2013-18057. Patient Access to Records

AGENCY:

Department of Veterans Affairs.

ACTION:

Final rule.

SUMMARY:

The Department of Veterans Affairs (VA) amends its regulation governing disclosure of information to veterans and other beneficiaries. The current regulation provides for a special procedure for evaluating sensitive records and determining whether an individual may gain access to his or her own records. The special procedure allows VA to prevent an individual's access to his or her own records if VA determines that such release could have an adverse effect on the physical or mental health of a requesting individual. We have determined that this special procedure is contrary to law, and therefore remove it from the current regulation.

DATES:

Effective Date: This final rule is effective July 29, 2013.

FOR FURTHER INFORMATION CONTACT:

Stephania Griffin, Veterans Health Administration Privacy Officer, Office of Informatics and Analytics (10P2C), Veterans Health Administration, Department of Veterans Affairs, 810 Vermont Avenue NW., Washington, DC 20420, [phone]. (This is not a toll-free number.)

SUPPLEMENTARY INFORMATION:

The Privacy Act of 1974 (Privacy Act), 5 U.S.C. 552a, requires federal agencies maintaining a system of records to disclose to an individual any record or information pertaining to that individual upon request. The Privacy Act provides safeguards for an individual against an invasion of personal privacy by requiring federal agencies to permit an individual to (1) determine what records pertaining to that individual are collected, maintained, used, or disseminated; (2) prevent records pertaining to that individual obtained by the agency for a particular purpose from being used or made available for another purpose without consent; and (3) gain access to information pertaining to that individual in agency records, to have a copy made of all or any portion thereof, and to correct or amend such records.

Federal agencies are required by the Privacy Act to establish procedures for the disclosure to an individual upon his request of his record or information pertaining to him. These procedures may include, if deemed necessary, a special procedure “for the disclosure to an individual of medical records, including psychological records, pertaining to him.” 5 U.S.C. 552a(f)(3). However, the end result of any procedure, including the special procedure, must be disclosure of the records to the requesting individual. Bavido v. Apfel, 215 F.3d 743 (7th Cir. 2000). Although agencies are allowed to establish such special procedures, they are not required to do so.

Disclosure of VA records, however, has a competing authority. Under 38 U.S.C. 5701(b)(1), VA is required to disclose files, records, reports, and other documents pertaining to a claimant only when, in the judgment of VA, the disclosure “would not be injurious to the physical or mental health of the claimant.”

VA developed a special procedure, pursuant to the Privacy Act and section 5701(b)(1), at 38 CFR 1.577(d). Under current § 1.577(d), in those cases where records contain information that may be injurious to the physical or mental health of the claimant, VA will either disclose the records to a physician or other professional person selected by the claimant, who can then disclose the information as that professional person may believe is indicated; arrange for the claimant to meet with a VA physician for a discussion of the contents before disclosure; or decide not to disclose the information. Denials of disclosure or access may be appealed to VA's Office of General Counsel.

In Benavides v. U.S. Bureau of Prisons, 995 F.2d 269 (D.C. Cir. 1993), the U.S. Court of Appeals for the D.C. Circuit considered a Department of Justice (DOJ) regulation that was published as a special procedure under 5 U.S.C. 552a(f)(3). In that case, the DOJ regulation allowed the agency to prevent disclosure to an individual of records pertaining to that individual. Instead, the DOJ regulation permitted the agency to disclose sensitive records to a physician designated by the requesting individual and required the designated physician to determine which records to disclose to the individual. Benavides, 995 F.2d at 271-72. The court held that this regulation was not permissible under 5 U.S.C. 552a(f)(3) because “[a] regulation that expressly contemplates that the requesting individual may never see certain medical records is simply not a special procedure for disclosure to that person.” Benavides, 995 F.2d at 272.

The special procedure in § 1.577(d) is similar to that considered by the court in Benavides. It operationalizes the requirement found in 38 U.S.C. 5701(b)(1) that VA disclose information to a veteran as to matters concerning the veteran only after VA determines that the disclosure would not be injurious to the physical or mental health of the veteran. Both the statute and regulation allow VA to withhold information it believes would be injurious.

Thus, 38 U.S.C. 5701(b)(1) and § 1.577(d) directly conflict with the Privacy Act. We have determined that the Privacy Act governs decisions regarding disclosure to a veteran of information pertaining to that veteran. The Act supersedes 38 U.S.C. 5701(b)(1) to the extent 38 U.S.C. 5701(b)(1) applies to Privacy Act protected records and is controlling. As a general rule of statutory construction, where two laws on the same subject are in conflict and the conflict cannot be reconciled, the later enacted law controls to the extent of the conflict. J.E.M. Ag Supply, Inc. v. Pioneer Hi-Bred International Inc., 534 U.S. 124 (2001); U.S. v. Borden Co., 308 U.S. 188 (1939); 1A Norman J. Singer & J.D. Shambie Singer, Sutherland Statutes and Statutory Construction § 23:9 (7th ed. 2009). This rule of construction is resorted to only when there is clearly an irreconcilable conflict, or the subsequent act of Congress clearly is intended to occupy the entire field covered by the prior enactment, and all other means of interpretation have been exhausted. Elephant Butte Irrigation Dist. of New Mexico v. U.S. Dep't of Interior, 269 F.3d 1158 (10th Cir. 2001).

The Privacy Act is applicable to all executive agencies and requires agencies to disclose to requesting individuals the content of records pertaining to them. It was intended to help individuals gain access to government records about themselves and to correct erroneous information in those records. Blazy v. Tenet, 194 F.3d 90, 95-96 (D.C. Cir. 1999). The Privacy Act was enacted to promote “governmental respect for the privacy of citizens by requiring all departments and agencies of the executive branch and their employees to observe certain constitutional rules in the computerization, collection, management, use, and disclosure of personal information about individuals.” S. Rep. No. 93-1183 (1974). When the individual to whom the information pertains is also the individual requesting the information, the Privacy Act presumes that disclosure to that individual will occur. Wren v. Harris, 675 F.2d 1144, 1146 (10th Cir. 1982); see also Bavido, 215 F.3d at 750; Benavides, 995 F.2d at 272.

The Privacy Act allows agencies to exempt certain records from access by the individual to whom the records pertain. These exemptions are found at 5 U.S.C. 552a(d)(5), 5 U.S.C. 552a(j), and 5 U.S.C. 552a(k). The content of veterans' records is not included as an exemption to disclosure under the Privacy Act. Because Congress recognized specific exceptions in the Privacy Act but did not authorize the exception in section 5701(b)(1) either specifically or through a general exception similar to the one in section 5701(b)(1), we believe the legislative intent behind the Privacy Act was to provide individuals with an unqualified right of access to their own health records. 2A Norman J. Singer & J.D. Shambie Singer, Sutherland Statutes and Statutory Construction § 47:23 (7th ed. 2009) (the express mention of one thing implies the exclusion of others).

The Privacy Act authorizes agencies to promulgate rules administering the process by which individuals may request records. However, as noted by the court in Bavido, while agencies are allowed under 5 U.S.C. 552a(f)(3) to develop special procedures for disclosure of health records in cases in which direct transmission could adversely affect a requesting individual, “under the plain wording of the statute, these procedures eventually must lead to disclosure of the records to the requesting individual.” Bavido, 215 F.3d at 750.

Section 30 of The World War Veteran's Act of 1924, Public Law 68-242, codified as 38 U.S.C. 5701(b)(1), is applicable to all VA records. The statute contains mandatory language, and it makes disclosure to requesting individuals conditional on VA finding that the content of the record will not be injurious to the physical or mental health of the veteran. Nondisclosure is required if VA determines that disclosure of the content will be injurious. The two laws cannot be harmonized to the extent they both apply to Privacy Act protected records, as compliance with one means noncompliance with the other. We therefore find that the Privacy Act, which is the later enacted statute, is controlling authority with respect to Privacy Act protected records such as a veteran's medical records and claims files.

The special procedure in § 1.577(d) was published under the authority of the Privacy Act, but also recognizes the nondisclosure requirement provided for in 38 U.S.C. 5701(b)(1). This result is contrary to the letter, spirit, and intent of the Privacy Act. As the Privacy Act controls and is the last legislative expression regarding disclosure to individuals of Privacy Act protected records, we remove the special procedure from § 1.577(d) in its entirety and publish this as a final rule, as removal of the procedure as written is mandated by law.

While VA has the authority to establish a special procedure for disclosure of medical and mental health treatment records, we believe that any such special procedure places an unwarranted barrier to the veteran's access to information and is not needed. VA believes that imposing a special procedure on disclosure is contrary to our goal of providing patient-centered care, which depends on the full and timely sharing of information and full, informed patient participation in decision making regarding current and future health care. Removing barriers to a veteran's access to VA records will support a provider-patient relationship based on mutual trust and sharing of information and promote patient autonomy and shared decision making. Removing this regulation will directly benefit veterans by increasing access to their own health records and fulfill the intent of the Privacy Act by allowing the veteran to determine what records VA maintains and whether the content of those records should be amended.

In addition, the process of reviewing the content of existing health records for the existence of “sensitive” material diverts valuable resources that would otherwise be used to deliver medical services because doctors must take time away from direct medical care of veterans to review materials in records that must ultimately be provided to the veteran in any circumstance. Finally, the process thwarts VA's goal of providing veterans with direct access to information contained in their electronic health record (EHR). For example, health records marked as containing “sensitive” material cannot be made directly available to veterans via MyHealtheVet, the award-winning web-based VA tool that allows veterans to manage and access their health information. This could result in a two-tiered system wherein only some veterans have access to their entire EHR. The remaining veterans would in effect be stigmatized due to flagged content in their health records.

Administrative Procedure Act

This final rule is an interpretive rule that merely reflects VA's interpretation of the Privacy Act and 38 U.S.C. 5701(b)(1). Therefore, it is exempt from the prior notice-and-comment and delayed effective date requirements of 5 U.S.C. 553. See 5 U.S.C. 553(b)(A) and (d)(2). This final rule eliminates a special procedure that is contrary to law and a potential barrier to VA disclosing a veteran's health information to that veteran upon request as required under the Privacy Act. Providing patients with access to records upon request is consistent with controlling privacy laws and prevailing practice and is not controversial. This action will directly benefit veterans by eliminating a barrier to veterans receiving information that they are otherwise entitled to receive.

Effect of Rulemaking

Title 38 of the Code of Federal Regulations, as revised by this final rulemaking, represents VA's implementation of its legal authority on this subject. Other than future amendments to this regulation or governing statutes, no contrary guidance or procedures are authorized. All existing or subsequent VA guidance must be read to conform with this rulemaking if possible or, if not possible, such guidance is superseded by this rulemaking.

Paperwork Reduction Act

This final rule contains no provisions constituting a collection of information under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3521).

Regulatory Flexibility Act

The Secretary hereby certifies that this final rule will not have a significant economic impact on a substantial number of small entities as they are defined in the Regulatory Flexibility Act, 5 U.S.C. 601-612. This final rule will directly affect only individuals and will not directly affect small entities. Therefore, pursuant to 5 U.S.C. 605(b), this rulemaking is exempt from the initial and final regulatory flexibility analysis requirements of 5 U.S.C. 603 and 604.

Executive Order 12866 and 13563

Executive Orders 12866 and 13563 direct agencies to assess the costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, and other advantages; distributive impacts; and equity). Executive Order 13563 (Improving Regulation and Regulatory Review) emphasizes the importance of quantifying both costs and benefits, reducing costs, harmonizing rules, and promoting flexibility. Executive Order 12866 (Regulatory Planning and Review) defines a “significant regulatory action,” requiring review by the Office of Management and Budget (OMB) unless OMB waives such review, as “any regulatory action that is likely to result in a rule that may: (1) Have an annual effect on the economy of $100 million or more or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, or tribal governments or communities; (2) Create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) Materially alter the budgetary impact of entitlements, grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) Raise novel legal or policy issues arising out of legal mandates, the President's priorities, or the principles set forth in this Executive Order.”

VA has examined the economic, interagency, budgetary, legal, and policy implications of this regulatory action, and it has been determined not to be a significant regulatory action under Executive Order 12866.

Unfunded Mandates

The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C. 1532, that agencies prepare an assessment of anticipated costs and benefits before issuing any rule that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more (adjusted annually for inflation) in any one year. This final rule will have no such effect on State, local, and tribal governments, or on the private sector.

Catalog of Federal Domestic Assistance

The Catalog of Federal Domestic Assistance numbers and titles for the programs affected by this document are 64.007, Blind Rehabilitation Centers; 64.008, Veterans Domiciliary Care; 64.009, Veterans Medical Care Benefits; 64.010, Veterans Nursing Home Care; 64.011, Veterans Dental Care; 64.012, Veterans Prescription Service; and 64.022, Veterans Home Based Primary Care.

Signing Authority

The Secretary of Veterans Affairs, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Jose D. Riojas, Interim Chief of Staff, Department of Veterans Affairs, approved this document on June 26, 2013, for publication.

List of Subjects in 38 CFR Part 1

• Administrative practice and procedure
• Archives and records
• Cemeteries
• Claims
• Courts
• Crime
• Flags
• Freedom of information
• Government contracts
• Government employees
• Government property
• Infants and children
• Inventions and patents
• Parking
• Penalties
• Privacy
• Reporting and recordkeeping requirements
• Seals and insignia
• Security measures
• Wages

Dated: July 23, 2013.

Robert C. McFetridge,

Director, Regulation Policy and Management, Office of the General Counsel, Department of Veterans Affairs.

For the reasons stated in the preamble, the Department of Veterans Affairs amends 38 CFR part 1 as follows:

PART 1—GENERAL PROVISIONS

1. The authority citation for part 1 continues to read as follows:

Authority: 38 U.S.C. 501(a), and as noted in specific sections.

2. Amend § 1.577 by:

a. Removing paragraph (d).

b. Redesignating paragraphs (e) through (g) as new paragraphs (d) through (f), respectively.

c. In newly designated paragraph (e)(3), in the “Activity and Fees” table, removing “(f)(1)” and adding, in its place, “(e)(1)”.