Commission in connection with investigations of alleged or possible discriminatory practices, examination of Federal affirmative employment programs, or other functions of the Commission as authorized by law.

8.

Federal Labor Relations Authority:

To the Federal Labor Relations Authority in connection with the investigation and resolution of allegations of unfair labor practices, the resolution of exceptions to arbitration awards when a question of material fact is raised, matters before the Federal Service Impasses Panel, and the investigation of representation petitions

and the conduct or supervision of representation elections.

9.

Merit System Protection Board:

To the Merit Systems Protection Board in connection with appeals, special studies of the civil service and other merit systems, review of rules and regulations, investigation of alleged or possible prohibited personnel practices, and such other functions promulgated in 5 U.S.C. 1205 and 1206, or as authorized by law.

10.

National Archives and Records Administration:

To the National Archives and Records Administration (NARA) in records management inspections conducted under 44 U.S.C. 2904 and 2906, or other functions authorized by laws and policies governing NARA operations and VA records management responsibilities.

11.

Federal Agencies, for Computer Matches:

To other Federal agencies for the purpose of conducting computer matches to obtain information to determine or verify eligibility of veterans receiving VA benefits or medical care under title 38.

12.

Federal Agencies, Courts, Litigants, for Litigation or Administrative Proceedings:

To another Federal agency, court, or party in litigation before a court or in an administrative proceeding conducted by a Federal agency, when the government is a party to the judicial or administrative proceeding.

13.

Governmental Agencies, for VA Hiring, Security Clearance, Contract, License, Grant:

To a Federal, state, local, or other governmental agency maintaining civil or criminal violation records, or other pertinent information, such as employment history, background investigations, or personal or educational background, to obtain information relevant to VA's hiring, transfer, or retention of an employee, issuance of a security clearance, letting of a contract, or issuance of a license, grant, or other benefit. The disclosure of the names and addresses of veterans and their dependents from VA records under this routine use must also comply with the provisions of 38 U.S.C. 5701.

14.

Federal Agencies, for Employment:

To a Federal agency, except the United States Postal Service, or to the District of Columbia government, in response to its request, in connection with that agency's decision on the hiring, transfer, or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant, or other benefit by that agency.

15.

State or Local Agencies, for Employment:

To a state, local, or other governmental agency, upon its official request, as relevant and necessary to that agency's decision on the hiring, transfer, or retention of an employee, the issuance of a security clearance, the letting of a contract, or the issuance of a license, grant, or other benefit by that agency. A disclosure of information about veterans or their dependents from VA claims files under this routine use must also comply with the requirements of 38 U.S.C. 5701(f).

16.

Consumer Reporting Agencies:

To a consumer reporting agency for the purpose of locating the individual, obtaining a consumer report to determine the ability of the individual to repay an indebtedness to the United States, or assisting in the collection of such indebtedness, provided that the provisions of 38 U.S.C. 5701(g)(2) and (4) have been met, provided that the disclosure is limited to information that is reasonably necessary to identify such individual or concerning that individual's indebtedness to the United States by virtue of the person's participation in a benefits program administered by the Department.

17.

Treasury, for Payment or Reimbursement:

To the Department of the Treasury to facilitate payments to veterans for reimbursement of authorized expenses, as well as to collect, by set off or otherwise, debts owed the United States.

18.

Treasury, for Withholding:

To the Department of the Treasury for the collection of title 38 benefit overpayments, overdue indebtedness, or costs of services provided to an individual not entitled to such services, by the withholding of all or a portion of the person's Federal income tax refund, provided that the disclosure is limited to information concerning an individual's indebtedness by virtue of a person's participation in a benefits program administered by VA.

19.

Treasury, to Report Waived Debt as Income:

To the Department of the Treasury as a report of income under 26 U.S.C. 61(a)(12), provided that the disclosure is limited to information concerning an individual's indebtedness that is waived under 38 U.S.C. 3102, compromised under 4 CFR part 103, otherwise forgiven, or for which the applicable statute of limitations for enforcing collection has expired.

20.

Guardians Ad Litem, for Representation:

To a fiduciary or guardian ad litem in relation to his or her representation of a claimant in any legal proceeding as relevant and necessary to fulfill the duties of the fiduciary or guardian ad litem.

21.

Guardians, Courts, for Incompetent Veterans:

To a court, magistrate, or administrative tribunal in matters of guardianship, inquests, and commitments; to private attorneys representing veterans rated incompetent in conjunction with issuance of Certificates of Incompetency; or to probation and parole officers in connection with court-required duties.

22.

Claims Representatives, for Title 38 Benefits:

To accredited service organizations, VA-approved claim agents, and attorneys acting under a declaration of representation, upon request, so that these individuals can aid claimants in the preparation, presentation, and prosecution of claims under the laws administered by VA, provided that the disclosure is limited to information relevant to a claim, such as the name, address, the basis and nature of a claim, amount of benefit payment information, medical information, and military service and active duty separation information.

23.

Third Party Collection Agencies, for Debt Collection Purposes:

A. Any information in this system, including available identifying information regarding a person, such as the person's name, address, Social Security number, VA insurance number, VA claim number, VA loan number, date of birth, employment information or identification number assigned by any Government component, may be disclosed, except to consumer reporting agencies, to a third party in order to obtain current name, address and credit report in connection with any proceeding for the collection of an amount owed the United States. Such disclosure may be made in the course of computer matching having the purpose of obtaining the information indicated above. Third parties may include other Federal agencies or state probate courts.

B. Any information concerning a person's indebtedness to the United States, including personal information obtained from other Federal agencies through computer matching programs, may be disclosed to any third party, except consumer reporting agencies, in connection with any proceeding for the collection of any amount owed to the United States. Purposes of these disclosures include but are not limited to (a) assisting the Government in collection of debts resulting from participation in Government programs of all categories and pay administration, and (b) initiating legal actions for prosecuting individuals who willfully or fraudulently obtain Government benefits, pay or allowances without entitlement. Third parties may include, but are not limited to, persons, organizations or other entities with contracts for collection services with the Government.

C. The name and address of a debtor, other information as is reasonably necessary to identify such person, including personal information obtained from other Federal, state, or local agencies as well as private sources through computer matching, and other information concerning the person's indebtedness to the United States, may be disclosed to third parties, including Federal, state, and local government agencies to determine the debtor's employer. Such information may be used to initiate garnishment of disposable pay in accordance with the provisions of 31 U.S.C. 3720D.

D. The name and address of a debtor, and such other information as may be necessary for identification of that debtor, may be disclosed to a debtor's employer for purposes of initiating garnishment of the disposable pay of that debtor under the provisions of 31 U.S.C. 3720D.

E. The names and addresses of delinquent debtors, along with the amounts of their debts, may be published or otherwise publicly disseminated subject to the provisions of 31 U.S.C. 3720E.

F. Any information in this system may be disclosed to a third-party purchaser of debt more than 90 days delinquent and for which the sale of such debt was conducted pursuant to the provisions of 31 U.S.C. 3711(i).

24.

Treasury, for the Do Not Pay Working System:

To The U.S. Department of the Treasury when disclosure of the information is relevant to review payment and award eligibility through the Do Not Pay Working System for the purposes of identifying, preventing, or recouping improper payments to an applicant for, or receipt of, Federal funds including funds disbursed by a state (meaning a state of the United States, the District of Columbia, a territory or possession of the United States, or a federally recognized Indian tribe) in a state-administered, federally funded program.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Records are maintained electronically on computer storage devices such as servers and cloud storage. The computer storage devices are located at the AITC. Computer records are maintained in a secure password protected environment.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Records may be retrieved or identified using any combination of the following: VA file number, social security number, Receivable ID, full name, date of birth, address, phone number.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

Records in this system are retained and disposed of in accordance with the schedule approved by the Archivist of the United States, General Records Schedule 1.1, Item number 10.

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Access to these records is restricted to authorized VA employees or contractors, on a “need-to-know” basis. Offices where these records are maintained are locked after working hours and are protected from outside access by the Federal Protective Service, other security officers and alarm systems. Access to computerized records is restricted to authorized VA employees or contractors, by means of SSOI and two factor authentication via the use of employee PIV cards and unique PIN. Security controls used to protect personal sensitive data are commensurate with those required for an information system rated moderate for confidentiality, integrity, and availability, as prescribed in NIST Special Publication, 800-53, “Recommended Security Controls for Federal Information Systems,” Revision 4. Administrative controls include the policies and procedures governing the agency program and systems operated within, background investigations for privileged users, and rules of behavior. Technical controls include role-based, user access controls and data encryption.

RECORD ACCESS PROCEDURES:

Individuals seeking information on the existence and content of records in this system pertaining to them should contact the system manager in writing as indicated above. A request for access to records must contain the requester's full name, address, telephone number, be signed by the requester, and describe the records sought in sufficient detail to enable VA personnel to locate them with a reasonable amount of effort.

CONTESTING RECORD PROCEDURES:

Individuals seeking to contest or amend records in this system pertaining to them should contact the system manager in writing as indicated above. A request to contest or amend records must state clearly and concisely what record is being contested, the reasons for contesting it, and the proposed amendment to the record.

NOTIFICATION PROCEDURES:

Individuals who wish to be notified if a record in this system of records pertains to them should submit the request following the procedures described in “Record Access Procedure,” above.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

63 FR 16864 (April 6, 1998); 83 FR 40140 (August 13, 2018).

[FR Doc. 2026-13453 Filed 7-1-26; 8:45 am]

BILLING CODE 8320-01-P