[Federal Register Volume 60, Number 239 (Wednesday, December 13, 1995)]
[Rules and Regulations]
[Pages 63926-63938]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 95-30138]



=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS

38 CFR Part 1

RIN 2900-AE28


Confidentiality of Certain Medical Records

AGENCY: Department of Veterans Affairs.


[[Page 63927]]

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This document establishes Department of Veterans Affairs (VA) 
regulations to implement specific provisions of the Veterans Omnibus 
Health Care Act of 1976 and the Veterans' Benefits and Services Act of 
1988 concerning the confidentiality of certain medical records. These 
regulations protect the confidentiality of VA records pertaining to 
drug abuse, alcoholism or alcohol abuse, infection with the human 
immunodeficiency virus (HIV), and sickle cell anemia.

EFFECTIVE DATE: January 12, 1996.

FOR FURTHER INFORMATION CONTACT: Celia Winter, Program Specialist, 
Veterans Health Administration (161F), Department of Veterans Affairs, 
810 Vermont Avenue, NW, Washington, DC 20420, (202) 273-6274.

SUPPLEMENTARY INFORMATION: On July 26, 1993, at 58 FR 39703, VA 
published a notice of proposed rulemaking (NPRM) concerning the 
confidentiality of VA records pertaining to drug abuse, alcoholism or 
alcohol abuse, infection with the human immunodeficiency virus (HIV) 
and sickle cell anemia treatment, rehabilitation, education, training, 
evaluation and research information. Interested parties were invited to 
submit written comments on or before August 25, 1993. Two comments were 
received.

Background

    VA was mandated by the Veterans Omnibus Health Care Act of 1976 and 
the Veterans' Benefits and Services Act of 1988 to publish its own 
regulations relative to the confidentiality of medical records relating 
to drug abuse, alcoholism or alcohol abuse, infection with the HIV, and 
sickle cell anemia. VA, generally, has been following the Department of 
Health and Human Services' regulations on drug and alcohol abuse which 
were published in the Federal Register, July 1, 1975. The Department of 
Health and Human Services (HHS) regulations (42 CFR Secs. 2.1-2.67) 
were promulgated with the enactment of legislation specific to alcohol 
and drug abuse programs and confidentiality of records. The regulations 
take into consideration the existing HHS regulations in implementing 
the confidentiality section of the Veterans Omnibus Health Care Act of 
1976. Editorial and substantive changes were made to the HHS 
regulations which were published in the Federal Register, June 9, 1987.
    The historical development of the regulations begins with Pub. L. 
93-282, ``Comprehensive Alcohol Abuse and Alcoholism Prevention, 
Treatment, and Rehabilitation Act Amendments of 1974,'' which provided 
that the then Administrator of Veterans Affairs, through the then Chief 
Medical Director, consistent with responsibilities under Title 38, 
United States Code, prescribe regulations applicable to the 
confidentiality of medical records maintained in connection with the 
provision of hospital care, nursing home care, domiciliary care and 
medical services under Title 38 to patients suffering from alcohol 
abuse, alcoholism, and drug abuse. In prescribing and implementing 
these regulations, the Secretary of Veterans Affairs was required to 
consult with the Secretary of HHS in order to achieve the maximum 
possible coordination of the regulations.
    Congress, recognizing that the particular problems of 
confidentiality of records in the VA health care system would best be 
handled by placing applicable provisions in Title 38, United States 
Code, added a new Sec. 4132, now Sec. 7332, to Title 38, United States 
Code, with the enactment of Pub. L. 94-581, Veterans Omnibus Health 
Care Act of 1976. The intent of this legislation was to ensure 
confidentiality of certain medical records by establishing sanctions 
for unauthorized disclosure of information, while at the same time, 
meeting the legitimate needs for disclosure under certain conditions. 
As part of this legislation, Congress imposed upon VA requirements 
similar to those of Pub. L. 93-282 noted above (38 U.S.C. Sec. 7334, 
formerly Sec. 4134).
    Section 111 of Pub. L. 94-581 replaced, for VA purposes, the 
provisions of Sections 122(a) and 303 of Pub. L. 93-282 (21 
U.S.C.Sec. 1175, for drug records; 42 U.S.C. Sec. 4582, for alcohol 
records) as the statutory base for confidentiality of drug and alcohol 
abuse records for those patients treated by VA medical facilities. 
Additionally, it replaced Section 109 of Pub. L. 93-82 (38 U.S.C. 
Sec. 1753(b), formerly Sec. 653(b)) which provided for confidentiality 
of sickle cell anemia records and required VA to promulgate 
regulations. Pub. L. 94-581, Veterans Omnibus Health Care Act of 1976, 
addressed all three subjects--drug abuse, alcoholism and sickle cell 
anemia records--in its confidentiality mandate. Section 121 of Pub. L. 
100-322 provided for the confidentiality of records relating to 
infection with the HIV. Accordingly, drug and alcohol abuse, infection 
with the HIV, and sickle cell anemia records are included in these 
regulations.
    VA has followed regulations on the confidentiality of patients' 
records related to drug and alcohol abuse as prescribed in 1975 by the 
Secretary of HHS. Certain provisions of the HHS regulations are 
inconsistent with VA requirements and these new VA regulations address 
those inconsistencies. Staff at HHS reviewed a draft of the regulations 
prior to publication and changes were made based on the comments where 
there was statutory authority for the change.
    The HHS regulations as revised in 1987 and further amended on May 
5, 1995, cover only alcohol and drug abuse information that is obtained 
by a specialized program or specific provider whose primary function is 
the provision of alcohol or drug abuse diagnosis, treatment, or 
referral for treatment. The 1987 regulations do not cover alcohol and 
drug abuse information obtained by health care facilities which provide 
alcohol and drug abuse care only as an incident to the provision of 
general medical care. The VA regulations include all records which are 
maintained in connection with the performance of any VA program or 
activity (including education, training, evaluation, treatment, 
rehabilitation or research) relating to drug abuse, alcoholism, 
infection with the HIV, or sickle cell anemia in order to provide 
greater confidentiality for patients who are provided care for these 
conditions. On May 5, 1995, HHS published a final rule in 60 FR 22296, 
amending its confidentiality regulations with regard to the definition 
of ``program.'' HHS's final rule was in direct response to the holding 
made by the Ninth Circuit in a case involving the VA, United States v. 
Eide, 875 F.2d 1429, 1438 (9th Cir. 1989). There the court held the 
VAMC's (VA medical center) general emergency room to be a ``program'' 
as defined by the HHS regulations, upon which VA's policy is based. In 
its final rule, HHS limited the definition of ``program'' to: (1) an 
individual or entity, or an identified unit within a medical care 
facility, who holds itself out as providing, and provides, alcohol or 
drug abuse diagnosis, treatment or referral for treatment, or (2) 
medical personnel or other staff in a general medical care facility, 
whose primary function is the provision of alcohol or drug abuse 
diagnosis, treatment or referral for treatment and who are identified 
as such providers. VA's final regulations DO NOT reflect the same 
regulatory language concerning the definition of a ``program'' as the 
HHS regulations due to the VA's treatment of the encompassed conditions 
as an integral part of the VA medical health care system and not a 
separate program 

[[Page 63928]]
isolated from other Department functions. VA believes, as does HHS, 
that clarification of this point is necessary to help prevent other 
courts from ruling as the Ninth Circuit did in Eide, even as to the VA 
version of these regulations. Therefore, a specific example has been 
added to Sec. 1.460(k)(2) to reflect that one-time emergency room care, 
where neither treatment or referral for treatment of the underlying 
drug or alcohol abuse condition is offered or sought, does not fall 
within the purview of these regulations. It was determined that a 
specific example was necessary to distinguish between those instances 
where an individual is brought into an emergency room for a potential 
drug overdose, receives one-time treatment and is released, from those 
instances where an individual enters an emergency room with, or 
acquires while there, the purpose of seeking treatment for his or her 
drug addiction, or VA offers treatment for such condition.

Discussion of Comments

    A total of two comments were received--one from a national medical 
specialty society and the other from a not-for-profit public interest 
law firm that specializes in legal and policy issues related to 
substance abuse and HIV/AIDS. One of the commenters suggested that the 
regulations be revised to include a requirement that patients be given 
written notice and summary of the confidentiality protections of the 
subject records by Secs. 1.460 through 1.499. This provision is 
included in the HHS regulations at 42 CFR 2.22. The HHS regulations 
provide confidentiality protections for drug or alcohol abuse 
information that is obtained by a specialized program or specific 
provider whose primary function is the provision of alcohol or drug 
abuse diagnosis, treatment, or referral for treatment. Consequently, 
the patients are easily identified at the initiation of treatment and 
can be provided the written notice and summary. The VA regulations, 
however, provide for the confidentiality of all records which are 
maintained in connection with the performance of any VA program or 
activity. Consequently, medical care may be given for drug or alcohol 
abuse, sickle cell anemia, or infection with the HIV in conjunction 
with, and after the initiation of medical care for other conditions. 
These patients are not as readily recognized as an individual who 
should be provided with the written notice and summary of the 
confidentiality protections. While VA will take efforts to notify 
patients of these provisions through notices in patient information 
handouts, handbooks, etc., it would not be possible to positively 
assure every patient will receive the notification as would be required 
if provided for in the regulations. Thus, we have not adopted this 
suggestion.
    The same commenter suggested the addition of a provision that would 
provide for limitations on court-ordered disclosure of confidential 
communications. They suggested that disclosure of confidential 
communications that a patient provides to a treatment service be 
limited to those situations where a serious crime is reported or 
threatened, or where the patient has already testified about 
confidential communications in a formal proceeding, such as is provided 
for by HHS at 42 CFR 2.63. The final regulations have been revised to 
include the suggested provision. This is consistent with 38 U.S.C. 7334 
which requires that the VA regulations follow the HHS regulations as 
far as possible. Accordingly, it has been added at Sec. 1.491. The 
provisions previously published at Sec. 1.491 and following have been 
renumbered following the newly inserted provision.
    Another commenter addressed Sec. 1.489(c) which provides for the 
release of identifiable patient records to ``congressional committees 
or subcommittees for program oversight and evaluation if such records 
pertain to any matter within the jurisdiction of such committee or 
subcommittee.'' The commenter did not understand the necessity for a 
broad based authorization for the release of individually identifiable 
patient records for program oversight and evaluation and assumed that 
Congressional committees would not have a need for individual records, 
but rather a compilation of information without patient identifiers. It 
was further stated that the standards of disclosure to Congress of 
individually identifiable patient records for these diagnoses should be 
the same as for other Federal and State entities. We do not agree with 
this suggestion. As part of their oversight responsibilities, 
Congressional committees do review individual patient treatment issues 
as well as overall program issues. In order to carry out this function, 
they need access to treatment information concerning directly affected 
individuals. These responsibilities are not shared nor are they the 
responsibility of other Federal and State entities. For these reasons, 
the provision was not revised.
    The same commenter recommended a revision of section 1.487 which 
provides for the notification of information related to infection with 
the human immunodeficiency virus to the spouse or sexual partner of a 
patient. Disclosure may be made only after the patient's physician or 
counselor, after making reasonable efforts to counsel and encourage the 
patient to provide the information to the spouse or sexual partner, 
reasonably believes that the patient will not provide the information 
and that the disclosure is necessary to protect the health of the 
spouse or sexual partner. The commenter recommended that the provision 
be refined to include a focus on risk behavior modification. No changes 
were made based on the comment. The regulation addresses the issue of 
confidentiality and the disclosure, under certain conditions, of the 
information to individuals who are at risk. The issue of risk behavior 
modification is best addressed in treatment and therapeutic 
publications, policies, guidelines, etc.
    These regulations are not intended to direct the manner in which 
substantive functions, such as research, treatment, and evaluation 
should be carried out, but rather to define the minimum requirements 
for the protection of confidentiality of patient records which must be 
satisfied in connection with the conduct of those functions in order to 
carry out the purposes of the authorizing legislation.
    An additional, clarifying change to the regulations has been made 
concerning internal non-patient investigations and healthcare 
inspections conducted by the Office of Inspector General (OIG). During 
the internal review process, a question was raised by the VA's OIG as 
to whether OIG would be prohibited access to records protected by the 
regulations in cases involving healthcare inspections or criminal 
investigations of non-patients. Because the statute prohibits access to 
such records only where the patient is the subject of an investigation, 
and because the OIG would have a need for the information in connection 
with their duties, we have included language in Sec. 1.461(c) that 
explicitly extends the exception of coverage of the regulations to 
healthcare inspections and non-patient investigations conducted by OIG. 
We have also added language clarifying that confidential information 
obtained by VA components, including OIG, who have a need for the 
information in connection with their duties, may not be redisclosed 
except in accordance with the regulations. These clarifications from 
the proposed rule merely reflect our interpretation of statutory 
authority.
    Other nonsubstantive changes have been added for purposes of 
clarity. 

[[Page 63929]]


Executive Order 12866
    This regulatory action has been reviewed by the Office of 
Management and Budget under Executive Order 12866.
Regulatory Flexibility Act
    The Secretary hereby certifies that this final rule will not have a 
significant economic impact on a substantial number of small entities 
as they are defined in the Regulatory Flexibility Act, 5 U.S.C. 600-
612. This rule will affect VA beneficiaries and will not affect small 
businesses. Therefore, pursuant to 5 U.S.C. 605(b), this final rule is 
exempt from the initial and final regulatory flexibility analyses 
requirements of Secs. 603 and 604.
The Paperwork Reduction Act
    Section 1.475 of this regulation contains an information collection 
requirement that has been approved by the Office of Management and 
Budget (OMB) in accordance with the requirements of the Paperwork 
Reduction Act and has been assigned OMB Control No. 2900-0544 
(expiration date is October 31, 1996). The Department of Veterans 
Affairs estimates that it will take an average of five minutes per 
respondent to provide the required information for the consent form and 
there will be approximately 20,640 such requests made per year.
List of Subjects in 38 CFR Part 1
    Administrative procedures, Privacy Act, Recordkeeping.

    Approved: August 24, 1995.
Jesse Brown,
Secretary of Veterans Affairs.

    In consideration of the foregoing, the Department of Veterans 
Affairs amends 38 CFR part 1, General Provisions, as follows:
PART 1--GENERAL
    1. The authority citation for part 1 is revised to read as follows:

    Authority: 38 U.S.C. 501(a), unless otherwise noted.

    2. Sections 1.460 through 1.499, an undesignated center heading, 
note, and authority citation preceding Sec. 1.460, and undesignated 
center headings preceding Secs. 1,475, 1,475 and 1,485 and 1,490 are 
added to read as follows:
Release of Information from Department of Veterans Affairs (VA) Records 
Relating to Drug Abuse, Alcoholism or Alcohol Abuse, Infection with the 
Human Immunodeficiency Virus (HIV), or Sickle Cell Anemia
Sec.
1.460  Definitions.
1.461  Applicability.
1.462  Confidentiality restrictions.
1.463  Criminal penalty for violations.
1.464  Minor patients.
1.465  Incompetent and deceased patients.
1.466  Security for records.
1.467  Restrictions on the use of identification cards and public 
signs.
1.468  Relationship to Federal statutes protecting research subjects 
against compulsory disclosure of their identity.
1.469  Patient access and restrictions on use.
1.470-1.474  [Reserved]
Disclosures With Patient's Consent

1.475  Form of written consent.
1.476  Prohibition on redisclosure.
1.477  Disclosures permitted with written consent.
1.478  Disclosures to prevent multiple enrollments in detoxification 
and maintenance treatment programs; not applicable to records 
relating to sickle cell anemia or infection with the human 
immunodeficiency virus.
1.479  Disclosures to elements of the criminal justice system which 
have referred patients.
1.480-1.484  [Reserved]
Disclosures Without Patient Consent

1.485  Medical emergencies.
1.486  Disclosure of information related to infection with the human 
immunodeficiency virus to public health authorities.
1.487  Disclosure of information related to infection with the human 
immunodeficiency virus to the spouse or sexual partner of the 
patient.
1.488  Research activities.
1.489  Audit and evaluation activities.
Court Orders Authorizing Disclosures and Use

1.490  Legal effect of order.
1.491  Confidential communications.
1.492  Order not applicable to records disclosed without consent to 
researchers, auditors and evaluators.
1.493  Procedures and criteria for orders authorizing disclosures 
for noncriminal purposes.
1.494  Procedures and criteria for orders authorizing disclosure and 
use of records to criminally investigate or prosecute patients.
1.495  Procedures and criteria for orders authorizing disclosure and 
use of records to investigate or prosecute VA or employees of VA.
1.496  Orders authorizing the use of undercover agents and 
informants to criminally investigate employees or agents of VA.
1.497-1.499  [Reserved]

Release of Information From Department of Veterans Affairs Records 
Relating to Drug Abuse, Alcoholism or Alcohol Abuse, Infection With the 
Human Immunodeficiency Virus (HIV), or Sickle Cell Anemia
    Note: Sections 1.460 through 1.499 of this part concern the 
confidentiality of information relating to drug abuse, alcoholism or 
alcohol abuse, infection with the human immunodeficiency virus, or 
sickle cell anemia in VA records and are applicable in combination 
with other regulations pertaining to the release of information from 
VA records. Sections 1.500 through 1.527, Title 38, Code of Federal 
Regulations, implement the provisions of 38 U.S.C. Secs. 5701 and 
5702. Sections 1.550 through 1.559 implement the provisions of 5 
U.S.C. Sec. 552 (The Freedom of Information Act). Sections 1.575 
through 1.584 implement the provisions of 5 U.S.C. Sec. 552a (The 
Privacy Act of 1974).
    The provisions of Secs. 1.460 through 1.499 of this part pertain 
to any program or activity, including education, treatment, 
rehabilitation or research, which relates to drug abuse, alcoholism 
or alcohol abuse, infection with the human immunodeficiency virus, 
or sickle cell anemia. The statutory authority for the drug abuse 
provisions and alcoholism or alcohol abuse provisions of Secs. 1.460 
through 1.499 is Sec. 111 of Pub. L. 94-581, the Veterans Omnibus 
Health Care Act of 1976 (38 U.S.C. Secs. 7331 through 7334), the 
authority for the human immunodeficiency virus provisions is Sec. 
121 of Pub. L. 100-322, the Veterans' Benefits and Services Act of 
1988 (38 U.S.C. Sec. 7332); the authority for the sickle cell anemia 
provisions is Sec. 109 of Pub. L. 93-82, the Veterans Health Care 
Expansion Act of 1973 (38 U.S.C. Secs. 1751-1754).
    Authority: 38 USC 1751-1754 and 7331-7334.
Sec. 1.460  Definitions.

    For purposes of Secs. 1.460 through 1.499 of this part, the 
following definitions apply:
    Alcohol abuse. The term ``alcohol abuse'' means the use of an 
alcoholic beverage which impairs the physical, mental, emotional, or 
social well-being of the user.
    Contractor. The term ``contractor'' means a person who provides 
services to VA such as data processing, dosage preparation, laboratory 
analyses or medical or other professional services. Each contractor 
shall be required to enter into a written agreement subjecting such 
contractor to the provisions of Secs. 1.460 through 1.499 of this part; 
38 U.S.C. 5701 and 7332; and 5 U.S.C. 552a and 38 CFR 1.576(g).
    Diagnosis. The term ``diagnosis'' means any reference to an 
individual's alcohol or drug abuse or to a condition which is 
identified as having been caused by that abuse or any reference to 
sickle cell anemia or infection with the human immunodeficiency virus 
which is made for the purpose of treatment or

[[Page 63930]]

referral for treatment. A diagnosis prepared for the purpose of 
treatment or referral for treatment but which is not so used is covered 
by Secs. 1.460 through 1.499 of this part. These regulations do not 
apply to a diagnosis of drug overdose or alcohol intoxication which 
clearly shows that the individual involved is not an alcohol or drug 
abuser (e.g., involuntary ingestion of alcohol or drugs or reaction to 
a prescribed dosage of one or more drugs).
    Disclose or disclosure. The term ``disclose'' or ``disclosure'' 
means a communication of patient identifying information, the 
affirmative verification of another person's communication of patient 
identifying information, or the communication of any information from 
the record of a patient who has been identified.
    Drug abuse. The term ``drug abuse'' means the use of a psychoactive 
substance for other than medicinal purposes which impairs the physical, 
mental, emotional, or social well-being of the user.
    Infection with the human immunodeficiency virus (HIV). The term 
``infection with the human immunodeficiency virus (HIV)'' means the 
presence of laboratory evidence for human immunodeficiency virus 
infection. For the purposes of Secs. 1.460 through 1.499 of this part, 
the term includes the testing of an individual for the presence of the 
virus or antibodies to the virus and information related to such 
testing (including tests with negative results).
    Informant. The term ``informant'' means an individual who is a 
patient or employee or who becomes a patient or employee at the request 
of a law enforcement agency or official and who at the request of a law 
enforcement agency or official observes one or more patients or 
employees for the purpose of reporting the information obtained to the 
law enforcement agency or official.
    Patient. The term ``patient'' means any individual or subject who 
has applied for or been given a diagnosis or treatment for drug abuse, 
alcoholism or alcohol abuse, infection with the human immunodeficiency 
virus, or sickle cell anemia and includes any individual who, after 
arrest on a criminal charge, is interviewed and/or tested in connection 
with drug abuse, alcoholism or alcohol abuse, infection with the human 
immunodeficiency virus, or sickle cell anemia in order to determine 
that individual's eligibility to participate in a treatment or 
rehabilitation program. The term patient includes an individual who has 
been diagnosed or treated for alcoholism, drug abuse, HIV infection, or 
sickle cell anemia for purposes of participation in a VA program or 
activity relating to those four conditions, including a program or 
activity consisting of treatment, rehabilitation, education, training, 
evaluation, or research. The term ``patient'' for the purpose of 
infection with the human immunodeficiency virus or sickle cell anemia, 
includes one tested for the disease.
    Patient identifying information. The term ``patient identifying 
information'' means the name, address, social security number, 
fingerprints, photograph, or similar information by which the identity 
of a patient can be determined with reasonable accuracy and speed 
either directly or by reference to other publicly available 
information. The term does not include a number assigned to a patient 
by a treatment program, if that number does not consist of, or contain 
numbers (such as social security, or driver's license number) which 
could be used to identify a patient with reasonable accuracy and speed 
from sources external to the treatment program.
    Person. The term ``person'' means an individual, partnership, 
corporation, Federal, State or local government agency, or any other 
legal entity.
    Records. The term ``records'' means any information received, 
obtained or maintained, whether recorded or not, by an employee or 
contractor of VA, for the purpose of seeking or performing VA program 
or activity functions relating to drug abuse, alcoholism, tests for or 
infection with the human immunodeficiency virus, or sickle cell anemia 
regarding an identifiable patient. A program or activity function 
relating to drug abuse, alcoholism, infection with the human 
immunodeficiency virus, or sickle cell anemia includes evaluation, 
treatment, education, training, rehabilitation, research, or referral 
for one of these conditions. Sections 1.460 through 1.499 of this part 
apply to a primary or other diagnosis, or other information which 
identifies, or could reasonably be expected to identify, a patient as 
having a drug or alcohol abuse condition, infection with the human 
immunodeficiency virus, or sickle cell anemia (e.g., alcoholic 
psychosis, drug dependence), but only if such diagnosis or information 
is received, obtained or maintained for the purpose of seeking or 
performing one of the above program or activity functions. Sections 
1.460 through 1.499 of this part do not apply if such diagnosis or 
other information is not received, obtained or maintained for the 
purpose of seeking or performing a function or activity relating to 
drug abuse, alcoholism, infection with the human immunodeficiency 
virus, or sickle cell anemia for the patient in question. Whenever such 
diagnosis or other information, not originally received or obtained for 
the purpose of obtaining or providing one of the above program or 
activity functions, is subsequently used in connection with such 
program or activity functions, those original entries become a 
``record'' and Secs. 1.460 through 1.499 of this part thereafter apply 
to those entries. Segregability: these regulations do not apply to 
records or information contained therein, the disclosure of which (the 
circumstances surrounding the disclosure having been considered) could 
not reasonably be expected to disclose the fact that a patient has been 
connected with a VA program or activity function relating to drug 
abuse, alcoholism, infection with the human immunodeficiency virus, or 
sickle cell anemia.
    (1) The following are examples of instances whereby records or 
information related to alcoholism or drug abuse are covered by the 
provisions of Secs. 1.460 through 1.499 of this part:
    (i) A patient with alcoholic delirium tremens is admitted for 
detoxification. The patient is offered treatment in a VA alcohol 
rehabilitation program which he declines.
    (ii) A patient who is diagnosed as a drug abuser applies for and is 
provided VA drug rehabilitation treatment.
    (iii) While undergoing treatment for an unrelated medical 
condition, a patient discusses with the physician his use and abuse of 
alcohol. The physician offers VA alcohol rehabilitation treatment which 
is declined by the patient.
    (2) The following are examples of instances whereby records or 
information related to alcoholism or drug abuse are not covered by the 
provisions of Secs. 1.460 through 1.499 of this part:
    (i) A patient with alcoholic delirium tremens is admitted for 
detoxification, treated and released with no counseling or treatment 
for the underlying condition of alcoholism.
    (ii) While undergoing treatment for an unrelated medical condition, 
a patient informs the physician of a history of drug abuse fifteen 
years earlier with no ingestion of drugs since. The history and 
diagnosis of drug abuse is documented in the hospital summary and no 
treatment is sought by the patient or offered or provided by VA during 
the current period of treatment.
    (iii) While undergoing treatment for injuries sustained in an 
accident, a patient's medical record is documented 

[[Page 63931]]
to support the judgment of the physician to prescribe certain alternate 
medications in order to avoid possible drug interactions in view of the 
patient's enrollment and treatment in a non-VA methadone maintenance 
program. The patient states that continued treatment and follow-up will 
be obtained from private physicians and VA treatment for the drug abuse 
is not sought by the patient nor provided or offered by the staff.
    (iv) A patient is admitted to the emergency room suffering from a 
possible drug overdose. The patient is treated and released; a history 
and diagnosis of drug abuse may be documented in the hospital summary. 
The patient is not offered treatment for the underlying conditions of 
drug abuse, nor is treatment sought by the patient for that condition.
    Third party payer. The term ``third party payer'' means a person 
who pays, or agrees to pay, for diagnosis or treatment furnished to a 
patient on the basis of a contractual relationship with the patient or 
a member of his or her family or on the basis of the patient's 
eligibility for Federal, State, or local governmental benefits.
    Treatment. The term ``treatment'' means the management and care of 
a patient for drug abuse, alcoholism or alcohol abuse, infection with 
the human immunodeficiency virus, or sickle cell anemia, or a condition 
which is identified as having been caused by one or more of these 
conditions, in order to reduce or eliminate the adverse effects upon 
the patient. The term includes testing for the human immunodeficiency 
virus or sickle cell anemia.
    Undercover agent. The term ``undercover agent'' means an officer of 
any Federal, State, or local law enforcement agency who becomes a 
patient or employee for the purpose of investigating a suspected 
violation of law or who pursues that purpose after becoming a patient 
or becoming employed for other purposes.

(Authority: 38 U.S.C. 7334)


Sec. 1.461  Applicability.

    (a) General.
    (1) Restrictions on disclosure. The restrictions on disclosure in 
these regulations apply to any information whether or not recorded, 
which:
    (i) Would identify a patient as an alcohol or drug abuser, an 
individual tested for or infected with the human immunodeficiency virus 
(HIV), hereafter referred to as HIV, or an individual with sickle cell 
anemia, either directly, by reference to other publicly available 
information, or through verification of such an identification by 
another person; and
    (ii) Is provided or obtained for the purpose of treating alcohol or 
drug abuse, infection with the HIV, or sickle cell anemia, making a 
diagnosis for that treatment, or making a referral for that treatment 
as well as for education, training, evaluation, rehabilitation and 
research program or activity purposes.
    (2) Restriction on use. The restriction on use of information to 
initiate or substantiate any criminal charges against a patient or to 
conduct any criminal investigation of a patient applies to any 
information, whether or not recorded, which is maintained for the 
purpose of treating drug abuse, alcoholism or alcohol abuse, infection 
with the HIV, or sickle cell anemia, making a diagnosis for that 
treatment, or making a referral for that treatment as well as for 
education, training, evaluation, rehabilitation, and research program 
or activity purposes.
    (b) Period covered as affecting applicability. The provisions of 
Secs. 1.460 through 1.499 of this part apply to records of identity, 
diagnosis, prognosis, or treatment pertaining to any given individual 
maintained over any period of time which, irrespective of when it 
begins, does not end before March 21, 1972, in the case of diagnosis or 
treatment for drug abuse; or before May 14, 1974, in the case of 
diagnosis or treatment for alcoholism or alcohol abuse; or before 
September 1, 1973, in the case of testing, diagnosis or treatment of 
sickle cell anemia; or before May 20, 1988, in the case of testing, 
diagnosis or treatment for an infection with the HIV.
    (c) Exceptions.
    (1) Department of Veterans Affairs and Armed Forces. The 
restrictions on disclosure in Secs. 1.460 through 1.499 of this part do 
not apply to communications of information between or among those 
components of VA who have a need for the information in connection with 
their duties in the provision of health care, adjudication of benefits, 
or in carrying out administrative responsibilities related to those 
functions, including personnel of the Office of the Inspector General 
who are conducting audits, evaluations, healthcare inspections, or non-
patient investigations, or between such components and the Armed 
Forces, of information pertaining to a person relating to a period when 
such person is or was subject to the Uniform Code of Military Justice. 
Information obtained by VA components under these circumstances may be 
disclosed outside of VA to prosecute or investigate a non-patient only 
in accordance with Sec. 1.495 of this part. Similarly, the restrictions 
on disclosure in Secs. 1.460 through 1.499 of this part do not apply to 
communications of information to the Department of Justice or U.S. 
Attorneys who are providing support in civil litigation or possible 
litigation involving VA.
    (2) Contractor. The restrictions on disclosure in Secs. 1.460 
through 1.499 of this part do not apply to communications between VA 
and a contractor of information needed by the contractor to provide his 
or her services.
    (3) Crimes on VA premises or against VA personnel. The restrictions 
on disclosure and use in Secs. 1.460 through 1.499 of this part do not 
apply to communications from VA personnel to law enforcement officers 
which:
    (i) Are directly related to a patient's commission of a crime on 
the premises of the facility or against personnel of VA or to a threat 
to commit such a crime; and
    (ii) Are limited to the circumstances of the incident, including 
the patient status of the individual committing or threatening to 
commit the crime, that individual's name and address to the extent 
authorized by 38 U.S.C. 5701(f)(2), and that individual's last known 
whereabouts.
    (4) Undercover agents and informants.
    (i) Except as specifically authorized by a court order granted 
under Sec. 1.495 of this part, VA may not knowingly employ, or admit as 
a patient, any undercover agent or informant in any VA drug abuse, 
alcoholism or alcohol abuse, HIV infection, or sickle cell anemia 
treatment program.
    (ii) No information obtained by an undercover agent or informant, 
whether or not that undercover agent or informant is placed in a VA 
drug abuse, alcoholism or alcohol abuse, HIV infection, or sickle cell 
anemia treatment program pursuant to an authorizing court order, may be 
used to criminally investigate or prosecute any patient unless 
authorized pursuant to the provisions of Sec. 1.494 of this part.
    (iii) The enrollment of an undercover agent or informant in a 
treatment unit shall not be deemed a violation of this section if the 
enrollment is solely for the purpose of enabling the individual to 
obtain treatment for drug or alcohol abuse, HIV infection, or sickle 
cell anemia.
    (d) Applicability to recipients of information.
    (1) Restriction on use of information. In the absence of a proper 
Sec. 1.494 court order, the restriction on the use of any information 
subject to Secs. 1.460 through 1.499 of this part to initiate or 

[[Page 63932]]
substantiate any criminal charges against a patient or to conduct any 
criminal investigation of a patient applies to any person who obtains 
that information from VA, regardless of the status of the person 
obtaining the information or of whether the information was obtained in 
accordance with Secs. 1.460 through 1.499 of this part. This 
restriction on use bars, among other things, the introduction of that 
information as evidence in a criminal proceeding and any other use of 
the information to investigate or prosecute a patient with respect to a 
suspected crime. Information obtained by undercover agents or 
informants (see paragraph (c) of this section) or through patient 
access (see Sec. 1.469 of this part) is subject to the restriction on 
use.
    (2) Restrictions on disclosures--third-party payers and others. The 
restrictions on disclosure in Secs. 1.460 through 1.499 of this part 
apply to third-party payers and persons who, pursuant to a consent, 
receive patient records directly from VA and who are notified of the 
restrictions on redisclosure of the records in accordance with 
Sec. 1.476 of this part.

(Authority: 38 U.S.C. 7332(e) and 7334)


Sec. 1.462  Confidentiality restrictions.

    (a) General. The patient records to which Secs. 1.460 through 1.499 
of this part apply may be disclosed or used only as permitted by these 
regulations and may not otherwise be disclosed or used in any civil, 
criminal, administrative, or legislative proceedings conducted by any 
Federal, State, or local authority. Any disclosure made under these 
regulations must be limited to that information which is necessary to 
carry out the purpose of the disclosure.
    (b) Unconditional compliance required. The restrictions on 
disclosure and use in Secs. 1.460 through 1.499 of this part apply 
whether the person seeking the information already has it, has other 
means of obtaining it, is a law enforcement or other official, has 
obtained a subpoena, or asserts any other justification for a 
disclosure or use which is not permitted by Secs. 1.460 through 1.499 
of this part. These provisions do not prohibit VA from acting 
accordingly when there is no disclosure of information.
    (c) Acknowledging the presence of patients: responding to requests.
    (1) The presence of an identified patient in a VA facility for the 
treatment or other VA program activity relating to drug abuse, 
alcoholism or alcohol abuse, infection with the HIV, or sickle cell 
anemia may be acknowledged only if the patient's written consent is 
obtained in accordance with Sec. 1.475 of this part or if an 
authorizing court order is entered in accordance with Secs. 1.490 
through 1.499 of this part. Acknowledgment of the presence of an 
identified patient in a facility is permitted if the acknowledgment 
does not reveal that the patient is being treated for or is otherwise 
involved in a VA program or activity concerning drug abuse, alcoholism 
or alcohol abuse, infection with the HIV, or sickle cell anemia.
    (2) Any answer to a request for a disclosure of patient records 
which is not permissible under Secs. 1.460 through 1.499 of this part 
must be made in a way that will not affirmatively reveal that an 
identified individual has been, or is being diagnosed or treated for 
drug abuse, alcoholism or alcohol abuse, infection with the HIV, or 
sickle cell anemia. These regulations do not restrict a disclosure that 
an identified individual is not and never has been a patient.

(Authority: 38 U.S.C. 7334)


Sec. 1.463  Criminal penalty for violations.

    Under 38 U.S.C. 7332(g), any person who violates any provision of 
this statute or Secs. 1.460 through 1.499 of this part shall be fined 
not more than $5,000 in the case of a first offense, and not more than 
$20,000 for a subsequent offense.

(Authority: 38 U.S.C. 7332(g))


Sec. 1.464  Minor patients.

    (a) Definition of minor. As used in Secs. 1.460 through 1.499 of 
this part the term ``minor'' means a person who has not attained the 
age of majority specified in the applicable State law, or if no age of 
majority is specified in the applicable State law, the age of eighteen 
years.
    (b) State law not requiring parental consent to treatment. If a 
minor patient acting alone has the legal capacity under the applicable 
State law to apply for and obtain treatment for drug abuse, alcoholism 
or alcohol abuse, infection with the HIV, or sickle cell anemia, any 
written consent for disclosure authorized under Sec. 1.475 of this part 
may be given only by the minor patient. This restriction includes, but 
is not limited to, any disclosure of patient identifying information to 
the parent or guardian of a minor patient for the purpose of obtaining 
financial reimbursement. Sections 1.460 through 1.499 of this part do 
not prohibit a VA facility from refusing to provide nonemergent 
treatment to an otherwise ineligible minor patient until the minor 
patient consents to the disclosure necessary to obtain reimbursement 
for services from a third party payer.
    (c) State law requiring parental consent to treatment.
    (1) Where State law requires consent of a parent, guardian, or 
other person for a minor to obtain treatment for drug abuse, alcoholism 
or alcohol abuse, infection with the HIV, or sickle cell anemia, any 
written consent for disclosure authorized under Sec. 1.475 of this part 
must be given by both the minor and his or her parent, guardian, or 
other person authorized under State law to act in the minor's behalf.
    (2) Where State law requires parental consent to treatment, the 
fact of a minor's application for treatment may be communicated to the 
minor's parent, guardian, or other person authorized under State law to 
act in the minor's behalf only if:
    (i) The minor has given written consent to the disclosure in 
accordance with Sec. 1.475 of this part; or
    (ii) The minor lacks the capacity to make a rational choice 
regarding such consent as judged by the appropriate VA facility 
director under paragraph (d) of this section.
    (d) Minor applicant for service lacks capacity for rational choice. 
Facts relevant to reducing a threat to the life or physical well being 
of the applicant or any other individual may be disclosed to the 
parent, guardian, or other person authorized under State law to act in 
the minor's behalf if the appropriate VA facility director judges that:
    (1) A minor applicant for services lacks capacity because of 
extreme youth or mental or physical condition to make a rational 
decision on whether to consent to a disclosure under Sec. 1.475 of this 
part to his or her parent, guardian, or other person authorized under 
State law to act in the minor's behalf, and
    (2) The applicant's situation poses a substantial threat to the 
life or physical well-being of the applicant or any other individual 
which may be reduced by communicating relevant facts to the minor's 
parent, guardian, or other person authorized under State law to act in 
the minor's behalf.

(Authority: 38 U.S.C. 7334)


Sec. 1.465  Incompetent and deceased patients.

    (a) Incompetent patients other than minors. In the case of a 
patient who has been adjudicated as lacking the capacity, for any 
reason other than insufficient age, to manage his or her own affairs, 
any consent which is required under Secs. 1.460 through 1.499 of this 
part may be given by a court appointed legal guardian. 

[[Page 63933]]

    (b) Deceased patients.
    (1) Vital statistics. Sec. 1.460 through 1.499 of this part do not 
restrict the disclosure of patient identifying information relating to 
the cause of death of a patient under laws requiring the collection of 
death or other vital statistics or permitting inquiry into the cause of 
death.
    (2) Consent by personal representative. Any other disclosure of 
information identifying a deceased patient as being treated for drug 
abuse, alcoholism or alcohol abuse, infection with the HIV, or sickle 
cell anemia is subject to Secs. 1.460 through 1.499 of this part. If a 
written consent to the disclosure is required, the Under Secretary for 
Health or designee may, upon the prior written request of the next of 
kin, executor/executrix, administrator/administratrix, or other 
personal representative of such deceased patient, disclose the contents 
of such records, only if the Under Secretary for Health or designee 
determines such disclosure is necessary to obtain survivorship benefits 
for the deceased patient's survivor. This would include not only VA 
benefits, but also payments by the Social Security Administration, 
Worker's Compensation Boards or Commissions, or other Federal, State, 
or local government agencies, or nongovernment entities, such as life 
insurance companies.
    (3) Information related to sickle cell anemia. Information related 
to sickle cell anemia may be released to a blood relative of a deceased 
veteran for medical follow-up or family planning purposes.

(Authority: 38 U.S.C. 7332(b)(3))


Sec. 1.466  Security for records.

    (a) Written records which are subject to Secs. 1.460 through 1.499 
of this part must be maintained in a secure room, locked file cabinet, 
safe or other similar container when not in use. Access to information 
stored in computers will be limited to authorized VA employees who have 
a need for the information in performing their duties. These security 
precautions shall be consistent with the Privacy Act of 1974 (5 U.S.C. 
552a).
    (b) Each VA facility shall adopt in writing procedures related to 
the access to and use of records which are subject to Secs. 1.460 
through 1.499 of this part.

(Authority: 38 U.S.C. 7334)


Sec. 1.467  Restrictions on the use of identification cards and public 
signs.

    (a) No facility may require any patient to carry on their person 
while away from the facility premises any card or other object which 
would identify the patient as a participant in any VA drug abuse, 
alcoholism or alcohol abuse, HIV infection, or sickle cell anemia 
treatment program. A facility may require patients to use or carry 
cards or other identification objects on the premises of a facility. 
Patients may not be required to wear clothing or colored identification 
bracelets or display objects openly to all facility staff or others 
which would identify them as being treated for drug or alcohol abuse, 
HIV infection, or sickle cell anemia.
    (b) Treatment locations should not be identified by signs that 
would identify individuals entering or exiting these locations as 
patients enrolled in a drug or alcohol abuse, HIV infection, or sickle 
cell anemia program or activity.

(Authority: 38 U.S.C. 7334)


Sec. 1.468  Relationship to Federal statutes protecting research 
subjects against compulsory disclosure of their identity.

    (a) Research privilege description. There may be concurrent 
coverage of patient identifying information by the provisions of 
Secs. 1.460 through 1.499 of this part and by administrative action 
taken under Sec. 303(a) of the Public Health Service Act (42 U.S.C. 
241(d) and the implementing regulations at 42 CFR Part 2a); or Sec. 
502(c) of the Controlled Substances Act (21 U.S.C. 872(c) and the 
implementing regulations at 21 CFR 1316.21). These ``research 
privilege'' statutes confer on the Secretary of Health and Human 
Services and on the Attorney General, respectively, the power to 
authorize researchers conducting certain types of research to withhold 
from all persons not connected with the research the names and other 
identifying information concerning individuals who are the subjects of 
the research.
    (b) Effect of concurrent coverage. Sections 1.460 through 1.499 of 
this part restrict the disclosure and use of information about 
patients, while administrative action taken under the research 
privilege statutes and implementing regulations protects a person 
engaged in applicable research from being compelled to disclose any 
identifying characteristics of the individuals who are the subjects of 
that research. The issuance under Secs. 1.490 through 1.499 of this 
part of a court order authorizing a disclosure of information about a 
patient does not affect an exercise of authority under these research 
privilege statutes. However, the research privilege granted under 21 
CFR 291.505(g) to treatment programs using methadone for maintenance 
treatment does not protect from compulsory disclosure any information 
which is permitted to be disclosed under those regulations. Thus, if a 
court order entered in accordance with Secs. 1.490 through 1.499 of 
this part authorizes a VA facility to disclose certain information 
about its patients, the facility may not invoke the research privilege 
under 21 CFR 291.505(g) as a defense to a subpoena for that 
information.

(Authority: 38 U.S.C. 7334)


Sec. 1.469  Patient access and restrictions on use.

    (a) Patient access not prohibited. Sections 1.460 through 1.499 of 
this part do not prohibit a facility from giving a patient access to 
his or her own records, including the opportunity to inspect and copy 
any records that VA maintains about the patient, subject to the 
provisions of the Privacy Act (5 U.S.C. 552a(d)(1)) and 38 CFR 1.577. 
If the patient is accompanied, giving access to the patient and the 
accompanying person will require a written consent by the patient which 
is provided in accordance with Sec. 1.475 of this part.
    (b) Restrictions on use of information. Information obtained by 
patient access to patient record is subject to the restriction on use 
of this information to initiate or substantiate any criminal charges 
against the patient or to conduct any criminal investigation of the 
patient as provided for under Sec. 1.461(d)(1) of this part.

(Authority: 38 U.S.C. 7334)


Secs. 1.470-1.474  [Reserved]

Disclosures With Patient's Consent


Sec. 1.475  Form of written consent.

    (a) Required elements. A written consent to a disclosure under 
Secs. 1.460 through 1.499 of this part must include:
    (1) The name of the facility permitted to make the disclosure (such 
a designation does not preclude the release of records from other VA 
health care facilities unless a restriction is stated on the consent).
    (2) The name or title of the individual or the name of the 
organization to which disclosure is to be made.
    (3) The name of the patient.
    (4) The purpose of the disclosure.
    (5) How much and what kind of information is to be disclosed.
    (6) The signature of the patient and, when required for a patient 
who is a minor, the signature of a person authorized to give consent 
under Sec. 1.464 of this part; or, when required for a patient who is 
incompetent or deceased, the signature of a person authorized to sign 
under Sec. 1.465 of this part in lieu of the patient.
    (7) The date on which the consent is signed. 
    
[[Page 63934]]

    (8) A statement that the consent is subject to revocation at any 
time except to the extent that the facility which is to make the 
disclosure has already acted in reliance on it. Acting in reliance 
includes the provision of treatment services in reliance on a valid 
consent to disclose information to a third party payer.
    (9) The date, event, or condition upon which the consent will 
expire if not revoked before. This date, event, or condition must 
ensure that the consent will last no longer than reasonably necessary 
to serve the purpose for which it is given.
    (b) Expired, deficient, or false consent. A disclosure may not be 
made on the basis of a consent which:
    (1) Has expired;
    (2) On its face substantially fails to conform to any of the 
requirements set forth in paragraph (a) of this section;
    (3) Is known to have been revoked; or
    (4) Is known, or through a reasonable effort could be known, by 
responsible personnel of VA to be materially false.
    (c) Notification of deficient consent. Other than the patient, no 
person or entity may be advised that a special consent is required in 
order to disclose information relating to an individual participating 
in a drug abuse, alcoholism or alcohol abuse, HIV, or sickle cell 
anemia program or activity. Where a person or entity presents VA with 
an insufficient written consent for information protected by 38 U.S.C. 
7332, VA must, in the process of obtaining a legally sufficient 
consent, correspond only with the patient whose records are involved, 
or the legal guardian of an incompetent patient or next of kin of a 
deceased patient, and not with any other person.
    (d) It is not necessary to use any particular form to establish a 
consent referred to in paragraph (a) of this section, however, VA Form 
10-5345, titled Request for and Consent to Release of Medical Records 
Protected by 38 U.S.C. 7332, may be used for such purpose.

(Authority: 38 U.S.C. 7332(a)(2) and (b)(1))


Sec. 1.476  Prohibition on redisclosure.

    Each disclosure under Secs. 1.460 through 1.499 of this part made 
with the patient's written consent must be accompanied by a written 
statement similar to the following:

    This information has been disclosed to you from records 
protected by Federal confidentiality rules (38 CFR Part 1). The 
Federal rules prohibit you from making any further disclosure of 
this information unless further disclosure is expressly permitted by 
the written consent of the person to whom it pertains or as 
otherwise permitted by 38 CFR Part 1. A general authorization for 
the release of medical or other information is NOT sufficient for 
this purpose. The Federal rules restrict any use of the information 
to criminally investigate or prosecute any alcohol or drug abuse 
patient or patient with sickle cell anemia or HIV infection.

(Authority: 38 U.S.C. 7334)


Sec. 1.477  Disclosures permitted with written consent.

    If a patient consents to a disclosure of his or her records under 
Sec. 1.475 of this part, a facility may disclose those records in 
accordance with that consent to any individual or organization named in 
the consent, except that disclosures to central registries and in 
connection with criminal justice referrals must meet the requirements 
of Secs. 1.478 and 1.479 of this part, respectively.

(Authority: 38 U.S.C. 7332(b)(1))


Sec. 1.478  Disclosures to prevent multiple enrollments in 
detoxification and maintenance treatment programs; not applicable to 
records relating to sickle cell anemia or infection with the HIV.

    (a) Definitions.
    For purposes of this section:
    (1) Central registry means an organization which obtains from two 
or more member programs patient identifying information about 
individuals applying for maintenance treatment or detoxification 
treatment for the purpose of avoiding an individual's concurrent 
enrollment in more than one program.
    (2) Detoxification treatment means the dispensing of a narcotic 
drug in decreasing doses to an individual in order to reduce or 
eliminate adverse physiological or psychological effects incident to 
withdrawal from the sustained use of a narcotic drug.
    (3) Maintenance treatment means the dispensing of a narcotic drug 
in the treatment of an individual for dependence upon heroin or other 
morphine-like drugs.
    (4) Member program means a non-VA detoxification treatment or 
maintenance treatment program which reports patient identifying 
information to a central registry and which is in the same State as 
that central registry or is not more than 125 miles from any border of 
the State in which the central registry is located.
    (b) Restrictions on disclosure. VA may disclose patient records to 
a central registry which is located in the same State or is not more 
than 125 miles from any border of the State or to any non-VA 
detoxification or maintenance treatment program not more than 200 miles 
away for the purpose of preventing the multiple enrollment of a patient 
only if:
    (1) The disclosure is made when:
    (i) The patient is accepted for treatment;
    (ii) The type or dosage of the drug is changed; or
    (iii) The treatment is interrupted, resumed or terminated.
    (2) The disclosure is limited to:
    (i) Patient identifying information;
    (ii) Type and dosage of the drug; and
    (iii) Relevant dates.
    (3) The disclosure is made with the patient's written consent 
meeting the requirements of Sec. 1.475 of this part, except that:
    (i) The consent must list the name and address of each central 
registry and each known non-VA detoxification or maintenance treatment 
program to which a disclosure will be made; and
    (ii) The consent may authorize a disclosure to any non-VA 
detoxification or maintenance treatment program established within 200 
miles after the consent is given without naming any such program.
    (c) Use of information limited to prevention of multiple 
enrollments. A central registry and any non-VA detoxification or 
maintenance treatment program to which information is disclosed to 
prevent multiple enrollments may not redisclose or use patient 
identifying information for any purpose other than the prevention of 
multiple enrollments unless authorized by a court order under 
Secs. 1.490 through 1.499 of this part.

(Authority: 38 U.S.C. 7334)


Sec. 1.479  Disclosures to elements of the criminal justice system 
which have referred patients.

    (a) VA may disclose information about a patient from records 
covered by Secs. 1.460 through 1.499 of this part to those persons 
within the criminal justice system which have made participation in a 
VA treatment program a condition of the disposition of any criminal 
proceedings against the patient or of the patient's parole or other 
release from custody if:
    (1) The disclosure is made only to those individuals within the 
criminal justice system who have a need for the information in 
connection with their duty to monitor the patient's progress (e.g., a 
prosecuting attorney who is withholding charges against the patient, a 
court granting pretrial or posttrial release, probation or parole 
officers responsible for supervision of the patient); and
    (2) The patient has signed a written consent as a condition of 
admission to the treatment program meeting the requirements of 
Sec. 1.475 of this part (except paragraph (a)(8) which is 

[[Page 63935]]
inconsistent with the revocation provisions of paragraph (c) of this 
section) and the requirements of paragraphs (b) and (c) of this 
section.
    (b) Duration of consent. The written consent must state the period 
during which it remains in effect. This period must be reasonable, 
taking into account:
    (1) The anticipated length of the treatment recognizing that 
revocation of consent may not generally be effected while treatment is 
ongoing;
    (2) The type of criminal proceeding involved, the need for the 
information in connection with the final disposition of that 
proceeding, and when the final disposition will occur; and
    (3) Such other factors as the facility, the patient, and the 
person(s) who will receive the disclosure consider pertinent.
    (c) Revocation of consent. The written consent must state that it 
is revocable upon the passage of a specified amount of time or the 
occurrence of a specified, ascertainable event. The time or occurrence 
upon which consent becomes revocable may be no earlier than the 
individual's completion of the treatment program and no later than the 
final disposition of the conditional release or other action in 
connection with which consent was given.
    (d) Restrictions on redisclosure and use. A person who receives 
patient information under this section may redisclose and use it only 
to carry out that person's official duties with regard to the patient's 
conditional release or other action in connection with which the 
consent was given, including parole.

(Authority: 38 U.S.C. 7334)


Secs. 1.480-1.484  [Reserved]

Disclosures Without Patient Consent


Sec. 1.485  Medical emergencies.

    (a) General rule. Under the procedures required by paragraph (c) of 
this section, patient identifying information from records covered by 
Secs. 1.460 through 1.499 of this part may be disclosed to medical 
personnel who have a need for information about a patient for the 
purpose of treating a condition which poses an immediate threat to the 
health of any individual and which requires immediate medical 
intervention.
    (b) Special rule. Patient identifying information may be disclosed 
to medical personnel of the Food and Drug Administration (FDA) who 
assert a reason to believe that the health of any individual may be 
threatened by an error in the manufacture, labeling, or sale of a 
product under FDA jurisdiction, and that the information will be used 
for the exclusive purpose of notifying patients or their physicians of 
potential dangers.
    (c) Procedures. Immediately following disclosure, any VA employee 
making an oral disclosure under authority of this section shall make an 
accounting of the disclosure in accordance with the Privacy Act (5 
U.S.C. 552a(c) and 38 CFR 1.576(c)) and document the disclosure in the 
patient's records setting forth in writing:
    (1) The name and address of the medical personnel to whom 
disclosure was made and their affiliation with any health care 
facility;
    (2) The name of the individual making the disclosure;
    (3) The date and time of the disclosure;
    (4) The nature of the emergency (or error, if the report was to 
FDA);
    (5) The information disclosed; and
    (6) The authority for making the disclosure (Sec. 1.485 of this 
part).

(Authority: 38 U.S.C. 7332(b)(2)(A))


Sec. 1.486  Disclosure of information related to infection with the 
human immunodeficiency virus to public health authorities.

    (a) In the case of any record which is maintained in connection 
with the performance of any program or activity relating to infection 
with the HIV, information may be disclosed to a Federal, State, or 
local public health authority, charged under Federal or State law with 
the protection of the public health, and to which Federal or State law 
requires disclosure of such record, if a qualified representative of 
such authority has made a written request that such record be provided 
as required pursuant to such law for a purpose authorized by such law. 
In the case of a State law, such law must, in order for VA to be able 
to release patient name and address information in accordance with 38 
U.S.C. 5701(f)(2), provide for a penalty or fine or other sanction to 
be assessed against those individuals who are subject to the 
jurisdiction of the public health authority but fail to comply with the 
reporting requirements.
    (b) A person to whom a record is disclosed under this section may 
not redisclose or use such record for a purpose other than that for 
which the disclosure was made.

(Authority: 38 U.S.C. 7332(b)(2)(C))


Sec. 1.487  Disclosure of information related to infection with the 
human immunodeficiency virus to the spouse or sexual partner of the 
patient.

    (a) Subject to paragraph (b) of this section, a physician or a 
professional counselor may disclose information or records indicating 
that a patient is infected with the HIV if the disclosure is made to 
the spouse of the patient, or to an individual whom the patient has, 
during the process of professional counseling or of testing to 
determine whether the patient is infected with such virus, identified 
as being a sexual partner of such patient.
    (b) A disclosure under this section may be made only if the 
physician or counselor, after making reasonable efforts to counsel and 
encourage the patient to provide the information to the spouse or 
sexual partner, reasonably believes that the patient will not provide 
the information to the spouse or sexual partner and that the disclosure 
is necessary to protect the health of the spouse or sexual partner.
    (c) A disclosure under this section may be made by a physician or 
counselor other than the physician or counselor referred to in 
paragraph (b) of this section if such physician or counselor is 
unavailable by reason of extended absence or termination of employment 
to make the disclosure.

(Authority: 38 U.S.C. 7332(b))


Sec. 1.488  Research activities.

    Subject to the provisions of 38 U.S.C. 5701, 38 CFR 1.500-1.527, 
the Privacy Act (5 U.S.C. 552a), 38 CFR 1.575-1.584 and the following 
paragraphs, patient medical record information covered by Secs. 1.460 
through 1.499 of this part may be disclosed for the purpose of 
conducting scientific research.
    (a) Information in individually identifiable form may be disclosed 
from records covered by Secs. 1.460 through 1.499 of this part for the 
purpose of conducting scientific research if the Under Secretary for 
Health or designee makes a determination that the recipient of the 
patient identifying information:
    (1) Is qualified to conduct the research.
    (2) Has a research protocol under which the information:
    (i) Will be maintained in accordance with the security requirements 
of Sec. 1.466 of this part (or more stringent requirements); and
    (ii) Will not be redisclosed except as permitted under paragraph 
(b) of this section.
    (3) Has furnished a written statement that the research protocol 
has been reviewed by an independent group of three or more individuals 
who found that the rights of patients would be adequately protected and 
that the potential benefits of the research outweigh any potential 
risks to patient confidentiality posed by the disclosure of records. 

[[Page 63936]]

    (b) A person conducting research may disclose information obtained 
under paragraph (a) of this section only back to VA and may not 
identify any individual patient in any report of that research or 
otherwise disclose patient identities.

(Authority: 38 U.S.C. 7332(b)(2)(B))


Sec. 1.489  Audit and evaluation activities.

    Subject to the provisions of 38 U.S.C. 5701, 38 CFR 1.500-1.527, 
the Privacy Act (5 U.S.C. 552a), 38 CFR 1.575-1.584, and the following 
paragraphs, patient medical records covered by Secs. 1.460 through 
1.499 of this part may be disclosed outside VA for the purposes of 
conducting audit and evaluation activities.
    (a) Records not copies. If patient records covered by Secs. 1.460 
through 1.499 of this part are not copied, patient identifying 
information may be disclosed in the course of a review of records on VA 
facility premises to any person who agrees in writing to comply with 
the limitations on redisclosure and use in paragraph (d) of this 
section and:
    (1) Where audit or evaluation functions are performed by a State or 
Federal governmental agency on behalf of VA; or
    (2) Who is determined by the VA facility director to be qualified 
to conduct the audit or evaluation activities.
    (b) Copying of records. Records containing patient identifying 
information may be copied by any person who:
    (1) Agrees in writing to:
    (i) Maintain the patient identifying information in accordance with 
the security requirements provided in Sec. 1.466 of this part (or more 
stringent requirements);
    (ii) Destroy all the patient identifying information upon 
completion of the audit or evaluation; and
    (iii) Comply with the limitations on disclosure and use in 
paragraph (d) of this section.
    (2) The VA medical facility director determines to be qualified to 
conduct the audit or evaluation activities.
    (c) Congressional oversight. Records subject to Secs. 1.460 through 
1.499 of this part upon written request may be released to 
congressional committees or subcommittees for program oversight and 
evaluation if such records pertain to any matter within the 
jurisdiction of such committee or subcommittee.
    (d) Limitation on disclosure and use. Records containing patient 
identifying information disclosed under this section may be disclosed 
only back to VA and used only to carry out an audit or evaluation 
purpose, or, to investigate or prosecute criminal or other activities 
as authorized by a court order entered under Sec. 1.494 of this part.

(Authority: 38 U.S.C. 7332(b)(2)(B))

Court Orders Authorizing Disclosures and Use


Sec. 1.490  Legal effect of order.

    The records to which Secs. 1.460 through 1.499 of this part apply 
may be disclosed if authorized by an appropriate order of a court of 
competent jurisdiction granted after application showing good cause 
therefore. In assessing good cause the court is statutorily required to 
weigh the public interest and the need for disclosure against the 
injury to the patient or subject, to the physician-patient 
relationship, and to the treatment services. Upon the granting of such 
order, the court, in determining the extent to which any disclosure of 
all or any part of any record is necessary, is required by statute to 
impose appropriate safeguards against unauthorized disclosure. An order 
of a court of competent jurisdiction to produce records subject to 
Secs. 1.460 through 1.499 of this part will not be sufficient unless 
the order reflects that the court has complied with the requirements of 
38 U.S.C. 7332(b)(2)(D). Such an order from a Federal court compels 
disclosure. However, such an order from a State court only acts to 
authorize the Secretary to exercise discretion pursuant to 38 U.S.C. 
5701(b)(5) and 38 CFR 1.511 to disclose such records. It does not 
compel disclosure.

(Authority: 38 U.S.C. 7332(b)(2)(D))


Sec. 1.491  Confidential communications.

    (a) A court order under Secs. 1.490 through 1.499 of this part may 
authorize disclosure of confidential communications made by a patient 
to a treatment program in the course of diagnosis, treatment, or 
referral for treatment only if:
    (1) The disclosure is necessary to protect against an existing 
threat to life or of serious bodily injury, including circumstances 
which constitute suspected child abuse and neglect and verbal threats 
against third parties;
    (2) The disclosure is necessary in connection with investigation or 
prosecution of an extremely serious crime, such as one which directly 
threatens loss of life or serious bodily injury, including homicide, 
rape, kidnapping, armed robbery, assault with a deadly weapon, or child 
abuse and neglect; or
    (3) The disclosure is in connection with litigation or an 
administrative proceeding in which the patient offers testimony or 
other evidence pertaining to the content of the confidential 
communications.

(Authority: 38 U.S.C. 7334)


Sec. 1.492  Order not applicable to records disclosed without consent 
to researchers, auditors and evaluators.

    A court order under Secs. 1.460 through 1.499 of this part may not 
authorize qualified personnel, who have received patient identifying 
information from VA without consent for the purpose of conducting 
research, audit or evaluation, to disclose that information or use it 
to conduct any criminal investigation or prosecution of a patient. 
However, a court order under Sec. 1.495 of this part may authorize 
disclosure and use of records to investigate or prosecute VA personnel.

(Authority: 38 U.S.C. 7334)


Sec. 1.493  Procedures and criteria for orders authorizing disclosures 
for noncriminal purposes.

    (a) Application. An order authorizing the disclosure of patient 
records covered by Secs. 1.460 through 1.499 of this part for purposes 
other than criminal investigation or prosecution may be applied for by 
any person having a legally recognized interest in the disclosure which 
is sought. The application may be filed separately or as part of a 
pending civil action in which it appears that the patient records are 
needed to provide evidence. An application must use a fictitious name, 
such as John Doe, to refer to any patient and may not contain or 
otherwise disclose any patient identifying information unless the 
patient is the applicant or has given a written consent (meeting the 
requirements of Sec. 1.475 of this part) to disclosure or the court has 
ordered the record of the proceeding sealed from public scrutiny.
    (b) Notice. The patient and VA facility from whom disclosure is 
sought must be given:
    (1) Adequate notice in a manner which will not disclose patient 
identifying information to other persons; and
    (2) An opportunity to file a written response to the application, 
or to appear in person, for the limited purpose of providing evidence 
on whether the statutory and regulatory criteria for the issuance of 
the court order are met.
    (c) Review of evidence: Conduct of hearing. Any oral argument, 
review of evidence, or hearing on the application must be held in the 
judge's chambers or in some manner which ensures that patient 
identifying information is not disclosed to anyone other than a party 

[[Page 63937]]
to the proceeding, the patient, or VA, unless the patient requests an 
open hearing in a manner which meets the written consent requirements 
of Sec. 1.475 of this part. The proceeding may include an examination 
by the judge of the patient records referred to in the application.
    (d) Criteria for entry of order. An order under this section may be 
entered only if the court determines that good cause exists. To make 
this determination the court must find that:
    (1) Other ways of obtaining the information are not available or 
would not be effective; and
    (2) The public interest and need for the disclosure outweigh the 
potential injury to the patient, the physician-patient relationship and 
the treatment services.
    (e) Content of order. An order authorizing a disclosure must:
    (1) Limit disclosure to those parts of the patient's record which 
are essential to fulfill the objective of the order;
    (2) Limit disclosure to those persons whose need for information is 
the basis for the order; and
    (3) Include such other measures as are necessary to limit 
disclosure for the protection of the patient, the physician-patient 
relationship and the treatment services; for example, sealing from 
public scrutiny the record of any proceeding for which disclosure of a 
patient's record has been ordered.

(Authority: 38 U.S.C. 7334)


Sec. 1.494  Procedures and criteria for orders authorizing disclosure 
and use of records to criminally investigate or prosecute patients.

    (a) Application. An order authorizing the disclosure or use of 
patient records covered by Secs. 1.460 through 1.499 of this part to 
criminally investigate or prosecute a patient may be applied for by VA 
or by any person conducting investigative or prosecutorial activities 
with respect to the enforcement of criminal laws. The application may 
be filed separately, as part of an application for a subpoena or other 
compulsory process, or in a pending criminal action. An application 
must use a fictitious name such as John Doe, to refer to any patient 
and may not contain or otherwise disclose patient identifying 
information unless the court has ordered the record of the proceeding 
sealed from public scrutiny.
    (b) Notice and hearing. Unless an order under Sec. 1.495 of this 
part is sought with an order under this section, VA must be given:
    (1) Adequate notice (in a manner which will not disclose patient 
identifying information to third parties) of an application by a person 
performing a law enforcement function;
    (2) An opportunity to appear and be heard for the limited purpose 
of providing evidence on the statutory and regulatory criteria for the 
issuance of the court order; and
    (3) An opportunity to be represented by counsel.
    (c) Review of evidence: Conduct of hearings. Any oral argument, 
review of evidence, or hearing on the application shall be held in the 
judge's chambers or in some other manner which ensures that patient 
identifying information is not disclosed to anyone other than a party 
to the proceedings, the patient, or VA. The proceeding may include an 
examination by the judge of the patient records referred to in the 
application.
    (d) Criteria. A court may authorize the disclosure and use of 
patient records for the purpose of conducting a criminal investigation 
or prosecution of a patient only if the court finds that all of the 
following criteria are met:
    (1) The crime involved is extremely serious, such as one which 
causes or directly threatens loss of life or serious bodily injury 
including, but not limited to, homicide, rape, kidnapping, armed 
robbery, assault with a deadly weapon, and child abuse and neglect.
    (2) There is a reasonable likelihood that the records will disclose 
information of substantial value in the investigation or prosecution.
    (3) Other ways of obtaining the information are not available or 
would not be effective.
    (4) The potential injury to the patient, to the physician-patient 
relationship and to the ability of VA to provide services to other 
patients is outweighed by the public interest and the need for the 
disclosure.
    (5) If the applicant is a person performing a law enforcement 
function, VA has been represented by counsel independent of the 
applicant.
    (e) Content of order. Any order authorizing a disclosure or use of 
patient records under this section must:
    (1) Limit disclosure and use to those parts of the patient's record 
which are essential to fulfill the objective of the order;
    (2) Limit disclosure to those law enforcement and prosecutorial 
officials who are responsible for, or are conducting, the investigation 
or prosecution, and limit their use of the records to investigation and 
prosecution of extremely serious crime or suspected crime specified in 
the applications; and
    (3) Include such other measures as are necessary to limit 
disclosure and use to the fulfillment on only that public interest and 
need found by the court.

(Authority: 38 U.S.C. 7332(c))


Sec. 1.495  Procedures and criteria for orders authorizing disclosure 
and use of records to investigate or prosecute VA or employees of VA.

    (a) Application.
    (1) An order authorizing the disclosure or use of patient records 
covered by Secs. 1.460 through 1.499 of this part to criminally or 
administratively investigate or prosecute VA (or employees or agents of 
VA) may be applied for by an administrative, regulatory, supervisory, 
investigative, law enforcement, or prosecutorial agency having 
jurisdiction over VA activities.
    (2) The application may be filed separately or as part of a pending 
civil or criminal action against VA (or agents or employees of VA) in 
which it appears that the patient records are needed to provide 
material evidence. The application must use a fictitious name, such as 
John Doe, to refer to any patient and may not contain or otherwise 
disclose any patient identifying information unless the court has 
ordered the record of the proceeding sealed from public scrutiny or the 
patient has given a written consent (meeting the requirements of Sec.  
1.475 of this part) to that disclosure.
    (b) Notice not required. An application under this section may, in 
the discretion of the court, be granted without notice. Although no 
express notice is required to VA or to any patient whose records are to 
be disclosed, upon implementation of an order so granted VA or the 
patient must be afforded an opportunity to seek revocation or amendment 
of that order, limited to the presentation of evidence on the statutory 
and regulatory criteria for the issuance of the court order.
    (c) Requirements for order. An order under this section must be 
entered in accordance with, and comply with the requirements of, 
Sec. 1.493(d) and (e) of this part.
    (d) Limitations on disclosure and use of patient identifying 
information.
    (1) An order entered under this section must require the deletion 
of patient identifying information from any documents made available to 
the public.
    (2) No information obtained under this section may be used to 
conduct any investigation or prosecution of a patient, or be used as 
the basis for an application for an order under Sec. 1.494 of this 
part.

(Authority: 38 U.S.C. 7334) 

[[Page 63938]]



Sec. 1.496  Orders authorizing the use of undercover agents and 
informants to criminally investigate employees or agents of VA.

    (a) Application. A court order authorizing the placement of an 
undercover agent or informant in a VA drug or alcohol abuse, HIV 
infection, or sickle cell anemia treatment program as an employee or 
patient may be applied for by any law enforcement or prosecutorial 
agency which has reason to believe that employees or agents of the VA 
treatment program are engaged in criminal misconduct.
    (b) Notice. The VA facility director must be given adequate notice 
of the application and an opportunity to appear and be heard (for the 
limited purpose of providing evidence on the statutory and regulatory 
criteria for the issuance of the court order), unless the application 
asserts a belief that:
    (1) The VA facility director is involved in the criminal activities 
to be investigated by the undercover agent or informant; or
    (2) The VA facility director will intentionally or unintentionally 
disclose the proposed placement of an undercover agent or informant to 
the employees or agents who are suspected of criminal activities.
    (c) Criteria. An order under this section may be entered only if 
the court determines that good cause exists. To make this determination 
the court must find:
    (1) There is reason to believe that an employee or agent of a VA 
treatment program is engaged in criminal activity;
    (2) Other ways of obtaining evidence of this criminal activity are 
not available or would not be effective; and
    (3) The public interest and need for the placement of an undercover 
agent or informant in the VA treatment program outweigh the potential 
injury to patients of the program, physician-patient relationships and 
the treatment services.
    (d) Content of order. An order authorizing the placement of an 
undercover agent or informant in a VA treatment program must:
    (1) Specifically authorize the placement of an undercover agent or 
an informant;
    (2) Limit the total period of the placement to six months;
    (3) Prohibit the undercover agent or informant from disclosing any 
patient identifying information obtained from the placement except as 
necessary to criminally investigate or prosecute employees or agents of 
the VA treatment program; and
    (4) Include any other measures which are appropriate to limit any 
potential disruption of the program by the placement and any potential 
for a real or apparent breach of patient confidentiality; for example, 
sealing from public scrutiny the record of any proceeding for which 
disclosure of a patient's record has been ordered.
    (e) Limitation on use of information. No information obtained by an 
undercover agent or informant placed under this section may be used to 
criminally investigate or prosecute any patient or as the basis for an 
application for an order under Sec. 1.494 of this part.

(Authority: 38 U.S.C. 7334)


Sec. 1.497-1.499  [Reserved]


Sec. 1.513  [Amended]

    3. In Sec. 1.513(b)(2) remove the words ``Post Office Department'' 
and add in their place, ``U.S. Postal Service''.


Sec. 1.513a  [Removed]

    4. Section Sec. 1.513a is removed.

[FR Doc. 95-30138 Filed 12-12-95; 8:45 am]
BILLING CODE 8320-01-P