Disclosure of Certain Protected Records Without Written Consent, 64040-64043 [2020-20276]

Download as PDF 64040 Federal Register / Vol. 85, No. 197 / Friday, October 9, 2020 / Rules and Regulations consideration in money or money’s worth. (B) Example. The following example illustrates the application of this paragraph (c)(2)(v): Example. Employer T operates a restaurant. T provides food and beverages to its food service employees before, during, and after their shifts for no consideration. Under section 274(e)(8) and this paragraph (c)(2)(v), the expenses associated with the food and beverages provided to the employees are not subject to the 50 percent deduction limitation in paragraph (a) of this section because the restaurant sells food and beverages to customers in a bona fide transaction for an adequate and full consideration in money or money’s worth. Thus, T may deduct 100 percent of the food and beverage expenses. (d) Applicability date. This section applies for taxable years that begin on or after October 9, 2020. SUPPLEMENTARY INFORMATION: Background The final regulations (TD 9902) that are the subject of this correction are issued under section 951A of the Code. Need for Correction As published, the final regulations (TD 9902) contain errors that need to be corrected. List of Subjects in 26 CFR Part 1 Income taxes, Reporting and recordkeeping requirements. Correction of Publication Accordingly, 26 CFR part 1 is corrected by making the following correcting amendments: PART 1—INCOME TAXES Paragraph 1. The authority citation for part 1 continues to read in part as follows: ■ Authority: 26 U.S.C. 7805 * * * Sunita Lough, Deputy Commissioner for Services and Enforcement. Approved: September 25, 2020. David J. Kautter, Assistant Secretary of the Treasury (Tax Policy). Par. 2. Section 1.951A–2 is amended by adding a sentence at the end of paragraph (c)(7)(viii)(E)(2)(ii) to read as follows: ■ § 1.951A–2 Tested Income and tested loss. * [FR Doc. 2020–21990 Filed 10–2–20; 4:15 pm] BILLING CODE 4830–01–P DEPARTMENT OF THE TREASURY Internal Revenue Service 26 CFR Part 1 [TD 9902] RIN 1545–BP15 Guidance Under Sections 951A and 954 Regarding Income Subject to a High Rate of Foreign Tax; Correcting Amendment Internal Revenue Service (IRS), Treasury. ACTION: Correcting amendments. AGENCY: This document contains corrections to Treasury Decision 9902, which was published in the Federal Register on Thursday, July 23, 2020. Treasury Decision 9902 contained final regulations under the global intangible low-taxed income and subpart F income provisions of the Internal Revenue Code regarding the treatment of income that is subject to a high rate of foreign tax. DATES: This correction is effective on October 9, 2020. FOR FURTHER INFORMATION CONTACT: Jorge M. Oben or Larry R. Pounders at (202) 317–6934 (not a toll-free number). * * * * (c) * * * (7) * * * (viii) * * * (E) * * * (2) * * * (ii) * * * Notwithstanding the rule set forth in this paragraph (c)(7)(viii)(E)(2)(ii), a controlled foreign corporation is not a member of a CFC group if, as of the close of its CFC inclusion year, the controlled foreign corporation does not have a controlling domestic shareholder. Crystal Pemberton, Senior Federal Register Liaison, Publications and Regulations Branch, Legal Processing Division, Associate Chief Counsel (Procedure and Administration). [FR Doc. 2020–20419 Filed 10–8–20; 8:45 am] BILLING CODE 4830–01–P SUMMARY: VerDate Sep<11>2014 16:35 Oct 08, 2020 Jkt 253001 DEPARTMENT OF VETERANS AFFAIRS 38 CFR Part 1 RIN 2900–AQ64 Disclosure of Certain Protected Records Without Written Consent Department of Veterans Affairs. Final rule. AGENCY: ACTION: The Department of Veterans Affairs (VA) adopts as final with no SUMMARY: PO 00000 Frm 00048 Fmt 4700 Sfmt 4700 changes, a proposed rule amending its regulations on disclosure of certain records. Recent changes in law, to include the VA MISSION Act of 2018, now authorize VA to disclose certain protected records to non-VA entities for purposes of providing health care or performing other health care-related activities or functions to include recovering or collecting reasonable charges for care furnished. DATES: The final rule is effective November 9, 2020. FOR FURTHER INFORMATION CONTACT: Stephania H. Griffin, Director, Information Access and Privacy Office (10A7), Department of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC 20420; (704) 245–2492. (This is not a toll-free number.) SUPPLEMENTARY INFORMATION: In accordance with section 5701 of title 38 United States Code (U.S.C.), records and files maintained by VA on veterans and beneficiaries, including medical records, are generally confidential, and VA may not disclose or release these materials except as provided by law. Moreover, records of the identity, diagnosis, prognosis, or treatment by or for VA of any patient related to drug abuse, alcoholism or alcohol abuse, infection with the human immunodeficiency virus (HIV), or sickle cell anemia as prescribed by 38 U.S.C. 7332(a)(1) are confidential and subject to special protection against disclosure. These records may only be disclosed for the specific purposes and under the circumstances expressly authorized under 38 U.S.C. 7332(b), where section (b)(1) authorizes disclosure with the prior written consent of the patient to the extent, circumstances, and purposes allowed by VA regulations, and section (b)(2) authorizes disclosure under certain circumstances with or without the written consent of the patient. Section 3 of Public Law (Pub. L.) 115– 26 (April 19, 2017) amended 38 U.S.C. 7332 by adding a new paragraph (b)(2)(H), authorizing disclosure of 7332-protected records without the written consent of the patient or subject of the record to a non-VA entity (including private entities and other Federal agencies) that provides VAauthorized hospital care or medical services to veterans. It also provided that any non-VA entity receiving such records may not redisclose or use those record for a purpose other than that for which the disclosure was made. Subsequently, section 132 of Public Law 115–182, the John S. McCain III, Daniel K. Akaka, and Samuel R. Johnson VA Maintaining Internal Systems and Strengthening Integrated Outside E:\FR\FM\09OCR1.SGM 09OCR1 Federal Register / Vol. 85, No. 197 / Friday, October 9, 2020 / Rules and Regulations Networks Act of 2018, or the VA MISSION Act of 2018 (June 6, 2018) amended 38 U.S.C. 7332(b)(2) by striking paragraph (H) and inserting new paragraphs (H) and (I). Paragraph (H)(i) authorizes disclosure of 7332-protected records without the written consent of the patient to a non-VA entity (including private entities and other Federal agencies) for purposes of providing health care, including hospital care, medical services, and extended care services to patients or performing other health care-related activities or functions. Thus, the scope of permissible disclosures of 7332protected records was expanded from non-VA entities providing hospital care or medical services authorized by the VA to non-VA entities providing health care or other health care-related activities or functions. Further, paragraph (H)(ii) was amended in 2017 to provide that any entity to which a record is disclosed under this paragraph may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. The amendment under the MISSION Act replaced the term redisclose with the term disclose and added that entities who receive 7332protected records may also make disclosures as permitted by law. Additionally, paragraph (I) was added to authorize disclosure to a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability as permitted by section 1729 of this title, or for a condition for which recovery is authorized, or with respect to which the United States is deemed to be a thirdparty beneficiary under the Federal Medical Care Recovery Act. VA has published regulations implementing release of information from VA records protected by one or more confidentiality provisions in 38 CFR part 1. General rules on release of information related to alcohol or other drug use disorder, HIV infection, or sickle cell anemia are at 38 CFR 1.460 through 1.469. In particular, § 1.460 contains the definitions for §§ 1.460 through 1.499 of this part. Disclosure with patient consent is addressed in §§ 1.475 through 1.479, while disclosures that do not require patient consent are addressed in §§ 1.483 through 1.489. The focus of §§ 1.490 through 1.499 is release of information in response to a court order. In a document published in the Federal Register on December 13, 2019 (84 FR 68065), VA proposed, among other things, to amend part 1 to conform to these statutory changes by adding the VerDate Sep<11>2014 16:35 Oct 08, 2020 Jkt 253001 terms health care and health care related activities or functions to § 1.460; and adding two new sections at 38 CFR 1.481 and 1.482 titled Disclosure of medical records of veterans who receive non-VA health care, and Disclosure of medical records to recover or collect reasonable charges, respectively. Furthermore, we proposed a technical correction to §§ 1.460 through 1.499 by moving the authority citations for these sections and moving them to the beginning of part 1 to comply with the Office of Federal Register direction that statutory authorities should be listed in the introductory portion of each CFR part. VA provided a 60-day comment period that ended on February 11, 2020, and we received two comments. The first comment stated that VA should obtain permission from veterans and that every effort should be made to contact a veteran’s family for the release of records if the veteran is deceased (we note that, although the comment used the word decided, based on the content of the comment, we believe that the intended word was deceased). To address the first portion of the comment related to obtaining permission from veterans, as previously explained, section 3 of Public Law 115–26 and section 132 of the VA MISSION Act of 2018, amended 38 U.S.C. 7332(b)(2) by allowing VA to disclose certain protected records to non-VA entities (including private entities and other Federal agencies) for purposes of providing health care or performing other health care-related activities or functions. Also, VA may disclose these protected records to a third party for the purpose of recovering or collecting reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability or to which the United States is deemed to be a thirdparty beneficiary. Therefore, VA may now disclose certain protected records with or without consent for the aforementioned reasons. Also, adding a consent mandate to the regulation would negate the intent of the statutory amendment. To address the portion of the comment related to the records of a deceased individual, such records continue to be protected under 38 U.S.C. 7332; however, we note that over time, certain disclosures (e.g., disclosures to a provider for treatment purposes, disclosures to a third-party to recover or collect reasonable charges) would no longer be made for a deceased individual because the deceased individual would no longer receive treatment. Furthermore, the family PO 00000 Frm 00049 Fmt 4700 Sfmt 4700 64041 members of a deceased individual cannot consent to a disclosure unless such disclosure is necessary to obtain benefits to which the family member may be entitled. 38 U.S.C. 7332(b)(3). We are not making any changes based on this comment. The second comment raised multiple concerns and recommendations regarding: (1) Definition for treatment and health care; (2) external treatment records; (3) restriction requests; and (4) the Privacy Act of 1974 (the Privacy Act)). 1. Definition for treatment and health care. The comment asked why VA would use the same definition for treatment and health care as the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. We proposed to use treatment as defined by 45 CFR 164.501 as part of our proposed definition for the term health care-related activities or functions. VA has chosen to use the same definition for treatment to maintain consistency with the HIPAA Privacy Rule. Likewise, we have chosen to define health care to have the same meaning as defined in the HIPAA Privacy Rule and to align with industry standard and practice. Therefore, we believe it is reasonable to maintain consistency with HIPAA to allow community providers to rely on the same definition when using and disclosing VA records, and we are not making any changes based on this portion of the comment. 2. External treatment records. The comment expressed concern regarding the creation of external treatment records when VA refers veterans to community providers, and further asked VA to revise § 1.481(b) as proposed to include, at the end, a phrase that reads including via any health information exchange or organization. When VA refers patients to community providers for treatment, those community providers create their own treatment records and VA does not have the authority to restrict the records created and owned by an external entity. However, if VA provides a copy of VA medical records to a community provider then VA may restrict the use of the medical record provided and the language proposed in 1.481(b) provides this restriction by stating that an entity to which a record is disclosed under this section may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. This language is consistent with our authorizing statute under 38 U.S.C. 7332(b)(2)(H)(i) and we do not believe it is necessary to add the additional phrase as suggested by the E:\FR\FM\09OCR1.SGM 09OCR1 64042 Federal Register / Vol. 85, No. 197 / Friday, October 9, 2020 / Rules and Regulations commenter because the restriction that is already present in § 1.418(b) as proposed captures all entity types to include health information exchanges or organizations when applicable. We are not making any changes based on this portion of the comment. 3. Restriction requests. The comment raised a concern that the proposed rule did not address requests for restrictions on the disclosure of medical records under the HIPAA Privacy Rule, and specifically, restrictions with regard to information sharing through a health information exchange. The comment addressed both the issues of restriction on the use and disclosure of protected health information, and the means under which protected health information is shared. To address both issues raised in the comment, we first note that the purpose of the proposed rule and this final rule is to align VA’s regulations with recent changes in law that now authorize VA to disclose 7332protected records to a third party for the purpose of providing health care or performing other health care-related activities or functions, and to a third party for the purpose of recovering or collecting reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability or to which the United States is deemed to be a thirdparty beneficiary. This authority does not negate an individual’s ability to request a restriction on the use and disclosure of their protected health information under 45 CFR 164.522, nor does it negate VA’s obligation to uphold a request if VA agrees to a restriction. We note that under the HIPAA Privacy Rule, VA may still use or disclose restricted protected health information for emergency treatment. 45 CFR 164.522(a)(1)(iii). Additionally, under the HIPAA Privacy Rule a covered entity is not required to agree to a restriction unless the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law and the protected health information pertains solely to a health care item or service for which the individual, or person other than the health plan on behalf of the individual, has paid the covered entity in full. 45 CFR 164.522(a)(1)(ii) and (vi). Thus, this final rule does not affect an individual’s ability to request restrictions on the disclosure of medical records. We next clarify this final rule does not impede an individual’s ability to opt-out of health information exchanges. VA provides individuals the opportunity to opt-out of sharing protected health information through VerDate Sep<11>2014 16:35 Oct 08, 2020 Jkt 253001 health information exchanges (HIE). Therefore, if an individual chooses to opt-out, VA will uphold this request by not sharing protected health information through an HIE. However, protected health information will continue to be shared on paper, fax, or other legally allowed means. We are not making any changes based on this portion of the comment. 4. The Privacy Act. The comment asked if the Privacy Act applies to medical records and whether the routine use exemption applies. We clarify that this rule does not impact protections under the Privacy Act because VA is authorized to disclose 7332-protected records without consent under routine use when such disclosure is authorized by 38 U.S.C. 7332. The Privacy Act requires Federal agencies to not disclose any record which is contained in a system of records . . . without the prior written consent of, the individual to whom the record pertains, unless the disclosure of the record would be . . . for routine use. 5 U.S.C. 552a(b) and (b)(3). Routine use, with respect to the disclosure of records, means the use of such record for a purpose which is compatible with the purpose for which it was collected. 5 U.S.C. 552a(a)(7). In accordance with 5 U.S.C. 552a(e), VA publishes a Federal Register Notice outlining the routine use disclosures of records from a Privacy Act system of records to a person or entity outside of VA without the prior signed written consent authorization of the individual who is the subject of the information. For example, published routine use disclosure statements in the Privacy Act system of records, ‘‘Patient Medical Records-VA’’, 24VA10P2 permits the release of protected health information when a disclosure is also authorized by other applicable legal authorities, including the HIPAA Privacy Rule; and disclosure of 7332-proteced records when the disclosure is also authorized by 38 U.S.C. 7332. Furthermore, this rule aligns VA’s regulations with recent changes in our statutory authority under 7332. We are not making any changes based on this portion of the comment. Based on the rationale set forth in the proposed rule and in this document, we are adopting the proposed rule as final without changes. Congressional Review Act Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), the Office of Information and Regulatory Affairs designated this rule as not a major rule, as defined by 5 U.S.C. 804(2). PO 00000 Frm 00050 Fmt 4700 Sfmt 4700 Paperwork Reduction Act The final rule contains no provisions constituting a collection of information under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501–3521). Regulatory Flexibility Act The Secretary hereby certifies that this final rule will not have a significant economic impact on a substantial number of small entities as they are defined in the Regulatory Flexibility Act, 5 U.S.C. 601–612. This final rule will directly affect health and medical insurance companies, some of which are small entities. VA has determined that this final rule will not have a significant economic impact because VA estimates the cost of this rulemaking to be no more than 1 percent of average annual receipts, and thus not significant. In the proposed rule, VA estimated the cost of this rulemaking to be $41.7 per year using FY2020 estimates. VA now estimates the cost of this rulemaking to be $43.8 million per year using FY2021 estimates for health and medical insurance carriers due to an increase in potential revenue received by VA from health and medical insurance firms for billed claims. This $43.8 million dollars per year will be distributed among 815, of which 312 are small, medical and health insurance firms that provide benefits to veterans treated for nonservice connected conditions and whose records are protected under 38 U.S.C. 7332. We are uncertain if any small entity will be impacted so we assume that all small entities will be impacted in addition to large entities. The cost to each of the 312 small entities will be $53,779 per year, which is 1 percent of average annual receipts for the smallest potentially affected small entities. Therefore, pursuant to 5 U.S.C. 605(b), the initial and final regulatory flexibility analysis requirements of 5 U.S.C. 603 and 604 do not apply. Executive Orders 12866, 13563, and 13771 Executive Orders 12866 and 13563 direct agencies to assess the costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, and other advantages; distributive impacts; and equity). Executive Order 13563 (Improving Regulation and Regulatory Review) emphasizes the importance of quantifying both costs and benefits, reducing costs, harmonizing rules, and promoting flexibility. The Office of E:\FR\FM\09OCR1.SGM 09OCR1 Federal Register / Vol. 85, No. 197 / Friday, October 9, 2020 / Rules and Regulations Information and Regulatory Affairs has determined this rule is not a significant regulatory action under Executive Order 12866. VA’s impact analysis can be found as a supporting document at https:// www.regulations.gov, usually within 48 hours after the rulemaking document is published. Additionally, a copy of the rulemaking and its impact analysis are available on VA’s website at https:// www.va.gov/orpm by following the link for VA Regulations Published from FY 2004 through FYTD. This rule is not an E.O. 13771 regulatory action because this rule is not significant under E.O. 12866. Unfunded Mandates The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C. 1532, that agencies prepare an assessment of anticipated costs and benefits before issuing any rule that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more (adjusted annually for inflation) in any one year. This final rule will have no such effect on State, local, and tribal governments, or on the private sector. Catalog of Federal Domestic Assistance The Catalog of Federal Domestic Assistance numbers and titles for the programs affected by this document are 64.008—Veterans Domiciliary Care; 64.011—Veterans Dental Care; 64.012— Veterans Prescription Service; 64.013— Veterans Prosthetic Appliances; 64.014—Veterans State Domiciliary Care; 64.015—Veterans State Nursing Home Care; 64.026—Veterans State Adult Day Health Care; 64.029— Purchase Care Program; 64.033—VA Supportive Services for Veteran Families Program; 64.039—CHAMPVA; 64.040—VHA Inpatient Medicine; 64.041—VHA Outpatient Specialty Care; 64.042—VHA Inpatient Surgery; 64.043—VHA Mental Health Residential; 64.044—VHA Home Care; 64.045—VHA Outpatient Ancillary Services; 64.046—VHA Inpatient Psychiatry; 64.047—VHA Primary Care; 64.048—VHA Mental Health clinics; 64.049—VHA Community Living Center; 64.050—VHA Diagnostic Care; 64.054—Research and Development. List of Subjects in 38 CFR Part 1 Administrative practice and procedure, Archives and records, Cemeteries, Claims, Courts, Crime, Flags, Freedom of information, Government contracts, Government employees, Government property, Infants and children, Inventions and patents, Parking, Penalties, Privacy VerDate Sep<11>2014 16:35 Oct 08, 2020 Jkt 253001 Reporting and recordkeeping requirements, Seals and insignia, Security measures, Wages. 64043 activities related to participation in health information exchanges for the delivery of health care; health care operations as defined by 45 CFR 164.501; and activities related to a patient’s exercise of privacy rights regarding health information. * * * * * Signing Authority The Secretary of Veterans Affairs, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Brooks D. Tucker, Acting Chief of Staff, Department of Veterans Affairs, approved this document on August 26, 2020, for publication. ■ Consuela Benjamin, Regulations Development Coordinator, Office of Regulation Policy & Management, Office of the Secretary, Department of Veterans Affairs. § 1.481 Disclosure of medical records of veterans who receive non-VA health care. For the reasons set forth in the preamble, Department of Veterans Affairs amends 38 CFR part 1 as follows: PART 1—GENERAL PROVISIONS 1. The authority citation for part 1 is revised to read as follows: ■ Authority: 38 U.S.C. 501, and as noted in specific sections. Sections 1.460 and 1.461 also issued under 38 U.S.C. 7332 and 7334. Sections 1.462, 1.464, 1.466–1.469, 1.476, 1.478, 1.479, 1.491–1.493, 1.495 and 1.496 also issued under 38 U.S.C. 7334. Sections 1.463, 1.465, 1.475, 1.477, 1.481, 1.482, 1.483, 1.485, 1.486–1.490, and 1.494 also issued under 38 U.S.C. 7332. Section 1.484 also issued under 38 U.S.C. 7331 and 7332. Section 1.485a also issued under 38 U.S.C. 5701 and 7332. § § 1.460 through 1.479 [Amended] 2. Remove the parenthetical Authority citation immediately following each section from §§ 1.460 through 1.479. ■ 3. Amend § 1.460 by adding, in alphabetical order, definitions for ‘‘Health care’’ and ‘‘Health care-related activities or functions’’ to read as follows: ■ § 1.460 * * * * Health care. The term ‘‘health care’’ has the same meaning as provided in 45 CFR 160.103. Health care-related activities or functions. The term ‘‘health care-related activities or functions’’ means the actions required for the delivery of health care, including hospital care, medical services, and extended care services. Health care-related activities or functions includes: Treatment as defined by 45 CFR 164.501; activities related to reimbursement for care and treatment by a health care provider; Frm 00051 Fmt 4700 (a) VA may disclose records referred to in 38 U.S.C. 7332(a) to a non-VA entity (including private entities and other Federal agencies) for purposes of providing health care to patients or performing other health care-related activities or functions. (b) An entity to which a record is disclosed under this section may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law. § 1.482 Disclosure of medical records to recover or collect reasonable charges. VA may disclose records described in 38 U.S.C. 7332(a) to a third party in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a patient in connection with a non-service connected disability as permitted by 38 U.S.C. 1729, or for a condition for which recovery is authorized, or with respect to which the United States is deemed to be a thirdparty beneficiary under the Federal Medical Care Recovery Act (Public Law 87–693, 42 U.S.C. 2651 et seq.). § § 1.484 through 1.496 Definitions. * PO 00000 4. Remove reserved §§ 1.481 and 1.482 from under the undesignated center heading ‘‘Disclosures With Patient’s Consent’’ and add new §§ 1.481 and 1.482 under the undesignated center heading ‘‘Disclosures Without Patient Consent’’ to read as follows: Sfmt 9990 [Amended] 5. Remove the parenthetical Authority citation immediately following each section from §§ 1.484 through 1.496. ■ [FR Doc. 2020–20276 Filed 10–8–20; 8:45 am] BILLING CODE 8320–01–P E:\FR\FM\09OCR1.SGM 09OCR1

Agencies

[Federal Register Volume 85, Number 197 (Friday, October 9, 2020)]
[Rules and Regulations]
[Pages 64040-64043]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-20276]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS

38 CFR Part 1

RIN 2900-AQ64


Disclosure of Certain Protected Records Without Written Consent

AGENCY: Department of Veterans Affairs.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Veterans Affairs (VA) adopts as final with 
no changes, a proposed rule amending its regulations on disclosure of 
certain records. Recent changes in law, to include the VA MISSION Act 
of 2018, now authorize VA to disclose certain protected records to non-
VA entities for purposes of providing health care or performing other 
health care-related activities or functions to include recovering or 
collecting reasonable charges for care furnished.

DATES: The final rule is effective November 9, 2020.

FOR FURTHER INFORMATION CONTACT: Stephania H. Griffin, Director, 
Information Access and Privacy Office (10A7), Department of Veterans 
Affairs, 810 Vermont Avenue NW, Washington, DC 20420; (704) 245-2492. 
(This is not a toll-free number.)

SUPPLEMENTARY INFORMATION: In accordance with section 5701 of title 38 
United States Code (U.S.C.), records and files maintained by VA on 
veterans and beneficiaries, including medical records, are generally 
confidential, and VA may not disclose or release these materials except 
as provided by law. Moreover, records of the identity, diagnosis, 
prognosis, or treatment by or for VA of any patient related to drug 
abuse, alcoholism or alcohol abuse, infection with the human 
immunodeficiency virus (HIV), or sickle cell anemia as prescribed by 38 
U.S.C. 7332(a)(1) are confidential and subject to special protection 
against disclosure. These records may only be disclosed for the 
specific purposes and under the circumstances expressly authorized 
under 38 U.S.C. 7332(b), where section (b)(1) authorizes disclosure 
with the prior written consent of the patient to the extent, 
circumstances, and purposes allowed by VA regulations, and section 
(b)(2) authorizes disclosure under certain circumstances with or 
without the written consent of the patient.
    Section 3 of Public Law (Pub. L.) 115-26 (April 19, 2017) amended 
38 U.S.C. 7332 by adding a new paragraph (b)(2)(H), authorizing 
disclosure of 7332-protected records without the written consent of the 
patient or subject of the record to a non-VA entity (including private 
entities and other Federal agencies) that provides VA-authorized 
hospital care or medical services to veterans. It also provided that 
any non-VA entity receiving such records may not redisclose or use 
those record for a purpose other than that for which the disclosure was 
made.
    Subsequently, section 132 of Public Law 115-182, the John S. McCain 
III, Daniel K. Akaka, and Samuel R. Johnson VA Maintaining Internal 
Systems and Strengthening Integrated Outside

[[Page 64041]]

Networks Act of 2018, or the VA MISSION Act of 2018 (June 6, 2018) 
amended 38 U.S.C. 7332(b)(2) by striking paragraph (H) and inserting 
new paragraphs (H) and (I). Paragraph (H)(i) authorizes disclosure of 
7332-protected records without the written consent of the patient to a 
non-VA entity (including private entities and other Federal agencies) 
for purposes of providing health care, including hospital care, medical 
services, and extended care services to patients or performing other 
health care-related activities or functions. Thus, the scope of 
permissible disclosures of 7332-protected records was expanded from 
non-VA entities providing hospital care or medical services authorized 
by the VA to non-VA entities providing health care or other health 
care-related activities or functions. Further, paragraph (H)(ii) was 
amended in 2017 to provide that any entity to which a record is 
disclosed under this paragraph may not disclose or use such record for 
a purpose other than that for which the disclosure was made or as 
permitted by law. The amendment under the MISSION Act replaced the term 
redisclose with the term disclose and added that entities who receive 
7332-protected records may also make disclosures as permitted by law. 
Additionally, paragraph (I) was added to authorize disclosure to a 
third party in order to recover or collect reasonable charges for care 
furnished to, or paid on behalf of, a patient in connection with a non-
service connected disability as permitted by section 1729 of this 
title, or for a condition for which recovery is authorized, or with 
respect to which the United States is deemed to be a third-party 
beneficiary under the Federal Medical Care Recovery Act.
    VA has published regulations implementing release of information 
from VA records protected by one or more confidentiality provisions in 
38 CFR part 1. General rules on release of information related to 
alcohol or other drug use disorder, HIV infection, or sickle cell 
anemia are at 38 CFR 1.460 through 1.469. In particular, Sec.  1.460 
contains the definitions for Sec. Sec.  1.460 through 1.499 of this 
part. Disclosure with patient consent is addressed in Sec. Sec.  1.475 
through 1.479, while disclosures that do not require patient consent 
are addressed in Sec. Sec.  1.483 through 1.489. The focus of 
Sec. Sec.  1.490 through 1.499 is release of information in response to 
a court order.
    In a document published in the Federal Register on December 13, 
2019 (84 FR 68065), VA proposed, among other things, to amend part 1 to 
conform to these statutory changes by adding the terms health care and 
health care related activities or functions to Sec.  1.460; and adding 
two new sections at 38 CFR 1.481 and 1.482 titled Disclosure of medical 
records of veterans who receive non-VA health care, and Disclosure of 
medical records to recover or collect reasonable charges, respectively. 
Furthermore, we proposed a technical correction to Sec. Sec.  1.460 
through 1.499 by moving the authority citations for these sections and 
moving them to the beginning of part 1 to comply with the Office of 
Federal Register direction that statutory authorities should be listed 
in the introductory portion of each CFR part.
    VA provided a 60-day comment period that ended on February 11, 
2020, and we received two comments. The first comment stated that VA 
should obtain permission from veterans and that every effort should be 
made to contact a veteran's family for the release of records if the 
veteran is deceased (we note that, although the comment used the word 
decided, based on the content of the comment, we believe that the 
intended word was deceased). To address the first portion of the 
comment related to obtaining permission from veterans, as previously 
explained, section 3 of Public Law 115-26 and section 132 of the VA 
MISSION Act of 2018, amended 38 U.S.C. 7332(b)(2) by allowing VA to 
disclose certain protected records to non-VA entities (including 
private entities and other Federal agencies) for purposes of providing 
health care or performing other health care-related activities or 
functions. Also, VA may disclose these protected records to a third 
party for the purpose of recovering or collecting reasonable charges 
for care furnished to, or paid on behalf of, a patient in connection 
with a non-service connected disability or to which the United States 
is deemed to be a third-party beneficiary. Therefore, VA may now 
disclose certain protected records with or without consent for the 
aforementioned reasons. Also, adding a consent mandate to the 
regulation would negate the intent of the statutory amendment. To 
address the portion of the comment related to the records of a deceased 
individual, such records continue to be protected under 38 U.S.C. 7332; 
however, we note that over time, certain disclosures (e.g., disclosures 
to a provider for treatment purposes, disclosures to a third-party to 
recover or collect reasonable charges) would no longer be made for a 
deceased individual because the deceased individual would no longer 
receive treatment. Furthermore, the family members of a deceased 
individual cannot consent to a disclosure unless such disclosure is 
necessary to obtain benefits to which the family member may be 
entitled. 38 U.S.C. 7332(b)(3). We are not making any changes based on 
this comment.
    The second comment raised multiple concerns and recommendations 
regarding: (1) Definition for treatment and health care; (2) external 
treatment records; (3) restriction requests; and (4) the Privacy Act of 
1974 (the Privacy Act)).
    1. Definition for treatment and health care. The comment asked why 
VA would use the same definition for treatment and health care as the 
Health Insurance Portability and Accountability Act (HIPAA) Privacy 
Rule. We proposed to use treatment as defined by 45 CFR 164.501 as part 
of our proposed definition for the term health care-related activities 
or functions. VA has chosen to use the same definition for treatment to 
maintain consistency with the HIPAA Privacy Rule. Likewise, we have 
chosen to define health care to have the same meaning as defined in the 
HIPAA Privacy Rule and to align with industry standard and practice. 
Therefore, we believe it is reasonable to maintain consistency with 
HIPAA to allow community providers to rely on the same definition when 
using and disclosing VA records, and we are not making any changes 
based on this portion of the comment.
    2. External treatment records. The comment expressed concern 
regarding the creation of external treatment records when VA refers 
veterans to community providers, and further asked VA to revise Sec.  
1.481(b) as proposed to include, at the end, a phrase that reads 
including via any health information exchange or organization. When VA 
refers patients to community providers for treatment, those community 
providers create their own treatment records and VA does not have the 
authority to restrict the records created and owned by an external 
entity. However, if VA provides a copy of VA medical records to a 
community provider then VA may restrict the use of the medical record 
provided and the language proposed in 1.481(b) provides this 
restriction by stating that an entity to which a record is disclosed 
under this section may not disclose or use such record for a purpose 
other than that for which the disclosure was made or as permitted by 
law. This language is consistent with our authorizing statute under 38 
U.S.C. 7332(b)(2)(H)(i) and we do not believe it is necessary to add 
the additional phrase as suggested by the

[[Page 64042]]

commenter because the restriction that is already present in Sec.  
1.418(b) as proposed captures all entity types to include health 
information exchanges or organizations when applicable. We are not 
making any changes based on this portion of the comment.
    3. Restriction requests. The comment raised a concern that the 
proposed rule did not address requests for restrictions on the 
disclosure of medical records under the HIPAA Privacy Rule, and 
specifically, restrictions with regard to information sharing through a 
health information exchange. The comment addressed both the issues of 
restriction on the use and disclosure of protected health information, 
and the means under which protected health information is shared. To 
address both issues raised in the comment, we first note that the 
purpose of the proposed rule and this final rule is to align VA's 
regulations with recent changes in law that now authorize VA to 
disclose 7332-protected records to a third party for the purpose of 
providing health care or performing other health care-related 
activities or functions, and to a third party for the purpose of 
recovering or collecting reasonable charges for care furnished to, or 
paid on behalf of, a patient in connection with a non-service connected 
disability or to which the United States is deemed to be a third-party 
beneficiary. This authority does not negate an individual's ability to 
request a restriction on the use and disclosure of their protected 
health information under 45 CFR 164.522, nor does it negate VA's 
obligation to uphold a request if VA agrees to a restriction. We note 
that under the HIPAA Privacy Rule, VA may still use or disclose 
restricted protected health information for emergency treatment. 45 CFR 
164.522(a)(1)(iii). Additionally, under the HIPAA Privacy Rule a 
covered entity is not required to agree to a restriction unless the 
disclosure is for the purpose of carrying out payment or health care 
operations and is not otherwise required by law and the protected 
health information pertains solely to a health care item or service for 
which the individual, or person other than the health plan on behalf of 
the individual, has paid the covered entity in full. 45 CFR 
164.522(a)(1)(ii) and (vi). Thus, this final rule does not affect an 
individual's ability to request restrictions on the disclosure of 
medical records. We next clarify this final rule does not impede an 
individual's ability to opt-out of health information exchanges. VA 
provides individuals the opportunity to opt-out of sharing protected 
health information through health information exchanges (HIE). 
Therefore, if an individual chooses to opt-out, VA will uphold this 
request by not sharing protected health information through an HIE. 
However, protected health information will continue to be shared on 
paper, fax, or other legally allowed means. We are not making any 
changes based on this portion of the comment.
    4. The Privacy Act. The comment asked if the Privacy Act applies to 
medical records and whether the routine use exemption applies. We 
clarify that this rule does not impact protections under the Privacy 
Act because VA is authorized to disclose 7332-protected records without 
consent under routine use when such disclosure is authorized by 38 
U.S.C. 7332. The Privacy Act requires Federal agencies to not disclose 
any record which is contained in a system of records . . . without the 
prior written consent of, the individual to whom the record pertains, 
unless the disclosure of the record would be . . . for routine use. 5 
U.S.C. 552a(b) and (b)(3). Routine use, with respect to the disclosure 
of records, means the use of such record for a purpose which is 
compatible with the purpose for which it was collected. 5 U.S.C. 
552a(a)(7). In accordance with 5 U.S.C. 552a(e), VA publishes a Federal 
Register Notice outlining the routine use disclosures of records from a 
Privacy Act system of records to a person or entity outside of VA 
without the prior signed written consent authorization of the 
individual who is the subject of the information. For example, 
published routine use disclosure statements in the Privacy Act system 
of records, ``Patient Medical Records-VA'', 24VA10P2 permits the 
release of protected health information when a disclosure is also 
authorized by other applicable legal authorities, including the HIPAA 
Privacy Rule; and disclosure of 7332-proteced records when the 
disclosure is also authorized by 38 U.S.C. 7332. Furthermore, this rule 
aligns VA's regulations with recent changes in our statutory authority 
under 7332. We are not making any changes based on this portion of the 
comment.
    Based on the rationale set forth in the proposed rule and in this 
document, we are adopting the proposed rule as final without changes.

Congressional Review Act

    Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), 
the Office of Information and Regulatory Affairs designated this rule 
as not a major rule, as defined by 5 U.S.C. 804(2).

Paperwork Reduction Act

    The final rule contains no provisions constituting a collection of 
information under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-
3521).

Regulatory Flexibility Act

    The Secretary hereby certifies that this final rule will not have a 
significant economic impact on a substantial number of small entities 
as they are defined in the Regulatory Flexibility Act, 5 U.S.C. 601-
612. This final rule will directly affect health and medical insurance 
companies, some of which are small entities. VA has determined that 
this final rule will not have a significant economic impact because VA 
estimates the cost of this rulemaking to be no more than 1 percent of 
average annual receipts, and thus not significant. In the proposed 
rule, VA estimated the cost of this rulemaking to be $41.7 per year 
using FY2020 estimates. VA now estimates the cost of this rulemaking to 
be $43.8 million per year using FY2021 estimates for health and medical 
insurance carriers due to an increase in potential revenue received by 
VA from health and medical insurance firms for billed claims. This 
$43.8 million dollars per year will be distributed among 815, of which 
312 are small, medical and health insurance firms that provide benefits 
to veterans treated for non-service connected conditions and whose 
records are protected under 38 U.S.C. 7332. We are uncertain if any 
small entity will be impacted so we assume that all small entities will 
be impacted in addition to large entities. The cost to each of the 312 
small entities will be $53,779 per year, which is 1 percent of average 
annual receipts for the smallest potentially affected small entities. 
Therefore, pursuant to 5 U.S.C. 605(b), the initial and final 
regulatory flexibility analysis requirements of 5 U.S.C. 603 and 604 do 
not apply.

Executive Orders 12866, 13563, and 13771

    Executive Orders 12866 and 13563 direct agencies to assess the 
costs and benefits of available regulatory alternatives and, when 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, and other advantages; distributive impacts; 
and equity). Executive Order 13563 (Improving Regulation and Regulatory 
Review) emphasizes the importance of quantifying both costs and 
benefits, reducing costs, harmonizing rules, and promoting flexibility. 
The Office of

[[Page 64043]]

Information and Regulatory Affairs has determined this rule is not a 
significant regulatory action under Executive Order 12866.
    VA's impact analysis can be found as a supporting document at 
https://www.regulations.gov, usually within 48 hours after the 
rulemaking document is published. Additionally, a copy of the 
rulemaking and its impact analysis are available on VA's website at 
https://www.va.gov/orpm by following the link for VA Regulations 
Published from FY 2004 through FYTD.
    This rule is not an E.O. 13771 regulatory action because this rule 
is not significant under E.O. 12866.

Unfunded Mandates

    The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C. 
1532, that agencies prepare an assessment of anticipated costs and 
benefits before issuing any rule that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100 million or more (adjusted annually for 
inflation) in any one year. This final rule will have no such effect on 
State, local, and tribal governments, or on the private sector.

Catalog of Federal Domestic Assistance

    The Catalog of Federal Domestic Assistance numbers and titles for 
the programs affected by this document are 64.008--Veterans Domiciliary 
Care; 64.011--Veterans Dental Care; 64.012--Veterans Prescription 
Service; 64.013--Veterans Prosthetic Appliances; 64.014--Veterans State 
Domiciliary Care; 64.015--Veterans State Nursing Home Care; 64.026--
Veterans State Adult Day Health Care; 64.029--Purchase Care Program; 
64.033--VA Supportive Services for Veteran Families Program; 64.039--
CHAMPVA; 64.040--VHA Inpatient Medicine; 64.041--VHA Outpatient 
Specialty Care; 64.042--VHA Inpatient Surgery; 64.043--VHA Mental 
Health Residential; 64.044--VHA Home Care; 64.045--VHA Outpatient 
Ancillary Services; 64.046--VHA Inpatient Psychiatry; 64.047--VHA 
Primary Care; 64.048--VHA Mental Health clinics; 64.049--VHA Community 
Living Center; 64.050--VHA Diagnostic Care; 64.054--Research and 
Development.

List of Subjects in 38 CFR Part 1

    Administrative practice and procedure, Archives and records, 
Cemeteries, Claims, Courts, Crime, Flags, Freedom of information, 
Government contracts, Government employees, Government property, 
Infants and children, Inventions and patents, Parking, Penalties, 
Privacy Reporting and recordkeeping requirements, Seals and insignia, 
Security measures, Wages.

Signing Authority

    The Secretary of Veterans Affairs, or designee, approved this 
document and authorized the undersigned to sign and submit the document 
to the Office of the Federal Register for publication electronically as 
an official document of the Department of Veterans Affairs. Brooks D. 
Tucker, Acting Chief of Staff, Department of Veterans Affairs, approved 
this document on August 26, 2020, for publication.

Consuela Benjamin,
Regulations Development Coordinator, Office of Regulation Policy & 
Management, Office of the Secretary, Department of Veterans Affairs.

    For the reasons set forth in the preamble, Department of Veterans 
Affairs amends 38 CFR part 1 as follows:

PART 1--GENERAL PROVISIONS

0
1. The authority citation for part 1 is revised to read as follows:

    Authority:  38 U.S.C. 501, and as noted in specific sections.
    Sections 1.460 and 1.461 also issued under 38 U.S.C. 7332 and 
7334.
    Sections 1.462, 1.464, 1.466-1.469, 1.476, 1.478, 1.479, 1.491-
1.493, 1.495 and 1.496 also issued under 38 U.S.C. 7334.
    Sections 1.463, 1.465, 1.475, 1.477, 1.481, 1.482, 1.483, 1.485, 
1.486-1.490, and 1.494 also issued under 38 U.S.C. 7332.
    Section 1.484 also issued under 38 U.S.C. 7331 and 7332.
    Section 1.485a also issued under 38 U.S.C. 5701 and 7332.


Sec.  Sec.  1.460 through 1.479  [Amended]

0
2. Remove the parenthetical Authority citation immediately following 
each section from Sec. Sec.  1.460 through 1.479.

0
3. Amend Sec.  1.460 by adding, in alphabetical order, definitions for 
``Health care'' and ``Health care-related activities or functions'' to 
read as follows:


Sec.  1.460  Definitions.

* * * * *
    Health care. The term ``health care'' has the same meaning as 
provided in 45 CFR 160.103.
    Health care-related activities or functions. The term ``health 
care-related activities or functions'' means the actions required for 
the delivery of health care, including hospital care, medical services, 
and extended care services. Health care-related activities or functions 
includes: Treatment as defined by 45 CFR 164.501; activities related to 
reimbursement for care and treatment by a health care provider; 
activities related to participation in health information exchanges for 
the delivery of health care; health care operations as defined by 45 
CFR 164.501; and activities related to a patient's exercise of privacy 
rights regarding health information.
* * * * *

0
4. Remove reserved Sec. Sec.  1.481 and 1.482 from under the 
undesignated center heading ``Disclosures With Patient's Consent'' and 
add new Sec. Sec.  1.481 and 1.482 under the undesignated center 
heading ``Disclosures Without Patient Consent'' to read as follows:


Sec.  1.481  Disclosure of medical records of veterans who receive non-
VA health care.

    (a) VA may disclose records referred to in 38 U.S.C. 7332(a) to a 
non-VA entity (including private entities and other Federal agencies) 
for purposes of providing health care to patients or performing other 
health care-related activities or functions.
    (b) An entity to which a record is disclosed under this section may 
not disclose or use such record for a purpose other than that for which 
the disclosure was made or as permitted by law.


Sec.  1.482  Disclosure of medical records to recover or collect 
reasonable charges.

    VA may disclose records described in 38 U.S.C. 7332(a) to a third 
party in order to recover or collect reasonable charges for care 
furnished to, or paid on behalf of, a patient in connection with a non-
service connected disability as permitted by 38 U.S.C. 1729, or for a 
condition for which recovery is authorized, or with respect to which 
the United States is deemed to be a third-party beneficiary under the 
Federal Medical Care Recovery Act (Public Law 87-693, 42 U.S.C. 2651 et 
seq.).


Sec.  Sec.  1.484 through 1.496   [Amended]

0
5. Remove the parenthetical Authority citation immediately following 
each section from Sec. Sec.  1.484 through 1.496.

[FR Doc. 2020-20276 Filed 10-8-20; 8:45 am]
BILLING CODE 8320-01-P
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.