Disclosure of Certain Protected Records Without Written Consent, 68065-68069 [2019-26910]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 84, Number 240 (Friday, December 13, 2019)]
[Proposed Rules]
[Pages 68065-68069]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-26910]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS

38 CFR Part 1

RIN 2900-AQ64


Disclosure of Certain Protected Records Without Written Consent

AGENCY: Department of Veterans Affairs.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Veterans Affairs (VA) proposes to amend its 
regulations on disclosure of certain records. Recent changes in law, to 
include the VA MISSION Act of 2018, now authorize VA to disclose 
certain protected records to non-VA entities (including private 
entities and other Federal agencies) for purposes of providing health 
care or performing other health care-related activities or functions. 
The Act also authorizes VA to disclose these protected records to a

[[Page 68066]]

third party for the purpose of recovering or collecting reasonable 
charges for care furnished to, or paid on behalf of, a patient in 
connection with a non-service connected disability or to which the 
United States is deemed to be a third-party beneficiary. This proposed 
rule would align VA's regulations with the recent changes in law.

DATES: Comments must be received by VA on or before February 11, 2020.

ADDRESSES: Written comments may be submitted through 
www.Regulations.gov; by mail or hand-delivery to: Director, Office of 
Regulation Policy and Management (00REG), Department of Veterans 
Affairs, 810 Vermont Avenue NW, Room 1064, Washington, DC 20420; or by 
fax to (202) 273-9026. (This is not a toll-free number.) Comments 
should indicate that they are submitted in response to ``RIN 2900-
AQ64--Disclosure of certain protected records without written 
consent.'' Copies of comments received will be available for public 
inspection in the Office of Regulation Policy and Management, Room 
1064, between the hours of 8:00 a.m. and 4:30 p.m. Monday through 
Friday (except holidays). Please call (202) 461-4902 for an 
appointment. (This is not a toll-free number.) In addition, during the 
comment period, comments may be viewed online through the Federal 
Docket Management System (FDMS) at www.Regulations.gov.

FOR FURTHER INFORMATION CONTACT: Stephania H. Griffin, Director, 
Information Access and Privacy Office (10A7), Department of Veterans 
Affairs, 810 Vermont Avenue NW, Washington, DC 20420; (704) 245-2492. 
(This is not a toll-free number.)

SUPPLEMENTARY INFORMATION: Records and files maintained by VA on 
veterans and beneficiaries, including medical records, are generally 
confidential, and VA may not disclose or release these materials except 
as provided by law. 38 U.S.C. 5701. Moreover, records of the identity, 
diagnosis, prognosis, or treatment by or for VA of any patient related 
to drug abuse, alcoholism or alcohol abuse, infection with the human 
immunodeficiency virus (HIV), or sickle cell anemia as prescribed by 38 
U.S.C. 7332(a)(1) are confidential and subject to special protection 
against disclosure. These records may only be disclosed for the 
specific purposes and under the circumstances expressly authorized 
under 38 U.S.C. 7332(b). Paragraph (b)(1) authorizes disclosure with 
the prior written consent of the patient to the extent, circumstances, 
and purposes allowed by VA regulations. Paragraph (b)(2) authorizes 
disclosure under certain circumstances with or without the written 
consent of the patient.
    Section 3 of Public Law (Pub. L.) 115-26 (April 19, 2017) amended 
38 U.S.C. 7332 by adding a new paragraph (b)(2)(H), authorizing 
disclosure of 7332-protected records without the written consent of the 
patient or subject of the record to a non-VA entity (including private 
entities and other Federal agencies) that provides VA-authorized 
hospital care or medical services to veterans. It also provided that 
any non-VA entity receiving such records may not redisclose or use 
those record for a purpose other than that for which the disclosure was 
made.
    Subsequently, section 132 of Public Law 115-182, the John S. McCain 
III, Daniel K. Akaka, and Samuel R. Johnson VA Maintaining Internal 
Systems and Strengthening Integrated Outside Networks Act of 2018, or 
the VA MISSION Act of 2018 (June 6, 2018) amended 38 U.S.C. 7332(b)(2) 
by striking paragraph (H) and inserting new paragraphs (H) and (I). 
Paragraph (H)(i) authorizes disclosure of 7332-protected records 
without the written consent of the patient to a non-VA entity 
(including private entities and other Federal agencies) for purposes of 
providing health care, including hospital care, medical services, and 
extended care services to patients or performing other health care-
related activities or functions. Thus, the scope of permissible 
disclosures of 7332-protected records was expanded from non-VA entities 
providing hospital care or medical services authorized by the VA to 
non-VA entities providing health care or other health care-related 
activities or functions. Further, paragraph (H)(ii) was amended in 2017 
to provide that any entity to which a record is disclosed under this 
paragraph may not disclose or use such record for a purpose other than 
that for which the disclosure was made or as permitted by law. The 
amendment under the MISSION Act replaced ``redisclose'' with 
``disclose'' and added that entities who receive 7332-protected records 
may also make disclosures as permitted by law. Additionally, paragraph 
(I) was added to authorize disclosure to a third party in order to 
recover or collect reasonable charges for care furnished to, or paid on 
behalf of, a patient in connection with a non-service connected 
disability as permitted by section 1729 of this title, or for a 
condition for which recovery is authorized, or with respect to which 
the United States is deemed to be a third-party beneficiary under the 
Federal Medical Care Recovery Act.
    VA has published regulations implementing release of information 
from VA records protected by one or more confidentiality provisions in 
38 CFR part 1. General rules on release of information related to 
alcohol or other drug use disorder, HIV infection, or sickle cell 
anemia are at 38 CFR 1.460 through 1.469. In particular, Sec.  1.460 
contains the definitions for Sec. Sec.  1.460 through 1.499 of this 
part. Disclosure with patient consent is addressed in Sec. Sec.  1.475 
through 1.479, while disclosures that do not require patient consent 
are addressed in Sec. Sec.  1.483 through 1.489. The focus of 
Sec. Sec.  1.490 through 1.499 is release of information in response to 
a court order. VA proposes to amend part 1 to conform to these 
statutory changes by adding two new definitions to Sec.  1.460, and 
adding two new sections at 38 CFR 1.481 and 1.482.
    In this rulemaking we propose to add two new definitions to Sec.  
1.460. We would add the term ``health care'' to have the same meaning 
as defined in the Health Insurance Portability and Accountability Act 
(HIPAA) Regulations, 45 CFR 160.103. We choose this definition to 
maintain consistency with the HIPAA Privacy Rule regulations 
promulgated by the Department of Health and Human Services at 45 CFR 
part 160 and subparts A and E of part 164, and to align with industry 
standards and practice. Section 160.103 of 45 CFR defines in part 
``health care'' as ``care, services, or supplies related to the health 
of an individual,'' including ``preventive, diagnostic, therapeutic, 
rehabilitative, maintenance, or palliative care, and counseling, 
service, assessment, or procedure with respect to the physical or 
mental condition, or functional status, of an individual or that 
affects the structure or function of the body.'' Furthermore, the 
``sale or dispensing of a drug, device, equipment, or other item in 
accordance with a prescription'' is included in the definition. We 
would cross-reference the definition found in 45 CFR 160.103 in 38 CFR 
1.460 to maintain consistency in definition of the term and in the 
event the definition is amended in the future. We note that the VA 
MISSION Act of 2018 includes hospital care, medical services, and 
extended care services as part of health care; however, since 45 CFR 
160.103 does not explicitly identify these services in the definition, 
we have added this language to the definition of ``health care-related 
activities or functions'' below.
    We would also add the term ``health care-related activities or 
functions'' and define it to mean the actions required

[[Page 68067]]

for the delivery of health care, including hospital care, medical 
services, and extended care services. The definition would also 
indicate that health care-related activities or functions include: 
Treatment as defined by 45 CFR 164.501, activities related to 
reimbursement for care and treatment by a health care provider, 
activities related to participation in health information exchanges for 
the delivery of health care, health care operations as defined by 45 
CFR 164.501, and activities related to a patient's exercise of privacy 
rights regarding health information. This definition would allow VA to 
implement the recent statutory changes to 7332 by expanding the scope 
of permissible disclosure to purposes other than providing health care. 
Thus, this definition will allow VA to implement the recent statutory 
changes to section 7332 while also maintaining consistency with the 
definition of ``health care'' from the HIPAA Privacy Rule. We note that 
this rulemaking does not negate the requirement of VA to comply with 
HIPAA, when applicable.
    VA believes that the examples of health-care-related activities and 
functions are appropriate to show consistency with the HIPAA Privacy 
Rule, which also allows the disclosure of protected health information 
for treatment. VA would apply the same standard for disclosures of 
section 7332 protected information since it aligns with common industry 
practice. Section 164.501 of 45 CFR defines ``treatment'' in part as 
the ``provision, coordination, or management of health care and related 
services by . . . health care providers, including the coordination or 
management of health care . . . with a third party; consultations 
between health care providers relating to a patient; or the referral of 
a patient from one health care provider to another.'' We would cross-
reference this definition found in 45 CFR 164.501 to maintain 
consistency in the definition of the terms and in the event the 
definitions are amended in the future. Also, the HIPAA Privacy Rule 
allows the disclosure of protected health information for payment 
activities. Likewise, VA regulations at 38 CFR 17.106 allows the 
disclosure of appropriate health care records to third-party payers for 
the purposes of verifying the care and services which are the subject 
of claims for which VA seeks payment, recovery, or collection. This 
definition will allow VA to implement the recent statutory changes to 
section 7332 while also maintaining consistency with industry standards 
and practice under the HIPAA Privacy Rule for disclosing appropriate 
health care records to third-party payers. Additionally, VA has entered 
into agreements to participate in a health information exchange (HIE) 
to help facilitate the transfer of information between different 
organizations that range from community health care providers and 
health plans to government agencies providing benefits. This definition 
would allow VA to electronically transfer health information with HIE 
community partners for the purposes of delivering health care. 
Furthermore, the HIPAA Privacy Rule allows the disclosure of protected 
health information for health care operations under certain 
circumstances outlined in 45 CFR 164.506(c)(1) and (4). Thus, VA would 
apply the same standard for disclosures of section 7332 protected 
information since it aligns with common industry practice. Section 
164.501 of 45 CFR defines ``health care operations'' in part as the 
``activities of [a] covered entity to the extent that the activities 
are related to covered functions,'' including certain administrative, 
financial, legal, and quality improvement activities that are necessary 
to support a covered entity's core functions. We would cross-reference 
this definition found in 45 CFR 164.501 to maintain consistency in the 
definition of the terms and in the event the definitions are amended in 
the future. Finally, both the HIPAA Privacy Rule and the Privacy Act 
permit individuals to request an amendment of their record and provide 
requirements for subsequent disclosures or informing others of any 
amendments made to a record. This definition would allow VA to make 
reasonable efforts to quickly notify prior recipients of a veteran's 
health information when a correction is made.
    Currently 38 CFR 1.481 and 1.482 are reserved for future use, and 
the undesignated center heading ``Disclosures without patient consent'' 
precedes Sec.  1.483. We are proposing to move the undesignated center 
heading to precede Sec.  1.481 and add a new Sec.  1.481 titled 
``Disclosure of medical records of veterans who receive non-VA health 
care.'' Paragraph (a) of Sec.  1.481 would state that VA may disclose 
records described in 38 U.S.C. 7332(a) to a non-VA entity (including 
private entities and other Federal agencies) for purposes of providing 
health care to patients or performing other health care-related 
activities or functions. Paragraph (b) would state that an entity to 
which a record is disclosed under this subparagraph may not disclose or 
use such record for a purpose other than that for which the disclosure 
was made or as permitted by law. This would align with the statutory 
changes in the VA MISSION Act of 2018.
    We note that this proposed rule would authorize, but not require, 
VA to disclose the protected health records without patient consent. 
Prior to enactment of Public Law 115-26 and the VA MISSION Act of 2018, 
VA was prohibited from disclosing health information related to alcohol 
or other drug use disorder, HIV infection, or sickle cell anemia to 
non-VA providers in those cases where written consent was not or could 
not be obtained from the veteran. This created potentially harmful 
situations where community providers would have to make medical 
decisions in the absence of relevant health information or delay the 
delivery of care until the consent form was signed and VA could 
transfer the patient's medical records. Accordingly, under 38 U.S.C. 
7332(b)(2)(H), which will be implemented by this proposed rule, VA will 
share relevant medical records with non-VA providers delivering health 
care and other health care-related activities or functions to veterans.
    In this rulemaking we propose to add a new Sec.  1.482 titled 
``Disclosure of medical records to recover or collect reasonable 
charges.'' This new section would state that VA may disclose records 
referenced in 38 U.S.C. 7332(a) to a third party in order to recover or 
collect reasonable charges for care furnished to, or paid on behalf of, 
a patient in connection with a non-service connected disability as 
permitted by 38 U.S.C. 1729, or for a condition for which recovery is 
authorized, or with respect to which the United States is deemed to be 
a third-party beneficiary under the Federal Medical Care Recovery Act 
(Pub. L. 87-693; 42 U.S.C. 2651 et seq.).
    Prior to the enactment of the VA MISSION Act of 2018, section 7332 
required VA to obtain written consent to release a patient's section 
7332 protected information when billing a third-party payer for 
treatment of a non-service connected condition. HIPAA standards on 
billing transactions require diagnostic codes for the submission of a 
bill which can convey 7332 protected information. In addition, third-
party payers generally require medical records to verify treatment 
prior to payment of a bill. As a result, under the original language of 
section 7332, VA was required to procure a veteran's consent prior to 
billing a third party for non-service connected care if the care 
involved and the medical documentation to be shared included

[[Page 68068]]

section 7332 protected information. If VA was unable to contact a 
veteran or the veteran refused to provide written consent, then the 
Department was unable to bill third-party payers to collect for the 
cost of the care. This resulted in an estimated 40 million dollars per 
year in lost revenue. Under 38 U.S.C. 7332(b)(2)(I), VA may provide the 
section 7332 protected information necessary to bill for services that 
previously required the veteran's written consent. Section 1.482 would 
implement the authority in section 7332 and VA will bill under this 
authority.
    In addition, we are proposing a technical correction to Sec. Sec.  
1.460 through 1.499. Currently, the statutory authority for each of 
these sections is found in a parenthetical immediately following each 
individual section. The Office of Federal Register has directed that 
statutory authorities should be listed in the introductory portion of 
each CFR part. Therefore, we are consolidating the statutory authority 
citations for these sections and moving them to the beginning of part 
1.

Effect of Rulemaking

    The Code of Federal Regulations, as proposed to be revised by this 
proposed rulemaking, would represent the exclusive legal authority on 
this subject. No contrary rules or procedures would be authorized. All 
VA guidance would be read to conform with this proposed rulemaking if 
possible or, if not possible, such guidance would be superseded by this 
rulemaking.

Paperwork Reduction Act

    The proposed rule contains no provisions constituting a collection 
of information under the Paperwork Reduction Act of 1995 (44 U.S.C. 
3501-3521).

Regulatory Flexibility Act

    The Secretary hereby certifies that this proposed rule would not 
have a significant economic impact on a substantial number of small 
entities as they are defined in the Regulatory Flexibility Act, 5 
U.S.C. 601-612. This proposed rule would directly affect health and 
medical insurance companies, some of which are small entities. VA has 
determined that this proposed rule will not have a significant economic 
impact because VA estimates the cost of this rulemaking to be no more 
than 1 percent of average annual receipts, and thus not significant. VA 
estimates the cost of this rulemaking to be $41.7 million per year 
using FY2020 estimates for health and medical insurance carriers due to 
an increase in potential revenue received by VA from health and medical 
insurance firms for billed claims. This $41.7 million dollars per year 
will be distributed among 815, of which 312 are small, medical and 
health insurance firms that provide benefits to veterans treated for 
non-service connected conditions and whose records are protected under 
38 U.S.C. 7332. We are uncertain if any small entity will be impacted 
so we assume that all small entities will be impacted in addition to 
large entities. The cost to each of the 312 small entities will be 
$51,172 per year, which is 1 percent of average annual receipts for the 
smallest potentially affected small entities. Therefore, pursuant to 5 
U.S.C. 605(b), the initial and final regulatory flexibility analysis 
requirements of 5 U.S.C. 603 and 604 do not apply.

Executive Orders 12866, 13563, and 13771

    Executive Orders 12866 and 13563 direct agencies to assess the 
costs and benefits of available regulatory alternatives and, when 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, and other advantages; distributive impacts; 
and equity). Executive Order 13563 (Improving Regulation and Regulatory 
Review) emphasizes the importance of quantifying both costs and 
benefits, reducing costs, harmonizing rules, and promoting flexibility.
    The Office of Management and Budget has designated this rule as a 
significant regulatory action under Executive Order 12866. VA's impact 
analysis can be found as a supporting document at https://www.regulations.gov, usually within 48 hours after the rulemaking 
document is published. Additionally, a copy of the rulemaking and its 
impact analysis are available on VA's website at https://www.va.gov/orpm 
by following the link for VA Regulations Published from FY 2004 through 
FYTD.
    This proposed rule is not expected to be subject to the 
requirements of E.O. 13771 because this proposed rule results in no 
more than de minimis costs.

Unfunded Mandates

    The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C. 
1532, that agencies prepare an assessment of anticipated costs and 
benefits before issuing any rule that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100 million or more (adjusted annually for 
inflation) in any one year. This proposed rule would have no such 
effect on State, local, and tribal governments, or on the private 
sector.

Catalog of Federal Domestic Assistance

    The Catalog of Federal Domestic Assistance numbers and titles for 
the programs affected by this document are 64.008--Veterans Domiciliary 
Care; 64.011--Veterans Dental Care; 64.012--Veterans Prescription 
Service; 64.013--Veterans Prosthetic Appliances; 64.014--Veterans State 
Domiciliary Care; 64.015--Veterans State Nursing Home Care; 64.026--
Veterans State Adult Day Health Care; 64.029--Purchase Care Program; 
64.033--VA Supportive Services for Veteran Families Program; 64.039--
CHAMPVA; 64.040--VHA Inpatient Medicine; 64.041--VHA Outpatient 
Specialty Care; 64.042--VHA Inpatient Surgery; 64.043--VHA Mental 
Health Residential; 64.044--VHA Home Care; 64.045--VHA Outpatient 
Ancillary Services; 64.046--VHA Inpatient Psychiatry; 64.047--VHA 
Primary Care; 64.048--VHA Mental Health clinics; 64.049--VHA Community 
Living Center; 64.050--VHA Diagnostic Care; 64.054--Research and 
Development.

List of Subjects in 38 CFR Part 1

    Administrative practice and procedure, Archives and records, 
Cemeteries, Claims, Courts, Crime, Flags, Freedom of information, 
Government contracts, Government employees, Government property, 
Infants and children, Inventions and patents, Parking, Penalties, 
Privacy, Reporting and recordkeeping requirements, Seals and insignia, 
Security measures, Wages.

Signing Authority

    The Secretary of Veterans Affairs, or designee, approved this 
document and authorized the undersigned to sign and submit the document 
to the Office of the Federal Register for publication electronically as 
an official document of the Department of Veterans Affairs. Robert L. 
Wilkie, Secretary, Department of Veterans Affairs, approved this 
document on July 30, 2019, for publication.

Consuela Benjamin,
Regulations Development Coordinator, Office of Regulation Policy & 
Management, Office of the Secretary, Department of Veterans Affairs.

    For the reasons set forth in the preamble, Department of Veterans 
Affairs proposes to amend 38 CFR part 1 as follows:

[[Page 68069]]

PART 1--GENERAL PROVISIONS

0
1. The authority citation for part 1 is amended to read as follows:

    Authority: 38 U.S.C. 501, and as noted in specific sections

    Sec. Sec.  1.460 and 1.461 also issued under 38 U.S.C. 7332 and 
7334.
    Sec. Sec.  1.462, 1.464, 1.466-1.469, 1.476, 1.478, 1.479, 
1.491-1.493, 1.495 and 1.496 also issued under 38 U.S.C. 7334.
    Sec. Sec.  1.463, 1.465, 1.475, 1.477, 1.481, 1.482, 1.483, 
1.485, 1.486-1.490, and 1.494 also issued under 38 U.S.C. 7332.
    Sec.  1.484 also issued under 38 U.S.C. 7331 and 7332.
    Sec.  1.485a also issued under 38 U.S.C. 5701 and 7332.

0
2. Remove the parenthetical Authority citation immediately following 
each section from Sec. Sec.  1.460 through 1.479.
0
3. Amend Sec.  1.460 by adding, in alphabetical order, definitions for 
``Health care'' and ``Health care-related activities or functions'' to 
read as follows:


Sec.  1.460  Definitions.

* * * * *
    Health care. The term ``health care'' has the same meaning as 
provided in 45 CFR 160.103.
    Health care-related activities or functions. The term ``health 
care-related activities or functions'' means the actions required for 
the delivery of health care, including hospital care, medical services, 
and extended care services. Health care-related activities or functions 
includes: Treatment as defined by 45 CFR 164.501; activities related to 
reimbursement for care and treatment by a health care provider; 
activities related to participation in health information exchanges for 
the delivery of health care; health care operations as defined by 45 
CFR 164.501; and activities related to a patient's exercise of privacy 
rights regarding health information.
* * * * *
0
4. Add an undesignated center heading immediately preceding Sec.  
1.481, and new Sec. Sec.  1.481 and 1.482 to read as follows:

Disclosures Without Patient Consent


Sec.  1.481  Disclosure of medical records of veterans who receive non-
VA health care.

    (a) VA may disclose records referred to in 38 U.S.C. 7332(a) to a 
non-VA entity (including private entities and other Federal agencies) 
for purposes of providing health care to patients or performing other 
health care-related activities or functions.
    (b) An entity to which a record is disclosed under this section may 
not disclose or use such record for a purpose other than that for which 
the disclosure was made or as permitted by law.


Sec.  1.482  Disclosure of medical records to recover or collect 
reasonable charges.

    VA may disclose records described in 38 U.S.C. 7332(a) to a third 
party in order to recover or collect reasonable charges for care 
furnished to, or paid on behalf of, a patient in connection with a non-
service connected disability as permitted by 38 U.S.C. 1729, or for a 
condition for which recovery is authorized, or with respect to which 
the United States is deemed to be a third-party beneficiary under the 
Federal Medical Care Recovery Act (Pub. L. 87-693, 42 U.S.C. 2651 et 
seq.).
0
5. Remove the undesignated center heading immediately preceding Sec.  
1.483.
0
6. Remove the parenthetical Authority citation immediately following 
each section from Sec. Sec.  1.483 through 1.496.

[FR Doc. 2019-26910 Filed 12-12-19; 8:45 am]
BILLING CODE 8320-01-P