Hipaa Laws: Do They Apply At The Va?

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that protects the privacy of patients' medical information. It applies to all healthcare providers in the United States, including the Department of Veterans Affairs (VA). The VA is responsible for protecting the sensitive information of millions of veterans who receive healthcare and benefits through its system. However, there have been numerous reports of privacy violations at VA facilities, raising concerns about the security of veterans' medical records.

VA Form 21-4142

The form, which was last revised in August 2024, covers a range of personal information, including medical treatment, hospitalizations, and outpatient care. It also includes information on psychological, psychiatric, or other mental impairments, excluding psychotherapy notes. The form also covers drug abuse, alcoholism, and other substance abuse, as well as gene-related impairments and communicable or non-communicable diseases.

Section I of the form, titled "Records to be Released to the Department of Veterans Affairs (VA)", includes a voluntary authorisation and request for disclosure of all medical records and other information regarding treatment, hospitalization, and outpatient care. This includes psychological, psychiatric, substance abuse, and gene-related impairments, as well as information on how these impairments affect the individual's ability to complete daily tasks and work.

Section V, "Authorization and Consent to Release Information to VA and Signature", specifies that the information is being released to the VA for the purpose of determining eligibility for benefits and the ability to manage such benefits. This section also includes information on the expiration of the authorisation, the right to revoke authorisation, and privacy notices.

It is important to note that the VA will not pay any fees charged by a custodian to provide the requested records. Additionally, providing a Social Security Number (SSN) is voluntary, but it helps ensure that records are properly associated with the individual's claim file.

Disclosure of certain protected records without written consent

The Department of Veterans Affairs (VA) has amended its regulations on the disclosure of certain records without written consent. This amendment was made in accordance with recent changes in the law, including the VA MISSION Act of 2018, which authorises the VA to disclose certain protected records to non-VA entities for the purpose of providing healthcare or performing other healthcare-related activities. This includes the authority to disclose records to third parties in order to recover or collect reasonable charges for care furnished to, or paid on behalf of, a patient.

The amendment, which came into effect on November 9, 2020, allows the VA to disclose records and files maintained on veterans and beneficiaries, including medical records, without written consent. This applies to records of the identity, diagnosis, prognosis, or treatment by or for VA of any patient related to drug abuse, alcoholism or alcohol abuse, infection with HIV, or sickle cell anemia. These records may be disclosed for specific purposes and under certain circumstances, with or without the written consent of the patient.

The amendment expands the scope of permissible disclosures of protected records from non-VA entities providing hospital care or medical services authorised by the VA to non-VA entities providing healthcare or other healthcare-related activities. It also allows entities that receive protected records to make disclosures as permitted by law.

The VA has published regulations implementing the release of information from VA records protected by one or more confidentiality provisions. The regulations address the release of information related to alcohol or other drug use disorder, HIV infection, or sickle cell anemia. They also cover disclosures with and without patient consent, as well as the release of information in response to a court order.

VA employees' intentional snooping and theft of data

The Health Insurance Portability and Accountability Act (HIPAA) applies to the Department of Veterans Affairs (VA) and VA employees. VA employees are highly trained in handling sensitive information and are required to take annual training on privacy and information security awareness.

However, there have been instances of VA employees intentionally snooping and stealing data. In September 2024, it was reported that VA employees improperly accessed the medical files of Sen. JD Vance and Minnesota Gov. Tim Walz, the two major-party vice-presidential nominees. At least a dozen employees accessed the records, and an investigation is underway.

This incident is not an isolated case, as VA OIG has released reports of data breaches and improper access to veterans' health information and personally identifiable information (PII) due to VA mismanagement. In one instance, a veteran shared their concern about the lack of privacy protection on VA kiosks, which are used for appointment check-ins and travel reimbursements. They felt that their personally identifiable information could be seen and stolen while using these kiosks.

These incidents highlight the importance of safeguarding sensitive information and the need for accountability among VA employees. While the VA has implemented measures to protect veterans' information, there is still room for improvement to ensure that data is secure and accessed only by authorized individuals.

VA's Sunshine Healthcare Network

The VA Sunshine Healthcare Network (VISN 8) is the nation's largest system of hospitals and clinics, serving over 1.6 million veterans across a vast area of 61,101 square miles. The network covers 79 counties in Florida, South Georgia, Puerto Rico, and the Caribbean, and includes eight VA medical centres and more than 50 outpatient clinics.

The network's seven healthcare systems are:

• Bay Pines VA Healthcare System
• North Florida/South Georgia Veterans Health System
• VA Caribbean Healthcare System
• James A. Haley Veterans' Hospital
• Miami VA Healthcare System
• Orlando VA Medical Center - Lake Nona
• West Palm Beach VA Healthcare System

The VA Sunshine Healthcare Network employs approximately 23,800 full-time staff and is committed to providing quality health care services to America's veterans.

VA's internal data and Office for Civil Rights letters

The Department of Veterans Affairs (VA) is bound by the Health Insurance Portability and Accountability Act (HIPAA) and must comply with its provisions regarding the disclosure of medical and other information. This includes the release of information from VA records protected by one or more confidentiality provisions in 38 CFR part 1.

In accordance with section 5701 of title 38 United States Code (U.S.C.), records and files maintained by the VA on veterans and beneficiaries, including medical records, are generally confidential. The VA may not disclose or release these materials except as provided by law. Records related to drug abuse, alcoholism, HIV infection, or sickle cell anemia are subject to special protection and may only be disclosed under specific circumstances with or without the patient's written consent.

The VA has published regulations in part 1 of 38 CFR that outline the conditions under which protected health information can be disclosed with or without patient consent. These regulations align with recent changes in statutory authority, such as the VA MISSION Act of 2018, which expanded the permissible disclosures of protected records. The VA may disclose certain protected records to non-VA entities, including private entities and other federal agencies, for purposes of providing healthcare or performing other healthcare-related activities. Additionally, the VA may disclose protected records to a third party to recover or collect reasonable charges for care furnished.

The VA's implementation of HIPAA and related regulations raises questions about how business will be conducted within the various parts of the department. The Office of General Counsel (OGC) provides advice to all organizations within the VA about their legal obligations. In March 2003, the OGC issued ADV 3-2003 (Advisory Opinion) to answer a list of questions submitted by the Veterans Benefits Administration. While OGC Advisory opinions are typically not published, this particular opinion was made public due to its relevance to the public and Veterans' Service Organizations.

The VA also follows civil rights laws that prohibit discrimination in programs and activities that receive federal funds. These include Title VI of the Civil Rights Act of 1964, Title IX of the Education Amendments of 1972, the Age Discrimination Act of 1975, and Section 504 of the Rehabilitation Act of 1973. If individuals feel they have experienced discrimination at the VA or in a VA-funded program, they can file a complaint with the external complaints program. The complaint process involves submitting a signed letter with details about the incident, including personal information, the VA location, and any relevant witnesses. The VA's external complaints program staff will then review the complaint and assign an investigator to gather more information.

Frequently asked questions