Attachment 09 - VACO National Privacy Guidance Authority to Make Disclosures to Community Partners.pdf

VACO National Privacy Guidance

Authority to Make Disclosures to Community Partners

The VHA Privacy Office, in collaboration with the VHA Homeless Program Office, after discussions with the VA Office of General Counsel, is issuing guidance regarding VHA’s legal authority to disclose

Veteran information and demographics, which is considered protected health information (PHI), to community partners who assist in serving Veterans who are currently homeless or those with a prior episode of homelessness. There is legal authority for the VHA Homeless Program Staff to disclose pertinent Veteran information, excluding 38 U.S.C. 7332-protected information, to community partners without a formal data sharing agreement or prior signed; written authorization from the Veteran IF the requirements of the legal authorities are followed.

The primary privacy laws that must be considered when disclosing to community partners are the

Privacy Act, HIPAA Privacy Rule and Title 38 Privacy Statutes. When following these laws, sharing only the minimum amount of information necessary and keeping an accounting of disclosures made to community partners is required. Keep in mind that all of these laws work together and the more

“protective” law applies when the laws do not agree. The legal authorities under these laws are discussed in detail below.

Privacy Laws and Regulations

The first Privacy law providing authority to disclose to community partners is the Privacy Act. There are two authorities in the Privacy Act that may be applicable to disclosures to community partners. The first authority is Routine Use #40 in the Privacy Act system of record “Patient Medical

Records-VA” (24VA10P2). This Routine Use provides VHA with legal authority under the Privacy Act to disclose relevant health care information to health and welfare agencies, housing resources, and utility companies in situations where VA needs to act quickly in order to provide basic and/or emergency needs for a Veteran and/or a Veteran’s family, if the family resides with the Veteran or serves as a caregiver. Basic need services include safety, shelter, housing and medical needs. This

Routine use provides authority under the Privacy Act for the various disclosures made by VHA to community partners and is the least restrictive (meaning the other laws below must also be satisfied).

The second Privacy Act authority is Routine Use #5 in “Patient Medical Records-VA” (24VA10P2). This

Routine Use provides VHA with legal authority under the Privacy Act to disclose relevant health care information to the extent necessary and on a need-to-know basis, consistent with good medical-ethical practices, to family members and/or the person(s) with whom the patient has a meaningful relationship. For the purposes of this guidance, a meaningful relationship is a connection, association, or involvement between the community partner and the Veteran, where the community partner is trying to provide housing and related services to the Veteran. This Routine use provides authority under the Privacy Act for disclosures made by VHA to community partners who are aware of and trying to provide services to the Veteran.

The second Privacy law providing authority to disclose to community partners is the HIPAA Privacy

Rule, which also has two legal authorities that can be considered when making disclosures to community partners: 45 CFR 164.512(j) and 164.510(b)(1)(ii). The first of these authorities, 164 512(j), provides VHA with legal authority to disclose PHI when VHA, in good faith, believes the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the disclosure is to a person or persons reasonably able to prevent or lessen the threat. VHA is presumed to have acted in good faith with regard to a belief, if the belief is based upon VHA's actual knowledge or in reliance on a credible representation by a person with apparent knowledge or authority. The VA Office of General Counsel has determined that homelessness in and of itself constitutes sufficient serious and imminent threat to an individual to rely upon this disclosure authority. This authority can only be relied upon when a Veteran is known to be homeless and VHA personnel are working with community partners to lessen the threats associated with his or her homelessness.

The second of these HIPAA authorities is 45 CFR 164.510(b)(1)(ii). VHA may use or disclose protected health information to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual's location, general condition, or death. Any such use or disclosure of protected health information for such notification purposes must be in accordance with paragraphs

(b)(2), (b)(3), (b)(4), or (b)(5) of this section, as applicable. These additional paragraphs require, that if the Veteran is present, VHA must obtain the Veteran's agreement and provide them with the opportunity to object to the disclosure, and if the Veteran does not express an objection; or VHA can reasonably infer from the circumstances, based on the exercise of professional judgment, that the individual does not object to the disclosure, VHA may make the disclosure.

If the Veteran is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the Veteran's incapacity or an emergency circumstance, VHA may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the

Veteran and, if so, disclose only the protected health information that is directly relevant to the community partner's involvement with the Veteran’s care or payment related to the Veteran's health care or needed for notification purposes. This authority can be relied upon when there is no imminent threat because the Veteran is known to not currently be homeless, but communication with community partners is critical to assist them as a person who is responsible for their care when that community partner is already aware of and trying to provide services to the Veteran.

38 U.S.C. 7332. VHA does NOT have legal authority to share health information protected under 38

U.S.C 7332 (any information related to the diagnosis of infection with HIV or sickle cell anemia, or the diagnosis of and treatment for drug abuse, alcohol abuse or alcoholism) with community partners

UNLESS a signed, written authorization is obtained from the Veteran. This means that if a Veteran is being treated for, or has, any of these diagnoses, this information or any information that would imply these diagnoses cannot be shared without the Veteran’s signed authorization, including information such as the name of a residential treatment facility that would infer the Veteran is being treated for substance abuse.

Summary of Legal Authorities

In addition to using these authorities to disclose information necessary for the coordination of housing and homeless services, these authorities may also be used to develop and manage “By Name Lists”

(BNL). VA and Non-VA community partners collaborate to develop BNLs, which are master lists of homeless Veterans in the community. These lists are populated through information obtained from outreach, Homeless Management Information System (HMIS; community data collection system), shelters, Homeless Operations Management & Evaluation System (HOMES; VA data collection system), and any other providers in the community who may work with veterans experiencing homelessness. VA and community partners work collaboratively to establish and maintain the BNL, which includes sharing information on Veterans already on the BNL, on Veterans needing to be placed on the BNL and Veterans needing to be removed from the BNL.

• If a Veteran is homeless, 24VA10P2 Routine Use #40 and HIPAA 45 CFR 164.512(j) would provide authority to disclose pertinent information on the Veteran related to obtaining housing and related services, such as the Veteran’s homeless status, without a signed authorization.

• If the Veteran is known to not be homeless, 24VA10P2 Routine Use #5 and HIPAA45 CFR

164.510(b)(1)(ii) would provide authority to disclose pertinent information on the Veteran related to obtaining housing and related services, such as the Veteran’s homeless status, to a community partner aware of and trying to provide services to the Veteran (i.e., being on the

BNL is evidence of the community partner awareness of the Veteran), BUT:

o If the Veteran is present, they should be given the opportunity to object to the disclosure, or o If they are not present, VHA can use its professional judgement to determine if the

Veteran would object and could make the disclosure based on that judgement.

• Regardless of whether or not the Veteran is homeless, the disclosure of 38 USC 7332-protected information requires a signed, written authorization from the Veteran.

Per Routine Use #40 under 24VA10P2/45 CFR 164.512(j) or Routine Use #5 under 24VA10P2/45 CFR

164.510(b)(1)(ii), VHA Homeless Program Staff have legal authority to disclose pertinent Veteran information, excluding 38 U.S.C. 7332-protected information, to community partners without a prior signed, written authorization from the Veteran if these authorities are followed. The VHA Homeless

Program Staff should limit the information disclosed to the community partner to the minimum amount needed for the community partner to immediately assist the Veteran.

VHA facility Privacy Officers should work with local VHA Homeless Program Staff to ensure they understand this guidance and that there is a process for maintaining an accounting of disclosures. A

Basic Rules-of Thumb for Application of these Disclosure Exceptions document is attached for additional reference.

If you have questions about the legal authorities outlined in this guidance, please contact the VHA

Privacy Office using the VHA Privacy Issues mail group at VHAPrivIssues@va.gov. For questions specific to VHA Homeless Program operations, please contact Nicole Harelik, Management & Program

Analyst for Clinical Operations, VA Homeless Programs at nicole.harelik@va.gov

Basic Rules of Thumb for Application of these Disclosure Exceptions

Keep in mind that you have to satisfy the Privacy Act, HIPAA Privacy Rule and 38 U.S.C. 7332 before making a disclosure to a Community Partner. The most protective of these Rules must be satisfied even if the others allow for the disclosure.

The Privacy Act Routine Use #40 – Use when VA needs to act quickly to provide basic and/or emergency services to the Veteran o This broad authority satisfies the Privacy Act IF the applicable HIPAA authority below is also is satisfied and IF 7332 is satisfied (when applicable) o No signed authorization needed o No opportunity to object need be provided to the Veteran o Community Partner to whom you are disclosing needs the information to assist VA in providing basic and/or emergency services to the Veteran o Only the minimum amount of information needed is disclosed

The Privacy Act Routine Use #5 – Use when VA needs to provide information to a person with meaningful relationship with Veteran, such as Community Partner who is aware of and trying to provide services to the Veteran o This broad authority satisfies the Privacy Act IF the applicable HIPAA authority below is also is satisfied and IF 7332 is satisfied (when applicable) o No signed authorization needed o Community Partner to whom you are disclosing needs the information has a need-to-know the information

The HIPAA Privacy Rule 164.512(j) – Use ONLY when the Veteran is in serious or imminent danger (OGC has determined being homeless to be considered a serious or imminent danger) o Satisfies the HIPAA Privacy Rule IF the Veteran is known to be homeless and IF 7332 (if applicable) and Privacy Act are satisfied o No signed authorization needed o No opportunity to object need be provided to the Veteran o Community Partner to whom you are disclosing must be able to lessen the serious or imminent threats associated with homelessness

The HIPAA Privacy Rule 164.510(b)(1)(ii) – Use if the Community Partner is involved in the care or payment for care of the Veterans or providing assistance in locating the Veteran.

o Satisfies the HIPAA Privacy Rule IF the Veteran is NOT homeless, but you need to communicate with Community Partners to facilitate services related to their care and IF

7332 (if applicable) and Privacy Act are satisfied o If the Veteran is present, you must offer them an opportunity to object to the disclosure before making it to the Community Partner o If the Veteran is not present, you may use professional judgement to determine that the

Veteran would not object as long as you are acting in their best interest and you limit the disclosure to the information needed by the Community Partner to meet that interest o If the Veteran does not object or you determine by professional judgement that they would not object (if they are not present), then you may make the disclosure

38 USC 7332 – Use if the Veteran is protected due to diagnoses of Sickle Cell, HIV, and/or alcohol or drug abuse.

o ONLY satisfied by a signed authorization from the Veteran to make the disclosure of this type of information or other information that would imply these diagnoses o You must satisfy this authority only when information in the Veteran’s record contains information about these particular protected diagnoses o You must also satisfy the Privacy Act and the applicable HIPAA authority above