Disclosure of Certain Protected Records Without Written Consent, 64040-64043 [2020-20276]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 85, Number 197 (Friday, October 9, 2020)]
[Rules and Regulations]
[Pages 64040-64043]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-20276]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS

38 CFR Part 1

RIN 2900-AQ64


Disclosure of Certain Protected Records Without Written Consent

AGENCY: Department of Veterans Affairs.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Veterans Affairs (VA) adopts as final with 
no changes, a proposed rule amending its regulations on disclosure of 
certain records. Recent changes in law, to include the VA MISSION Act 
of 2018, now authorize VA to disclose certain protected records to non-
VA entities for purposes of providing health care or performing other 
health care-related activities or functions to include recovering or 
collecting reasonable charges for care furnished.

DATES: The final rule is effective November 9, 2020.

FOR FURTHER INFORMATION CONTACT: Stephania H. Griffin, Director, 
Information Access and Privacy Office (10A7), Department of Veterans 
Affairs, 810 Vermont Avenue NW, Washington, DC 20420; (704) 245-2492. 
(This is not a toll-free number.)

SUPPLEMENTARY INFORMATION: In accordance with section 5701 of title 38 
United States Code (U.S.C.), records and files maintained by VA on 
veterans and beneficiaries, including medical records, are generally 
confidential, and VA may not disclose or release these materials except 
as provided by law. Moreover, records of the identity, diagnosis, 
prognosis, or treatment by or for VA of any patient related to drug 
abuse, alcoholism or alcohol abuse, infection with the human 
immunodeficiency virus (HIV), or sickle cell anemia as prescribed by 38 
U.S.C. 7332(a)(1) are confidential and subject to special protection 
against disclosure. These records may only be disclosed for the 
specific purposes and under the circumstances expressly authorized 
under 38 U.S.C. 7332(b), where section (b)(1) authorizes disclosure 
with the prior written consent of the patient to the extent, 
circumstances, and purposes allowed by VA regulations, and section 
(b)(2) authorizes disclosure under certain circumstances with or 
without the written consent of the patient.
    Section 3 of Public Law (Pub. L.) 115-26 (April 19, 2017) amended 
38 U.S.C. 7332 by adding a new paragraph (b)(2)(H), authorizing 
disclosure of 7332-protected records without the written consent of the 
patient or subject of the record to a non-VA entity (including private 
entities and other Federal agencies) that provides VA-authorized 
hospital care or medical services to veterans. It also provided that 
any non-VA entity receiving such records may not redisclose or use 
those record for a purpose other than that for which the disclosure was 
made.
    Subsequently, section 132 of Public Law 115-182, the John S. McCain 
III, Daniel K. Akaka, and Samuel R. Johnson VA Maintaining Internal 
Systems and Strengthening Integrated Outside

[[Page 64041]]

Networks Act of 2018, or the VA MISSION Act of 2018 (June 6, 2018) 
amended 38 U.S.C. 7332(b)(2) by striking paragraph (H) and inserting 
new paragraphs (H) and (I). Paragraph (H)(i) authorizes disclosure of 
7332-protected records without the written consent of the patient to a 
non-VA entity (including private entities and other Federal agencies) 
for purposes of providing health care, including hospital care, medical 
services, and extended care services to patients or performing other 
health care-related activities or functions. Thus, the scope of 
permissible disclosures of 7332-protected records was expanded from 
non-VA entities providing hospital care or medical services authorized 
by the VA to non-VA entities providing health care or other health 
care-related activities or functions. Further, paragraph (H)(ii) was 
amended in 2017 to provide that any entity to which a record is 
disclosed under this paragraph may not disclose or use such record for 
a purpose other than that for which the disclosure was made or as 
permitted by law. The amendment under the MISSION Act replaced the term 
redisclose with the term disclose and added that entities who receive 
7332-protected records may also make disclosures as permitted by law. 
Additionally, paragraph (I) was added to authorize disclosure to a 
third party in order to recover or collect reasonable charges for care 
furnished to, or paid on behalf of, a patient in connection with a non-
service connected disability as permitted by section 1729 of this 
title, or for a condition for which recovery is authorized, or with 
respect to which the United States is deemed to be a third-party 
beneficiary under the Federal Medical Care Recovery Act.
    VA has published regulations implementing release of information 
from VA records protected by one or more confidentiality provisions in 
38 CFR part 1. General rules on release of information related to 
alcohol or other drug use disorder, HIV infection, or sickle cell 
anemia are at 38 CFR 1.460 through 1.469. In particular, Sec.  1.460 
contains the definitions for Sec. Sec.  1.460 through 1.499 of this 
part. Disclosure with patient consent is addressed in Sec. Sec.  1.475 
through 1.479, while disclosures that do not require patient consent 
are addressed in Sec. Sec.  1.483 through 1.489. The focus of 
Sec. Sec.  1.490 through 1.499 is release of information in response to 
a court order.
    In a document published in the Federal Register on December 13, 
2019 (84 FR 68065), VA proposed, among other things, to amend part 1 to 
conform to these statutory changes by adding the terms health care and 
health care related activities or functions to Sec.  1.460; and adding 
two new sections at 38 CFR 1.481 and 1.482 titled Disclosure of medical 
records of veterans who receive non-VA health care, and Disclosure of 
medical records to recover or collect reasonable charges, respectively. 
Furthermore, we proposed a technical correction to Sec. Sec.  1.460 
through 1.499 by moving the authority citations for these sections and 
moving them to the beginning of part 1 to comply with the Office of 
Federal Register direction that statutory authorities should be listed 
in the introductory portion of each CFR part.
    VA provided a 60-day comment period that ended on February 11, 
2020, and we received two comments. The first comment stated that VA 
should obtain permission from veterans and that every effort should be 
made to contact a veteran's family for the release of records if the 
veteran is deceased (we note that, although the comment used the word 
decided, based on the content of the comment, we believe that the 
intended word was deceased). To address the first portion of the 
comment related to obtaining permission from veterans, as previously 
explained, section 3 of Public Law 115-26 and section 132 of the VA 
MISSION Act of 2018, amended 38 U.S.C. 7332(b)(2) by allowing VA to 
disclose certain protected records to non-VA entities (including 
private entities and other Federal agencies) for purposes of providing 
health care or performing other health care-related activities or 
functions. Also, VA may disclose these protected records to a third 
party for the purpose of recovering or collecting reasonable charges 
for care furnished to, or paid on behalf of, a patient in connection 
with a non-service connected disability or to which the United States 
is deemed to be a third-party beneficiary. Therefore, VA may now 
disclose certain protected records with or without consent for the 
aforementioned reasons. Also, adding a consent mandate to the 
regulation would negate the intent of the statutory amendment. To 
address the portion of the comment related to the records of a deceased 
individual, such records continue to be protected under 38 U.S.C. 7332; 
however, we note that over time, certain disclosures (e.g., disclosures 
to a provider for treatment purposes, disclosures to a third-party to 
recover or collect reasonable charges) would no longer be made for a 
deceased individual because the deceased individual would no longer 
receive treatment. Furthermore, the family members of a deceased 
individual cannot consent to a disclosure unless such disclosure is 
necessary to obtain benefits to which the family member may be 
entitled. 38 U.S.C. 7332(b)(3). We are not making any changes based on 
this comment.
    The second comment raised multiple concerns and recommendations 
regarding: (1) Definition for treatment and health care; (2) external 
treatment records; (3) restriction requests; and (4) the Privacy Act of 
1974 (the Privacy Act)).
    1. Definition for treatment and health care. The comment asked why 
VA would use the same definition for treatment and health care as the 
Health Insurance Portability and Accountability Act (HIPAA) Privacy 
Rule. We proposed to use treatment as defined by 45 CFR 164.501 as part 
of our proposed definition for the term health care-related activities 
or functions. VA has chosen to use the same definition for treatment to 
maintain consistency with the HIPAA Privacy Rule. Likewise, we have 
chosen to define health care to have the same meaning as defined in the 
HIPAA Privacy Rule and to align with industry standard and practice. 
Therefore, we believe it is reasonable to maintain consistency with 
HIPAA to allow community providers to rely on the same definition when 
using and disclosing VA records, and we are not making any changes 
based on this portion of the comment.
    2. External treatment records. The comment expressed concern 
regarding the creation of external treatment records when VA refers 
veterans to community providers, and further asked VA to revise Sec.  
1.481(b) as proposed to include, at the end, a phrase that reads 
including via any health information exchange or organization. When VA 
refers patients to community providers for treatment, those community 
providers create their own treatment records and VA does not have the 
authority to restrict the records created and owned by an external 
entity. However, if VA provides a copy of VA medical records to a 
community provider then VA may restrict the use of the medical record 
provided and the language proposed in 1.481(b) provides this 
restriction by stating that an entity to which a record is disclosed 
under this section may not disclose or use such record for a purpose 
other than that for which the disclosure was made or as permitted by 
law. This language is consistent with our authorizing statute under 38 
U.S.C. 7332(b)(2)(H)(i) and we do not believe it is necessary to add 
the additional phrase as suggested by the

[[Page 64042]]

commenter because the restriction that is already present in Sec.  
1.418(b) as proposed captures all entity types to include health 
information exchanges or organizations when applicable. We are not 
making any changes based on this portion of the comment.
    3. Restriction requests. The comment raised a concern that the 
proposed rule did not address requests for restrictions on the 
disclosure of medical records under the HIPAA Privacy Rule, and 
specifically, restrictions with regard to information sharing through a 
health information exchange. The comment addressed both the issues of 
restriction on the use and disclosure of protected health information, 
and the means under which protected health information is shared. To 
address both issues raised in the comment, we first note that the 
purpose of the proposed rule and this final rule is to align VA's 
regulations with recent changes in law that now authorize VA to 
disclose 7332-protected records to a third party for the purpose of 
providing health care or performing other health care-related 
activities or functions, and to a third party for the purpose of 
recovering or collecting reasonable charges for care furnished to, or 
paid on behalf of, a patient in connection with a non-service connected 
disability or to which the United States is deemed to be a third-party 
beneficiary. This authority does not negate an individual's ability to 
request a restriction on the use and disclosure of their protected 
health information under 45 CFR 164.522, nor does it negate VA's 
obligation to uphold a request if VA agrees to a restriction. We note 
that under the HIPAA Privacy Rule, VA may still use or disclose 
restricted protected health information for emergency treatment. 45 CFR 
164.522(a)(1)(iii). Additionally, under the HIPAA Privacy Rule a 
covered entity is not required to agree to a restriction unless the 
disclosure is for the purpose of carrying out payment or health care 
operations and is not otherwise required by law and the protected 
health information pertains solely to a health care item or service for 
which the individual, or person other than the health plan on behalf of 
the individual, has paid the covered entity in full. 45 CFR 
164.522(a)(1)(ii) and (vi). Thus, this final rule does not affect an 
individual's ability to request restrictions on the disclosure of 
medical records. We next clarify this final rule does not impede an 
individual's ability to opt-out of health information exchanges. VA 
provides individuals the opportunity to opt-out of sharing protected 
health information through health information exchanges (HIE). 
Therefore, if an individual chooses to opt-out, VA will uphold this 
request by not sharing protected health information through an HIE. 
However, protected health information will continue to be shared on 
paper, fax, or other legally allowed means. We are not making any 
changes based on this portion of the comment.
    4. The Privacy Act. The comment asked if the Privacy Act applies to 
medical records and whether the routine use exemption applies. We 
clarify that this rule does not impact protections under the Privacy 
Act because VA is authorized to disclose 7332-protected records without 
consent under routine use when such disclosure is authorized by 38 
U.S.C. 7332. The Privacy Act requires Federal agencies to not disclose 
any record which is contained in a system of records . . . without the 
prior written consent of, the individual to whom the record pertains, 
unless the disclosure of the record would be . . . for routine use. 5 
U.S.C. 552a(b) and (b)(3). Routine use, with respect to the disclosure 
of records, means the use of such record for a purpose which is 
compatible with the purpose for which it was collected. 5 U.S.C. 
552a(a)(7). In accordance with 5 U.S.C. 552a(e), VA publishes a Federal 
Register Notice outlining the routine use disclosures of records from a 
Privacy Act system of records to a person or entity outside of VA 
without the prior signed written consent authorization of the 
individual who is the subject of the information. For example, 
published routine use disclosure statements in the Privacy Act system 
of records, ``Patient Medical Records-VA'', 24VA10P2 permits the 
release of protected health information when a disclosure is also 
authorized by other applicable legal authorities, including the HIPAA 
Privacy Rule; and disclosure of 7332-proteced records when the 
disclosure is also authorized by 38 U.S.C. 7332. Furthermore, this rule 
aligns VA's regulations with recent changes in our statutory authority 
under 7332. We are not making any changes based on this portion of the 
comment.
    Based on the rationale set forth in the proposed rule and in this 
document, we are adopting the proposed rule as final without changes.

Congressional Review Act

    Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), 
the Office of Information and Regulatory Affairs designated this rule 
as not a major rule, as defined by 5 U.S.C. 804(2).

Paperwork Reduction Act

    The final rule contains no provisions constituting a collection of 
information under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-
3521).

Regulatory Flexibility Act

    The Secretary hereby certifies that this final rule will not have a 
significant economic impact on a substantial number of small entities 
as they are defined in the Regulatory Flexibility Act, 5 U.S.C. 601-
612. This final rule will directly affect health and medical insurance 
companies, some of which are small entities. VA has determined that 
this final rule will not have a significant economic impact because VA 
estimates the cost of this rulemaking to be no more than 1 percent of 
average annual receipts, and thus not significant. In the proposed 
rule, VA estimated the cost of this rulemaking to be $41.7 per year 
using FY2020 estimates. VA now estimates the cost of this rulemaking to 
be $43.8 million per year using FY2021 estimates for health and medical 
insurance carriers due to an increase in potential revenue received by 
VA from health and medical insurance firms for billed claims. This 
$43.8 million dollars per year will be distributed among 815, of which 
312 are small, medical and health insurance firms that provide benefits 
to veterans treated for non-service connected conditions and whose 
records are protected under 38 U.S.C. 7332. We are uncertain if any 
small entity will be impacted so we assume that all small entities will 
be impacted in addition to large entities. The cost to each of the 312 
small entities will be $53,779 per year, which is 1 percent of average 
annual receipts for the smallest potentially affected small entities. 
Therefore, pursuant to 5 U.S.C. 605(b), the initial and final 
regulatory flexibility analysis requirements of 5 U.S.C. 603 and 604 do 
not apply.

Executive Orders 12866, 13563, and 13771

    Executive Orders 12866 and 13563 direct agencies to assess the 
costs and benefits of available regulatory alternatives and, when 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, and other advantages; distributive impacts; 
and equity). Executive Order 13563 (Improving Regulation and Regulatory 
Review) emphasizes the importance of quantifying both costs and 
benefits, reducing costs, harmonizing rules, and promoting flexibility. 
The Office of

[[Page 64043]]

Information and Regulatory Affairs has determined this rule is not a 
significant regulatory action under Executive Order 12866.
    VA's impact analysis can be found as a supporting document at 
https://www.regulations.gov, usually within 48 hours after the 
rulemaking document is published. Additionally, a copy of the 
rulemaking and its impact analysis are available on VA's website at 
https://www.va.gov/orpm by following the link for VA Regulations 
Published from FY 2004 through FYTD.
    This rule is not an E.O. 13771 regulatory action because this rule 
is not significant under E.O. 12866.

Unfunded Mandates

    The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C. 
1532, that agencies prepare an assessment of anticipated costs and 
benefits before issuing any rule that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100 million or more (adjusted annually for 
inflation) in any one year. This final rule will have no such effect on 
State, local, and tribal governments, or on the private sector.

Catalog of Federal Domestic Assistance

    The Catalog of Federal Domestic Assistance numbers and titles for 
the programs affected by this document are 64.008--Veterans Domiciliary 
Care; 64.011--Veterans Dental Care; 64.012--Veterans Prescription 
Service; 64.013--Veterans Prosthetic Appliances; 64.014--Veterans State 
Domiciliary Care; 64.015--Veterans State Nursing Home Care; 64.026--
Veterans State Adult Day Health Care; 64.029--Purchase Care Program; 
64.033--VA Supportive Services for Veteran Families Program; 64.039--
CHAMPVA; 64.040--VHA Inpatient Medicine; 64.041--VHA Outpatient 
Specialty Care; 64.042--VHA Inpatient Surgery; 64.043--VHA Mental 
Health Residential; 64.044--VHA Home Care; 64.045--VHA Outpatient 
Ancillary Services; 64.046--VHA Inpatient Psychiatry; 64.047--VHA 
Primary Care; 64.048--VHA Mental Health clinics; 64.049--VHA Community 
Living Center; 64.050--VHA Diagnostic Care; 64.054--Research and 
Development.

List of Subjects in 38 CFR Part 1

    Administrative practice and procedure, Archives and records, 
Cemeteries, Claims, Courts, Crime, Flags, Freedom of information, 
Government contracts, Government employees, Government property, 
Infants and children, Inventions and patents, Parking, Penalties, 
Privacy Reporting and recordkeeping requirements, Seals and insignia, 
Security measures, Wages.

Signing Authority

    The Secretary of Veterans Affairs, or designee, approved this 
document and authorized the undersigned to sign and submit the document 
to the Office of the Federal Register for publication electronically as 
an official document of the Department of Veterans Affairs. Brooks D. 
Tucker, Acting Chief of Staff, Department of Veterans Affairs, approved 
this document on August 26, 2020, for publication.

Consuela Benjamin,
Regulations Development Coordinator, Office of Regulation Policy & 
Management, Office of the Secretary, Department of Veterans Affairs.

    For the reasons set forth in the preamble, Department of Veterans 
Affairs amends 38 CFR part 1 as follows:

PART 1--GENERAL PROVISIONS

0
1. The authority citation for part 1 is revised to read as follows:

    Authority:  38 U.S.C. 501, and as noted in specific sections.
    Sections 1.460 and 1.461 also issued under 38 U.S.C. 7332 and 
7334.
    Sections 1.462, 1.464, 1.466-1.469, 1.476, 1.478, 1.479, 1.491-
1.493, 1.495 and 1.496 also issued under 38 U.S.C. 7334.
    Sections 1.463, 1.465, 1.475, 1.477, 1.481, 1.482, 1.483, 1.485, 
1.486-1.490, and 1.494 also issued under 38 U.S.C. 7332.
    Section 1.484 also issued under 38 U.S.C. 7331 and 7332.
    Section 1.485a also issued under 38 U.S.C. 5701 and 7332.


Sec.  Sec.  1.460 through 1.479  [Amended]

0
2. Remove the parenthetical Authority citation immediately following 
each section from Sec. Sec.  1.460 through 1.479.

0
3. Amend Sec.  1.460 by adding, in alphabetical order, definitions for 
``Health care'' and ``Health care-related activities or functions'' to 
read as follows:


Sec.  1.460  Definitions.

* * * * *
    Health care. The term ``health care'' has the same meaning as 
provided in 45 CFR 160.103.
    Health care-related activities or functions. The term ``health 
care-related activities or functions'' means the actions required for 
the delivery of health care, including hospital care, medical services, 
and extended care services. Health care-related activities or functions 
includes: Treatment as defined by 45 CFR 164.501; activities related to 
reimbursement for care and treatment by a health care provider; 
activities related to participation in health information exchanges for 
the delivery of health care; health care operations as defined by 45 
CFR 164.501; and activities related to a patient's exercise of privacy 
rights regarding health information.
* * * * *

0
4. Remove reserved Sec. Sec.  1.481 and 1.482 from under the 
undesignated center heading ``Disclosures With Patient's Consent'' and 
add new Sec. Sec.  1.481 and 1.482 under the undesignated center 
heading ``Disclosures Without Patient Consent'' to read as follows:


Sec.  1.481  Disclosure of medical records of veterans who receive non-
VA health care.

    (a) VA may disclose records referred to in 38 U.S.C. 7332(a) to a 
non-VA entity (including private entities and other Federal agencies) 
for purposes of providing health care to patients or performing other 
health care-related activities or functions.
    (b) An entity to which a record is disclosed under this section may 
not disclose or use such record for a purpose other than that for which 
the disclosure was made or as permitted by law.


Sec.  1.482  Disclosure of medical records to recover or collect 
reasonable charges.

    VA may disclose records described in 38 U.S.C. 7332(a) to a third 
party in order to recover or collect reasonable charges for care 
furnished to, or paid on behalf of, a patient in connection with a non-
service connected disability as permitted by 38 U.S.C. 1729, or for a 
condition for which recovery is authorized, or with respect to which 
the United States is deemed to be a third-party beneficiary under the 
Federal Medical Care Recovery Act (Public Law 87-693, 42 U.S.C. 2651 et 
seq.).


Sec.  Sec.  1.484 through 1.496   [Amended]

0
5. Remove the parenthetical Authority citation immediately following 
each section from Sec. Sec.  1.484 through 1.496.

[FR Doc. 2020-20276 Filed 10-8-20; 8:45 am]
BILLING CODE 8320-01-P