The Veterans Administration (VA) is a U.S. government agency responsible for providing services to military veterans. The VA itself is made up of many parts each operating with different forms of information and compliance requirements. In the context of HIPAA, the VHA acts as an organization handling the medical information of veterans and at times their families. It is the VHA as part of the VA that needs to be HIPAA compliant.
The Veterans Benefits Administration (VBA) and the Veterans Health Administration (VHA) are two major parts of the VA.
The VBA primarily handles benefits like disability compensation, pensions, and education assistance. Most of these activities do not involve direct medical care or the type of health transactions covered by HIPAA. Therefore, as stated by the VA Advisory Opinion on HIPAA, “...it seems clear that certain components of VBA are not covered entities.” This means its operations don’t fall under the strict HIPAA rules that apply to the VHA. However, the VBA still has to protect personal information under other laws like the Privacy Act of 1974.
The VHA provides medical care to veterans. It includes everything from routine check-ups to surgeries and long-term treatments. The same VA Advisory Opinion provides, “The Veterans Health Administration (VHA) is designated a health plan to care provided or paid for under Chapter 17 of title 38, United States Code. 42 U.S.C. § 1320d(5)(J). VHA's treatment activities also satisfy the definition of a covered health care provider.” Its status means the VHA must follow strict rules to protect veterans' health information.
The VBA doesn't provide medical care. Instead, it manages benefits like disability compensation and pensions. However, to determine eligibility for these benefits, the VBA sometimes needs medical information from the VHA.
The VHA can share medical information with the VBA without a veteran's written permission under certain conditions. This is allowed because of a special rule in HIPAA, specifically at 45 C.F.R. § 164.512(k)(1)(iii). This rule says that if the information is needed to assess eligibility for VA benefits, the VHA can share it.
Here’s what happens:
As the VHA operates hospitals, clinics, and medical facilities, it is continuously required to adhere to HIPAA regulations to ensure the privacy and security of Protected Health Information (PHI). At the heart of HIPAA compliance within the VHA is the handling of medical records. Any time staff access, update, or share a veteran's medical records, HIPAA's privacy and security rules are in full effect. The interactions between the VBA and VHA relating to veteran benefits also need to remain complaint as long as PHI is involved.
A VA directive on the handling of PHI amongst VA business associates and the VHA provides insight into the commonplace practices and policies applied by the VA.
These policies include:
The directive requires all VA components that qualify as Business Associates of the VHA to enter into BAAs. These agreements ensure that these associates comply with HIPAA standards when handling PHI and EPHI. The BAAs outline the responsibilities of the Business Associates concerning the protection and confidentiality of PHI.
All personnel within the VA who handle PHI are required to undergo training in HIPAA compliance. It allows all employees, contractors, and subcontractors to be aware of the regulations and understand how to handle PHI appropriately to avoid violations.
The VHA conducts periodic reviews to ensure compliance with HIPAA. These reviews help identify any areas of non-compliance or potential improvement, ensuring that all practices meet federal requirements.
In the event of a suspected or actual PHI breach, the VHA has established protocols for incident response. It includes immediate reporting, assessment, containment, and mitigation strategies to prevent further unauthorized access or disclosure.
In March 2024, the Orlando VA Medical Center experienced a data breach when a departing employee sent documents with sensitive veteran information to their personal email. This breach affected 10,059 individuals, exposing data such as Social Security numbers, names, and contact details. In this case, the unauthorized sending of veterans' sensitive data by a former employee shows a failure to meet these HIPAA requirements.
See also: HIPAA Compliant Email: The Definitive Guide
Yes.
Besides healthcare, the VA offers benefits like disability compensation, education assistance, home loans, and life insurance to veterans and their families.
Yes.