[Federal Register Volume 83, Number 13 (Friday, January 19, 2018)]
[Proposed Rules]
[Pages 2762-2765]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-00758]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS

38 CFR Part 1

RIN 2900-AP90


Consent for Release of VA Medical Records

AGENCY: Department of Veterans Affairs.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Veterans Affairs (VA) proposes to amend its 
regulations to clarify that a valid consent authorizing the Department 
to release the patient's confidential VA medical records to a health 
information exchange (HIE) community partner may be established not 
only by VA's physical possession of the written consent form, but also 
by the HIE community partner's written (electronic) attestation that 
the patient has, in fact, provided such consent. This proposed rule 
would be a reinterpretation of an existing, long-standing regulation 
and is necessary to facilitate modern requirements for the sharing of 
patient records with community health care providers, health plans, 
governmental agencies, and other entities participating in electronic 
HIEs. This revision would ensure that more community health care 
providers and other HIE community partners can deliver informed medical 
care to patients by having access to the patient's VA medical records 
at the point of care.

DATES: Comment Date: Comments must be received on or before March 20, 
2018.

ADDRESSES: Written comments may be submitted through 
www.Regulations.gov; by mail or hand-delivery to Director, Regulation 
Policy and Management (00REG), Department of Veterans Affairs, 810 
Vermont Avenue NW, Room 1063B, Washington, DC 20420; or by fax to (202) 
273-9026. Comments should indicate that they are submitted in response 
to ``RIN 2900-AP90 Consent for Release of VA Medical Records.'' Copies 
of comments received will be available for public inspection in the 
Office of Regulation Policy and Management, Room 1063B, between the 
hours of 8:00 a.m. and 4:30 p.m., Monday through Friday (except 
holidays). Please call (202) 461-4902 for an appointment. (This is not 
a toll-free number.) In addition, during the comment period, comments 
may be viewed online through the Federal Docket Management System 
(FDMS) at www.Regulations.gov.

FOR FURTHER INFORMATION CONTACT: Stephania Griffin, Director, Veterans 
Health Administration Information Access and Privacy Office, Department 
of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC 20420; 
<a href="/cdn-cgi/l/email-protection#72210617021a131c1b135c15001b14141b1c3204135c151d04"><span class="__cf_email__" data-cfemail="ca99beafbaa2aba4a3abe4adb8a3acaca3a48abcabe4ada5bc">[email protected]</span></a>, (704) 245-2492 (This is not a toll-free 
number.)

SUPPLEMENTARY INFORMATION: Under 38 U.S.C. 7332, VA must keep 
confidential all records of identity, diagnosis, prognosis, or 
treatment of a patient in connection with any program or activity 
carried out by VA related to drug abuse, alcoholism or alcohol abuse, 
infection with human immunodeficiency virus, or sickle cell anemia, and 
must obtain patients' written consent before VA may disclose the 
protected information unless authorized by the statute. This 
requirement applies to communications between VA and community health 
care providers for the purposes of treatment, except in certain 
situations, for instance in medical emergencies and when the records 
are sent to a non-Department entity that provides hospital care to 
patients as authorized by the Secretary. 38 U.S.C. 7332(b)(2)(A) and 
(H); Public Law 115-26 (April 19, 2017). Although section 7332 does not 
explicitly require that the written consent physically be in VA's 
possession at the time of the disclosure, VA had interpreted the 
statute to require such possession, and therefore applied 38 CFR 1.475 
consistent with that interpretation. VA has reexamined that statutory 
interpretation in light of contemporary

[[Page 2763]]

healthcare industry standards and proposes to revise Sec.  1.475 to 
reflect this updated reading of section 7332. This proposed rule would 
revise 38 CFR 1.475 to permit VA to release section 7332-protected 
medical records to eligible community partners, even if VA does not 
physically have the patient's written consent, provided that specified 
criteria are met.
    The ability to quickly release section 7332-protected information 
has become increasingly important as VA strives to support veterans' 
choice to seek care in the community and create innovative ways to 
provide effective and timely care to veterans. In this regard, VA has 
entered into an agreement to participate in an HIE to help facilitate 
the transfer of information between different organizations. An HIE is 
the electronic transfer of health information among organizations 
according to nationally recognized standards. The organizations that 
participate (HIE community partners) range from community health care 
providers and health plans to governmental agencies providing benefits, 
such as the Social Security Administration (SSA).
    The interpretation that valid consent may be established only by 
VA's physical possession of the written consent has left many HIE 
community partners unable to access veterans' VA medical records at the 
point of care. While an estimated three out of four veterans enrolled 
in VA's health care system also seek medical care in the community, HIE 
community partners' requests for their VA health records must 
frequently be denied because VA does not have a consent on file, and 
many HIE community partners therefore either must delay care to 
veterans or provide treatment to veterans without having the benefit of 
reviewing the veteran's full medical history.
    The reason for the low rate of consent is not because veterans 
object to providing consent; veteran participation is almost always 
favorable when asked to provide consent. The primary obstacle is that 
veterans will often seek care in the community prior to having the 
opportunity to provide the consent form to VA and are then left without 
any means of getting the consent into VA's physical possession promptly 
once they are at the community health care facility.
    By allowing HIE community partners to attest that they have, in 
fact, obtained a valid consent, VA would be able to collect consent in 
a broader array of circumstances. Most importantly, this would allow VA 
to release a veteran's medical records to an HIE community partner, 
such as a community health care provider or SSA, once the partner 
attests that they have collected valid consent, without VA having to 
wait for the document to be furnished. This would allow for HIE 
community partners to provide veterans with the most informed care, 
would allow VA to more expediently provide veterans' records for the 
adjudication of their SSA disability claims, and would also allow for 
VA to continue innovating and creating new ways for veterans to receive 
timely and high quality health care.
    VA believes that this new interpretation of section 7332--to permit 
disclosure to an HIE community partner pursuant to the partner's 
attestation regarding written consent, would uphold veterans' right to 
privacy. As explained in greater detail below, such disclosure would 
still require a legally sufficient written consent. We clarify that the 
only change would be that a valid consent authorizing disclosure may be 
established not only by VA's physical possession of the written consent 
form but also by the HIE community partner's attestation that the 
veteran has submitted legally sufficient consent. Moreover, in the 
private sector under the Health Insurance Portability and 
Accountability Act (HIPAA) Privacy Rule, health care providers are able 
to release a patient's confidential medical records to another one of 
the patient's treating providers without written consent. Therefore, 
VA's privacy protections would remain more robust than those of the 
private sector generally and greater than those required by the HIPAA 
Privacy Rule.
    This proposed rule would revise 38 CFR 1.460 to include definitions 
for ``health information exchange'' and ``health information exchange 
community partner'' as described above. Further, the rule would revise 
1.475 as follows. Current paragraph (d) would be redesignated as 
paragraph (e) and would be revised as explained below. New paragraph 
(d) would provide the criteria to establish written consent that would 
authorize the disclosure of confidential VA medical records. 
Specifically, it would establish that, in addition to physical 
possession of a patient's written consent, VA may release the patient's 
protected medical information to an HIE community partner pursuant to 
that partner's attestation that valid consent has been obtained. To 
clarify, this paragraph would not require VA to provide the records to 
HIE community partners just because the partner submitted an 
attestation; instead, VA would have the discretion to send the records.
    Proposed paragraph (d)(1) states that written consent may be 
established by VA's physical possession of the patient's written 
consent that meets the criteria in paragraph (a) of this section. This 
is how VA traditionally collected consent forms.
    Paragraph (d)(2) would provide an alternative for disclosure of 
section 7332-protected information. VA would also be able to disclose 
the protected information to an HIE community partner as long as two 
criteria are met. Initially, we note that this alternative for 
disclosure would be limited to VA's partners in the HIE because the 
partners have all signed an agreement to comply with certain standards 
of practice. Additionally, all partners would be required to have the 
technological capabilities to provide the requisite attestation.
    The first proposed criterion is that the HIE community partner must 
provide written attestation that the patient has submitted legally 
sufficient consent to them. This requirement is necessary because 38 
U.S.C. 7332 and 38 CFR 1.475 still require the veteran provide legally 
sufficient written consent to release section 7332-protected 
information. Therefore, in order for VA to release the records to the 
HIE community partner, VA must have an attestation or some 
documentation that the patient provided legally sufficient written 
consent.
    To clarify, ``written attestation'' would not require a physical 
document and a wet signature; electronic attestations satisfy this 
requirement and are the expected form of attestation from the HIE 
community partner. VA would not specifically require the attestation to 
be electronic in order to provide for flexibility if there are changes 
in technology and best practices. However, VA envisions the vast 
majority, if not all, of the attestations would be electronic through 
approved messaging with the HIE community partners. This proposed rule 
would allow for VA's community partners to electronically attest, 
through the computer software, that the veteran submitted legally 
sufficient written consent. At that time, VA would be able to release 
the veteran's medical records electronically to the HIE community 
partner.
    In addition to the written attestation, paragraph (d)(2) would 
require that VA have the ability to retrieve or obtain the written 
consent. There are two ways in which VA can obtain the records. First, 
proposed paragraph (d)(2)(i) provides that a .HIE community partner can 
make the consent form available to VA within 10 business days of its 
attestation. This can be accomplished either by storing

[[Page 2764]]

the written consent form electronically for access by VA or by sending 
the written consent form to VA.
    Second, paragraph (d)(2)(ii) would provide that the HIE community 
partner can maintain the patient's written consent form in accordance 
with a memorandum of understanding (MOU) that is drafted and signed by 
VA and the HIE community partner. The MOU would ensure that the 
patient's records are retained in accordance with VA record retention 
requirements set forth in VHA Records Control Schedule (RCS) 10-1. Even 
though VA would not require the written consent to be physically in 
VA's possession since it is a VA record, the HIE would have to retain 
the consent form according to VA's record retention requirements. 
Paragraph (d)(2)(ii) would also require that the MOU outline how VA can 
request the consent form from the HIE community partner and how the HIE 
community partner can make the consent form available to VA. In this 
regard, VA and the partner would determine a mutually agreeable 
timeframe to comply with a request by VA for a copy of the consent 
form.
    As explained above current paragraph (d) would be redesignated as 
new paragraph (e). This paragraph would be revised to update the name 
of VA Form 10-5345. Specifically, current paragraph (d) provides that 
it was not necessary to use any particular form to establish a consent 
referred to in paragraph (a) of this section, however, VA Form 10-5345, 
titled Request for and Consent to Release of Medical Records Protected 
by 38 U.S.C. 7332, may be used for such purpose. VA Form 10-5345 has 
been updated and renamed Request for and Authorization to Release 
Medical Records or Health Information. Accordingly, VA would revise the 
paragraph to reflect the new name of VA Form 10-5345.

Effect of Rulemaking

    The Code of Federal Regulations, as proposed to be revised by this 
proposed rulemaking, would represent the exclusive legal authority on 
this subject. No contrary rules or procedures would be authorized. All 
VA guidance would be read to conform with this proposed rulemaking if 
possible or, if not possible, such guidance would be superseded by this 
rulemaking.

Paperwork Reduction Act

    This proposed rule contains no provisions constituting a collection 
of information under the Paperwork Reduction Act of 1995 (44 U.S.C. 
3501-3521).

Regulatory Flexibility Act

    The Secretary hereby certifies that this proposed rule would not 
have a significant economic impact on a substantial number of small 
entities as they are defined in the Regulatory Flexibility Act (5 
U.S.C. 601-612). The overall impact of the proposed rule on small 
entities would be minimal as the proposed rule would only require that 
entities attest that they received the veteran's consent and make the 
written consent available to VA. These administrative burdens are 
similar to current burdens related to medical privacy and will not have 
a significant economic impact on these entities. On this basis, the 
Secretary certifies that the adoption of this proposed rule would not 
have a significant economic impact on a substantial number of small 
entities as they are defined in the Regulatory Flexibility Act, 5 
U.S.C. 601-612. Therefore, under 5 U.S.C. 605(b), this rulemaking is 
exempt from the initial and final regulatory flexibility analysis 
requirements of sections 603 and 604.

Executive Orders 12866, 13563 and 13771

    Executive Orders (E.O.s) 12866 and 13563 direct agencies to assess 
all costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). E.O. 
13563 emphasizes the importance of quantifying both costs and benefits 
of reducing costs, of harmonizing rules, and of promoting flexibility. 
E.O. 12866, Regulatory Planning and Review, defines ``significant 
regulatory action'' to mean any regulatory action that is likely to 
result in a rule that may: ``(1) Have an annual effect on the economy 
of $100 million or more or adversely affect in a material way the 
economy, a sector of the economy, productivity, competition, jobs, the 
environment, public health or safety, or State, local, or tribal 
governments or communities; (2) Create a serious inconsistency or 
otherwise interfere with an action taken or planned by another agency; 
(3) Materially alter the budgetary impact of entitlements, grants, user 
fees, or loan programs or the rights and obligations of recipients 
thereof; or (4) Raise novel legal or policy issues arising out of legal 
mandates, the President's priorities, or the principles set forth in 
this Executive order.''
    VA has examined the economic, interagency, budgetary, legal, and 
policy implications of this regulatory action, and it has been 
determined not to be a significant regulatory action under E.O. 12866. 
This proposed rule is not expected to be an E.O. 13771 regulatory 
action because this proposed rule is not significant under E.O. 12866.

Unfunded Mandates

    The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C. 
1532, that agencies prepare an assessment of anticipated costs and 
benefits before issuing any rule that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100 million or more (adjusted annually for 
inflation) in any one year. This proposed rule would have no such 
effect on State, local, and tribal governments, or on the private 
sector.

Catalog of Federal Domestic Assistance

    The Catalog of Federal Domestic Assistance numbers and titles for 
the programs affected by this document are 64.008--Veterans Domiciliary 
Care; 64.011--Veterans Dental Care; 64.012--Veterans Prescription 
Service; 64.013--Veterans Prosthetic Appliances; 64.014--Veterans State 
Domiciliary Care; 64.015--Veterans State Nursing Home Care; 64.024--VA 
Homeless Providers Grant and Per Diem Program; 64.026--Veterans State 
Adult Day Health Care; 64.029--Purchase Care Program; 64.033--VA 
Supportive Services for Veteran Families Program; 64.039--CHAMPVA; 
64.040--VHA Inpatient Medicine; 64.041--VHA Outpatient Specialty Care; 
64.042--VHA Inpatient Surgery; 64.043--VHA Mental Health Residential; 
64.044--VHA Home Care; 64.045--VHA Outpatient Ancillary Services; 
64.046--VHA Inpatient Psychiatry; 64.047--VHA Primary Care; 64.048--VHA 
Mental Health clinics; 64.049--VHA Community Living Center; 64.050--VHA 
Diagnostic Care; 64.054--Research and Development.

Signing Authority

    The Secretary of Veterans Affairs, or designee, approved this 
document and authorized the undersigned to sign and submit the document 
to the Office of the Federal Register for publication electronically as 
an official document of the Department of Veterans Affairs. Gina S. 
Farrisee, Deputy Chief of Staff, Department of Veterans Affairs, 
approved this document on December 8, 2017, for publication.

List of Subjects in 38 CFR Part 1

    Administrative practice and procedure, Archives and records,

[[Page 2765]]

Cemeteries, Claims, Courts, Crime, Flags, Freedom of information, 
Government contracts, Government employees, Government property, 
Infants and children, Inventions and patents, Parking, Penalties, 
Privacy, Reporting and recordkeeping requirements, Seals and insignia, 
Security measures, Wages.

    Dated: January 12, 2018.
Janet Coleman,
Chief, Office of Regulation Policy & Management, Office of the 
Secretary, Department of Veterans Affairs.
    For the reasons set out in the preamble, Department of Veterans 
Affairs proposes to amend 38 CFR part 1 as follows:

PART 1--GENERAL PROVISIONS

0
1. The authority citation for part 1 continues to read as follows:

    Authority: 38 U.S.C. 501, and as noted in specific sections.

0
2. Amend Sec.  1.460 by adding, in alphabetical order, definitions for 
``health information exchange'' and ``health information exchange 
community partner.''


Sec.  1.460  Definitions.

* * * * *
    Health information exchange. The term ``health information 
exchange'' means the electronic transfer of health information among 
health care professionals, health plans, governmental agencies 
providing benefits, and other persons and entities according to 
nationally recognized standards that allow the participants to 
appropriately access and securely share patients' vital medical 
information to improve the quality, safety, and efficiency of health 
care delivery.
    Health information exchange community partner. The term ``health 
information exchange community partner'' means a health care provider, 
health plan, governmental agency providing benefits, or other person or 
entity with whom VA shares patients' vital medical information 
according to nationally recognized standards.
* * * * *
0
3. Amend Sec.  1.475 by redesignating paragraph (d) as paragraph (e), 
adding a new paragraph (d) and revising newly redesignated paragraph 
(e) to read as follows:


Sec.  1.475  Form of written consent.

* * * * *
    (d) Establishing written consent. A written consent authorizing the 
disclosure may be demonstrated by:
    (1) A written consent meeting the criteria set forth in paragraph 
(a) of this section that is presented to VA in physical form; or
    (2) A written attestation by a health information exchange 
community partner that the patient submitted legally sufficient consent 
meeting the criteria set forth in paragraph (a), provided that:
    (i) Within 10 business days of the health information exchange 
community partner's attestation, the partner either makes the written 
consent form available for electronic retrieval by VA or produces the 
written consent form to VA; or
    (ii) The health information exchange community partner complies 
with a memorandum of understanding signed by the partner and VA that 
outlines:
    (A) How the written consent will be retained in accordance with VHA 
Records Control Schedule (RCS) 10-1;
    (B) How VA can request the consent form from the partner; and
    (C) How the partner can send the consent form to VA.
    (e) Required Form. It is not necessary to use any particular form 
to establish a consent referred to in paragraph (a) of this section, 
however, VA Form 10-5345, titled Request for and Authorization to 
Release Medical Records or Health Information, complies with all 
applicable legal requirements and may be used for such purpose.

[FR Doc. 2018-00758 Filed 1-18-18; 8:45 am]
BILLING CODE 8320-01-P


</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>