VA Policy Violates Veterans’ Privacy

(This article first appeared in the November/December 2019 issue of the American Postal Worker magazine) ​

The dictionary defines ‘private’ as “belonging to, restricted to or intended for an individual person.” With that it has long been understood and additionally codified in numerous laws that medical records, including those belonging to veterans, are private and protected. They cannot be released, with rare exception, without a patient’s written consent. The Department of Veterans Affairs (VA), however, has recently taken another position based on its interpretation of the Mission Act.

The VA intends to automatically enroll all its registered veterans into Health Information Exchanges (HIE), a system that is being managed by the Sequoia Project/Healtheway, Inc., a third-party administrator. HIE will permit numerous government agencies and private organizations to access veterans’ private medical records without their written consent, unless the veteran revoked their enrollment using VA Form 10-0484 or Form 10-10164. To opt out, forms had to be received in person or by mail at the veteran’s respective local VA Release of Information Office by Sept. 30.

One problem is the VA only provided one business day before the designated deadline for its 2 million registered veterans to act in response to this massive VA privacy policy change. Further VA Form 10-10164, which replaces form 10-0484, had no legal effect until October – so even if it was submitted timely it could arguably not be honored.

Veterans who missed the deadline might also reasonably assume submitting the Opt-Out of Sharing Protected Health Information Through Health Information Exchanges form after-the-fact would prove sufficient. The VA, however, is not processing any revocations for the purpose of opting out individuals who they intend to initially opt in based on its September filing deadline. Another disconcerting wrinkle is veterans who sign this form may not realize they are actually opting themselves into the system. The form requires veterans to opt into HIE before they can be opted out.

Fortunately, VA Form 10-10164 is not the only way veterans can tell the VA they do not want their health information sent to the Exchange. Veterans who are wary of the potential secondary repercussions of the form might instead consider sending a letter to their local VA Release of Information Office instructing the agency not to release their records without their express written consent. They might also instead choose to identify specific information, entities or circumstances where release would otherwise be permitted, e.g. to hospitals in case of a medical emergency.

In an effort to stop implementation of the agency’s decision to share veterans’ health information without consent, a lawsuit was filed on behalf of the Military-Veterans Advocacy and three veterans, case number 19-CV-2956.

In response, the VA produced a declaration to the court at an emergency hearing on the motion, indicating it will not move forward with health information sharing using Health Information Exchanges under its new privacy rule until January 2020.

This is a strategic victory for veterans, allowing additional time for veterans to submit opt out letters revoking their automatic enrollment into HIE, and allowing other possible legal action to unfold. The VA had planned to implement the new procedures as early as this month. To follow veterans’ privacy news as it develops, visit disabledveterans.org.

Thank You for Your Service.

– Human Relations Department