Document Headings

                    Document headings vary by document type but may contain                    the following:                  
                -                       the agency or agencies that issued and signed a document                    
                -                       the number of the CFR title and the number of each part                      the document amends, proposes to amend, or is directly                      related to                    
                -                       the agency docket number / agency internal file number                    
                -                       the RIN which identifies each regulatory action listed in                      the Unified Agenda of Federal Regulatory and Deregulatory                      Actions                    

                    See the                                          Document Drafting Handbook                                        for more details.                  

###### Department of Veterans Affairs

          - 38 CFR Part 1
          - RIN 2900-AP90

# AGENCY:

Department of Veterans Affairs.

# ACTION:

Proposed rule.

# SUMMARY:

The Department of Veterans Affairs (VA) proposes to amend its regulations to clarify that a valid consent authorizing the Department to release the patient's confidential VA medical records to a health information exchange (HIE) community partner may be established not only by VA's physical possession of the written consent form, but also by the HIE community partner's written (electronic) attestation that the patient has, in fact, provided such consent. This proposed rule would be a reinterpretation of an existing, long-standing regulation and is necessary to facilitate modern requirements for the sharing of patient records with community health care providers, health plans, governmental agencies, and other entities participating in electronic HIEs. This revision would ensure that more community health care providers and other HIE community partners can deliver informed medical care to patients by having access to the patient's VA medical records at the point of care.

# DATES:

*Comment Date:*                         Comments must be received on or before March 20, 2018.                    

# ADDRESSES:

                        Written comments may be submitted through                         *www.Regulations.gov;*                         by mail or hand-delivery to Director, Regulation Policy and Management (00REG), Department of Veterans Affairs, 810 Vermont Avenue NW, Room 1063B, Washington, DC 20420; or by fax to (202) 273-9026. Comments should indicate that they are submitted in response to “RIN 2900-AP90 Consent for Release of VA Medical Records.” Copies of comments received will be available for public inspection in the Office of Regulation Policy and Management, Room 1063B, between the hours of 8:00 a.m. and 4:30 p.m., Monday through Friday (except holidays). Please call (202) 461-4902 for an appointment. (This is not a toll-free number.) In addition, during the comment period, comments may be viewed online through the Federal Docket Management System (FDMS) at                         *www.Regulations.gov.*

# FOR FURTHER INFORMATION CONTACT:

                        Stephania Griffin, Director, Veterans Health Administration Information Access and Privacy Office, Department of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC 20420;                         *Stephania.griffin@va.gov,*                         (704) 245-2492 (This is not a toll-free number.)                    

# SUPPLEMENTARY INFORMATION:

                    Under 38 U.S.C. 7332, VA must keep confidential all records of identity, diagnosis, prognosis, or treatment of a patient in connection with any program or activity carried out by VA related to drug abuse, alcoholism or alcohol abuse, infection with human immunodeficiency virus, or sickle cell anemia, and must obtain patients' written consent before VA may disclose the protected information unless authorized by the statute. This requirement applies to communications between VA and community health care providers for the purposes of treatment, except in certain situations, for instance in medical emergencies and when the records are sent to a non-Department entity that provides hospital care to patients as authorized by the Secretary. 38 U.S.C. 7332(b)(2)(A) and (H); Public Law 115-26 (April 19, 2017). Although section 7332 does not explicitly require that the written consent physically be in VA's possession at the time of the disclosure, VA had interpreted the statute to require such possession, and therefore applied 38 CFR 1.475 consistent with that interpretation. VA has reexamined that statutory interpretation in light of contemporary                           ( print page 2763)                        healthcare industry standards and proposes to revise § 1.475 to reflect this updated reading of section 7332. This proposed rule would revise 38 CFR 1.475 to permit VA to release section 7332-protected medical records to eligible community partners, even if VA does not physically have the patient's written consent, provided that specified criteria are met.                

The ability to quickly release section 7332-protected information has become increasingly important as VA strives to support veterans' choice to seek care in the community and create innovative ways to provide effective and timely care to veterans. In this regard, VA has entered into an agreement to participate in an HIE to help facilitate the transfer of information between different organizations. An HIE is the electronic transfer of health information among organizations according to nationally recognized standards. The organizations that participate (HIE community partners) range from community health care providers and health plans to governmental agencies providing benefits, such as the Social Security Administration (SSA).

The interpretation that valid consent may be established only by VA's physical possession of the written consent has left many HIE community partners unable to access veterans' VA medical records at the point of care. While an estimated three out of four veterans enrolled in VA's health care system also seek medical care in the community, HIE community partners' requests for their VA health records must frequently be denied because VA does not have a consent on file, and many HIE community partners therefore either must delay care to veterans or provide treatment to veterans without having the benefit of reviewing the veteran's full medical history.

The reason for the low rate of consent is not because veterans object to providing consent; veteran participation is almost always favorable when asked to provide consent. The primary obstacle is that veterans will often seek care in the community prior to having the opportunity to provide the consent form to VA and are then left without any means of getting the consent into VA's physical possession promptly once they are at the community health care facility.

By allowing HIE community partners to attest that they have, in fact, obtained a valid consent, VA would be able to collect consent in a broader array of circumstances. Most importantly, this would allow VA to release a veteran's medical records to an HIE community partner, such as a community health care provider or SSA, once the partner attests that they have collected valid consent, without VA having to wait for the document to be furnished. This would allow for HIE community partners to provide veterans with the most informed care, would allow VA to more expediently provide veterans' records for the adjudication of their SSA disability claims, and would also allow for VA to continue innovating and creating new ways for veterans to receive timely and high quality health care.

VA believes that this new interpretation of section 7332—to permit disclosure to an HIE community partner pursuant to the partner's attestation regarding written consent, would uphold veterans' right to privacy. As explained in greater detail below, such disclosure would still require a legally sufficient written consent. We clarify that the only change would be that a valid consent authorizing disclosure may be established not only by VA's physical possession of the written consent form but also by the HIE community partner's attestation that the veteran has submitted legally sufficient consent. Moreover, in the private sector under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, health care providers are able to release a patient's confidential medical records to another one of the patient's treating providers without written consent. Therefore, VA's privacy protections would remain more robust than those of the private sector generally and greater than those required by the HIPAA Privacy Rule.

This proposed rule would revise 38 CFR 1.460 to include definitions for “health information exchange” and “health information exchange community partner” as described above. Further, the rule would revise 1.475 as follows. Current paragraph (d) would be redesignated as paragraph (e) and would be revised as explained below. New paragraph (d) would provide the criteria to establish written consent that would authorize the disclosure of confidential VA medical records. Specifically, it would establish that, in addition to physical possession of a patient's written consent, VA may release the patient's protected medical information to an HIE community partner pursuant to that partner's attestation that valid consent has been obtained. To clarify, this paragraph would not require VA to provide the records to HIE community partners just because the partner submitted an attestation; instead, VA would have the discretion to send the records.

Proposed paragraph (d)(1) states that written consent may be established by VA's physical possession of the patient's written consent that meets the criteria in paragraph (a) of this section. This is how VA traditionally collected consent forms.

Paragraph (d)(2) would provide an alternative for disclosure of section 7332-protected information. VA would also be able to disclose the protected information to an HIE community partner as long as two criteria are met. Initially, we note that this alternative for disclosure would be limited to VA's partners in the HIE because the partners have all signed an agreement to comply with certain standards of practice. Additionally, all partners would be required to have the technological capabilities to provide the requisite attestation.

The first proposed criterion is that the HIE community partner must provide written attestation that the patient has submitted legally sufficient consent to them. This requirement is necessary because 38 U.S.C. 7332 and 38 CFR 1.475 still require the veteran provide legally sufficient written consent to release section 7332-protected information. Therefore, in order for VA to release the records to the HIE community partner, VA must have an attestation or some documentation that the patient provided legally sufficient written consent.

To clarify, “written attestation” would not require a physical document and a wet signature; electronic attestations satisfy this requirement and are the expected form of attestation from the HIE community partner. VA would not specifically require the attestation to be electronic in order to provide for flexibility if there are changes in technology and best practices. However, VA envisions the vast majority, if not all, of the attestations would be electronic through approved messaging with the HIE community partners. This proposed rule would allow for VA's community partners to electronically attest, through the computer software, that the veteran submitted legally sufficient written consent. At that time, VA would be able to release the veteran's medical records electronically to the HIE community partner.

                    In addition to the written attestation, paragraph (d)(2) would require that VA have the ability to retrieve or obtain the written consent. There are two ways in which VA can obtain the records. First, proposed paragraph (d)(2)(i) provides that a .HIE community partner can make the consent form available to VA within 10 business days of its attestation. This can be accomplished either by storing                           ( print page 2764)                        the written consent form electronically for access by VA or by sending the written consent form to VA.                

Second, paragraph (d)(2)(ii) would provide that the HIE community partner can maintain the patient's written consent form in accordance with a memorandum of understanding (MOU) that is drafted and signed by VA and the HIE community partner. The MOU would ensure that the patient's records are retained in accordance with VA record retention requirements set forth in VHA Records Control Schedule (RCS) 10-1. Even though VA would not require the written consent to be physically in VA's possession since it is a VA record, the HIE would have to retain the consent form according to VA's record retention requirements. Paragraph (d)(2)(ii) would also require that the MOU outline how VA can request the consent form from the HIE community partner and how the HIE community partner can make the consent form available to VA. In this regard, VA and the partner would determine a mutually agreeable timeframe to comply with a request by VA for a copy of the consent form.

As explained above current paragraph (d) would be redesignated as new paragraph (e). This paragraph would be revised to update the name of VA Form 10-5345. Specifically, current paragraph (d) provides that it was not necessary to use any particular form to establish a consent referred to in paragraph (a) of this section, however, VA Form 10-5345, titled Request for and Consent to Release of Medical Records Protected by 38 U.S.C. 7332, may be used for such purpose. VA Form 10-5345 has been updated and renamed Request for and Authorization to Release Medical Records or Health Information. Accordingly, VA would revise the paragraph to reflect the new name of VA Form 10-5345.

## Effect of Rulemaking

The Code of Federal Regulations, as proposed to be revised by this proposed rulemaking, would represent the exclusive legal authority on this subject. No contrary rules or procedures would be authorized. All VA guidance would be read to conform with this proposed rulemaking if possible or, if not possible, such guidance would be superseded by this rulemaking.

## Paperwork Reduction Act

This proposed rule contains no provisions constituting a collection of information under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3521).

## Regulatory Flexibility Act

The Secretary hereby certifies that this proposed rule would not have a significant economic impact on a substantial number of small entities as they are defined in the Regulatory Flexibility Act (5 U.S.C. 601-612). The overall impact of the proposed rule on small entities would be minimal as the proposed rule would only require that entities attest that they received the veteran's consent and make the written consent available to VA. These administrative burdens are similar to current burdens related to medical privacy and will not have a significant economic impact on these entities. On this basis, the Secretary certifies that the adoption of this proposed rule would not have a significant economic impact on a substantial number of small entities as they are defined in the Regulatory Flexibility Act, 5 U.S.C. 601-612. Therefore, under 5 U.S.C. 605(b), this rulemaking is exempt from the initial and final regulatory flexibility analysis requirements of sections 603 and 604.

## Executive Orders 12866, 13563 and 13771

Executive Orders (E.O.s) 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). E.O. 13563 emphasizes the importance of quantifying both costs and benefits of reducing costs, of harmonizing rules, and of promoting flexibility. E.O. 12866, Regulatory Planning and Review, defines “significant regulatory action” to mean any regulatory action that is likely to result in a rule that may: “(1) Have an annual effect on the economy of $100 million or more or adversely affect in a material way the economy, a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or State, local, or tribal governments or communities; (2) Create a serious inconsistency or otherwise interfere with an action taken or planned by another agency; (3) Materially alter the budgetary impact of entitlements, grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) Raise novel legal or policy issues arising out of legal mandates, the President's priorities, or the principles set forth in this Executive order.”

VA has examined the economic, interagency, budgetary, legal, and policy implications of this regulatory action, and it has been determined not to be a significant regulatory action under E.O. 12866. This proposed rule is not expected to be an E.O. 13771 regulatory action because this proposed rule is not significant under E.O. 12866.

## Unfunded Mandates

The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C. 1532, that agencies prepare an assessment of anticipated costs and benefits before issuing any rule that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more (adjusted annually for inflation) in any one year. This proposed rule would have no such effect on State, local, and tribal governments, or on the private sector.

## Catalog of Federal Domestic Assistance

The Catalog of Federal Domestic Assistance numbers and titles for the programs affected by this document are 64.008—Veterans Domiciliary Care; 64.011—Veterans Dental Care; 64.012—Veterans Prescription Service; 64.013—Veterans Prosthetic Appliances; 64.014—Veterans State Domiciliary Care; 64.015—Veterans State Nursing Home Care; 64.024—VA Homeless Providers Grant and Per Diem Program; 64.026—Veterans State Adult Day Health Care; 64.029—Purchase Care Program; 64.033—VA Supportive Services for Veteran Families Program; 64.039—CHAMPVA; 64.040—VHA Inpatient Medicine; 64.041—VHA Outpatient Specialty Care; 64.042—VHA Inpatient Surgery; 64.043—VHA Mental Health Residential; 64.044—VHA Home Care; 64.045—VHA Outpatient Ancillary Services; 64.046—VHA Inpatient Psychiatry; 64.047—VHA Primary Care; 64.048—VHA Mental Health clinics; 64.049—VHA Community Living Center; 64.050—VHA Diagnostic Care; 64.054—Research and Development.

## Signing Authority

The Secretary of Veterans Affairs, or designee, approved this document and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs. Gina S. Farrisee, Deputy Chief of Staff, Department of Veterans Affairs, approved this document on December 8, 2017, for publication.

# List of Subjects in 38 CFR Part 1

      - Administrative practice and procedure
      - Archives and records, 

Dated: January 12, 2018.

Janet Coleman,

Chief, Office of Regulation Policy & Management, Office of the Secretary, Department of Veterans Affairs.

For the reasons set out in the preamble, Department of Veterans Affairs proposes to amend 38 CFR part 1 as follows:

# PART 1—GENERAL PROVISIONS

1. The authority citation for part 1 continues to read as follows: 

Authority:38 U.S.C. 501, and as noted in specific sections.

2. Amend § 1.460 by adding, in alphabetical order, definitions for “health information exchange” and “health information exchange community partner.” 

§ 1.460 

* * * * *

*Health information exchange.*                         The term “health information exchange” means the electronic transfer of health information among health care professionals, health plans, governmental agencies providing benefits, and other persons and entities according to nationally recognized standards that allow the participants to appropriately access and securely share patients' vital medical information to improve the quality, safety, and efficiency of health care delivery.                    

*Health information exchange community partner.*                         The term “health information exchange community partner” means a health care provider, health plan, governmental agency providing benefits, or other person or entity with whom VA shares patients' vital medical information according to nationally recognized standards.                    

* * * * *

3. Amend § 1.475 by redesignating paragraph (d) as paragraph (e), adding a new paragraph (d) and revising newly redesignated paragraph (e) to read as follows: 

§ 1.475 

* * * * *

                        (d)                         *Establishing written consent.*                         A written consent authorizing the disclosure may be demonstrated by:                    

(1) A written consent meeting the criteria set forth in paragraph (a) of this section that is presented to VA in physical form; or

(2) A written attestation by a health information exchange community partner that the patient submitted legally sufficient consent meeting the criteria set forth in paragraph (a), provided that:

(i) Within 10 business days of the health information exchange community partner's attestation, the partner either makes the written consent form available for electronic retrieval by VA or produces the written consent form to VA; or

(ii) The health information exchange community partner complies with a memorandum of understanding signed by the partner and VA that outlines:

(A) How the written consent will be retained in accordance with VHA Records Control Schedule (RCS) 10-1;

(B) How VA can request the consent form from the partner; and

(C) How the partner can send the consent form to VA.

                        (e)                         *Required Form.*                         It is not necessary to use any particular form to establish a consent referred to in paragraph (a) of this section, however, VA Form 10-5345, titled Request for and Authorization to Release Medical Records or Health Information, complies with all applicable legal requirements and may be used for such purpose.                    

[FR Doc. 2018-00758 Filed 1-18-18; 8:45 am]

BILLING CODE 8320-01-P