[Federal Register Volume 84, Number 240 (Friday, December 13, 2019)]
[Proposed Rules]
[Pages 68065-68069]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-26910]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF VETERANS AFFAIRS
38 CFR Part 1
RIN 2900-AQ64
Disclosure of Certain Protected Records Without Written Consent
AGENCY: Department of Veterans Affairs.
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: The Department of Veterans Affairs (VA) proposes to amend its
regulations on disclosure of certain records. Recent changes in law, to
include the VA MISSION Act of 2018, now authorize VA to disclose
certain protected records to non-VA entities (including private
entities and other Federal agencies) for purposes of providing health
care or performing other health care-related activities or functions.
The Act also authorizes VA to disclose these protected records to a
[[Page 68066]]
third party for the purpose of recovering or collecting reasonable
charges for care furnished to, or paid on behalf of, a patient in
connection with a non-service connected disability or to which the
United States is deemed to be a third-party beneficiary. This proposed
rule would align VA's regulations with the recent changes in law.
DATES: Comments must be received by VA on or before February 11, 2020.
ADDRESSES: Written comments may be submitted through
www.Regulations.gov; by mail or hand-delivery to: Director, Office of
Regulation Policy and Management (00REG), Department of Veterans
Affairs, 810 Vermont Avenue NW, Room 1064, Washington, DC 20420; or by
fax to (202) 273-9026. (This is not a toll-free number.) Comments
should indicate that they are submitted in response to ``RIN 2900-
AQ64--Disclosure of certain protected records without written
consent.'' Copies of comments received will be available for public
inspection in the Office of Regulation Policy and Management, Room
1064, between the hours of 8:00 a.m. and 4:30 p.m. Monday through
Friday (except holidays). Please call (202) 461-4902 for an
appointment. (This is not a toll-free number.) In addition, during the
comment period, comments may be viewed online through the Federal
Docket Management System (FDMS) at www.Regulations.gov.
FOR FURTHER INFORMATION CONTACT: Stephania H. Griffin, Director,
Information Access and Privacy Office (10A7), Department of Veterans
Affairs, 810 Vermont Avenue NW, Washington, DC 20420; (704) 245-2492.
(This is not a toll-free number.)
SUPPLEMENTARY INFORMATION: Records and files maintained by VA on
veterans and beneficiaries, including medical records, are generally
confidential, and VA may not disclose or release these materials except
as provided by law. 38 U.S.C. 5701. Moreover, records of the identity,
diagnosis, prognosis, or treatment by or for VA of any patient related
to drug abuse, alcoholism or alcohol abuse, infection with the human
immunodeficiency virus (HIV), or sickle cell anemia as prescribed by 38
U.S.C. 7332(a)(1) are confidential and subject to special protection
against disclosure. These records may only be disclosed for the
specific purposes and under the circumstances expressly authorized
under 38 U.S.C. 7332(b). Paragraph (b)(1) authorizes disclosure with
the prior written consent of the patient to the extent, circumstances,
and purposes allowed by VA regulations. Paragraph (b)(2) authorizes
disclosure under certain circumstances with or without the written
consent of the patient.
Section 3 of Public Law (Pub. L.) 115-26 (April 19, 2017) amended
38 U.S.C. 7332 by adding a new paragraph (b)(2)(H), authorizing
disclosure of 7332-protected records without the written consent of the
patient or subject of the record to a non-VA entity (including private
entities and other Federal agencies) that provides VA-authorized
hospital care or medical services to veterans. It also provided that
any non-VA entity receiving such records may not redisclose or use
those record for a purpose other than that for which the disclosure was
made.
Subsequently, section 132 of Public Law 115-182, the John S. McCain
III, Daniel K. Akaka, and Samuel R. Johnson VA Maintaining Internal
Systems and Strengthening Integrated Outside Networks Act of 2018, or
the VA MISSION Act of 2018 (June 6, 2018) amended 38 U.S.C. 7332(b)(2)
by striking paragraph (H) and inserting new paragraphs (H) and (I).
Paragraph (H)(i) authorizes disclosure of 7332-protected records
without the written consent of the patient to a non-VA entity
(including private entities and other Federal agencies) for purposes of
providing health care, including hospital care, medical services, and
extended care services to patients or performing other health care-
related activities or functions. Thus, the scope of permissible
disclosures of 7332-protected records was expanded from non-VA entities
providing hospital care or medical services authorized by the VA to
non-VA entities providing health care or other health care-related
activities or functions. Further, paragraph (H)(ii) was amended in 2017
to provide that any entity to which a record is disclosed under this
paragraph may not disclose or use such record for a purpose other than
that for which the disclosure was made or as permitted by law. The
amendment under the MISSION Act replaced ``redisclose'' with
``disclose'' and added that entities who receive 7332-protected records
may also make disclosures as permitted by law. Additionally, paragraph
(I) was added to authorize disclosure to a third party in order to
recover or collect reasonable charges for care furnished to, or paid on
behalf of, a patient in connection with a non-service connected
disability as permitted by section 1729 of this title, or for a
condition for which recovery is authorized, or with respect to which
the United States is deemed to be a third-party beneficiary under the
Federal Medical Care Recovery Act.
VA has published regulations implementing release of information
from VA records protected by one or more confidentiality provisions in
38 CFR part 1. General rules on release of information related to
alcohol or other drug use disorder, HIV infection, or sickle cell
anemia are at 38 CFR 1.460 through 1.469. In particular, Sec. 1.460
contains the definitions for Sec. Sec. 1.460 through 1.499 of this
part. Disclosure with patient consent is addressed in Sec. Sec. 1.475
through 1.479, while disclosures that do not require patient consent
are addressed in Sec. Sec. 1.483 through 1.489. The focus of
Sec. Sec. 1.490 through 1.499 is release of information in response to
a court order. VA proposes to amend part 1 to conform to these
statutory changes by adding two new definitions to Sec. 1.460, and
adding two new sections at 38 CFR 1.481 and 1.482.
In this rulemaking we propose to add two new definitions to Sec.
1.460. We would add the term ``health care'' to have the same meaning
as defined in the Health Insurance Portability and Accountability Act
(HIPAA) Regulations, 45 CFR 160.103. We choose this definition to
maintain consistency with the HIPAA Privacy Rule regulations
promulgated by the Department of Health and Human Services at 45 CFR
part 160 and subparts A and E of part 164, and to align with industry
standards and practice. Section 160.103 of 45 CFR defines in part
``health care'' as ``care, services, or supplies related to the health
of an individual,'' including ``preventive, diagnostic, therapeutic,
rehabilitative, maintenance, or palliative care, and counseling,
service, assessment, or procedure with respect to the physical or
mental condition, or functional status, of an individual or that
affects the structure or function of the body.'' Furthermore, the
``sale or dispensing of a drug, device, equipment, or other item in
accordance with a prescription'' is included in the definition. We
would cross-reference the definition found in 45 CFR 160.103 in 38 CFR
1.460 to maintain consistency in definition of the term and in the
event the definition is amended in the future. We note that the VA
MISSION Act of 2018 includes hospital care, medical services, and
extended care services as part of health care; however, since 45 CFR
160.103 does not explicitly identify these services in the definition,
we have added this language to the definition of ``health care-related
activities or functions'' below.
We would also add the term ``health care-related activities or
functions'' and define it to mean the actions required
[[Page 68067]]
for the delivery of health care, including hospital care, medical
services, and extended care services. The definition would also
indicate that health care-related activities or functions include:
Treatment as defined by 45 CFR 164.501, activities related to
reimbursement for care and treatment by a health care provider,
activities related to participation in health information exchanges for
the delivery of health care, health care operations as defined by 45
CFR 164.501, and activities related to a patient's exercise of privacy
rights regarding health information. This definition would allow VA to
implement the recent statutory changes to 7332 by expanding the scope
of permissible disclosure to purposes other than providing health care.
Thus, this definition will allow VA to implement the recent statutory
changes to section 7332 while also maintaining consistency with the
definition of ``health care'' from the HIPAA Privacy Rule. We note that
this rulemaking does not negate the requirement of VA to comply with
HIPAA, when applicable.
VA believes that the examples of health-care-related activities and
functions are appropriate to show consistency with the HIPAA Privacy
Rule, which also allows the disclosure of protected health information
for treatment. VA would apply the same standard for disclosures of
section 7332 protected information since it aligns with common industry
practice. Section 164.501 of 45 CFR defines ``treatment'' in part as
the ``provision, coordination, or management of health care and related
services by . . . health care providers, including the coordination or
management of health care . . . with a third party; consultations
between health care providers relating to a patient; or the referral of
a patient from one health care provider to another.'' We would cross-
reference this definition found in 45 CFR 164.501 to maintain
consistency in the definition of the terms and in the event the
definitions are amended in the future. Also, the HIPAA Privacy Rule
allows the disclosure of protected health information for payment
activities. Likewise, VA regulations at 38 CFR 17.106 allows the
disclosure of appropriate health care records to third-party payers for
the purposes of verifying the care and services which are the subject
of claims for which VA seeks payment, recovery, or collection. This
definition will allow VA to implement the recent statutory changes to
section 7332 while also maintaining consistency with industry standards
and practice under the HIPAA Privacy Rule for disclosing appropriate
health care records to third-party payers. Additionally, VA has entered
into agreements to participate in a health information exchange (HIE)
to help facilitate the transfer of information between different
organizations that range from community health care providers and
health plans to government agencies providing benefits. This definition
would allow VA to electronically transfer health information with HIE
community partners for the purposes of delivering health care.
Furthermore, the HIPAA Privacy Rule allows the disclosure of protected
health information for health care operations under certain
circumstances outlined in 45 CFR 164.506(c)(1) and (4). Thus, VA would
apply the same standard for disclosures of section 7332 protected
information since it aligns with common industry practice. Section
164.501 of 45 CFR defines ``health care operations'' in part as the
``activities of [a] covered entity to the extent that the activities
are related to covered functions,'' including certain administrative,
financial, legal, and quality improvement activities that are necessary
to support a covered entity's core functions. We would cross-reference
this definition found in 45 CFR 164.501 to maintain consistency in the
definition of the terms and in the event the definitions are amended in
the future. Finally, both the HIPAA Privacy Rule and the Privacy Act
permit individuals to request an amendment of their record and provide
requirements for subsequent disclosures or informing others of any
amendments made to a record. This definition would allow VA to make
reasonable efforts to quickly notify prior recipients of a veteran's
health information when a correction is made.
Currently 38 CFR 1.481 and 1.482 are reserved for future use, and
the undesignated center heading ``Disclosures without patient consent''
precedes Sec. 1.483. We are proposing to move the undesignated center
heading to precede Sec. 1.481 and add a new Sec. 1.481 titled
``Disclosure of medical records of veterans who receive non-VA health
care.'' Paragraph (a) of Sec. 1.481 would state that VA may disclose
records described in 38 U.S.C. 7332(a) to a non-VA entity (including
private entities and other Federal agencies) for purposes of providing
health care to patients or performing other health care-related
activities or functions. Paragraph (b) would state that an entity to
which a record is disclosed under this subparagraph may not disclose or
use such record for a purpose other than that for which the disclosure
was made or as permitted by law. This would align with the statutory
changes in the VA MISSION Act of 2018.
We note that this proposed rule would authorize, but not require,
VA to disclose the protected health records without patient consent.
Prior to enactment of Public Law 115-26 and the VA MISSION Act of 2018,
VA was prohibited from disclosing health information related to alcohol
or other drug use disorder, HIV infection, or sickle cell anemia to
non-VA providers in those cases where written consent was not or could
not be obtained from the veteran. This created potentially harmful
situations where community providers would have to make medical
decisions in the absence of relevant health information or delay the
delivery of care until the consent form was signed and VA could
transfer the patient's medical records. Accordingly, under 38 U.S.C.
7332(b)(2)(H), which will be implemented by this proposed rule, VA will
share relevant medical records with non-VA providers delivering health
care and other health care-related activities or functions to veterans.
In this rulemaking we propose to add a new Sec. 1.482 titled
``Disclosure of medical records to recover or collect reasonable
charges.'' This new section would state that VA may disclose records
referenced in 38 U.S.C. 7332(a) to a third party in order to recover or
collect reasonable charges for care furnished to, or paid on behalf of,
a patient in connection with a non-service connected disability as
permitted by 38 U.S.C. 1729, or for a condition for which recovery is
authorized, or with respect to which the United States is deemed to be
a third-party beneficiary under the Federal Medical Care Recovery Act
(Pub. L. 87-693; 42 U.S.C. 2651 et seq.).
Prior to the enactment of the VA MISSION Act of 2018, section 7332
required VA to obtain written consent to release a patient's section
7332 protected information when billing a third-party payer for
treatment of a non-service connected condition. HIPAA standards on
billing transactions require diagnostic codes for the submission of a
bill which can convey 7332 protected information. In addition, third-
party payers generally require medical records to verify treatment
prior to payment of a bill. As a result, under the original language of
section 7332, VA was required to procure a veteran's consent prior to
billing a third party for non-service connected care if the care
involved and the medical documentation to be shared included
[[Page 68068]]
section 7332 protected information. If VA was unable to contact a
veteran or the veteran refused to provide written consent, then the
Department was unable to bill third-party payers to collect for the
cost of the care. This resulted in an estimated 40 million dollars per
year in lost revenue. Under 38 U.S.C. 7332(b)(2)(I), VA may provide the
section 7332 protected information necessary to bill for services that
previously required the veteran's written consent. Section 1.482 would
implement the authority in section 7332 and VA will bill under this
authority.
In addition, we are proposing a technical correction to Sec. Sec.
1.460 through 1.499. Currently, the statutory authority for each of
these sections is found in a parenthetical immediately following each
individual section. The Office of Federal Register has directed that
statutory authorities should be listed in the introductory portion of
each CFR part. Therefore, we are consolidating the statutory authority
citations for these sections and moving them to the beginning of part
1.
Effect of Rulemaking
The Code of Federal Regulations, as proposed to be revised by this
proposed rulemaking, would represent the exclusive legal authority on
this subject. No contrary rules or procedures would be authorized. All
VA guidance would be read to conform with this proposed rulemaking if
possible or, if not possible, such guidance would be superseded by this
rulemaking.
Paperwork Reduction Act
The proposed rule contains no provisions constituting a collection
of information under the Paperwork Reduction Act of 1995 (44 U.S.C.
3501-3521).
Regulatory Flexibility Act
The Secretary hereby certifies that this proposed rule would not
have a significant economic impact on a substantial number of small
entities as they are defined in the Regulatory Flexibility Act, 5
U.S.C. 601-612. This proposed rule would directly affect health and
medical insurance companies, some of which are small entities. VA has
determined that this proposed rule will not have a significant economic
impact because VA estimates the cost of this rulemaking to be no more
than 1 percent of average annual receipts, and thus not significant. VA
estimates the cost of this rulemaking to be $41.7 million per year
using FY2020 estimates for health and medical insurance carriers due to
an increase in potential revenue received by VA from health and medical
insurance firms for billed claims. This $41.7 million dollars per year
will be distributed among 815, of which 312 are small, medical and
health insurance firms that provide benefits to veterans treated for
non-service connected conditions and whose records are protected under
38 U.S.C. 7332. We are uncertain if any small entity will be impacted
so we assume that all small entities will be impacted in addition to
large entities. The cost to each of the 312 small entities will be
$51,172 per year, which is 1 percent of average annual receipts for the
smallest potentially affected small entities. Therefore, pursuant to 5
U.S.C. 605(b), the initial and final regulatory flexibility analysis
requirements of 5 U.S.C. 603 and 604 do not apply.
Executive Orders 12866, 13563, and 13771
Executive Orders 12866 and 13563 direct agencies to assess the
costs and benefits of available regulatory alternatives and, when
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety effects, and other advantages; distributive impacts;
and equity). Executive Order 13563 (Improving Regulation and Regulatory
Review) emphasizes the importance of quantifying both costs and
benefits, reducing costs, harmonizing rules, and promoting flexibility.
The Office of Management and Budget has designated this rule as a
significant regulatory action under Executive Order 12866. VA's impact
analysis can be found as a supporting document at http://www.regulations.gov, usually within 48 hours after the rulemaking
document is published. Additionally, a copy of the rulemaking and its
impact analysis are available on VA's website at http://www.va.gov/orpm
by following the link for VA Regulations Published from FY 2004 through
FYTD.
This proposed rule is not expected to be subject to the
requirements of E.O. 13771 because this proposed rule results in no
more than de minimis costs.
Unfunded Mandates
The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C.
1532, that agencies prepare an assessment of anticipated costs and
benefits before issuing any rule that may result in the expenditure by
State, local, and tribal governments, in the aggregate, or by the
private sector, of $100 million or more (adjusted annually for
inflation) in any one year. This proposed rule would have no such
effect on State, local, and tribal governments, or on the private
sector.
Catalog of Federal Domestic Assistance
The Catalog of Federal Domestic Assistance numbers and titles for
the programs affected by this document are 64.008--Veterans Domiciliary
Care; 64.011--Veterans Dental Care; 64.012--Veterans Prescription
Service; 64.013--Veterans Prosthetic Appliances; 64.014--Veterans State
Domiciliary Care; 64.015--Veterans State Nursing Home Care; 64.026--
Veterans State Adult Day Health Care; 64.029--Purchase Care Program;
64.033--VA Supportive Services for Veteran Families Program; 64.039--
CHAMPVA; 64.040--VHA Inpatient Medicine; 64.041--VHA Outpatient
Specialty Care; 64.042--VHA Inpatient Surgery; 64.043--VHA Mental
Health Residential; 64.044--VHA Home Care; 64.045--VHA Outpatient
Ancillary Services; 64.046--VHA Inpatient Psychiatry; 64.047--VHA
Primary Care; 64.048--VHA Mental Health clinics; 64.049--VHA Community
Living Center; 64.050--VHA Diagnostic Care; 64.054--Research and
Development.
List of Subjects in 38 CFR Part 1
Administrative practice and procedure, Archives and records,
Cemeteries, Claims, Courts, Crime, Flags, Freedom of information,
Government contracts, Government employees, Government property,
Infants and children, Inventions and patents, Parking, Penalties,
Privacy, Reporting and recordkeeping requirements, Seals and insignia,
Security measures, Wages.
Signing Authority
The Secretary of Veterans Affairs, or designee, approved this
document and authorized the undersigned to sign and submit the document
to the Office of the Federal Register for publication electronically as
an official document of the Department of Veterans Affairs. Robert L.
Wilkie, Secretary, Department of Veterans Affairs, approved this
document on July 30, 2019, for publication.
Consuela Benjamin,
Regulations Development Coordinator, Office of Regulation Policy &
Management, Office of the Secretary, Department of Veterans Affairs.
For the reasons set forth in the preamble, Department of Veterans
Affairs proposes to amend 38 CFR part 1 as follows:
[[Page 68069]]
PART 1--GENERAL PROVISIONS
0
1. The authority citation for part 1 is amended to read as follows:
Authority: 38 U.S.C. 501, and as noted in specific sections
Sec. Sec. 1.460 and 1.461 also issued under 38 U.S.C. 7332 and
7334.
Sec. Sec. 1.462, 1.464, 1.466-1.469, 1.476, 1.478, 1.479,
1.491-1.493, 1.495 and 1.496 also issued under 38 U.S.C. 7334.
Sec. Sec. 1.463, 1.465, 1.475, 1.477, 1.481, 1.482, 1.483,
1.485, 1.486-1.490, and 1.494 also issued under 38 U.S.C. 7332.
Sec. 1.484 also issued under 38 U.S.C. 7331 and 7332.
Sec. 1.485a also issued under 38 U.S.C. 5701 and 7332.
0
2. Remove the parenthetical Authority citation immediately following
each section from Sec. Sec. 1.460 through 1.479.
0
3. Amend Sec. 1.460 by adding, in alphabetical order, definitions for
``Health care'' and ``Health care-related activities or functions'' to
read as follows:
Sec. 1.460 Definitions.
* * * * *
Health care. The term ``health care'' has the same meaning as
provided in 45 CFR 160.103.
Health care-related activities or functions. The term ``health
care-related activities or functions'' means the actions required for
the delivery of health care, including hospital care, medical services,
and extended care services. Health care-related activities or functions
includes: Treatment as defined by 45 CFR 164.501; activities related to
reimbursement for care and treatment by a health care provider;
activities related to participation in health information exchanges for
the delivery of health care; health care operations as defined by 45
CFR 164.501; and activities related to a patient's exercise of privacy
rights regarding health information.
* * * * *
0
4. Add an undesignated center heading immediately preceding Sec.
1.481, and new Sec. Sec. 1.481 and 1.482 to read as follows:
Disclosures Without Patient Consent
Sec. 1.481 Disclosure of medical records of veterans who receive non-
VA health care.
(a) VA may disclose records referred to in 38 U.S.C. 7332(a) to a
non-VA entity (including private entities and other Federal agencies)
for purposes of providing health care to patients or performing other
health care-related activities or functions.
(b) An entity to which a record is disclosed under this section may
not disclose or use such record for a purpose other than that for which
the disclosure was made or as permitted by law.
Sec. 1.482 Disclosure of medical records to recover or collect
reasonable charges.
VA may disclose records described in 38 U.S.C. 7332(a) to a third
party in order to recover or collect reasonable charges for care
furnished to, or paid on behalf of, a patient in connection with a non-
service connected disability as permitted by 38 U.S.C. 1729, or for a
condition for which recovery is authorized, or with respect to which
the United States is deemed to be a third-party beneficiary under the
Federal Medical Care Recovery Act (Pub. L. 87-693, 42 U.S.C. 2651 et
seq.).
0
5. Remove the undesignated center heading immediately preceding Sec.
1.483.
0
6. Remove the parenthetical Authority citation immediately following
each section from Sec. Sec. 1.483 through 1.496.
[FR Doc. 2019-26910 Filed 12-12-19; 8:45 am]
BILLING CODE 8320-01-P