for Health Care Providers
Confidentiality and the VA Health Care System
This article addresses:
- VA regulations regarding patient confidentiality
- Release of patient records
- Ways to protect the confidentiality of patients with or at risk for HIV/AIDS
Confidentiality in the health care setting is not only the patient's right but a starting point in which to build an effective provider-patient relationship.
In the VA health care system, "confidential" means that under normal circumstances only health care professionals involved in the patient's care and treatment will have access to information contained in their medical file. This information cannot be released to a third party (e.g., insurance company, potential employer, private practice clinician) unless the patient provides special written consent (VA Form 10-5345) for such a release.
When meeting with a patient for their first visit, it may be good to clarify the patient's confidentiality rights and the circumstances under which a VA provider can disclose a patient's medical information without prior consent. These circumstances involve:
- when it is necessary to protect the life or health of any individual (e.g., homicidal or suicidal intent, sexual or physical abuse of a minor)
- when an employee needs to know the information to perform his/her job
- when it is pursuant to a published routine use in the patient medical records system of records
- when it is pursuant to a request from law enforcement entities
- when requested by a Congressional oversight committee or subcommittee, or
- when it is pursuant to a court order.
In regards to a Congressional request, the VA may disclose information to a Congressional office without prior consent in response to an inquiry from the Congressional office made at the request of the patient (not at the request of a third party, such as a family member).
HIV/AIDS information in a patient's VA medical records is formally protected through 38 U.S.C. § 7332. Section 7332 states that any patient's medical record maintained in connection with the performance of any program or activity (including education, training, treatment, rehabilitation, or research) relating to HIV testing and infection, drug abuse, alcoholism and alcohol abuse, or sickle cell anemia can be disclosed only with the specific written consent (VA Form 10-5345) of the individual or as permitted by one of the limited exceptions (see below). Penalties for unauthorized disclosures include a fine of up to $5,000 for the first offense and up to $20,000 for a subsequent offense. Unauthorized disclosures also include verbal disclosures.
Current 38 U.S.C. Section 7332 allows disclosure without the specific consent of the HIV-tested patient under the following circumstances:
- To medical personnel to the extent necessary to meet a bona fide medical emergency.
- To qualified personnel for the purpose of conducting scientific research, management audits, financial audits, or program evaluation; however, redisclosure of such data is subject to further restrictions.
- In response to an appropriate request from a proper federal, state, or local public health authority charged with the protection of the public health and to which federal or state law appropriately requires disclosure of such information, if a qualified representative of such authority has made a written request for that record.
- Where authorized by an appropriate court order.
- To the appropriate component of the Armed Forces which is providing health care to the veteran.
In addition to the circumstances set forth above, one more notable exception to the disclosure rule is set forth in 38 U.S.C. Section 7332. More specifically, that section provides that a physician or "professional counselor" may disclose, under certain conditions, without the patient's consent, only under the following conditions:
- the physician or counselor has made a reasonable effort to counsel and encourage the patient to voluntarily provide this information to the spouse or sexual partner,
- the physician or counselor reasonably believes the patient will not provide the information to the spouse or sexual partner, and
- disclosure is necessary to protect the health of the spouse or sexual partner.
Should a VA patient request that a facility release their medical record to a third party, you should inform the patient that once the record is released, VA has no control over the information within it. This should be discussed before the patient has signed a consent form for the release of medical records.
As a provider, you can protect the confidentiality of your patients through the manner in which you document HIV risk behaviors in their medical records. Because HIV-related discussions frequently involve activities that are stigmatized and sometimes illegal, it is important to keep medical records as neutral as possible. For instance, if a male patient says he has unprotected sex with multiple men, a statement in his medical record could read "engaging in high-risk sexual activities" as opposed to "engaging in unprotected anal sex with other men." This phrasing will document the patient's risk so that other providers involved in his care will be aware of his risk factors, but it won't disclose personal information that the patient may not want to share with unfamiliar providers.
It is important to understand that even well-intended actions can undermine the confidential relationship you have with your patient. Conversations with colleagues about patient information, including HIV/AIDS status and risk behaviors, should be confined to the appropriate settings.
It is not appropriate to discuss a patient's care or clinical status in public areas in clinical settings such as hallways, nurses' stations, clinical front desks, or elevators. Even though the patient may remain unnamed throughout the conversation, certain identifying information may reveal the identity of the patient. It may be helpful to provide your patients with information on VHA confidentiality and patient privacy practices.