(5) How much and what kind of information is to be disclosed.

(6) The signature of the patient and, when required for a patient who is a minor, the signature of a person authorized to give consent under §1.464 of this part; or, when required for a patient who is incompetent or deceased, the signature of a person authorized to sign under §1.465 of this part in lieu of the patient.

(7) The date on which the consent is signed.

(8) A statement that the consent is subject to revocation at any time except to the extent that the facility which is to make the disclosure has already acted in reliance on it. Acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third party payer.

(9) The date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must ensure that the consent will last no longer than reasonably necessary to serve the purpose for which it is given.

(b) Expired, deficient, or false consent. A disclosure may not be made on the basis of a consent which:

(1) Has expired;

(2) On its face substantially fails to conform to any of the requirements set forth in paragraph (a) of this section;

(3) Is known to have been revoked; or (4) Is known, or through a reasonable effort could be known, by responsible personnel of VA to be materially false.

(c) Notification of deficient consent. Other than the patient, no person or entity may be advised that a special consent is required in order to disclose information relating to an individual participating in a drug abuse, alcoholism or alcohol abuse, HIV, or sickle cell anemia program or activity. Where a person or entity presents VA with an insufficient written consent for information protected by 38 U.S.C. 7332, VA must, in the process of obtaining a legally sufficient consent, correspond only with the patient whose records are involved, or the legal guardian of an incompetent patient or next of kin of a deceased patient, and not with any other person.

(d) It is not necessary to use any particular form to establish a consent referred to in paragraph (a) of this section, however, VA Form 10-5345, titled Request for and Consent to Release of Medical Records Protected by 38 U.S.C. 7332, may be used for such purpose. (Authority: 38 U.S.C. 7332(a)(2) and (b)(1))

§ 1.476 Prohibition on redisclosure.

Each disclosure under §§1.460 through 1.499 of this part made with the patient's written consent must be accompanied by a written statement similar to the following:

This information has been disclosed to you from records protected by Federal confidentiality rules (38 CFR Part 1). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 38 CFR Part 1. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient or patient with sickle cell anemia or HIV infection.

(Authority: 38 U.S.C. 7334)

for maintenance treatment or detoxification treatment for the purpose of avoiding an individual's concurrent enrollment in more than one program.

(2) Detoxification treatment means the dispensing of a narcotic drug in decreasing doses to an individual in order to reduce or eliminate adverse physiological or psychological effects incident to withdrawal from the sustained use of a narcotic drug.

(3) Maintenance treatment means the dispensing of a narcotic drug in the treatment of an individual for dependence upon heroin or other morphinelike drugs.

(4) Member program means a non-VA detoxification treatment or maintenance treatment program which reports patient identifying information to a central registry and which is in the same State as that central registry or is not more than 125 miles from any border of the State in which the central registry is located.

(b) Restrictions on disclosure. VA may disclose patient records to a central registry which is located in the same State or is not more than 125 miles from any border of the State or to any non-VA detoxification or maintenance treatment program not more than 200 miles away for the purpose of preventing the multiple enrollment of a patient only if:

(1) The disclosure is made when:

(i) The patient is accepted for treatment;

(ii) The type or dosage of the drug is changed; or

(iii) The treatment is interrupted, resumed or terminated.

(2) The disclosure is limited to:

(i) Patient identifying information;
(ii) Type and dosage of the drug; and
(iii) Relevant dates.

(3) The disclosure is made with the patient's written consent meeting the requirements of §1.475 of this part, except that:

(i) The consent must list the name and address of each central registry and each known non-VA detoxification or maintenance treatment program to which a disclosure will be made; and

(ii) The consent may authorize a disclosure to any non-VA detoxification or maintenance treatment program established within 200 miles after the

consent is given without naming any such program.

(c) Use of information limited to prevention of multiple enrollments. A central registry and any non-VA detoxification or maintenance treatment program to which information is disclosed to prevent multiple enrollments may not redisclose or use patient identifying information for any purpose other than the prevention of multiple enrollments unless authorized by a court order under §§1.490 through 1.499 of this part. (Authority: 38 U.S.C. 7334)

§1.479 Disclosures to elements of the criminal justice system which have referred patients.

(a) VA may disclose information about a patient from records covered by §§1.460 through 1.499 of this part to those persons within the criminal justice system which have made participation in a VA treatment program a condition of the disposition of any criminal proceedings against the patient or of the patient's parole or other release from custody if:

(1) The disclosure is made only to those individuals within the criminal justice system who have a need for the information in connection with their duty to monitor the patient's progress (e.g., a prosecuting attorney who is withholding charges against the patient, a court granting pretrial or posttrial release, probation or parole officers responsible for supervision of the patient); and

(2) The patient has signed a written consent as a condition of admission to the treatment program meeting the requirements of §1.475 of this part (except paragraph (a)(8) which is inconsistent with the revocation provisions of paragraph (c) of this section) and the requirements of paragraphs (b) and (c) of this section.

(b) Duration of consent. The written consent must state the period during which it remains in effect. This period must be reasonable, taking into account:

(1) The anticipated length of the treatment recognizing that revocation of consent may not generally be effected while treatment is ongoing;

(2) The type of criminal proceeding involved, the need for the information

in connection with the final disposition of that proceeding, and when the final disposition will occur; and

(3) Such other factors as the facility, the patient, and the person(s) who will receive the disclosure consider pertinent.

(c) Revocation of consent. The written consent must state that it is revocable upon the passage of a specified amount of time or the occurrence of a specified, ascertainable event. The time or occurrence upon which consent becomes revocable may be no earlier than the individual's completion of the treatment program and no later than the final disposition of the conditional release or other action in connection with which consent was given.

(d) Restrictions on redisclosure and use. A person who receives patient information under this section may redisclose and use it only to carry out that person's official duties with regard to the patient's conditional release or other action in connection with which the consent was given, including parole. (Authority: 38 U.S.C. 7334)

§§ 1.480-1.484 [Reserved]

DISCLOSURES WITHOUT PATIENT CONSENT

§1.485 Medical emergencies.

(a) General rule. Under the procedures required by paragraph (c) of this section, patient identifying information from records covered by §§ 1.460 through 1.499 of this part may be disclosed to medical personnel who have a need for information about a patient for the purpose of treating a condition which poses an immediate threat to the health of any individual and which requires immediate medical intervention.

(b) Special rule. Patient identifying information may be disclosed to medical personnel of the Food and Drug Administration (FDA) who assert a reason to believe that the health of any individual may be threatened by an error in the manufacture, labeling, or sale of a product under FDA jurisdiction, and that the information will be used for the exclusive purpose of notifying patients or their physicians of potential dangers.

(c) Procedures. Immediately following disclosure, any VA employee making an oral disclosure under authority of this section shall make an accounting of the disclosure in accordance with the Privacy Act (5 U.S.C. 552a(c) and 38 CFR 1.576(c)) and document the disclosure in the patient's records setting forth in writing:

(1) The name and address of the medical personnel to whom disclosure was made and their affiliation with any health care facility;

(2) The name of the individual making the disclosure;

(3) The date and time of the disclosure;

(4) The nature of the emergency (or error, if the report was to FDA);

(5) The information disclosed; and (6) The authority for making the disclosure (§1.485 of this part).

(Authority: 38 U.S.C. 7332(b)(2)(A))

§1.486 Disclosure of information related to infection with the human immunodeficiency virus to public health authorities.

(a) In the case of any record which is maintained in connection with the performance of any program or activity relating to infection with the HIV, information may be disclosed to a Federal, State, or local public health authority, charged under Federal or State law with the protection of the public health, and to which Federal or State law requires disclosure of such record, if a qualified representative of such authority has made a written request that such record be provided as required pursuant to such law for a purpose authorized by such law. In the case of a State law, such law must, in order for VA to be able to release patient name and address information in accordance with 38 U.S.C. 5701(f)(2), provide for a penalty or fine or other sanction to be assessed against those individuals who are subject to the jurisdiction of the public health authority but fail to comply with the reporting requirements.

(b) A person to whom a record is disclosed under this section may not redisclose or use such record for a purpose other than that for which the disclosure was made.

(Authority: 38 U.S.C. 7332(b)(2)(C))

§1.487 Disclosure of information relat

ed to infection with the human immunodeficiency virus to the spouse or sexual partner of the patient.

(a) Subject to paragraph (b) of this section, a physician or a professional counselor may disclose information or records indicating that a patient is infected with the HIV if the disclosure is made to the spouse of the patient, or to an individual whom the patient has, during the process of professional counseling or of testing to determine whether the patient is infected with such virus, identified as being a sexual partner of such patient.

(b) A disclosure under this section may be made only if the physician or counselor, after making reasonable efforts to counsel and encourage the patient to provide the information to the spouse or sexual partner, reasonably believes that the patient will not provide the information to the spouse or sexual partner and that the disclosure is necessary to protect the health of the spouse or sexual partner.

(c) A disclosure under this section may be made by a physician or counselor other than the physician or counselor referred to in paragraph (b) of this section if such physician or counselor is unavailable by reason of extended absence or termination of employment to make the disclosure. (Authority: 38 U.S.C. 7332(b))

$1.488 Research activities.

Subject to the provisions of 38 U.S.C. 5701, 38 CFR 1.500-1.527, the Privacy Act (5 U.S.C. 552a), 38 CFR 1.575-1.584 and the following paragraphs, patient medical record information covered by §§1.460 through 1.499 of this part may be disclosed for the purpose of conducting scientific research.

(a) Information in individually identifiable form may be disclosed from records covered by §§1.460 through 1.499 of this part for the purpose of conducting scientific research if the Under Secretary for Health or designee makes a determination that the recipient of the patient identifying information:

(1) Is qualified to conduct the research.

(2) Has a research protocol under which the information:

(i) Will be maintained in accordance with the security requirements of §1.466 of this part (or more stringent requirements); and

(ii) Will not be redisclosed except as permitted under paragraph (b) of this section.

(3) Has furnished a written statement that the research protocol has been reviewed by an independent group of three or more individuals who found that the rights of patients would be adequately protected and that the potential benefits of the research outweigh any potential risks to patient confidentiality posed by the disclosure of records.

(b) A person conducting research may disclose information obtained under paragraph (a) of this section only back to VA and may not identify any individual patient in any report of that research or otherwise disclose patient identities.

(Authority: 38 U.S.C. 7332(b)(2)(B))

§1.489 Audit and evaluation activities.

Subject to the provisions of 38 U.S.C. 5701, 38 CFR 1.500-1.527, the Privacy Act (5 U.S.C. 552a), 38 CFR 1.575-1.584, and the following paragraphs, patient medical records covered by §§1.460 through 1.499 of this part may be disclosed outside VA for the purposes of conducting audit and evaluation activities.

(a) Records not copies. If patient records covered by §§ 1.460 through 1.499 of this part are not copied, patient identifying information may be disclosed in the course of a review of records on VA facility premises to any person who agrees in writing to comply with the limitations on redisclosure and use in paragraph (d) of this section and:

(1) Where audit or evaluation functions are performed by a State or Federal governmental agency on behalf of VA; or

(2) Who is determined by the VA facility director to be qualified to conduct the audit or evaluation activities. (b) Copying of records. Records containing patient identifying information may be copied by any person who:

(1) Agrees in writing to:

(i) Maintain the patient identifying information in accordance with the security requirements provided in §1.466

of this part (or more stringent requirements);

(ii) Destroy all the patient identifying information upon completion of the audit or evaluation; and

(iii) Comply with the limitations on disclosure and use in paragraph (d) of this section.

(2) The VA medical facility director determines to be qualified to conduct the audit or evaluation activities.

(c) Congressional oversight. Records subject to §§1.460 through 1.499 of this part upon written request may be released to congressional committees or subcommittees for program oversight and evaluation if such records pertain to any matter within the jurisdiction of such committee or subcommittee.

(d) Limitation on disclosure and use. Records containing patient identifying information disclosed under this section may be disclosed only back to VA and used only to carry out an audit or evaluation purpose, or, to investigate or prosecute criminal or other activities as authorized by a court order entered under §1.494 of this part. (Authority: 38 U.S.C. 7332(b)(2)(B))

COURT ORDERS AUTHORIZING
DISCLOSURES AND USE

§1.490 Legal effect of order.

The records to which §§ 1.460 through 1.499 of this part apply may be disclosed if authorized by an appropriate order of a court of competent jurisdiction granted after application showing good cause therefore. In assessing good cause the court is statutorily required to weigh the public interest and the need for disclosure against the injury to the patient or subject, to the physician-patient relationship, and to the treatment services. Upon the granting of such order, the court, in determining the extent to which any disclosure of all or any part of any record is necessary, is required by statute to impose appropriate safeguards against unauthorized disclosure. An order of a court of competent jurisdiction to produce records subject to §§1.460 through 1.499 of this part will not be sufficient unless the order reflects that the court has complied with the requirements of 38 U.S.C. 7332(b)(2)(D). Such an order from a Federal court compels disclosure.

However, such an order from a State court only acts to authorize the Secretary to exercise discretion pursuant to 38 U.S.C. 5701(b)(5) and 38 CFR 1.511 to disclose such records. It does not compel disclosure.

(Authority: 38 U.S.C. 7332(b)(2)(D))

§1.491 Confidential communications. (a) A court order under §§ 1.490 through 1.499 of this part may authorize disclosure of confidential communications made by a patient to a treatment program in the course of diagnosis, treatment, or referral for treatment only if:

(1) The disclosure is necessary to protect against an existing threat to life or of serious bodily injury, including circumstances which constitute suspected child abuse and neglect and verbal threats against third parties;

(2) The disclosure is necessary in connection with investigation or prosecution of an extremely serious crime, such as one which directly threatens loss of life or serious bodily injury, including homicide, rape, kidnapping, armed robbery, assault with a deadly weapon, or child abuse and neglect; or

(3) The disclosure is in connection with litigation or an administrative proceeding in which the patient offers testimony or other evidence pertaining to the content of the confidential communications.

(b) [Reserved]

(Authority: 38 U.S.C. 7334)

§ 1.492 Order not applicable to records disclosed without consent to researchers, auditors and evaluators.

A court order under §§ 1.460 through 1.499 of this part may not authorize qualified personnel, who have received patient identifying information from VA without consent for the purpose of conducting research, audit or evaluation, to disclose that information or use it to conduct any criminal investigation or prosecution of a patient. However, a court order under §1.495 of this part may authorize disclosure and use of records to investigate or prosecute VA personnel.

(Authority: 38 U.S.C. 7334)