§1.460. Definitions. — Inbound Citations

For purposes of §§ 1.460 through 1.499 of this part, the following definitions apply:

(b) The provisions of §§ 1.460 through 1.499 of this part apply to records of identity, diagnosis, prognosis, or treatment pertaining to any given individual maintained over any period of time which, irrespective of when it begins, does not end before March 21, 1972, in the case of diagnosis or treatment for drug abuse; or before May 14, 1974, in the case of diagnosis or treatment for alcoholism or alcohol abuse; or before September 1, 1973, in the case of testing, diagnosis or treatment of sickle cell anemia; or before May 20, 1988, in the case of testing, diagnosis or treatment for an infection with the HIV.

(a) The patient records to which §§ 1.460 through 1.499 of this part apply may be disclosed or used only as permitted by these regulations and may not otherwise be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any Federal, State, or local authority. Any disclosure made under these regulations must be limited to that information which is necessary to carry out the purpose of the disclosure.

Under 38 U.S.C. 7332(g), any person who violates any provision of this statute or §§ 1.460 through 1.499 of this part shall be fined not more than $5,000 in the case of a first offense, and not more than $20,000 for a subsequent offense.

(a) As used in §§ 1.460 through 1.499 of this part the term “minor” means a person who has not attained the age of majority specified in the applicable State law, or if no age of majority is specified in the applicable State law, the age of eighteen years.

(a) In the case of a patient who has been adjudicated as lacking the capacity, for any reason other than insufficient age, to manage his or her own affairs, any consent which is required under §§ 1.460 through 1.499 of this part may be given by a court appointed legal guardian.

(a) Written records which are subject to §§ 1.460 through 1.499 of this part must be maintained in a secure room, locked file cabinet, safe or other similar container when not in use. Access to information stored in computers will be limited to authorized VA employees who have a need for the information in performing their duties. These security precautions shall be consistent with the Privacy Act of 1974 (5 U.S.C. 552a).

(a) There may be concurrent coverage of patient identifying information by the provisions of §§ 1.460 through 1.499 of this part and by administrative action taken under Sec. 303(a) of the Public Health Service Act (42 U.S.C. 241(d) and the implementing regulations at 42 CFR Part 2a); or Sec. 502(c) of the Controlled Substances Act (21 U.S.C. 872(c) and the implementing regulations at 21 CFR 1316.21). These “research privilege” statutes confer on the Secretary of Health and Human Services and on the Attorney General, respectively, the power to authorize researchers conducting certain types of research to withhold from all persons not connected with the research the names and other identifying information concerning individuals who are the subjects of the research.

(a) Sections 1.460 through 1.499 of this part do not prohibit a facility from giving a patient access to his or her own records, including the opportunity to inspect and copy any records that VA maintains about the patient, subject to the provisions of the Privacy Act (5 U.S.C. 552a(d)(1)) and 38 CFR 1.577. If the patient is accompanied, giving access to the patient and the accompanying person will require a written consent by the patient which is provided in accordance with § 1.475 of this part.

(a) A written consent to a disclosure under §§ 1.460 through 1.499 of this part must include:

(1) The name of the facility permitted to make the disclosure (such a designation does not preclude the release of records from other VA health care facilities unless a restriction is stated on the consent).

(6) The signature of the patient and, when required for a patient who is a minor, the signature of a person authorized to give consent under § 1.464 of this part; or, when required for a patient who is incompetent or deceased, the signature of a person authorized to sign under § 1.465 of this part in lieu of the patient.

(8) A statement that the consent is subject to revocation at any time except to the extent that the facility which is to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third party payer.

(9) The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must ensure that the consent will last no longer than reasonably necessary to serve the purpose for which it is given.

Each disclosure under §§ 1.460 through 1.499 of this part made with the patient's written consent must be accompanied by a written statement similar to the following:

(a) VA may disclose information about a patient from records covered by §§ 1.460 through 1.499 of this part to those persons within the criminal justice system which have made participation in a VA treatment program a condition of the disposition of any criminal proceedings against the patient or of the patient's parole or other release from custody if:

(1) The disclosure is made only to those individuals within the criminal justice system who have a need for the information in connection with their duty to monitor the patient's progress (e.g., a prosecuting attorney who is withholding charges against the patient, a court granting pretrial or posttrial release, probation or parole officers responsible for supervision of the patient); and

(2) The patient has signed a written consent as a condition of admission to the treatment program meeting the requirements of § 1.475 of this part (except paragraph (a)(8) which is inconsistent with the revocation provisions of paragraph (c) of this section) and the requirements of paragraphs (b) and (c) of this section.

Information covered by §§ 1.460 through 1.499 of this part may be disclosed to State Prescription Drug Monitoring Programs pursuant to the limitations set forth in § 1.515 of this part.

(a) Under the procedures required by paragraph (c) of this section, patient identifying information from records covered by §§ 1.460 through 1.499 of this part may be disclosed to medical personnel who have a need for information about a patient for the purpose of treating a condition which poses an immediate threat to the health of any individual and which requires immediate medical intervention.

A VHA health care facility may disclose the individually-identified medical record information of an individual covered by §§ 1.460 through 1.499 of this part to an authorized representative of a procurement organization for the purpose of facilitating determination of whether the individual is a suitable potential organ, eye, or tissue donor if:

Subject to the provisions of 38 U.S.C. 5701, 38 CFR 1.500-1.527, the Privacy Act (5 U.S.C. 552a), 38 CFR 1.575-1.584 and the following paragraphs, patient medical record information covered by §§ 1.460 through 1.499 of this part may be disclosed for the purpose of conducting scientific research.

Subject to the provisions of 38 U.S.C. 5701, 38 CFR 1.500-1.527, the Privacy Act (5 U.S.C. 552a), 38 CFR 1.575-1.584, and the following paragraphs, patient medical records covered by §§ 1.460 through 1.499 of this part may be disclosed outside VA for the purposes of conducting audit and evaluation activities.

The records to which §§ 1.460 through 1.499 of this part apply may be disclosed if authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefore. In assessing good cause the court is statutorily required to weigh the public interest and the need for disclosure against the injury to the patient or subject, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, is required by statute to impose appropriate safeguards against unauthorized disclosure. An order of a court of competent jurisdiction to produce records subject to §§ 1.460 through 1.499 of this part will not be sufficient unless the order reflects that the court has complied with the requirements of 38 U.S.C. 7332(b)(2)(D). Such an order from a Federal court compels disclosure. However, such an order from a State court only acts to authorize the Secretary to exercise discretion pursuant to 38 U.S.C. 5701(b)(5) and 38 CFR 1.511 to disclose such records. It does not compel disclosure.

A court order under §§ 1.460 through 1.499 of this part may not authorize qualified personnel, who have received patient identifying information from VA without consent for the purpose of conducting research, audit or evaluation, to disclose that information or use it to conduct any criminal investigation or prosecution of a patient. However, a court order under § 1.495 of this part may authorize disclosure and use of records to investigate or prosecute VA personnel.

(a) An order authorizing the disclosure of patient records covered by §§ 1.460 through 1.499 of this part for purposes other than criminal investigation or prosecution may be applied for by any person having a legally recognized interest in the disclosure which is sought. The application may be filed separately or as part of a pending civil action in which it appears that the patient records are needed to provide evidence. An application must use a fictitious name, such as John Doe, to refer to any patient and may not contain or otherwise disclose any patient identifying information unless the patient is the applicant or has given a written consent (meeting the requirements of § 1.475 of this part) to disclosure or the court has ordered the record of the proceeding sealed from public scrutiny.

(a) An order authorizing the disclosure or use of patient records covered by §§ 1.460 through 1.499 of this part to criminally investigate or prosecute a patient may be applied for by VA or by any person conducting investigative or prosecutorial activities with respect to the enforcement of criminal laws. The application may be filed separately, as part of an application for a subpoena or other compulsory process, or in a pending criminal action. An application must use a fictitious name such as John Doe, to refer to any patient and may not contain or otherwise disclose patient identifying information unless the court has ordered the record of the proceeding sealed from public scrutiny.

(1) An order authorizing the disclosure or use of patient records covered by §§ 1.460 through 1.499 of this part to criminally or administratively investigate or prosecute VA (or employees or agents of VA) may be applied for by an administrative, regulatory, supervisory, investigative, law enforcement, or prosecutorial agency having jurisdiction over VA activities.

A VHA health care facility may disclose the name and home address of an “individual” as defined in § 1.460 to an authorized representative of a “procurement organization” as also defined in § 1.460 for the purpose of facilitating a determination by the procurement organization of whether the individual is a suitable potential organ, eye, or tissue donor if:

(e) Requests for records relating to treatment for the conditions specified in 38 U.S.C. 7332, such as drug abuse, alcoholism or alcohol abuse, infection with the Human Immunodeficiency Virus (HIV), or sickle cell anemia, will be processed under the FOIA and 38 U.S.C. 7332. In addition to the following FOIA regulations, see §§ 1.460 through 1.499 of this part for regulations implementing 38 U.S.C. 7332.

VA will actively pursue medical care cost recovery in accordance with applicable law.

Confidentiality of records will be maintained in accordance with 38 CFR 1.460 through 1.582.

(a) Comply with all VA information security and privacy program policies, procedures, practices, and related contract requirements, specifications, and clauses, this includes complying with VA privacy and confidentiality laws and implementing VA and Veterans Health Administration (VHA) regulations (see 38 U.S.C. 5701, 5705, 5721-5728, and 7332; 38 CFR 1.460 through 1.496, 1.500 through 1.527, and 17.500 through 17.511), the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191), and the Privacy Act of 1974 (as amended) (5 U.S.C. 522a);