2020-20276. Disclosure of Certain Protected Records Without Written Consent

AGENCY:

Department of Veterans Affairs.

ACTION:

Final rule.

SUMMARY:

The Department of Veterans Affairs (VA) adopts as final with no changes, a proposed rule amending its regulations on disclosure of certain records. Recent changes in law, to include the VA MISSION Act of 2018, now authorize VA to disclose certain protected records to non-VA entities for purposes of providing health care or performing other health care-related activities or functions to include recovering or collecting reasonable charges for care furnished.

DATES:

The final rule is effective November 9, 2020.

FOR FURTHER INFORMATION CONTACT:

Stephania H. Griffin, Director, Information Access and Privacy Office (10A7), Department of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC 20420; [phone]. (This is not a toll-free number.)

SUPPLEMENTARY INFORMATION:

In accordance with section 5701 of title 38 United States Code (U.S.C.), records and files maintained by VA on veterans and beneficiaries, including medical records, are generally confidential, and VA may not disclose or release these materials except as provided by law. Moreover, records of the identity, diagnosis, prognosis, or treatment by or for VA of any patient related to drug abuse, alcoholism or alcohol abuse, infection with the human immunodeficiency virus (HIV), or sickle cell anemia as prescribed by 38 U.S.C. 7332(a)(1) are confidential and subject to special protection against disclosure. These records may only be disclosed for the specific purposes and under the circumstances expressly authorized under 38 U.S.C. 7332(b), where section (b)(1) authorizes disclosure with the prior written consent of the patient to the extent, circumstances, and purposes allowed by VA regulations, and section (b)(2) authorizes disclosure under certain circumstances with or without the written consent of the patient.

Section 3 of Public Law (Pub. L.) 115-26 (April 19, 2017) amended 38 U.S.C. 7332 by adding a new paragraph (b)(2)(H), authorizing disclosure of 7332-protected records without the written consent of the patient or subject of the record to a non-VA entity (including private entities and other Federal agencies) that provides VA-authorized hospital care or medical services to veterans. It also provided that any non-VA entity receiving such records may not redisclose or use those record for a purpose other than that for which the disclosure was made.

Subsequently, section 132 of Public Law 115-182, the John S. McCain III, Daniel K. Akaka, and Samuel R. Johnson VA Maintaining Internal Systems and Strengthening Integrated Outside Networks Act of 2018, or the VA MISSION Act of 2018 (June 6, 2018) amended 38 U.S.C. 7332(b)(2) by striking paragraph (H) and inserting new paragraphs (H) and (I). Paragraph (H)(i) authorizes disclosure of 7332-protected records without the written consent of the patient to a non-VA entity (including private entities and other Federal agencies) for purposes of providing health care, including hospital care, medical services, and extended care services to patients or performing other health care-related activities or functions. Thus, the scope of permissible disclosures of 7332-protected records was expanded from non-VA entities providing hospital care or medical services authorized by the VA to non-VA entities providing health care or other health care-related activities or functions. Further, paragraph (H)(ii) was amended in 2017 to provide that any entity to which a record is disclosed under this paragraph may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. The amendment under the MISSION Act replaced the term redisclose with the term disclose and added that entities who receive 7332-protected records may also make disclosures as permitted by law. Additionally, paragraph (I) was added to authorize disclosure to a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability as permitted by section 1729 of this title, or for a condition for which recovery is authorized, or with respect to which the United States is deemed to be a third-party beneficiary under the Federal Medical Care Recovery Act.

VA has published regulations implementing release of information from VA records protected by one or more confidentiality provisions in 38 CFR part 1. General rules on release of information related to alcohol or other drug use disorder, HIV infection, or sickle cell anemia are at 38 CFR 1.460 through 1.469. In particular, § 1.460 contains the definitions for §§ 1.460 through 1.499 of this part. Disclosure with patient consent is addressed in §§ 1.475 through 1.479, while disclosures that do not require patient consent are addressed in §§ 1.483 through 1.489. The focus of §§ 1.490 through 1.499 is release of information in response to a court order.

In a document published in the Federal Register on December 13, 2019 (84 FR 68065), VA proposed, among other things, to amend part 1 to conform to these statutory changes by adding the terms health care and health care related activities or functions to § 1.460; and adding two new sections at 38 CFR 1.481 and 1.482 titled Disclosure of medical records of veterans who receive non-VA health care, and Disclosure of medical records to recover or collect reasonable charges, respectively. Furthermore, we proposed a technical correction to §§ 1.460 through 1.499 by moving the authority citations for these sections and moving them to the beginning of part 1 to comply with the Office of Federal Register direction that statutory authorities should be listed in the introductory portion of each CFR part.

VA provided a 60-day comment period that ended on February 11, 2020, and we received two comments. The first comment stated that VA should obtain permission from veterans and that every effort should be made to contact a veteran's family for the release of records if the veteran is deceased (we note that, although the comment used the word decided, based on the content of the comment, we believe that the intended word was deceased). To address the first portion of the comment related to obtaining permission from veterans, as previously explained, section 3 of Public Law 115-26 and section 132 of the VA MISSION Act of 2018, amended 38 U.S.C. 7332(b)(2) by allowing VA to disclose certain protected records to non-VA entities (including private entities and other Federal agencies) for purposes of providing health care or performing other health care-related activities or functions. Also, VA may disclose these protected records to a third party for the purpose of recovering or collecting reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability or to which the United States is deemed to be a third-party beneficiary. Therefore, VA may now disclose certain protected records with or without consent for the aforementioned reasons. Also, adding a consent mandate to the regulation would negate the intent of the statutory amendment. To address the portion of the comment related to the records of a deceased individual, such records continue to be protected under 38 U.S.C. 7332; however, we note that over time, certain disclosures (e.g., disclosures to a provider for treatment purposes, disclosures to a third-party to recover or collect reasonable charges) would no longer be made for a deceased individual because the deceased individual would no longer receive treatment. Furthermore, the family members of a deceased individual cannot consent to a disclosure unless such disclosure is necessary to obtain benefits to which the family member may be entitled. 38 U.S.C. 7332(b)(3). We are not making any changes based on this comment.

The second comment raised multiple concerns and recommendations regarding: (1) Definition for treatment and health care; (2) external treatment records; (3) restriction requests; and (4) the Privacy Act of 1974 (the Privacy Act)).

1. Definition for treatment and health care. The comment asked why VA would use the same definition for treatment and health care as the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. We proposed to use treatment as defined by 45 CFR 164.501 as part of our proposed definition for the term health care-related activities or functions. VA has chosen to use the same definition for treatment to maintain consistency with the HIPAA Privacy Rule. Likewise, we have chosen to define health care to have the same meaning as defined in the HIPAA Privacy Rule and to align with industry standard and practice. Therefore, we believe it is reasonable to maintain consistency with HIPAA to allow community providers to rely on the same definition when using and disclosing VA records, and we are not making any changes based on this portion of the comment.

2. External treatment records. The comment expressed concern regarding the creation of external treatment records when VA refers veterans to community providers, and further asked VA to revise § 1.481(b) as proposed to include, at the end, a phrase that reads including via any health information exchange or organization. When VA refers patients to community providers for treatment, those community providers create their own treatment records and VA does not have the authority to restrict the records created and owned by an external entity. However, if VA provides a copy of VA medical records to a community provider then VA may restrict the use of the medical record provided and the language proposed in 1.481(b) provides this restriction by stating that an entity to which a record is disclosed under this section may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. This language is consistent with our authorizing statute under 38 U.S.C. 7332(b)(2)(H)(i) and we do not believe it is necessary to add the additional phrase as suggested by the commenter because the restriction that is already present in § 1.418(b) as proposed captures all entity types to include health information exchanges or organizations when applicable. We are not making any changes based on this portion of the comment.

3. Restriction requests. The comment raised a concern that the proposed rule did not address requests for restrictions on the disclosure of medical records under the HIPAA Privacy Rule, and specifically, restrictions with regard to information sharing through a health information exchange. The comment addressed both the issues of restriction on the use and disclosure of protected health information, and the means under which protected health information is shared. To address both issues raised in the comment, we first note that the purpose of the proposed rule and this final rule is to align VA's regulations with recent changes in law that now authorize VA to disclose 7332-protected records to a third party for the purpose of providing health care or performing other health care-related activities or functions, and to a third party for the purpose of recovering or collecting reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability or to which the United States is deemed to be a third-party beneficiary. This authority does not negate an individual's ability to request a restriction on the use and disclosure of their protected health information under 45 CFR 164.522, nor does it negate VA's obligation to uphold a request if VA agrees to a restriction. We note that under the HIPAA Privacy Rule, VA may still use or disclose restricted protected health information for emergency treatment. 45 CFR 164.522(a)(1)(iii). Additionally, under the HIPAA Privacy Rule a covered entity is not required to agree to a restriction unless the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law and the protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full. 45 CFR 164.522(a)(1)(ii) and (vi). Thus, this final rule does not affect an individual's ability to request restrictions on the disclosure of medical records. We next clarify this final rule does not impede an individual's ability to opt-out of health information exchanges. VA provides individuals the opportunity to opt-out of sharing protected health information through health information exchanges (HIE). Therefore, if an individual chooses to opt-out, VA will uphold this request by not sharing protected health information through an HIE. However, protected health information will continue to be shared on paper, fax, or other legally allowed means. We are not making any changes based on this portion of the comment.

4. The Privacy Act. The comment asked if the Privacy Act applies to medical records and whether the routine use exemption applies. We clarify that this rule does not impact protections under the Privacy Act because VA is authorized to disclose 7332-protected records without consent under routine use when such disclosure is authorized by 38 U.S.C. 7332. The Privacy Act requires Federal agencies to not disclose any record which is contained in a system of records . . . without the prior written consent of, the individual to whom the record pertains, unless the disclosure of the record would be . . . for routine use. 5 U.S.C. 552a(b) and (b)(3). Routine use, with respect to the disclosure of records, means the use of such record for a purpose which is compatible with the purpose for which it was collected. 5 U.S.C. 552a(a)(7). In accordance with 5 U.S.C. 552a(e), VA publishes a Federal Register Notice outlining the routine use disclosures of records from a Privacy Act system of records to a person or entity outside of VA without the prior signed written consent authorization of the individual who is the subject of the information. For example, published routine use disclosure statements in the Privacy Act system of records, “Patient Medical Records-VA”, 24VA10P2 permits the release of protected health information when a disclosure is also authorized by other applicable legal authorities, including the HIPAA Privacy Rule; and disclosure of 7332-proteced records when the disclosure is also authorized by 38 U.S.C. 7332. Furthermore, this rule aligns VA's regulations with recent changes in our statutory authority under 7332. We are not making any changes based on this portion of the comment.

Based on the rationale set forth in the proposed rule and in this document, we are adopting the proposed rule as final without changes.

Congressional Review Act

Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), the Office of Information and Regulatory Affairs designated this rule as not a major rule, as defined by 5 U.S.C. 804(2).

Paperwork Reduction Act

The final rule contains no provisions constituting a collection of information under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3521).

Regulatory Flexibility Act

The Secretary hereby certifies that this final rule will not have a significant economic impact on a substantial number of small entities as they are defined in the Regulatory Flexibility Act, 5 U.S.C. 601-612. This final rule will directly affect health and medical insurance companies, some of which are small entities. VA has determined that this final rule will not have a significant economic impact because VA estimates the cost of this rulemaking to be no more than 1 percent of average annual receipts, and thus not significant. In the proposed rule, VA estimated the cost of this rulemaking to be $41.7 per year using FY2020 estimates. VA now estimates the cost of this rulemaking to be $43.8 million per year using FY2021 estimates for health and medical insurance carriers due to an increase in potential revenue received by VA from health and medical insurance firms for billed claims. This $43.8 million dollars per year will be distributed among 815, of which 312 are small, medical and health insurance firms that provide benefits to veterans treated for non-service connected conditions and whose records are protected under 38 U.S.C. 7332. We are uncertain if any small entity will be impacted so we assume that all small entities will be impacted in addition to large entities. The cost to each of the 312 small entities will be $53,779 per year, which is 1 percent of average annual receipts for the smallest potentially affected small entities. Therefore, pursuant to 5 U.S.C. 605(b), the initial and final regulatory flexibility analysis requirements of 5 U.S.C. 603 and 604 do not apply.

Executive Orders 12866, 13563, and 13771

Executive Orders 12866 and 13563 direct agencies to assess the costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, and other advantages; distributive impacts; and equity). Executive Order 13563 (Improving Regulation and Regulatory Review) emphasizes the importance of quantifying both costs and benefits, reducing costs, harmonizing rules, and promoting flexibility. The Office of Information and Regulatory Affairs has determined this rule is not a significant regulatory action under Executive Order 12866.

VA's impact analysis can be found as a supporting document at http://www.regulations.gov,, usually within 48 hours after the rulemaking document is published. Additionally, a copy of the rulemaking and its impact analysis are available on VA's website at http://www.va.gov/​orpm by following the link for VA Regulations Published from FY 2004 through FYTD.

This rule is not an E.O. 13771 regulatory action because this rule is not significant under E.O. 12866.

Unfunded Mandates

The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C. 1532, that agencies prepare an assessment of anticipated costs and benefits before issuing any rule that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more (adjusted annually for inflation) in any one year. This final rule will have no such effect on State, local, and tribal governments, or on the private sector.

Catalog of Federal Domestic Assistance

The Catalog of Federal Domestic Assistance numbers and titles for the programs affected by this document are 64.008—Veterans Domiciliary Care; 64.011—Veterans Dental Care; 64.012—Veterans Prescription Service; 64.013—Veterans Prosthetic Appliances; 64.014—Veterans State Domiciliary Care; 64.015—Veterans State Nursing Home Care; 64.026—Veterans State Adult Day Health Care; 64.029—Purchase Care Program; 64.033—VA Supportive Services for Veteran Families Program; 64.039—CHAMPVA; 64.040—VHA Inpatient Medicine; 64.041—VHA Outpatient Specialty Care; 64.042—VHA Inpatient Surgery; 64.043—VHA Mental Health Residential; 64.044—VHA Home Care; 64.045—VHA Outpatient Ancillary Services; 64.046—VHA Inpatient Psychiatry; 64.047—VHA Primary Care; 64.048—VHA Mental Health clinics; 64.049—VHA Community Living Center; 64.050—VHA Diagnostic Care; 64.054—Research and Development.

List of Subjects in 38 CFR Part 1

• Administrative practice and procedure
• Archives and records
• Cemeteries
• Claims
• Courts
• Crime
• Flags
• Freedom of information
• Government contracts
• Government employees
• Government property
• Infants and children
• Inventions and patents
• Parking
• Penalties
• Privacy Reporting and recordkeeping requirements
• Seals and insignia
• Security measures
• Wages

Signing Authority

The Secretary of Veterans Affairs, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Brooks D. Tucker, Acting Chief of Staff, Department of Veterans Affairs, approved this document on August 26, 2020, for publication.

Consuela Benjamin,

Regulations Development Coordinator, Office of Regulation Policy & Management, Office of the Secretary, Department of Veterans Affairs.

For the reasons set forth in the preamble, Department of Veterans Affairs amends 38 CFR part 1 as follows:

PART 1—GENERAL PROVISIONS

1. The authority citation for part 1 is revised to read as follows:

Authority: 38 U.S.C. 501, and as noted in specific sections.

Sections 1.460 and 1.461 also issued under 38 U.S.C. 7332 and 7334.

Sections 1.462, 1.464, 1.466-1.469, 1.476, 1.478, 1.479, 1.491-1.493, 1.495 and 1.496 also issued under 38 U.S.C. 7334.

Sections 1.463, 1.465, 1.475, 1.477, 1.481, 1.482, 1.483, 1.485, 1.486-1.490, and 1.494 also issued under 38 U.S.C. 7332.

Section 1.484 also issued under 38 U.S.C. 7331 and 7332.

Section 1.485a also issued under 38 U.S.C. 5701 and 7332.

§ § 1.460 through 1.479

[Amended]

2. Remove the parenthetical Authority citation immediately following each section from §§ 1.460 through 1.479.

3. Amend § 1.460 by adding, in alphabetical order, definitions for “Health care” and “Health care-related activities or functions” to read as follows:

§ 1.460

Definitions.

* * * * *

Health care. The term “health care” has the same meaning as provided in 45 CFR 160.103.

Health care-related activities or functions. The term “health care-related activities or functions” means the actions required for the delivery of health care, including hospital care, medical services, and extended care services. Health care-related activities or functions includes: Treatment as defined by 45 CFR 164.501; activities related to reimbursement for care and treatment by a health care provider; activities related to participation in health information exchanges for the delivery of health care; health care operations as defined by 45 CFR 164.501; and activities related to a patient's exercise of privacy rights regarding health information.

* * * * *

4. Remove reserved §§ 1.481 and 1.482 from under the undesignated center heading “Disclosures With Patient's Consent” and add new §§ 1.481 and 1.482 under the undesignated center heading “Disclosures Without Patient Consent” to read as follows:

§ 1.481

Disclosure of medical records of veterans who receive non-VA health care.

(a) VA may disclose records referred to in 38 U.S.C. 7332(a) to a non-VA entity (including private entities and other Federal agencies) for purposes of providing health care to patients or performing other health care-related activities or functions.

(b) An entity to which a record is disclosed under this section may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law.

§ 1.482

Disclosure of medical records to recover or collect reasonable charges.

VA may disclose records described in 38 U.S.C. 7332(a) to a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability as permitted by 38 U.S.C. 1729, or for a condition for which recovery is authorized, or with respect to which the United States is deemed to be a third-party beneficiary under the Federal Medical Care Recovery Act (Public Law 87-693, 42 U.S.C. 2651 et seq.).

§ § 1.484 through 1.496

[Amended]

5. Remove the parenthetical Authority citation immediately following each section from §§ 1.484 through 1.496.