VA Issues Guidance on Releasing Information About Homeless Veterans to Community Service Providers
Washington, D.C. – (RealEstateRama) — The VHA Privacy Office, in collaboration with the VHA Homeless Program Office, after discussions with the VA Office of General Counsel, is issuing guidance regarding VHA’s legal authority to disclose Veteran information and demographics, which is considered protected health information (PHI), to community partners who assist in serving Veterans who are currently homeless or those with a prior episode of homelessness.
There is legal authority for the VHA Homeless Program Staff to disclose pertinent Veteran information, excluding 38 U.S.C. 7332-protected information, to community partners without a formal data sharing agreement or prior signed, written authorization from the Veteran IF the requirements of the legal authorities are followed.
The primary privacy laws that must be considered when disclosing to community partners are the Privacy Act, HIPAA Privacy Rule and Title 38 Privacy Statutes. When following these laws, sharing only the minimum amount of information necessary and keeping an accounting of disclosures made to community partners is required. Keep in mind that all of these laws work together and the more “protective” law applies when the laws do not agree. The legal authorities under these laws are discussed in detail below.
Privacy Laws and Regulations:
The first Privacy law providing authority to disclose to community partners is the Privacy Act. There are two authorities in the Privacy Act that may be applicable to disclosures to community partners. The first authority is Routine Use #40 in the Privacy Act system of record “Patient Medical Records-VA” (24VA10P2). This Routine Use provides VHA with legal authority under the Privacy Act to disclose relevant health care information to health and welfare agencies, housing resources, and utility companies in situations where VA needs to act quickly in order to provide basic and/or emergency needs for a Veteran and/or a Veteran’s family, if the family resides with the Veteran or serves as a caregiver. Basic need services include safety, shelter, housing and medical needs. This Routine use provides authority under the Privacy Act for the various disclosures made by VHA to community partners and is the least restrictive (meaning the other laws below must also be satisfied).
The second Privacy Act authority is Routine Use #5 in “Patient Medical Records-VA” (24VA10P2). This Routine Use provides VHA with legal authority under the Privacy Act to disclose relevant health care information to the extent necessary and on a need-to-know basis, consistent with good medical-ethical practices, to family members and/or the person(s) with whom the patient has a meaningful relationship. For the purposes of this guidance, a meaningful relationship is a connection, association, or involvement between the community partner and the Veteran, where the community partner is trying to provide housing and related services to the Veteran. This Routine use provides authority under the Privacy Act for disclosures made by VHA to community partners who are aware of and trying to provide services to the Veteran.
The second Privacy law providing authority to disclose to community partners is the HIPAA Privacy Rule, which also has two legal authorities that can be considered when making disclosures to community partners: 45 CFR 164.512(j) and 164.510(b)(1)(ii). The first of these authorities, 164 512(j), provides VHA with legal authority to disclose PHI when VHA, in good faith, believes the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and the disclosure is to a person or persons reasonably able to prevent or lessen the threat. VHA is presumed to have acted in good faith with regard to a belief, if the belief is based upon VHA’s actual knowledge or in reliance on a credible representation by a person with apparent knowledge or authority. The VA Office of General Counsel has determined that homelessness in and of itself constitutes sufficient serious and imminent threat to an individual to rely upon this disclosure authority. This authority can only be relied upon when a Veteran is known to be homeless and VHA personnel are working with community partners to lessen the threats associated with his or her homelessness.
The second of these HIPAA authorities is 45 CFR 164.510(b)(1)(ii). VHA may use or disclose protected health information to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual’s location, general condition, or death. Any such use or disclosure of protected health information for such notification purposes must be in accordance with paragraphs (b)(2), (b)(3), (b)(4), or (b)(5) of this section, as applicable. These additional paragraphs require, that if the Veteran is present, VHA must obtain the Veteran’s agreement and provide them with the opportunity to object to the disclosure, and if the Veteran does not express an objection; or VHA can reasonably infer from the circumstances, based on the exercise of professional judgment, that the individual does not object to the disclosure, VHA may make the disclosure.
If the Veteran is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the Veteran’s incapacity or an emergency circumstance, VHA may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the Veteran and, if so, disclose only the protected health information that is directly relevant to the community partner’s involvement with the Veteran’s care or payment related to the Veteran’s health care or needed for notification purposes. This authority can be relied upon when there is no imminent threat because the Veteran is known to not currently be homeless, but communication with community partners is critical to assist them as a person who is responsible for their care when that community partner is already aware of and trying to provide services to the Veteran.
38 U.S.C. 7332. VHA does NOT have legal authority to share health information protected under 38 U.S.C 7332 (any information related to the diagnosis of infection with HIV or sickle cell anemia, or the diagnosis of and treatment for drug abuse, alcohol abuse or alcoholism) with community partners UNLESS a signed, written authorization is obtained from the Veteran. This means that if a Veteran is being treated for, or has, any of these diagnoses, this information or any information that would imply these diagnoses cannot be shared without the Veteran’s signed authorization, including information such as the name of a residential treatment facility that would infer the Veteran is being treated for substance abuse.
Summary of Legal Authorities:
In addition to using these authorities to disclose information necessary for the coordination of housing and homeless services, these authorities may also be used to develop and manage “By Name Lists” (BNL). VA and Non-VA community partners collaborate to develop BNLs, which are master lists of homeless Veterans in the community. These lists are populated through information obtained from outreach, Homeless Management Information System (HMIS; community data collection system), shelters, Homeless Operations Management & Evaluation System (HOMES; VA data collection system), and any other providers in the community who may work with veterans experiencing homelessness. VA and community partners work collaboratively to establish and maintain the BNL, which includes sharing information on Veterans already on the BNL, on Veterans needing to be placed on the BNL and Veterans needing to be removed from the BNL.
• If a Veteran is homeless, 24VA10P2 Routine Use #40 and HIPAA 45 CFR 164.512(j) would provide authority to disclose pertinent information on the Veteran related to obtaining housing and related services, such as the Veteran’s homeless status, without a signed authorization.
• If the Veteran is known to not be homeless, 24VA10P2 Routine Use #5 and HIPAA45 CFR 164.510(b)(1)(ii) would provide authority to disclose pertinent information on the Veteran related to obtaining housing and related services, such as the Veteran’s homeless status, to a community partner aware of and trying to provide services to the Veteran (i.e., being on the BNL is evidence of the community partner awareness of the Veteran), BUT:
o If the Veteran is present, they should be given the opportunity to object to the disclosure, or
o If they are not present, VHA can use its professional judgement to determine if the Veteran would object and could make the disclosure based on that judgement.
• Regardless of whether or not the Veteran is homeless, the disclosure of 38 USC 7332-protected information requires a signed, written authorization from the Veteran.
Per Routine Use #40 under 24VA10P2/45 CFR 164.512(j) or Routine Use #5 under 24VA10P2/45 CFR 164.510(b)(1)(ii), VHA Homeless Program Staff have legal authority to disclose pertinent Veteran information, excluding 38 U.S.C. 7332-protected information, to community partners without a prior signed, written authorization from the Veteran if these authorities are followed. The VHA Homeless Program Staff should limit the information disclosed to the community partner to the minimum amount needed for the community partner to immediately assist the Veteran.
VHA facility Privacy Officers should work with local VHA Homeless Program Staff to ensure they understand this guidance and that there is a process for maintaining an accounting of disclosures. A Basic Rules-of Thumb for Application of these Disclosure Exceptions document is attached for additional reference.
If you have questions about the legal authorities outlined in this guidance, please contact the VHA Privacy Office using the VHA Privacy Issues mail group at 
