§17.511. Penalties for violations. — Inbound Citations

(d) Requests for records relating to healthcare quality assurance reviews pursuant to 38 U.S.C. 5705 will be processed under the FOIA and 38 U.S.C. 5705. In addition to the following FOIA regulations, see 38 CFR 17.500 through 17.511 for regulations implementing 38 U.S.C. 5705.

(a) Section 5705, title 38, United States Code was enacted to protect the integrity of the VA's medical quality assurance program by making confidential and privileged certain records and documents generated by this program and information contained therein. Disclosure of quality assurance records and documents made confidential and privileged by 38 U.S.C. 5705 and the regulations in §§ 17.500 through 17.511 may only be made in accordance with the provisions of 38 U.S.C. 5705 and those regulations.

(2) Focused reviews which address specific issues or incidents and which are designated by the reviewing office at the outset of the review as protected by 38 U.S.C. 5705 and the regulations in §§ 17.500 through 17.511; focused reviews may be either:

(i) Facility focused reviews;

(ii) VA Central Office or Regional focused reviews;

(a) Disclosure of quality assurance records and documents which are not confidential and privileged under 38 U.S.C. 5705 and the confidentiality regulations in §§ 17.500 through 17.511 will be governed by the provisions of the Freedom of Information Act, and, if applicable, the Privacy Act and any other VA or federal confidentiality statutes.

(a) Improper disclosure is the disclosure of confidential and privileged healthcare quality assurance review records or documents (or information contained therein), as defined in § 17.501, to any person who is not authorized access to the records or documents under the statute and the regulations in §§ 17.500 through 17.511.

(a) Disclosure of confidential and privileged quality assurance records and documents or the information contained therein outside VA, where permitted by the statute and the regulations in §§ 17.500 through 17.511, will always be by copies, abstracts, summaries, or similar records or documents prepared by the Department of Veterans Affairs and released to the requestor. The original confidential and privileged quality assurance records and documents will not be removed from the VA facility by any person, VA employee or otherwise, except in accordance with § 17.508(c) or where otherwise legally required.

The VA medical facility Director, Regional Director, Under Secretary for Health, or their designees are authorized to disclose any confidential and privileged quality assurance records or documents under their control to other agencies, organizations, or individuals where 38 U.S.C. 5705 or the regulations in §§ 17.500 through 17.511 expressly provide for disclosure.

When a request for records or documents subject to the regulations in §§ 17.500 through 17.511 is denied in whole or in part by the VA medical facility Director, Regional Director or Under Secretary for Health, the VA official denying the request in whole or in part will notify the requestor in writing of the right to appeal this decision to the General Counsel of the Department of Veterans Affairs within 60 days of the date of the denial letter. The final Department decision will be made by the General Counsel or the Deputy General Counsel.

(a) All VA employees and other individuals who have access to records designated as confidential and privileged under 38 U.S.C. 5705 and the regulations in §§ 17.500 through 17.511 will treat the findings, views, and actions relating to quality assurance in a confidential manner.

(a) Access to confidential and privileged quality assurance records and documents within the Department pursuant to this section is restricted to VA employees (including consultants and contractors of VA) who have a need for such information to perform their government duties or contractual responsibilities and who are authorized access by the VA medical facility Director, Regional Director, the Under Secretary for Health, or their designees or by the regulations in §§ 17.500 through 17.511.

(l) For any disclosure made under paragraphs (a) through (i) of this section, the name of and other identifying information regarding any individual VA patient, employee, or other individual associated with VA shall be deleted from any confidential and privileged quality assurance record or document before any disclosure under these quality assurance regulations in §§ 17.500 through 17.511 is made, if disclosure of such name and identifying information would constitute a clearly unwarranted invasion of personal privacy.

No person or entity to whom a quality assurance record or document has been disclosed under § 17.508 or § 17.509 shall make further disclosure of such record or document except as provided for in 38 U.S.C. 5705 and the regulations in §§ 17.500 through 17.511.

Any person who knows that a document or record is a confidential and privileged quality assurance document or record described in §§ 17.500 through 17.511 and willfully discloses such confidential and privileged quality assurance record or document or information contained therein, except as authorized by 38 U.S.C. 5705 or the regulations in §§ 17.500 through 17.511, shall be fined not more than $5,000 in the case of a first offense and not more than $20,000 in the case of each subsequent offense.

(a) Comply with all VA information security and privacy program policies, procedures, practices, and related contract requirements, specifications, and clauses, this includes complying with VA privacy and confidentiality laws and implementing VA and Veterans Health Administration (VHA) regulations (see 38 U.S.C. 5701, 5705, 5721-5728, and 7332; 38 CFR 1.460 through 1.496, 1.500 through 1.527, and 17.500 through 17.511), the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191), and the Privacy Act of 1974 (as amended) (5 U.S.C. 522a);