1 of 8
IB 10-163p
Department of Veterans Affairs
Veterans Health Administration
NOTICE OF PRIVACY PRACTICES
Effective Date September 30, 2022
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED
OR DISCLOSED AND HOW YOU CAN GET ACCESS TO YOUR INFORMATION.
PLEASE REVIEW IT CAREFULLY
The Department of Veterans Affairs (VA), Veterans Health Administration (VHA) is required by law to
maintain the privacy of your protected health information and to provide you with notice of its legal
duties and privacy practices. VHA may use or disclose your health information without your
permission for treatment, payment and health care operations, and when otherwise required or
permitted by law. This Notice outlines the ways in which VHA may use and disclose your health
information without your permission as required or permitted by law. For VHA to use or disclose your
information for any other purposes, we are required to get your permission in the form of a signed,
written authorization. VHA is required to maintain the privacy of your health information as outlined in
this Notice and its privacy policies. Please read through this Notice carefully to understand your
privacy rights and VHA’s obligations.
YOUR PRIVACY RIGHTS
Right to Review and Obtain a Copy of Health Information. You have the right to review and
obtain a copy of your health information in our records. You must submit a written request to the
facility Privacy Officer at the VHA health care facility that provided or paid for your care. The VHA
Privacy Office at Central Office in Washington, D.C. does not maintain VHA health records, nor past
military service health records. For a copy of your military service health records, please contact the
National Personnel Records Center at (314) 801-0800. The Web site is
http://www.archives.gov/veterans/military-service-records/medical-records.html.
Right to Request Amendment of Health Information. You have the right to request an amendment
(correction) to your health information in our records if you believe it is incomplete, inaccurate,
untimely, or unrelated to your care. You must submit your request in writing, specify the information
that you want corrected, and provide a reason to support your request for amendment. All
amendment requests should be submitted to the facility Privacy Officer at the VHA health care facility
that maintains your information or health records.
If your request for amendment is denied, you will be notified of this decision in writing and given
information about your right to appeal the decision. In response, you may do any of the
following:
• File an appeal.
• File a “Statement of Disagreement” which will be included in your health record
• Ask that your initial request for amendment accompany all future disclosures of the disputed
health information.
Right to Request Receipt of Communications in a Confidential Manner. You have the right to
request that we provide your health information to you by alternative means or at an alternative
location. We will accommodate reasonable requests, as determined by VA/VHA policy, from you to
receive communications containing your health information:
2 of 8
IB 10-163p
• At a mailing address (e.g., confidential communications address) other than your permanent
address.
• In person, under certain circumstances.
Right to Request Restriction. You may request that we not use or disclose all or part of your health
information to carry out treatment, payment or health care operations, or that we not use or disclose
all or part of your health information with individuals such as your relatives or friends involved in your
care, including use or disclosure for a particular purpose or to a particular person.
Please be aware, that because VHA, and other health care organizations are “covered entities” under
the law, VHA is not required to agree to such restriction, except in the case of a disclosure restricted
under 45 CFR § 164.522(a)(1)(vi). This provision applies only if the disclosure of your health
information is to a health plan for the purpose of payment or health care operations and your health
information pertains solely to a health care service or visit which you paid out of pocket in full.
However, VHA is not legally able to accept an out-of-pocket payment from a Veteran for the full cost
of a health care service or visit. We are only able to accept payment from a Veteran for co-payments.
Therefore, this provision does not apply to VHA and VHA is not required or able to agree to a
restriction on the disclosure of your health information to a health plan for the purpose of receiving
payment for health care services VA provided to you.
To request a restriction, you must submit a written request that identifies the information you want
restricted, when you want it to be restricted, and the extent of the restrictions. All requests to restrict
use or disclosure should be submitted to the facility Privacy Officer at the VHA health care facility that
provided or paid for your care. If we agree to your request, we will honor the restriction until you
revoke it unless the information covered by the restriction is needed to provide you with emergency
treatment or the restriction is terminated by VHA upon notification to you.
NOTE: We are not able to honor requests to remove all or part of your health information from the electronic
database of health information that is shared between VHA and DoD, or to restrict access to your health
information by DoD providers with whom you have a treatment relationship.
Right to Receive an Accounting of Disclosures. You have the right to know and request a copy
of what disclosures of your health information have been made to you and to other individuals
outside of VHA. To exercise this right, you must submit a written request to the facility Privacy
Officer at the VHA health care facility that provides your care.
Right to a Printed Copy of the Privacy Notice. You have the right to obtain an additional paper
copy of this Notice from your VHA health care facility. You can obtain this Notice from the facility
Privacy Officer at your local VHA health care facility. You may also obtain a copy of this Notice at the
following website: http://www.va.gov/vhapublications.
Notification of a Breach of your Health Information. If a breach of any of your protected health
information occurs, we will notify you and provide instruction for further actions you may take, if any.
Complaints. If you are concerned that your privacy rights have been violated, you may file a complaint
with:
• The Privacy Officer at your local VHA health care facility. Visit this Web site for VHA facilities
and telephone numbers http://www.va.gov/directory/guide/home.asp?isflash=1
• VA via the Internet through “Contact us” at http://www.va.gov/contact-us/ or by dialing 1-800-
983-0936 or by writing the VHA Privacy Office (105HIG) at 810 Vermont Avenue NW,
Washington, DC 20420.
3 of 8
IB 10-163p
• The U.S. Department of Health and Human Services, Office for Civil
Rights at http://www.hhs.gov/ocr/privacy/hipaa/complaints/index.html
• The Office of the Inspector General. http://www.va.gov/oig/hotline/default.asp
• Complaints do not have to be in writing, though it is recommended. An individual filing a
complaint will not face retaliation by any VA/VHA organization or VA/VHA employee.
When We May Use or Disclose Your Health Information without Your Authorization
Treatment. We may use and disclose your health information without your authorization for treatment
or to provide health care services. This includes using and disclosing your information for:
• Emergency and routine health care or
services, including but not limited to labs
and x-rays; clinic visits; inpatient admissions
• Contacting you to provide appointment
reminders or information about treatment
alternatives
• Seeking placement in community living
centers or skilled nursing homes
• Providing or obtaining home-based services
or hospice services
• Filling and submitting prescriptions for
medications, supplies, and equipment
• Coordination of care, including care
from non-VHA providers,
• Communicating with non-VHA
providers regarding your care through
health information exchanges
• Coordination of care with DoD,
including electronic information
exchange
NOTE: If you are an active-duty service member, Reservist or National Guard member, your health
information is available to DoD providers with whom you have a treatment relationship. Your protected health
information is on an electronic database that is shared between VHA and DoD. VHA does not have the ability
to restrict DoD’s access to your information in this database, even if you ask us to do so.
Examples:
1)
A Veteran sees a VHA doctor who prescribes medication based on the Veteran’s health information. The
VHA pharmacy uses this information to fill the prescription.
2)
A Veteran is taken to a community hospital emergency room. Upon request from the emergency room,
VHA discloses health information to the non-VHA hospital staff that needs the information to treat this
Veteran.
3)
A National Guard member seeks mental health care from VHA. VHA discloses this information to DoD
by entering the information into a database that may be accessed by DoD providers at some future date.
4)
A Veteran is seen by his community health care provider, who wants to review the Veteran’s last blood
work results from his VHA Primary Care visit for comparison. The community health care provider uses a
local health information exchange to request and receive the results from VHA to better care for the
Veteran.
Payment. We may use and disclose your health information without your authorization for payment
purposes or to receive reimbursement for care provided. This includes using and disclosing your
information for:
• Determining eligibility for health care services
• Paying for non-VHA care and services,
including but not limited to, CHAMPVA, Choice
and fee basis
• Coordinating benefits with other insurance payers
• Finding or verifying coverage under a health
insurance plan or policy
• Pre-certifying insurance benefits
• Billing and collecting for health care
services provided by VHA
• Reporting to consumer reporting
agencies regarding delinquent debt owed
to VHA.
4 of 8
IB 10-163p
Examples:
1)
A Veteran is seeking care at a VHA health care facility. VA uses the Veteran’s health information to
determine eligibility for health care services.
2)
The VHA health care facility discloses a Veteran’s health information to a private health insurance
company to seek and receive payment for the care and services provided to the Veteran.
3)
A Veteran owes VA $5000 in copayments for Non-Service Connected care over two years. The Veteran
has not responded to reasonable administrative efforts to collect the debt. VA releases information
concerning the debt, including the Veteran’s name and address, to a consumer reporting agency for the
purpose of making the information available for third-party decisions regarding such things as the Veteran’s
credit, insurance, housing, banking services, utilities.
Health Care Operations. We may use or disclose your health information without your authorization to
support the activities related to health care. This includes using and disclosing your information for:
• Improving quality of care or
services
• Conducting Veteran and
beneficiary satisfaction
surveys
• Reviewing competence or
qualifications of health care
professionals
• Providing information about
treatment alternatives or
other health-related benefits
and services
• Conducting health care training
programs
• Managing, budgeting and
planning activities and reports
• Improving health care
processes, reducing health care
costs and assessing
organizational performance
• Developing, maintaining and
supporting computer systems
• Addressing patient
complaints
• Legal services
• Conducting accreditation
activities
• Certifying, licensing, or
credentialing of health care
professionals
• Conducting audits and
compliance programs, including
fraud, waste and abuse
investigations
• Performing process reviews
and root cause analyses
Examples:
1)
Medical Service, within a VHA health care facility, uses the health information of diabetic Veterans as part
of a quality of care review process to determine if the care was provided in accordance with the established
clinical practices.
2)
A VHA health care facility discloses a Veteran’s health information to the Department of Justice (DOJ)
attorneys assigned to VA for defense of VHA in litigation.
3) The VHA health care facility Utilization Review Committee reviews care data, patient demographics, and
diagnosis to determine that the appropriate length of stay is provided per Utilization Review Standards.
Eligibility and Enrollment for Federal Benefits. We may use or disclose your health information
without your authorization to other programs within VA or other Federal agencies, such as the
Veterans Benefits Administration, Internal Revenue Service, or Social Security Administration, to
determine your eligibility for Federal benefits.
Abuse Reporting. We may use or disclose your health information without your authorization to report
suspected child abuse, including child pornography; elder abuse or neglect; or domestic violence to
appropriate Federal, State, local, or tribal authorities. This reporting is for the health and safety of the
suspected victim.
Serious and Imminent Threat to Health and Safety. We may use or disclose your health
information without your authorization when necessary to prevent or lessen a serious and imminent
threat to the health and safety of the public, yourself, or another person. Any disclosure would only
be to someone able to help prevent or lessen the harm, such as a law enforcement agency or the
person threatened. You will be notified in writing if any such disclosure has been made by a VHA
health care facility.
Public Health Activities. We may disclose your health information without your authorization to public
health and regulatory authorities, including the Food and Drug Administration (FDA) and Centers for
5 of 8
IB 10-163p
Disease Control (CDC), for public health activities. This includes disclosing your information for:
• Controlling and preventing
disease, injury, or disability
• Reporting vaccination
events
• Reporting vital events such
as births and deaths
• Reporting communicable
diseases such as hepatitis,
tuberculosis, sexually
transmitted diseases & HIV
• Tracking FDA-regulated
products
• Reporting adverse
events and product
defects or problems
• Enabling product recalls,
repairs or replacements
Judicial or Administrative Proceedings. We may disclose your health information without your
authorization for judicial or administrative proceedings, such as when we receive an order of a
court, such as a subpoena signed by a judge, or administrative tribunal, requiring the disclosure.
Law Enforcement. We may disclose your health information without your authorization to law
enforcement agencies for law enforcement purposes when applicable legal requirements are met.
This includes disclosing your information for:
• Identifying or apprehending an individual
who has admitted to participating in a
violent crime
• Reporting a death where there is a suspicion
that death has occurred as a result of a
crime
• Reporting Fugitive Felons
• Routine reporting to law enforcement agencies,
such as gunshot wounds
• Providing certain information to identify or locate
a suspect, fugitive, material witness, or missing
person
• Investigating a specific criminal act.
Health Care Oversight. We may disclose your health information without your authorization to a
governmental health care oversight agency (e.g., Inspector General; House Veterans Affairs
Committee) for activities authorized by law, such as audits, investigations, and inspections. Health
care oversight agencies include government agencies that oversee the health care system,
government benefit programs, other government regulatory programs, and agencies that enforce
civil rights laws.
Cadaveric Organ, Eye, or Tissue Donation. When you are an organ donor and death is imminent,
we may use or disclose your relevant health information without your authorization to an Organ
Procurement Organization (OPO), or other entity designated by the OPO, for determining suitability
of your organs or tissues for organ donation. If you have not specified your donation preferences and
can no longer do so, your family may make the determination regarding organ donation on your
behalf.
Coroner or Funeral Services. Upon your death, we may disclose your health information to a funeral
director for burial purposes, as authorized by law. We may also disclose your health information to a
coroner or medical examiner for identification purposes, determining cause of death, or performing
other duties authorized by law.
Services. We may provide your health information without your authorization to individuals,
companies and others who need to see your information to perform a function or service for or on
behalf of VHA. An appropriately executed contractual document, if applicable, and business
associate agreement must be in place securing your information.
National Security Matters. We may use and disclose your health information without your
authorization to authorized Federal officials for conducting national security and intelligence
activities. These activities may include protective services for the President and others.
6 of 8
IB 10-163p
Workers’ Compensation. We may use or disclose your health information without your
authorization to comply with workers’ compensation laws and other similar programs.
Correctional Facilities. We may disclose your health information without your authorization to a
correctional facility if you are an inmate and disclosure is necessary to provide you with health care; to
protect the health and safety of you or others; or for the safety of the correctional facility.
Required by Law. We may use or disclose your health information without your authorization for
other purposes to the extent required or mandated by Federal law (e.g., to comply with the
Americans with Disabilities Act; to comply with the Freedom of Information Act (FOIA); to comply with
a Health Insurance Portability and Accountability Act (HIPAA) privacy or security rule complaint
investigation or review by the Department of Health and Human Services).
Activities Related to Research. Before we may use health information for research, all research
projects must go through a special VHA approval process. This process requires an Institutional
Review Board (IRB) to evaluate the project and its use of health information based on, among other
things, the level of risk to you and to your privacy. For many research projects, including any in which
you are physically examined or provided care as part of the research, you will be asked to sign a
consent form to participate in the project and a separate authorization form for use and possibly
disclosure of your information. However, there are times when we may use your health information
without an authorization, such as, when:
• A researcher is preparing a plan for a research project. For example, a researcher needs to
examine patient medical records to identify patients with specific medical needs. The researcher
must agree to use this information only to prepare a plan for a research study; the researcher
may not use it to contact you or actually conduct the study. The researcher also must agree not
to remove that information from the VHA health care facility. These activities are considered
preparatory to research.
• The IRB approves a waiver of authorization to use or disclose health information for the
research because privacy and confidentiality risks are minimal and other regulatory criteria
are satisfied.
• A Limited Data Set containing only indirectly identifiable health information (such as dates,
unique characteristics, unique numbers or zip codes) is used or disclosed, with a data use
agreement (DUA) in place.
Military Activities. We may use or disclose your health information without your authorization if you
are a member of the Armed Forces, for activities deemed necessary by appropriate military
command authorities to assure the proper execution of the military mission, when applicable legal
requirements are met. Members of the Armed Forces include Active Duty Service members and in
some cases Reservist and National Guard members.
Example:
Your Base Commander requests your health information to determine your fitness for duty or deployment.
Academic Affiliates. We may use or disclose your health information without your authorization to
support our education and training program for students and residents to enhance the quality of
care provided to you.
State Prescription Drug Monitoring Program (SPDMP). We may use or disclose your health
information without your authorization to a SPDMP in an effort to promote the sharing of prescription
information to ensure safe medical care.
7 of 8
IB 10-163p
General Information Disclosures. We may disclose general information about you without your
authorization to your family and friends. These disclosures will be made only as necessary and on a
need-to-know basis consistent with good medical and ethical practices, unless otherwise directed by
you or your personal representative. General information is limited to:
• Verification of identity
• Your condition described in general terms (e.g., critical, stable, good, prognosis poor)
• Your location in a VHA health care facility (e.g., building, floor, or room number)
Verbal Disclosures to Others While You Are Present. When you are present, or otherwise
available, we may disclose your health information to your next-of-kin, family or to other individuals
that you identify. Your doctor may talk to your spouse about your condition while at your bedside or
in the exam room. Before we make such a disclosure, we will ask you if you object or if it is
acceptable for the person to remain in the room. We will not make the disclosure if you object.
Verbal Disclosures to Others When You Are Not Present. When you are not present, or are
unavailable, VHA health care providers may discuss your health care or payment for your health
care with your next-of-kin, family, or others with a significant relationship to you without your
authorization. This will only be done if it is determined that it is in your best interests. We will limit the
disclosure to information that is directly relevant to the other person’s involvement with your health
care or payment for your health care.
Examples of this type of disclosure may include questions or discussions concerning your in-patient
medical care, home-based care, medical supplies such as a wheelchair, and filled prescriptions.
IMPORTANT NOTE: A copy of your medical records can be provided to family, next-of-kin, or other
individuals involved in your care only if we have your signed, written authorization or if the individual is your
authorized personal representative.
Other Uses and Disclosures with Your Authorization. We may use or disclose your health
information for any purpose you specify in a signed, written authorization you provide us. Your
signed, written authorization is always required to disclose your psychotherapy notes, if they exist. If
we were to use or disclose your health information for marketing purposes we would require your
signed written authorization. In all other cases, we will not use or make a disclosure of your health
information without your signed, written authorization, unless the use or disclosure falls under one of
the exceptions described in this Notice. When we receive your signed, written authorization we will
review the authorization to determine if it is valid, and then disclose your health information as
requested by you in the authorization.
Revocation of Authorization. If you provide us a signed, written authorization to use or disclose
your health information, you may revoke that authorization, in writing, at any time. If you revoke your
authorization, we will no longer use or disclose your health information unless the use or disclosure
falls under one of the exceptions described in this Notice or as otherwise permitted by other laws.
Please understand that we are unable to take back any uses or disclosures we have already made
based on your signed, written authorization.
When We Offer You the Opportunity to Decline the Use or Disclosure of Your Health Information
Patient Directories. Unless you opt-out of the VHA medical center patient directory when being
admitted to a VHA health care facility, we may list your general condition, religious affiliation and the
location where you are receiving care. This information may be disclosed to people who ask for you
by name. Your religious affiliation will only be disclosed to members of the clergy who ask for you by
8 of 8
IB 10-163p
name.
NOTE: If you do object to being listed in the Patient Directory, no information will be given out about you
unless there is other legal authority. This means your family and friends will not be able to find what room you
are in while you are in the hospital. It also means you will not be able to receive flowers or mail, including
Federal benefits checks, while you are an inpatient in the hospital or nursing home. All flowers and mail will
be returned to the sender.
When We Will Not Use or Disclose Your Health Information
Sale of Health Information. We will not sell your health information. Receipt by VA of a fee
expressly permitted by law, such as Privacy Act copying fees or FOIA copying fees is not a “sale of
health information.”
Genetic Information. We will not use or disclose genetic information to determine your eligibility
for or enrollment in VA health care benefits.
Changes to This Notice. We reserve the right to change this Notice. The revised privacy practices will
pertain to all existing health information, as well as health information we receive in the future. Should
there be any changes to this Notice we will make a copy of the revised Notice available to you within 60
days of any change. The Notice will contain the effective date on the first page.
Contact Information. You may contact the Privacy Officer at your local VHA health care facility if
you have questions regarding the privacy of your health information or if you would like further
explanation of this Notice. The VHA Privacy Office may be reached by mail at VHA Privacy Office,
Office of Health Informatics (105HIG), 810 Vermont Avenue NW, Washington, DC 20420 or by
telephone at 1-877-461-5038 (toll free).
