Part 2 VA records exception

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

The live 42 CFR 2.12(c)(1) states that Part 2 does not apply to SUD patient information maintained in connection with the Department of Veterans Affairs' specified Title 38 care and services. It directs those records to 38 U.S.C. 7332 and VA regulations issued under that authority. eCFR displays section 2.12 as current through August 20, 2026 and last amended August 13, 2026. The HHS fact sheet confirms the February 16, 2026 compliance date for the 2024 Part 2 amendments.

The exception is tied to VA care and maintenance

42 CFR 2.12 names the Department, information, and care context. Record the VA component, facility, service, record system, creation and maintenance path, patient status, dates, and responsible privacy authority.

Another confidentiality framework governs

The exception does not create an unregulated record. Route uses, disclosures, access, subpoenas, patient rights, security, breaches, and retention through current Title 38 authority, HIPAA where applicable, and other law.

Mixed environments need record-level classification

Community care, contractors, exchanges, non-VA providers, imported records, dual-status systems, and later redisclosures can create different roles. Preserve provenance and do not extend the exception by organizational association.

Confirm all three parts of the connection

Identify the maintaining holder, the VA relationship, and the care or service tied to the record. Section 2.12 names hospital care, nursing-home care, domiciliary care, and medical services under Title 38. Record the VA component, facility or program, service, record system, source, maintenance purpose, dates, and responsible privacy office.

The patient's veteran status or a VA payment does not settle the record's governing framework. A community provider, contractor, exchange participant, or outside Part 2 program may create, receive, or maintain information in a different capacity. Classify each copy and transfer by its actual provenance and holder.

Route the record to the correct framework

The exception is a handoff, not a permission to disclose. Section 7332 protects certain identity, diagnosis, prognosis, and treatment records maintained in connection with covered VA programs or activities and provides its own disclosure rules. Verify current VA regulations, Title 38, HIPAA where applicable, other federal law, state law, and the precise purpose before using or releasing information.

Create a routing matrix for patient access, treatment exchange, payer requests, research, audits, legal demands, law enforcement, family requests, public health, incidents, and retention. Name the authority, approver, minimum data, secure route, notice, logging, and escalation path for each. Do not reuse a Part 2 consent or exception as a substitute for Title 38 review.

Control mixed and copied records

Tag source, holder, governing basis, service, creation date, receipt date, and onward transfer. Keep VA-origin information distinguishable when it enters a community system, and keep community Part 2 information distinguishable when it reaches VA. Avoid a single organization-wide label that erases separate obligations.

Test portals, health-information exchanges, document imports, referrals, release queues, legal holds, analytics, and bulk exports. Reassess when custody, contract, system, service, or recipient changes, and preserve the version and legal analysis used for every material disclosure.

Example

Eight VA-related flows are classified. Six have supported holder, care context, system, authority, and recipient evidence; two rely on a VA patient label. Completeness is 6 of 8 flows.

Record one result per flow

Classify each flow as supported under the VA exception, subject to Part 2, governed by another identified route, or unresolved. State the affected copy, holder, service, dates, evidence, legal framework, permitted next action, and reviewer. For unresolved records, apply an interim restriction and a resolution date.

Have the receiving owner confirm the result before transmission. A sender's classification cannot substitute for the recipient's authority, safeguards, and intended use.

VA-record classification checklist

• identify the holder, VA component, Title 38 care or service, system, and dates;
• preserve the record's source, maintenance purpose, copies, and transfer history;
• route the action through current 38 U.S.C. 7332 and applicable VA rules;
• assess HIPAA, other federal law, state law, contracts, and professional duties separately;
• configure mixed systems and exchanges to retain record-level provenance; and
• document the authority, approver, data, recipient, transmission, and outcome.

This exception does not determine that every veteran-related record falls outside Part 2 or that a disclosure is allowed. The holder, covered service, governing VA authority, other law, and the requested action need qualified VA privacy and legal review.