2019-26910. Disclosure of Certain Protected Records Without Written Consent

AGENCY:

Department of Veterans Affairs.

ACTION:

Proposed rule.

SUMMARY:

The Department of Veterans Affairs (VA) proposes to amend its regulations on disclosure of certain records. Recent changes in law, to include the VA MISSION Act of 2018, now authorize VA to disclose certain protected records to non-VA entities (including private entities and other Federal agencies) for purposes of providing health care or performing other health care-related activities or functions. The Act also authorizes VA to disclose these protected records to a third party for the purpose of recovering or collecting reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability or to which the United States is deemed to be a third-party beneficiary. This proposed rule would align VA's regulations with the recent changes in law.

DATES:

Comments must be received by VA on or before February 11, 2020.

ADDRESSES:

Written comments may be submitted through www.Regulations.gov;​; by mail or hand-delivery to: Director, Office of Regulation Policy and Management (00REG), Department of Veterans Affairs, 810 Vermont Avenue NW, Room 1064, Washington, DC 20420; or by fax to [phone]. (This is not a toll-free number.) Comments should indicate that they are submitted in response to “RIN 2900-AQ64—Disclosure of certain protected records without written consent.” Copies of comments received will be available for public inspection in the Office of Regulation Policy and Management, Room 1064, between the hours of 8:00 a.m. and 4:30 p.m. Monday through Friday (except holidays). Please call [phone] for an appointment. (This is not a toll-free number.) In addition, during the comment period, comments may be viewed online through the Federal Docket Management System (FDMS) at www.Regulations.gov.

FOR FURTHER INFORMATION CONTACT:

Stephania H. Griffin, Director, Information Access and Privacy Office (10A7), Department of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC 20420; [phone]. (This is not a toll-free number.)

SUPPLEMENTARY INFORMATION:

Records and files maintained by VA on veterans and beneficiaries, including medical records, are generally confidential, and VA may not disclose or release these materials except as provided by law. 38 U.S.C. 5701. Moreover, records of the identity, diagnosis, prognosis, or treatment by or for VA of any patient related to drug abuse, alcoholism or alcohol abuse, infection with the human immunodeficiency virus (HIV), or sickle cell anemia as prescribed by 38 U.S.C. 7332(a)(1) are confidential and subject to special protection against disclosure. These records may only be disclosed for the specific purposes and under the circumstances expressly authorized under 38 U.S.C. 7332(b). Paragraph (b)(1) authorizes disclosure with the prior written consent of the patient to the extent, circumstances, and purposes allowed by VA regulations. Paragraph (b)(2) authorizes disclosure under certain circumstances with or without the written consent of the patient.

Section 3 of Public Law (Pub. L.) 115-26 (April 19, 2017) amended 38 U.S.C. 7332 by adding a new paragraph (b)(2)(H), authorizing disclosure of 7332-protected records without the written consent of the patient or subject of the record to a non-VA entity (including private entities and other Federal agencies) that provides VA-authorized hospital care or medical services to veterans. It also provided that any non-VA entity receiving such records may not redisclose or use those record for a purpose other than that for which the disclosure was made.

Subsequently, section 132 of Public Law 115-182, the John S. McCain III, Daniel K. Akaka, and Samuel R. Johnson VA Maintaining Internal Systems and Strengthening Integrated Outside Networks Act of 2018, or the VA MISSION Act of 2018 (June 6, 2018) amended 38 U.S.C. 7332(b)(2) by striking paragraph (H) and inserting new paragraphs (H) and (I). Paragraph (H)(i) authorizes disclosure of 7332-protected records without the written consent of the patient to a non-VA entity (including private entities and other Federal agencies) for purposes of providing health care, including hospital care, medical services, and extended care services to patients or performing other health care-related activities or functions. Thus, the scope of permissible disclosures of 7332-protected records was expanded from non-VA entities providing hospital care or medical services authorized by the VA to non-VA entities providing health care or other health care-related activities or functions. Further, paragraph (H)(ii) was amended in 2017 to provide that any entity to which a record is disclosed under this paragraph may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. The amendment under the MISSION Act replaced “redisclose” with “disclose” and added that entities who receive 7332-protected records may also make disclosures as permitted by law. Additionally, paragraph (I) was added to authorize disclosure to a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability as permitted by section 1729 of this title, or for a condition for which recovery is authorized, or with respect to which the United States is deemed to be a third-party beneficiary under the Federal Medical Care Recovery Act.

VA has published regulations implementing release of information from VA records protected by one or more confidentiality provisions in 38 CFR part 1. General rules on release of information related to alcohol or other drug use disorder, HIV infection, or sickle cell anemia are at 38 CFR 1.460 through 1.469. In particular, § 1.460 contains the definitions for §§ 1.460 through 1.499 of this part. Disclosure with patient consent is addressed in §§ 1.475 through 1.479, while disclosures that do not require patient consent are addressed in §§ 1.483 through 1.489. The focus of §§ 1.490 through 1.499 is release of information in response to a court order. VA proposes to amend part 1 to conform to these statutory changes by adding two new definitions to § 1.460, and adding two new sections at 38 CFR 1.481 and 1.482.

In this rulemaking we propose to add two new definitions to § 1.460. We would add the term “health care” to have the same meaning as defined in the Health Insurance Portability and Accountability Act (HIPAA) Regulations, 45 CFR 160.103. We choose this definition to maintain consistency with the HIPAA Privacy Rule regulations promulgated by the Department of Health and Human Services at 45 CFR part 160 and subparts A and E of part 164, and to align with industry standards and practice. Section 160.103 of 45 CFR defines in part “health care” as “care, services, or supplies related to the health of an individual,” including “preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure or function of the body.” Furthermore, the “sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription” is included in the definition. We would cross-reference the definition found in 45 CFR 160.103 in 38 CFR 1.460 to maintain consistency in definition of the term and in the event the definition is amended in the future. We note that the VA MISSION Act of 2018 includes hospital care, medical services, and extended care services as part of health care; however, since 45 CFR 160.103 does not explicitly identify these services in the definition, we have added this language to the definition of “health care-related activities or functions” below.

We would also add the term “health care-related activities or functions” and define it to mean the actions required for the delivery of health care, including hospital care, medical services, and extended care services. The definition would also indicate that health care-related activities or functions include: Treatment as defined by 45 CFR 164.501, activities related to reimbursement for care and treatment by a health care provider, activities related to participation in health information exchanges for the delivery of health care, health care operations as defined by 45 CFR 164.501, and activities related to a patient's exercise of privacy rights regarding health information. This definition would allow VA to implement the recent statutory changes to 7332 by expanding the scope of permissible disclosure to purposes other than providing health care. Thus, this definition will allow VA to implement the recent statutory changes to section 7332 while also maintaining consistency with the definition of “health care” from the HIPAA Privacy Rule. We note that this rulemaking does not negate the requirement of VA to comply with HIPAA, when applicable.

VA believes that the examples of health-care-related activities and functions are appropriate to show consistency with the HIPAA Privacy Rule, which also allows the disclosure of protected health information for treatment. VA would apply the same standard for disclosures of section 7332 protected information since it aligns with common industry practice. Section 164.501 of 45 CFR defines “treatment” in part as the “provision, coordination, or management of health care and related services by . . . health care providers, including the coordination or management of health care . . . with a third party; consultations between health care providers relating to a patient; or the referral of a patient from one health care provider to another.” We would cross-reference this definition found in 45 CFR 164.501 to maintain consistency in the definition of the terms and in the event the definitions are amended in the future. Also, the HIPAA Privacy Rule allows the disclosure of protected health information for payment activities. Likewise, VA regulations at 38 CFR 17.106 allows the disclosure of appropriate health care records to third-party payers for the purposes of verifying the care and services which are the subject of claims for which VA seeks payment, recovery, or collection. This definition will allow VA to implement the recent statutory changes to section 7332 while also maintaining consistency with industry standards and practice under the HIPAA Privacy Rule for disclosing appropriate health care records to third-party payers. Additionally, VA has entered into agreements to participate in a health information exchange (HIE) to help facilitate the transfer of information between different organizations that range from community health care providers and health plans to government agencies providing benefits. This definition would allow VA to electronically transfer health information with HIE community partners for the purposes of delivering health care. Furthermore, the HIPAA Privacy Rule allows the disclosure of protected health information for health care operations under certain circumstances outlined in 45 CFR 164.506(c)(1) and (4). Thus, VA would apply the same standard for disclosures of section 7332 protected information since it aligns with common industry practice. Section 164.501 of 45 CFR defines “health care operations” in part as the “activities of [a] covered entity to the extent that the activities are related to covered functions,” including certain administrative, financial, legal, and quality improvement activities that are necessary to support a covered entity's core functions. We would cross-reference this definition found in 45 CFR 164.501 to maintain consistency in the definition of the terms and in the event the definitions are amended in the future. Finally, both the HIPAA Privacy Rule and the Privacy Act permit individuals to request an amendment of their record and provide requirements for subsequent disclosures or informing others of any amendments made to a record. This definition would allow VA to make reasonable efforts to quickly notify prior recipients of a veteran's health information when a correction is made.

Currently 38 CFR 1.481 and 1.482 are reserved for future use, and the undesignated center heading “Disclosures without patient consent” precedes § 1.483. We are proposing to move the undesignated center heading to precede § 1.481 and add a new § 1.481 titled “Disclosure of medical records of veterans who receive non-VA health care.” Paragraph (a) of § 1.481 would state that VA may disclose records described in 38 U.S.C. 7332(a) to a non-VA entity (including private entities and other Federal agencies) for purposes of providing health care to patients or performing other health care-related activities or functions. Paragraph (b) would state that an entity to which a record is disclosed under this subparagraph may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. This would align with the statutory changes in the VA MISSION Act of 2018.

We note that this proposed rule would authorize, but not require, VA to disclose the protected health records without patient consent. Prior to enactment of Public Law 115-26 and the VA MISSION Act of 2018, VA was prohibited from disclosing health information related to alcohol or other drug use disorder, HIV infection, or sickle cell anemia to non-VA providers in those cases where written consent was not or could not be obtained from the veteran. This created potentially harmful situations where community providers would have to make medical decisions in the absence of relevant health information or delay the delivery of care until the consent form was signed and VA could transfer the patient's medical records. Accordingly, under 38 U.S.C. 7332(b)(2)(H), which will be implemented by this proposed rule, VA will share relevant medical records with non-VA providers delivering health care and other health care-related activities or functions to veterans.

In this rulemaking we propose to add a new § 1.482 titled “Disclosure of medical records to recover or collect reasonable charges.” This new section would state that VA may disclose records referenced in 38 U.S.C. 7332(a) to a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability as permitted by 38 U.S.C. 1729, or for a condition for which recovery is authorized, or with respect to which the United States is deemed to be a third-party beneficiary under the Federal Medical Care Recovery Act (Pub. L. 87-693; 42 U.S.C. 2651 et seq.).

Prior to the enactment of the VA MISSION Act of 2018, section 7332 required VA to obtain written consent to release a patient's section 7332 protected information when billing a third-party payer for treatment of a non-service connected condition. HIPAA standards on billing transactions require diagnostic codes for the submission of a bill which can convey 7332 protected information. In addition, third-party payers generally require medical records to verify treatment prior to payment of a bill. As a result, under the original language of section 7332, VA was required to procure a veteran's consent prior to billing a third party for non-service connected care if the care involved and the medical documentation to be shared included section 7332 protected information. If VA was unable to contact a veteran or the veteran refused to provide written consent, then the Department was unable to bill third-party payers to collect for the cost of the care. This resulted in an estimated 40 million dollars per year in lost revenue. Under 38 U.S.C. 7332(b)(2)(I), VA may provide the section 7332 protected information necessary to bill for services that previously required the veteran's written consent. Section 1.482 would implement the authority in section 7332 and VA will bill under this authority.

In addition, we are proposing a technical correction to §§ 1.460 through 1.499. Currently, the statutory authority for each of these sections is found in a parenthetical immediately following each individual section. The Office of Federal Register has directed that statutory authorities should be listed in the introductory portion of each CFR part. Therefore, we are consolidating the statutory authority citations for these sections and moving them to the beginning of part 1.

Effect of Rulemaking

The Code of Federal Regulations, as proposed to be revised by this proposed rulemaking, would represent the exclusive legal authority on this subject. No contrary rules or procedures would be authorized. All VA guidance would be read to conform with this proposed rulemaking if possible or, if not possible, such guidance would be superseded by this rulemaking.

Paperwork Reduction Act

The proposed rule contains no provisions constituting a collection of information under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3521).

Regulatory Flexibility Act

The Secretary hereby certifies that this proposed rule would not have a significant economic impact on a substantial number of small entities as they are defined in the Regulatory Flexibility Act, 5 U.S.C. 601-612. This proposed rule would directly affect health and medical insurance companies, some of which are small entities. VA has determined that this proposed rule will not have a significant economic impact because VA estimates the cost of this rulemaking to be no more than 1 percent of average annual receipts, and thus not significant. VA estimates the cost of this rulemaking to be $41.7 million per year using FY2020 estimates for health and medical insurance carriers due to an increase in potential revenue received by VA from health and medical insurance firms for billed claims. This $41.7 million dollars per year will be distributed among 815, of which 312 are small, medical and health insurance firms that provide benefits to veterans treated for non-service connected conditions and whose records are protected under 38 U.S.C. 7332. We are uncertain if any small entity will be impacted so we assume that all small entities will be impacted in addition to large entities. The cost to each of the 312 small entities will be $51,172 per year, which is 1 percent of average annual receipts for the smallest potentially affected small entities. Therefore, pursuant to 5 U.S.C. 605(b), the initial and final regulatory flexibility analysis requirements of 5 U.S.C. 603 and 604 do not apply.

Executive Orders 12866, 13563, and 13771

Executive Orders 12866 and 13563 direct agencies to assess the costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, and other advantages; distributive impacts; and equity). Executive Order 13563 (Improving Regulation and Regulatory Review) emphasizes the importance of quantifying both costs and benefits, reducing costs, harmonizing rules, and promoting flexibility.

The Office of Management and Budget has designated this rule as a significant regulatory action under Executive Order 12866. VA's impact analysis can be found as a supporting document at http://www.regulations.gov,, usually within 48 hours after the rulemaking document is published. Additionally, a copy of the rulemaking and its impact analysis are available on VA's website at http://www.va.gov/​orpm by following the link for VA Regulations Published from FY 2004 through FYTD.

This proposed rule is not expected to be subject to the requirements of E.O. 13771 because this proposed rule results in no more than de minimis costs.

Unfunded Mandates

The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C. 1532, that agencies prepare an assessment of anticipated costs and benefits before issuing any rule that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more (adjusted annually for inflation) in any one year. This proposed rule would have no such effect on State, local, and tribal governments, or on the private sector.

Catalog of Federal Domestic Assistance

The Catalog of Federal Domestic Assistance numbers and titles for the programs affected by this document are 64.008—Veterans Domiciliary Care; 64.011—Veterans Dental Care; 64.012—Veterans Prescription Service; 64.013—Veterans Prosthetic Appliances; 64.014—Veterans State Domiciliary Care; 64.015—Veterans State Nursing Home Care; 64.026—Veterans State Adult Day Health Care; 64.029—Purchase Care Program; 64.033—VA Supportive Services for Veteran Families Program; 64.039—CHAMPVA; 64.040—VHA Inpatient Medicine; 64.041—VHA Outpatient Specialty Care; 64.042—VHA Inpatient Surgery; 64.043—VHA Mental Health Residential; 64.044—VHA Home Care; 64.045—VHA Outpatient Ancillary Services; 64.046—VHA Inpatient Psychiatry; 64.047—VHA Primary Care; 64.048—VHA Mental Health clinics; 64.049—VHA Community Living Center; 64.050—VHA Diagnostic Care; 64.054—Research and Development.

List of Subjects in 38 CFR Part 1

• Administrative practice and procedure
• Archives and records
• Cemeteries
• Claims
• Courts
• Crime
• Flags
• Freedom of information
• Government contracts
• Government employees
• Government property
• Infants and children
• Inventions and patents
• Parking
• Penalties
• Privacy
• Reporting and recordkeeping requirements
• Seals and insignia
• Security measures
• Wages

Signing Authority

The Secretary of Veterans Affairs, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Robert L. Wilkie, Secretary, Department of Veterans Affairs, approved this document on July 30, 2019, for publication.

Consuela Benjamin,

Regulations Development Coordinator, Office of Regulation Policy & Management, Office of the Secretary, Department of Veterans Affairs.

For the reasons set forth in the preamble, Department of Veterans Affairs proposes to amend 38 CFR part 1 as follows:

PART 1—GENERAL PROVISIONS

1. The authority citation for part 1 is amended to read as follows:

Authority: 38 U.S.C. 501, and as noted in specific sections

§§ 1.460 and 1.461 also issued under 38 U.S.C. 7332 and 7334.

§§ 1.462, 1.464, 1.466-1.469, 1.476, 1.478, 1.479, 1.491-1.493, 1.495 and 1.496 also issued under 38 U.S.C. 7334.

§§ 1.463, 1.465, 1.475, 1.477, 1.481, 1.482, 1.483, 1.485, 1.486-1.490, and 1.494 also issued under 38 U.S.C. 7332.

§ 1.484 also issued under 38 U.S.C. 7331 and 7332.

§ 1.485a also issued under 38 U.S.C. 5701 and 7332.

2. Remove the parenthetical Authority citation immediately following each section from §§ 1.460 through 1.479.

3. Amend § 1.460 by adding, in alphabetical order, definitions for “Health care” and “Health care-related activities or functions” to read as follows:

§ 1.460

Definitions.

* * * * *

Health care. The term “health care” has the same meaning as provided in 45 CFR 160.103.

Health care-related activities or functions. The term “health care-related activities or functions” means the actions required for the delivery of health care, including hospital care, medical services, and extended care services. Health care-related activities or functions includes: Treatment as defined by 45 CFR 164.501; activities related to reimbursement for care and treatment by a health care provider; activities related to participation in health information exchanges for the delivery of health care; health care operations as defined by 45 CFR 164.501; and activities related to a patient's exercise of privacy rights regarding health information.

* * * * *

4. Add an undesignated center heading immediately preceding § 1.481, and new §§ 1.481 and 1.482 to read as follows:

Disclosures Without Patient Consent

§ 1.481

Disclosure of medical records of veterans who receive non-VA health care.

(a) VA may disclose records referred to in 38 U.S.C. 7332(a) to a non-VA entity (including private entities and other Federal agencies) for purposes of providing health care to patients or performing other health care-related activities or functions.

(b) An entity to which a record is disclosed under this section may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law.

§ 1.482

Disclosure of medical records to recover or collect reasonable charges.

VA may disclose records described in 38 U.S.C. 7332(a) to a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability as permitted by 38 U.S.C. 1729, or for a condition for which recovery is authorized, or with respect to which the United States is deemed to be a third-party beneficiary under the Federal Medical Care Recovery Act (Pub. L. 87-693, 42 U.S.C. 2651 et seq.).

5. Remove the undesignated center heading immediately preceding § 1.483.

6. Remove the parenthetical Authority citation immediately following each section from §§ 1.483 through 1.496.