36C25818R0026-010.pdf

T-1

Department of Veterans Affairs Veterans Health Administration Washington, DC 20420

VHA DIRECTIVE 1605.01

Transmittal Sheet

August 31, 2016

PRIVACY AND RELEASE OF INFORMATION

1. REASON FOR ISSUE: This Veterans Health Administration (VHA) directive provides revised instructions on compliance with the Privacy Act and the release of information from drug and alcohol abuse, infection with the human immunodeficiency virus, and sickle cell anemia health records.

2. SUMMARY OF MAJOR CHANGES: This directive revises, consolidates, and updates procedures involving privacy and the release of information. This directive also establishes VHA procedures regarding compliance with the provisions of the Standards of Privacy of Individually-Identifiable Health Information, 45 Code of Federal Regulations (CFR) Parts 160 and 164 (the HIPAA Privacy Rule). This directive removes provisions addressing compliance with the Freedom of Information Act (FOIA), which are addressed in VA Handbook 6300.3.

3. RELATED ISSUES: VA Handbook 6300.3 through VA Handbook 6300.7 as well as VHA Handbooks included in the 1605 series.

4. RESPONSIBLE OFFICE: The VHA Office of Informatics and Information Governance , Information Access and Privacy (10P2C), is responsible for the content of this directive. Questions may be referred to the VHA Privacy Officer at 704-245-2492.

5. RESCISSION: VHA Handbook 1605.1, dated May 17, 2006, is rescinded.

6. RECERTIFICATION: This VHA directive is scheduled for recertification on or before the last working day of August 2021.

David J. Shulkin, M.D.

Under Secretary for Health

DISTRIBUTION: Emailed to the VHA Publications Distribution List on 09/02/2016.

August 31, 2016 VHA DIRECTIVE 1605.01 i

CONTENTS

PRIVACY AND RELEASE OF INFORMATION

1. PURPOSE

2. BACKGROUND

3. DEFINITIONS

4. POLICY

5. INDIVIDUALS’ RIGHTS

6. NOTICE OF PRIVACY PRACTICES (IB 10-163)

7. INDIVIDUALS’ RIGHT OF ACCESS

8. RIGHT TO REQUEST AMENDMENT OF RECORDS

9. ACCOUNTING OF DISCLOSURES FROM RECORDS

10. CONFIDENTIAL COMMUNICATIONS

11. RIGHT TO REQUEST RESTRICTION

12. TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS

13. RESEARCH

14. AUTHORIZATION REQUIREMENTS

15. PROCESSING A REQUEST

16. ROI WITHIN VA FOR PURPOSES OTHER THAN TREATMENT, PAYMENT,

OR HEALTH CARE OPERATIONS WITHOUT AUTHORIZATION

17. ROI OUTSIDE VA, FOR ANY PURPOSE

18. CONGRESS

19. CONSUMER REPORTING AGENCY

20. COURTS, QUASI-JUDICIAL BODIES, AND ATTORNEYS

21. LAW ENFORCEMENT ENTITIES

22. MEDICAL CARE COLLECTION FUND

23. NEXT-OF-KIN, FAMILY AND OTHERS WITH A SIGNIFICANT RELATIONSHIP

24. NON-VA HEALTH CARE PROVIDER (HEALTH CARE PROVIDERS,

HOSPITALS, NURSING HOMES)

25. ORGAN PROCUREMENT ORGANIZATION

26. OTHER GOVERNMENT AGENCIES

August 31, 2016 VHA DIRECTIVE 1605.1 ii

27. PUBLIC HEALTH AUTHORITIES

28. REGISTRIES

29. STATE VETERAN HOMES

30. VETERANS SERVICE ORGANIZATIONS (VSO)

31. READJUSTMENT COUNSELING SERVICES (RCS) VET CENTERS

32. COMPENSATED WORK THERAPY

33. WORK STUDY STUDENTS AND STUDENT VOLUNTEERS

34. DECEASED INDIVIDUALS

35. VHA SYSTEMS OF RECORDS

36. RELEASE FROM NON-VHA SYSTEMS OF RECORDS

37. OTHER TYPES OF USES, DISCLOSURES AND RELEASES

38. GENERAL OPERATIONAL PRIVACY REQUIREMENTS

APPENDIX A

DE-IDENTIFICATION OF DATA

APPENDIX B

NON-VHA SYSTEMS OF RECORDS

PRIVACY AND RELEASE OF INFORMATION

1. PURPOSE

This Veterans Health Administration (VHA) directive establishes the VHA privacy practices procedures for the use and disclosure of individually-identifiable information, and individual privacy rights related to VHA health care data. This directive defines the responsibilities and requirements for VHA compliance with all Federal confidentiality and privacy laws and regulations. When using or disclosing VHA information, all applicable laws and regulations must be reviewed and applied simultaneously to the use or disclosure. This directive should be used as a reference tool for documenting and facilitating the appropriate use and disclosure of information maintained by VHA.

AUTHORITY: 5 U.S.C. 552a, 38 U.S.C. 5701, 5705, 7332, 38 CFR 1.460-1.582, 17.500-17.511, and 45 CFR parts 160 and 164.

2. BACKGROUND

a. VHA, as a component of a government agency and as a health plan and health care provider, must comply with all applicable privacy and confidentiality statutes and regulations. The most commonly encountered statutes and sets of regulations are identified in paragraph 2.b. and addressed by this directive. Questions concerning other confidentiality and privacy legal requirements not covered in this directive should be addressed to the VA Office of General Counsel or Regional Counsel. Generally, the same privacy rules apply across the Department of Veterans Affairs (VA). However, regulations promulgated by the Department of Health and Human Services (HHS) under the Health Insurance Portability and Accountability Act (HIPAA) of 1996 impose additional requirements on VHA’s privacy practices for protected health information.

The HIPAA regulations impose specific requirements for VHA to act, in certain circumstances, as a separate entity from the rest of VA. This directive provides the guidance for these requirements and addresses how VHA simultaneously satisfies the requirements of these regulations and other confidentiality requirements established by statute or regulation.

b. The six statutes (and their implementing regulations) that govern the collection, maintenance, and release of information from VHA records are:

(1) The Freedom of Information Act (FOIA). Title 5 United States Code (U.S.C.)

552, implemented by Title 38 Code of Federal Regulations (CFR), Sections 1.550-

1.562. FOIA compels disclosure of reasonably described VHA records or a reasonably segregated portion of the records to any individual upon written request, unless one or more of nine exemptions apply to the records (see 5 U.S.C. 552(b)(1)-(b)(9) and 38 CFR 1.554(a)(1)-(9)). A FOIA request may be made by any individual (including foreign citizens), partnerships, corporations, associations, and foreign, State, or local governments. Federal employees acting in their official capacities and Federal agencies may not make FOIA requests for VHA records. VHA administrative records are made available to the greatest extent possible in keeping with the spirit and intent of FOIA. All FOIA requests must be processed in accordance with 5 U.S.C. 552, 38 CFR

1.550-1.562, and VA Handbook 6300.3, Procedures for Implementing the Freedom of Information Act.

(2) The Privacy Act, 5 U.S.C. 552a, implemented by VA at 38 CFR 1.575-1.582.

Generally, the Privacy Act provides for the confidentiality of individually-identifiable information about living individuals retrieved by name or other unique identifier. VHA must maintain this information according to the terms of a published Privacy Act system of records and may disclose Privacy Act-protected records only when specifically authorized by the statute. The Privacy Act provides that VHA may collect information about individuals for a purpose that is legally-authorized, relevant, and necessary for VHA to perform its statutory duties. All personally-identifiable and identifiable information must be maintained in a manner that precludes unwarranted intrusion upon individual privacy. Information is collected directly from the subject individual to the extent possible. At the time information is collected, the individual must be informed of the authority for collecting the information, whether providing the information is mandatory or voluntary, the purposes for which the information will be used, and the consequences of not providing the information. The Privacy Act requires VHA to take reasonable steps to ensure that its Privacy Act-protected records are accurate, timely, complete, and relevant. NOTE: The information collection requirements of the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3521) must be met, where applicable.

(3) The VA Claims Confidentiality Statute (formal title, Confidential Nature of Claims), 38 U.S.C. 5701, implemented by 38 CFR Section 1.500-1.527. Section 5701 of 38 U.S.C. provides for the confidentiality of all VA files, records, reports and other papers and documents that pertain to any VA claim, the name and address of present or former personnel of the armed services and their dependents, and permits disclosure of such information only when specifically authorized by the statute. Title 38 CFR Sections 1.500-1.527, are not to be used in releasing information from patient health records when in conflict with The Privacy Act, Confidentiality of Drug Abuse, Alcoholism and Alcohol Abuse, HIV and Sickle Cell Anemia Medical Records, or HIPAA.

(4) Confidentiality of Drug Abuse, Alcoholism and Alcohol Abuse, Human Immunodeficiency Virus (HIV) Infection, and Sickle Cell Anemia Health Records, 38 U.S.C. 7332, implemented by 38 CFR Section 1.460-1.496. Section 7332 of 38 U.S.C. provides for the confidentiality of certain individually-identifiable patient health information about the identity, diagnosis, prognosis or an offer or referral for treatment of drug and alcohol abuse, alcoholism and the testing and treatment of sickle cell anemia or HIV infection, including negative or positive test results. Section 7332 permits disclosure of the protected information only when specifically authorized, in writing, by the patient or legal guardian; or personal representative as authorized by the patient; or by the common disclosure provisions of this statute for each of the following circumstances:

(a) To medical personnel to the extent to meet a bona fide medical emergency;

(b) To qualified personnel for conducting scientific research, management audits, financial audits or program evaluations;

(c) To a public health authority charged under federal or state law with the protection of public health pursuant to a standing written request;

(d) To a court of competent jurisdiction pursuant to a Court Order;

(e) To the Department of Defense (DoD);

(f) To a uninformed spouse or sexual partner of HIV-positive patient;

(g) To a State Prescription Drug Monitoring Program (SPDMP);

(h) To the next of kin to obtain survivorship benefits; or

(i) To the patient’s surrogate under the conditions specified in paragraph 24.e.

(5) HIPAA (Public Law 104-191), implemented by 45 CFR Parts 160 and 164.

HIPAA provides for the improvement of the efficiency and effectiveness of health care systems by encouraging the development of health information systems through the establishment of standards and requirements for the electronic transmission, privacy, and security of certain health information. Most of the privacy requirements are contained in the implementing regulations, which are referred to in this directive as the HIPAA Privacy Rule. VHA must comply with the HIPAA Privacy Rule when creating, maintaining, using, and disclosing individually-identifiable health information.

(6) Confidentiality of Medical Quality Assurance Review Records, 38 U.S.C.

5705, implemented by 38 CFR Section 17.500-17.511. This statute provides that records and documents created by VHA as part of a designated medical quality-assurance program are confidential and privileged and may not be disclosed to any person or entity except when specifically authorized by 38 U.S.C. 5705.

c. When following VHA policies, all six statutes will be applied simultaneously. VHA health care facilities need to comply with all statutes, so that the result will be the application of the more stringent provision for all uses or disclosures of VHA health care data and in the exercise of the greatest rights of the individual. For example, when an individual requests a copy of the individual’s own records, VHA must provide the records to which the individual would be entitled under the Privacy Act, FOIA, and the Right of Access under the HIPAA Privacy Rule. VHA may refuse to provide a copy of the records only where the individual is not entitled to them under all of these legal authorities.

NOTE: De-identified information is not considered to be individually-identifiable;

therefore, the Privacy Act, HIPAA, and VA Confidentiality statutes 38 U.S.C. 5701 and 7332 do not apply, only FOIA (see Appendix A).

d. Compliance with Federal Law, Regulation, and VHA Policy.

(1) All VHA employees must comply with all Federal laws and regulations, VA regulations and policies, and VHA policies.

(2) All employees must conduct themselves in accordance with the rules of conduct concerning the disclosure or misuse of information. Employees are required to annually sign the VA National Rules of Behavior per VA Handbook 6500, Appendix D.

(3) All VHA health care facilities must create facility procedures using the VHA facility Policy and Procedure template which is consistent with procedures and policies contained in this directive. This template can be found at http://vaww.vhaco.va.gov/privacy/templates.htm. This policy must be posted and available to all employees (e.g., posted on the facility’s internal web site).

(4) All VA employees who have access to VHA records must receive annual training on the requirements of Federal privacy and information laws and regulations, VA regulations and policies, and VHA privacy policy. Training must also be provided at the time of VA employment and within 6 months of any significant change in Federal law, regulation, this directive, and/or facility or office policies and procedures regarding privacy, and as otherwise directed in paragraph 38.g. of this directive, Training of Personnel.

(5) VA may not collect or maintain information about individuals that is retrieved by a personal identifier until proper notifications are given to Congress and the Office of Management and Budget (OMB), and a notice is published in the Federal Register as required by the Privacy Act.

e. Use of Information.

(1) All VHA employees may use information contained in VHA records when they need the records in the performance of their official job duties for treatment, payment, and/or health care operations (TPO) purposes. There must be an authorization or other legal authority, (e.g., waiver of HIPAA authorization for research) in order to access a health record for any other reason. Browsing any health record for personal reasons such as looking up appointment for relatives, or accessing the health record of a friend or out of curiosity is strictly prohibited and is a privacy violation. Appropriate disciplinary action may be taken by the supervisor with guidance from Human Resources.

(2) All VHA employees must access or use only the minimum amount of information from VHA records necessary to fulfill or complete their official job duties in accordance with VHA Handbook 1605.02, Minimum Necessary Standard for Protected Health Information.

(3) Where VHA has determined that it is legally permissible to provide access to information or data protected by one or more of the applicable confidentiality or privacy provisions, VHA may do so only after complying with the relevant legal requirements.

(4) Sharing of individually-identifiable information for official VA approved research may require the completion of a Data Use Agreement (DUA) (see paragraph 13, Research; VHA Handbook 1080.01, Data Use Agreement and VHA Handbook 1200.12, Use of Data and Data Repositories in VHA Research).

http://vaww.vhaco.va.gov/privacy/templates.htm

(5) VHA may use a limited data set for the purpose of research, public health, or health care operations without obtaining a HIPAA authorization or waiver of HIPAA authorization. VHA may use individually-identifiable information to create a limited data set pursuant to a DUA. A limited data set is similar to de-identified information, in that it has all direct patient identifiers removed, but a limited data set may contain dates, state, city; and full 5 or 9-digit zip codes.

(6) VHA records may be used for VA-approved research purposes as authorized by law.

(7) Information obtained by VA employees in the performance of official job duties must not be used for research purposes or publications without approval through appropriate VA authority in accordance with applicable VHA research policies including VHA Handbook 1200.12, 38 CFR Part 16, and this directive.

(8) The Office of General Counsel Advisory Opinion (VAOPGCADV B-2004), Disclosure under the HIPAA Privacy Rule and the Privacy Act of Medical Records for Use in an Employee Disciplinary Investigation states that the Privacy Act does not allow the disclosure of a VHA employee’s occupational health record or VHA employee’s Veteran health record to management or personnel officials for disciplinary investigation purposes without prior written authorization from the employee. In addition, management or personnel officials, such as supervisors, may not access a VHA employee’s occupational health record or VHA employee’s Veteran health record for any other employment purpose without the prior written authorization from the employee.

f. Disclosure of Information.

NOTE: Throughout this directive, various situations are described in which individually-identifiable information may be disclosed. Because disclosure is discretionary, individually-identifiable information should not be released unless it is determined that such disclosure is in the best interest of VA or the record subject (e.g., Veteran) except when disclosure is mandated by law or regulation. Questions regarding the appropriateness of such disclosure should be referred to the facility Privacy Officer or the VHA Privacy Officer in advance of the disclosure.

(1) When VHA discloses individually-identifiable information pursuant to legal authority other than a signed, written authorization, the disclosing VHA official shall notify the recipient, preferably in writing, that the information disclosed is confidential and the information must be handled with appropriate sensitivity.

(2) Disclosure of information must be made only from official VHA records. When the request for disclosure requires copies of official VHA records, the request must be in writing.

(3) Individually-identifiable information from VHA records can be disclosed or released only upon receipt of the prior signed-written authorization of the individual or under other legal authority as outlined in this directive. All disclosures must be covered by or listed in the Information Bulletin (IB) 10-163, VHA Notice of Privacy Practices (see VHA Handbook 1605.04, Appendix A).

(4) Any individually-identifiable information related to VHA treatment of drug abuse or referral for drug treatment, alcoholism or referral for alcohol treatment, sickle cell anemia, and testing or treatment for HIV has special protection under 38 U.S.C. 7332.

The information can be disclosed only as authorized by 38 U.S.C. 7332 and implementing VA regulations at 38 CFR 1.460–1.496.

(5) When disclosing individually-identifiable information with non-governmental organizations or individuals, as authorized by law and this directive, for non-VA research purposes VHA may condition the disclosure on the completion of a DUA, which specifies the conditions for the provision of the VHA data. Refer to VHA Handbook 1080.01, Data Use Agreements for detailed guidance.

(6) Limited Data Sets. VHA may disclose a limited data set for research and public health purposes and health care operations pursuant to a DUA or Memorandum of Understanding (MOU). See VHA Handbook 1080.01, Data Use Agreements.

g. Safeguards.

(1) VHA, including each health care facility, must ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of individually-identifiable information and records, including protected health information (PHI), and to protect against any anticipated threats or hazards to the security or integrity of such records, which would result in substantial harm, embarrassment, inconvenience, or unfairness to any individual about whom information is maintained. These safeguards require a VA employee to:

(a) Log off the computer or lock the computer screen when they walk away from the computer or at any time that the computer is left unattended;

(b) Secure and safeguard all protected health information (PHI) by locking PHI in a file cabinet or desk drawer. PHI should not be left unattended per compliance with VA Handbook 6500;

(c) Destroy all documents containing PHI when no longer needed in accordance with VA Directive 6371, Destruction of Temporary Paper Records, and all applicable records control schedules;

(d) Comply with the requirements contained in the VA National Rules of Behavior found in VA Handbook 6500, Appendix D.

(2) Each VHA health care facility must develop clear and explicit policies governing privacy requirements when employees are discussing sensitive patient care issues.

Employees must be conscious of when and where it is appropriate to discuss issues involving individually-identifiable health information to prevent identity theft or unauthorized disclosure of health information. For example, employees should:

(e) Speak quietly when discussing a patient’s condition with family members in a waiting room, telephone, or other public areas;

(f) Speak quietly to the patient when you are in an open area (e.g., emergency room or multiple bed ward); and

(g) Avoid speaking about patients’ PHI in public hallways and elevators. Signs regarding principles of auditory privacy should be posted in public hallways and elevators to remind employees and others to protect patient confidentiality.

NOTE: Facilities do not have to build private, soundproof rooms or alter existing space to prevent overheard conversations about a patient’s condition. The HIPAA Privacy Rule simply requires that facilities provide reasonable safeguards to protect confidential information, such as using curtains, screens, white noise or similar barriers. If a health care facility is planning for new or revised clinical areas, the facility Privacy Officer must be involved in the initial discussions so that the reasonable privacy safeguards are met.

(3) Use of facsimile (fax) or email to disclose individually-identifiable information must strictly adhere to VA Handbook 6500, Information Security Program; VHA Handbook 1907.01, Health Information Management and Health Records; and this directive.

(4) No personal copies of VHA records can be maintained by VHA employees nor should VHA employee access their own records.

(5) VHA employees may maintain required electronic log books with appropriate safeguards in place. No paper log books may be kept unless there is a mandatory regulation that requires the physical log book.

(6) All VHA employees who need to remove and/or transport individually-identifiable information in the performance of their official job duties must have prior written approval from their respective VA supervisor and Information Security Officer (ISO) before individually-identifiable information can be removed from VHA.

h. Sale of Protected Health Information.

(1) VHA may not, and does not, sell protected health information. VHA business associates may not sell protected health information received from VHA.

(2) Except as otherwise described in paragraph 2.h.(3) below, the sale of protected health information is a disclosure of protected health information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information.

(3) The following disclosures of protected health information are not considered a sale of protected health information:

(a) For public health purposes;

(b) For research purposes, where the only remuneration received by VHA or its business associate is a reasonable cost-based fee to cover the cost to prepare and transmit the protected health information for such purposes;

(c) For treatment and payment purposes;

(d) To or by a business associate for activities that the business associate undertakes on behalf of VHA, or on behalf of a business associate in the case of a subcontractor, and the only remuneration provided is from VHA to the business associate or from the business associate to the subcontractor, if applicable, for the performance of such activities;

(e) To an individual, when requested under Right of Access or Accounting of Disclosures, and fees are charged for replication of the records;

(f) When required by law; and

(g) For any other purpose permitted where the only remuneration received by VHA or its business associate is a reasonable, cost-based fee to cover the cost to prepare and transmit the protected health information for such purpose, or a fee otherwise expressly permitted by other law, such a FOIA fees.

i. Fundraising. VHA health care facilities do not use Veterans’ protected health information for fundraising. If a VHA health care facility believes they are using PHI for fundraising purposes, contact the VHA Privacy Office for additional guidance.

3. DEFINITIONS

NOTE: The terms defined below are contained in statutes or regulations. The following definitions are intended to have the same meaning contained in the statutes and regulations, unless otherwise specified, and are meant to be easy to understand without changing the legal meaning of the term.

a. Access. Access is the obtaining or using of information, electronically, on paper, or through other medium, for the purpose of performing an official function.

b. Accounting of Disclosure. An accounting of disclosure is a list of all disclosures made to entities outside VA. This is not the same as the Sensitive Patient Access Report (SPAR).

c. Alcohol Abuse. Alcohol abuse is the use of an alcoholic beverage that impairs the physical, mental, emotional, or social well-being of the user.

d. Amendment. An amendment is the authorized alteration of health information by modification, correction, addition or deletion.

e. Business Associate. A business associate is an entity, including an individual, company, or organization that performs or assists in the performance of a function or activity on behalf of VHA that involves the creation, receiving, maintenance or transmission of PHI, or that provides to or for VHA certain services as specified in the HIPAA Privacy Rule that involve the disclosure of PHI by VHA. Subcontractors of business associates are also considered business associates.

f. Claimant. A claimant is any individual who has filed a claim for disability benefits under 38 U.S.C. 5101, including health benefits, under 38 CFR part 17.

g. Close Friend. A close friend is any person eighteen years or older who has shown care and concern for the patient's welfare, who is familiar with the patient's activities, health, religious beliefs and values, and who has presented a signed written statement for the record that describes that person's relationship to and familiarity with the patient.

h. Compensated Work Therapy Workers. A compensated work therapy worker (CWT) is a patient in an inpatient treatment program who is compensated by VHA.

CWT workers are not VHA employees. CWT workers cannot have access to or work in areas where they will be exposed to individually-identifiable information. VHA may not disclose or release any protected health information to a CWT Worker without the signed written authorization of the individual to whom the information pertains.

i. Contractor. A contractor means a person who provides services to VA such as data processing, dosage preparation, laboratory analyses or medical or other professional services. Each contractor shall be required to enter into a written agreement subjecting such contractor to the provisions of 38 CFR 1.460 through 1.499, 38 U.S.C. 5701 and 7332, and 5 U.S.C. 552a and 38 CFR 1.576(g).

j. Court Leave. For the purpose of this directive, court leave is the authorized absence from official duty of an employee, without charge to leave or loss of salary, to present records in court or to appear as a witness in the employee's official capacity.

k. Court Order. A court order is a written directive or mandate, signed by a court or judge, directing that some action be taken or prohibiting some action being taken. A subpoena is only a court order if it is signed by a judge.

l. De-identified Information. De-identified Information is health information that is presumed not to identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual, because the 18 patient identifiers described in the HIPAA Privacy Rule have been removed or a qualified biostatistician has determined that the health information has been de-identified. De-identified information is no longer covered by the Privacy Act, 38 U.S.C.

5701, 38 U.S.C. 7332, or the HIPAA Privacy Rule. See Appendix A.

m. Designated Record Set. A designated record set is a group of records, maintained by or for VHA, that are the health records and billing records; enrollment;

payment; claims; adjudication; case or medical management records; or records used, in whole or part, to make decisions regarding individuals. For the purposes of this directive, all designated record sets are covered under a System of Records.

n. Diagnosis. Diagnosis is the identification of a disease, condition, situation, or problem based on the systematic analysis of signs and symptoms.

o. Disclosure. Disclosure means a communication of patient identifying information, the affirmative verification of another person's communication of patient identifying information, or the communication of any information from the record of a patient who has been identified.

p. Drug Abuse. Drug abuse means the use of a psychoactive substance for other than medicinal purposes which impairs the physical, mental, emotional, or social well-being of the user

q. Extramural Research. Extramural research as defined in VHA Directive 1200 is research performed by investigators not in the employ of VA, but who may be under contract with VA. For purposes of this directive, the privacy requirements for disclosing information to outside entities under contract with VA is covered under Intramural Research when the disclosure is necessary for the entity to fulfill the terms of the contract.

r. Family Member. Family member includes, but is not limited to, the spouse, parent, child, step-family member, extended family member, and any individual who lives with the veteran but is not a member of the veteran’s family.

s. Financial Remuneration. Financial remuneration means direct or indirect payment from or on behalf of a third party whose product or service is being described.

Direct or indirect payment does not include any payment for treatment of an individual.

t. Fiduciary. Fiduciary means a person who is a guardian, curator, conservator, committee, or person legally vested with the responsibility or care of a claimant (or a claimant's estate) or of a beneficiary (or a beneficiary's estate); or any other person having been appointed in a representative capacity to receive money paid under any of the laws administered by the Secretary for the use and benefit of a minor, incompetent, or other beneficiary.

u. Fundraising. Fundraising is an organized activity or instance of soliciting money or pledges, such as for charitable organizations or political campaigns.

v. Genetic Information. Genetic information, with respect to an individual, means information about: (1) the individual’s genetic tests, (2) the genetic tests of the individual’s family members, (3) the manifestation of a disease or disorder in the individual’s family members, or (4) any request for, or receipt of, genetic services, or participation in clinical research which includes genetic services, by the individual or any of the individual’s family members. Genetic information is health information.

w. Genetic Services. Genetic services means genetic tests, genetic counseling (including obtaining, interpreting, or assessing genetic information), or genetic education.

x. Genetic Test. A genetic test means an analysis of human DNA, RNA, chromosomes, proteins, or metabolites, if the analysis detects genotypes, mutations, or chromosomal changes. Genetic test does not include an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition.

y. Genetic Information Nondiscrimination Act of 2008. Genetic Information Nondiscrimination Act of 2008 (GINA) gives individuals new privacy and nondiscrimination rights with respect to the use of genetic information in health insurance decisions and employment. VHA, as a health plan and health care provider, does not perform underwriting.

z. Health care Operations. Health care operations mean any of the following activities of the covered entity to the extent that the activities are related to covered functions:

(1) Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; patient safety activities (as defined in 42 CFR 3.20); population-based activities relating to improving health or reducing health care costs, protocol development, case management and care coordination, contacting of health care providers and patients with information about treatment alternatives; and related functions that do not include treatment,

(2) Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provide performance, health plan performance, conducting training programs in which students, trainees, or practitioners in areas of health care learn under supervision to practice or improve their skills as health care providers, training of non-health care professionals, accreditation, certification, licensing, or credentialing activities,

(3) Underwriting, enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits, and ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care (including stop-loss insurance and excess of loss insurance),

(4) Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs,

(5) Business planning and development, such as conducting cost-management and planning-related analyses related to managing and operating the entity, including formulary development and administration, development or improvement of methods of payment or coverage policies, and

(6) Business management and general administrative activities of the entity, including, but not limited to, management activities relating to implementation of and compliance with the HIPAA requirements; customer service, including the provision of data analyses for policy holders, plan sponsors, or other customers, provided that protected health information is not disclosed to such policy holder, plan sponsor, or customer; resolution of internal grievances; creating de-identified health information or a limited data set; and fundraising for the benefit of the covered entity.

aa. Health care Provider. For the purpose of this directive, the term health care provider includes an individual who is licensed to provide care such as physicians, nurses, and therapists.

bb. Health Information. Health Information is any information, including genetic information, whether oral or recorded in any form or medium, created or received by a health care provider, health plan, public health authority, employer, life insurers, school or university, or health care clearinghouse or health plan that relates to the past, present, or future physical, mental health or condition of an individual; the provision of health care to an individual; or payment for the provision of health care to an individual.

Health information includes information pertaining to examination, medical history, diagnosis, and findings or treatment, including laboratory examinations, X-rays, microscopic slides, photographs, and prescriptions, etc.

cc. Health Record. The health record consists of both the electronic health record and the paper record, where applicable. The health record is also known as the legal health record. The health record can be comprised of two divisions, the health record and the administrative record. The health record includes documentation of all types of health care service provided to an individual in any aspect of health care delivery. The term includes records of care in any health-related setting used by health care professionals while providing patient care services, reviewing patient data, or documenting their own observations, actions, or instructions. The administrative record contains the administrative aspects involved in the care of a patient, including demographics, eligibility, billing, correspondence, and other business-related information.

dd. Individually-Identifiable Information. Individually-identifiable information is any information pertaining to an individual that is retrieved by the individual’s name or other unique identifier, as well as individually-identifiable health information regardless of how it is retrieved. Individually-identifiable information is a subset of personally identifiable information (PII) and is protected by the Privacy Act.

ee. Individually-Identifiable Health Information. Individually-identifiable health information is a subset of health information, including demographic information collected from an individual, that: (1) is created or received by a health care provider, health plan, or health care clearinghouse (e.g., a HIPAA-covered entity, such as VHA);

(2) relates to the past, present, or future physical or mental condition of an individual, or provision of or payment for health care to an individual; and (3) identifies the individual or where a reasonable basis exists to believe the information can be used to identify the individual. NOTE: VHA uses the term individually-identifiable health information to define information covered by the Privacy Act and the Title 38 confidentiality statutes, in addition to HIPAA. Individually-identifiable health information does not have to be retrieved by name or other unique identifier to be covered by this directive.

ff. Infection with the Human Immunodeficiency Virus. Infection with Human Immunodeficiency Virus (HIV) is the presence of laboratory evidence for HIV. For the purposes of this directive, the term HIV has the same meaning as in 38 CFR § 1.460.

gg. Intramural Research. Intramural research is research performed by VA employees or appointees (including those serving without compensation) at VA facilities and approved off-site locations.

hh. Law Enforcement Official. A law enforcement official is an officer or employee of any agency or authority of the United States (U.S.), a State, a territory, a political subdivision of a State, or territory, or an Indian tribe, who is empowered by law to conduct the following law enforcement activities:

(1) Investigate or conduct an official inquiry into a violation or potential violation of law, or

(2) Prosecute or otherwise conduct a criminal, civil, or administrative proceeding arising from an alleged violation of law.

ii. Legal Guardian. A legal guardian is a person appointed by a court of appropriate jurisdiction to make decisions for an individual who has been judicially determined to be incompetent.

jj. Limited Data Set. A limited data set is protected health information from which certain specified direct identifiers of the individuals and their relatives, household members, and employers have been removed. These identifiers include name, address (other than town or city, state, or zip code), phone number, fax number, Email address, Social Security Number (SSN), medical record number, health plan number, account number, certificate or license numbers, vehicle identification, device identifiers, web universal resource locators (URL), internet protocol (IP) address numbers, biometric identifiers, and full-face photographic images. The two patient identifiers that can be used are dates and postal address information that is limited to town or city, State, or zip code. Thus, a limited data set is not de-identified information, and it is covered by the HIPAA Privacy Rule. A limited data set may be used and disclosed for research, health care operations, and public health purposes pursuant to a Data Use Agreement.

See 45 CFR 164.514(e)(2).

kk. Marketing. Marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service. Marketing excludes communications made: to provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by VHA in exchange for making the communication is reasonably related to VHA’s cost of making the communication; for the following treatment and health care operations, except where VHA receives financial remuneration in exchange for making the communication:

(1) For treatment of an individual by a health care provider, including case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual,

(2) To describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication, including communications about: the entities participating in a health care provider network or health plan network; replacement of, or enhancements to, a health plan; and health-related products or services available only to a health plan enrollee that add value to, but are not part of, a plan of benefits, or

(3) For case management or care coordination, contacting of individuals with information about treatment alternatives.

ll. Medical Emergency. A medical emergency is a condition that poses an immediate threat to the health or life of a person that requires immediate medical intervention.

mm. Next-of-kin. For purposes of this directive a person such as a spouse, adult child, parent, adult sibling, grandparent, or adult grandchild of the individual is not automatically a personal representative of the individual except that VHA recognizes a next-of-kin as a personal representative of a deceased individual.

nn. Non-Identifiable Information. Non-identifiable information is information from which all unique identifiers have been removed so that the information is no longer protected under the Privacy Act, 38 U.S.C. 5701, or 7332. However, non-identifiable information has not necessarily been de-identified and may still be covered by the HIPAA Privacy Rule unless all 18 patient identifiers listed in the HIPAA Privacy Rule de-identification standards are removed.

oo. Patient. For purposes of this directive, a patient is a recipient of VA-authorized health care under 38 U.S.C. Veterans’ Benefits. This includes, but is not limited to, care in a: VA medical center, nursing home care unit, community nursing home, domiciliary, outpatient clinic or readjustment counseling center.

pp. Patient Identifiers. Patient identifiers are the 18 data elements attributed to an individual under the HIPAA Privacy Rule that must be removed from health information for it to be de-identified and no longer covered by the HIPAA Privacy Rule. See Appendix A, De-Identification of Data, for more detail.

qq. Payment. Except as prohibited under 45 CFR 164.502(a)(5)(i), payment is an activity undertaken by a health plan to obtain premiums, to determine its responsibility for coverage, or to provide reimbursement for the provision of health care including eligibility, enrollment, and authorization for services. Payment includes activities undertaken by a health care provider to obtain reimbursement for the provision of health care including pre-certification and utilization review. NOTE: VHA is both a health plan and a health care provider.

rr. Personal Representative. A personal representative is a person who, under applicable law, has authority to act on behalf of the individual to include privacy-related matters. The authority may include a power of attorney, legal guardianship of the individual, appointment as executor of the estate of a deceased individual, or a Federal, State, local or tribal law that establishes such authority (e.g., parent of a minor).

ss. Personally Identifiable Information. Personally identifiable information is any information that can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. Information does not have to be retrieved by any specific individual or unique identifier (i.e., covered by the Privacy Act) to be personally identifiable information. NOTE: The term “Personally Identifiable Information” is synonymous and interchangeable with “Sensitive Personal Information”.

tt. Personnel. For the purpose of this directive, the term personnel includes officers and employees of VA; consulting and attending physicians; without compensation (WOC) workers; contractors; others employed on a fee basis; medical students and other trainees; and volunteer workers, excluding patient volunteers, rendering uncompensated services, at the direction of VA staff. NOTE: Compensated Work Therapy (CWT) patients are part of VHA Vocational and Rehabilitation Services program. They are not VHA personnel; they are patients receiving active treatment or therapy.

uu. Privacy Board. Privacy Board is a term created by the HIPAA Privacy Rule to describe a board comprised of members with varying backgrounds and appropriate professional competencies, as necessary, to review the effect of a research protocol on an individual’s privacy rights when an Institutional Review Board (IRB) does not.

vv. Protected Health Information. The HIPAA Privacy Rule defines PHI as Individually-identifiable health information transmitted or maintained in any form or medium by a covered entity, such as VHA. NOTE: VHA uses the term protected health information to define information that is covered by HIPAA but, unlike individually-identifiable health information, may or may not be covered by the Privacy Act or Title 38 confidentiality statutes. PHI excludes employment records held by VHA in its role as an employer, even if those records include information about the health of the employee obtained by VHA in the course of employment of the individual.

ww. Psychotherapy Notes. Psychotherapy notes are notes recorded by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session (or a group, joint, or family counseling session) and that are separated from the rest of the individual’s health record. Psychotherapy notes exclude counseling session times, modalities and frequencies of treatment, results of tests, and any summary of diagnosis, status, treatment plan, or progress to date. Psychotherapy notes are the personal session notes of the mental health professional for use in composing progress notes for the official VHA health record (see 45 CFR 164.501). Psychotherapy notes may not be used or disclosed without the prior written authorization of the individual to whom the notes pertain. Psychotherapy notes are not considered protected health information.

xx. Record. A record is any item, collection, or grouping of information about an individual that is VHA-maintained, including, but not limited to: education, financial transactions, medical history, treatment, and criminal or employment history that contains the name, or an identifying number, symbol, or other identifying particular assigned to the individual, such as finger or voice print or a photograph. Records include information that is stored in any medium including paper; film and electronic media; and computers, minicomputers, and personal computers, or word processors.

NOTE: Tissue samples or any other physical items, such as clothing, are not considered a record.

yy. Required by Law. Required by law is a mandate contained in Federal, State, local or tribal law and enforceable under the law that compels an entity to collect, create, use, or disclose PHI. This includes, but is not limited to, disclosures under FOIA, court orders, court-ordered warrants, and summonses issued by a governmental or tribal inspector general.

zz. Research. Research is a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalized knowledge.

aaa. Routine Use. A routine use is a statement of Privacy Act discretionary authority, published in the Federal Register in advance of a disclosure, which permits VHA to disclose information or records from a Privacy Act system of records to a person or entity outside of VA without the prior signed-written authorization of the individual who is the subject of the information. A routine use permits the:

(1) Release of PHI only when disclosure is also authorized by other applicable legal authorities, including the HIPAA Privacy Rule, and

(2) Release of drug or alcohol abuse, HIV, or sickle cell anemia medical information only when the disclosure is also authorized by 38 U.S.C. 7332.

bbb. Sensitive Personal Information. Sensitive personal information (SPI), with respect to an individual, means any information about the individual maintained by an agency, including the following: (1) education, financial transactions, medical…