38 U.S.C. 7332 Pertains to Records Containing Identity, Diagnosis, Prognosis, or Treatment for: What the VA Confidentiality Statute Actually Covers

Section 7332 of Title 38 is a federal confidentiality statute that prevents the Department of Veterans Affairs from disclosing records containing identity, diagnosis, prognosis, or treatment information for four specific categories: drug abuse, alcoholism or alcohol abuse, infection with HIV, and sickle cell anemia. The statute covers VA records only, not records held by private providers, the Department of Defense, or community care clinicians billing Medicare. That boundary is the single most important thing to understand before relying on it.

The Four Protected Categories and How the Statute Reads

The text of 38 U.S.C. 7332 names its categories explicitly. VA may not disclose records "to which this section applies" if those records contain identity, diagnosis, prognosis, or treatment information relating to drug abuse, alcoholism or alcohol abuse, infection with HIV, or sickle cell anemia. The identity, diagnosis, prognosis, treatment language is not a separate test; it describes the content that triggers protection once the record falls into one of the four named categories.

A record does not need to be labeled "substance abuse" to fall under the statute. A VA progress note that mentions alcohol use in passing, a lab order that includes an HIV test, or a discharge summary listing sickle cell trait can qualify if the content matches a protected category. The statute protects the information, not the folder it sits in. VA's own privacy guidance, published through the Veterans Health Administration's privacy office, treats these four categories as distinct from ordinary protected health information under HIPAA.

The word "infection" matters for HIV. A negative HIV test result recorded in a VA chart is still a record about testing for infection with HIV, and VA privacy officers generally treat it as protected rather than as a routine lab value. That reading is conservative but consistent with how the statute is written, because the identity, diagnosis, prognosis, or treatment content includes the fact of testing itself.

Sickle cell anemia is the narrowest of the four in practice. Sickle cell trait, which affects roughly 1 in 13 Black Americans according to figures long cited by the Centers for Disease Control and Prevention, is not the same condition as sickle cell anemia. VA facilities vary in how they tag trait results, so a veteran who wants trait information withheld should say so explicitly rather than assume the statute catches it automatically.

What "Disclosure" Means in Practice, Including Within VA

Disclosure under Section 7332 covers more than releasing records to an outside party. VA's implementing regulations at 38 C.F.R. Part 1, particularly the sections governing confidentiality of certain health information, treat sharing protected records between VA staff who do not need them for treatment, payment, or health care operations as a disclosure question. The statute's written consent requirement is the mechanism that keeps those records from moving on routine authorization alone.

Written consent must be specific. A general authorization signed at intake does not automatically cover Section 7332 records for every future purpose. The consent has to identify the record, the recipient, and the purpose, and it can be revoked in writing. VA privacy officers routinely reject blanket authorizations for these four categories, and veterans who have been told "just sign here" at a front desk should ask what specifically is being authorized.

Within a treatment team, the statute does not block a physician from seeing an HIV result needed for care. The practical friction shows up at the edges: a VA police officer, a benefits adjudicator, or a contractor handling scheduling who could see a flagged record without a treatment need. Those are the situations where the statute's teeth show, and where a veteran who believes a disclosure went wrong can file a complaint with the facility's privacy officer or the VA Office of Inspector General.

The statute does not create a private right of action in the ordinary sense. Enforcement runs through VA administrative channels, the Privacy Act's civil remedies where they overlap, and congressional oversight. That gap between a strong-sounding statute and limited individual remedies is one reason veterans' service organizations push for written acknowledgment of every Section 7332 disclosure rather than trusting internal handling alone.

The HIPAA Overlap and Where Section 7332 Stops

HIPAA and Section 7332 are separate regimes that sometimes cover the same document. HIPAA's special protection for psychotherapy notes and its general rules for substance use disorder records under 42 C.F.R. Part 2, administered by the Substance Abuse and Mental Health Services Administration, do different work than Section 7332. A VA record about alcohol abuse can be covered by more than one rule at once, and the strictest applicable rule governs disclosure.

The sharpest boundary is institutional. Section 7332 applies to "records of the Secretary" — meaning VA-held records — and to certain non-VA records that VA obtains for a veteran's care or benefits claim. A veteran's HIV diagnosis recorded at a community care clinic that bills VA is not automatically a Section 7332 record. If VA later receives that record into its own system and uses it for a claim, VA's handling of its copy is covered, but the clinic's own disclosure rules come from HIPAA and state law.

A specific failure case makes the boundary concrete. Suppose a veteran treated at a VA medical center for alcohol use disorder later applies for VA disability compensation. A Veterans Benefits Administration examiner needs the treatment records to evaluate the claim. The VBA has lawful access for benefits purposes, and the veteran's consent is generally obtained through the standard claim authorization. Now suppose the same veteran applies for a private life insurance policy and the insurer requests records through a release. The insurer's request does not reach VA records without a Section 7332-compliant consent, regardless of what the veteran signed for the insurer, because the insurer's authorization format is built for HIPAA, not for this statute.

State law can add protection, not subtract it. Several states have HIV confidentiality statutes stricter than Section 7332, and VA generally follows the more protective rule when a state requirement is more stringent. Veterans in those states should check the state health department's HIV confidentiality guidance alongside VA's own notice.

Why the Statute Rarely Reaches Military and DoD Records

A veteran's military health record sits under the Department of Defense's own privacy rules, primarily the HIPAA-covered Military Health System and DoD's Privacy Act system of records notices. Section 7332 does not govern DoD's handling. A veteran who wants an in-service alcohol treatment note kept from a future employer has to look to DoD and HIPAA rules, not to Section 7332, and the answer may differ from what VA would do with the same content.

The gap becomes visible at transition. Records move from DoD to VA in a disability examination or benefits claim package, and once VA holds them, the Section 7332 analysis attaches to VA's use and redisclosure. Cases where the original DoD record was shared more freely than VA would share its own copy are not a statute violation; they reflect two different legal regimes passing the same document across a boundary.

For veterans with a less-than-honorable discharge and a substance use history, this matters because discharge review boards and upgrade applications often involve records from both systems. A board reading a DoD treatment record is not bound by Section 7332, even though a VA clinician reading the same content would be. Anyone preparing a discharge upgrade package should assume the substance use and HIV content will be seen by the board and plan accordingly, rather than relying on the statute to keep it out.

VA's own notice of privacy practices, which every VA facility must provide, explains which categories fall under Section 7332 and how to request restrictions. Veterans who never received the notice can ask the facility's privacy officer for a copy; the notice is not optional under VA policy.

Consent Mechanics: What a Valid Written Authorization Contains

A valid Section 7332 consent is narrower than people expect. VA's regulations require the authorization to name the specific record or category, the person or entity receiving it, the purpose of the disclosure, and a statement that the veteran may revoke the authorization in writing. A consent form that says "all medical records to all treating providers" fails that test for the four protected categories, and VA privacy staff are supposed to catch it.

Revocation is not retroactive. If VA already disclosed a record in reliance on a valid consent, withdrawing consent later stops future disclosures but does not claw back what was released. That asymmetry is worth knowing before signing anything for a disability claim, a legal proceeding, or an insurance application, because the practical effect of consent outlasts the paperwork.

Timing matters at the edges of care. An emergency disclosure to prevent serious harm can proceed under VA's regulations and under HIPAA's emergency provisions, and the statute's consent requirement yields to those narrow exceptions. Veterans should not assume a family member who calls a VA facility during a crisis will be told nothing; the facility has discretion in a genuine emergency, and the consent requirement is a general rule, not an absolute veto.

Third-party requests deserve scrutiny. Attorneys representing veterans in benefits appeals, employers conducting background checks, and life insurers all send authorizations. A background check authorization signed for an employer does not satisfy Section 7332 because the recipient and purpose are wrong for these records. If an employer's request produces a Section 7332 record, someone at VA made a disclosure error, and the veteran should ask the privacy officer to document it.

VA and VBA: How the Benefits Side Handles Protected Records

Veterans Benefits Administration adjudicators need treatment records to decide claims for substance use disorders, HIV-related conditions, and sickle cell disease. The consent obtained through VA Form 21-4142 and the standard claim process covers VA's internal use for the claim, and VBA access for adjudication is treated as permitted rather than as a disclosure requiring separate consent. Veterans who object to VBA seeing specific treatment notes can say so, but withholding records that support a claim usually costs more than it protects.

The tension shows up in claims for conditions that are themselves the protected information. A veteran claiming service connection for alcohol use disorder, HIV infection, or sickle cell anemia has to put the diagnosis at issue. Section 7332 does not create a way to litigate the claim while keeping the diagnosis from the decision-maker, and claims agents who promise otherwise are overselling.

Records from VA treatment can also surface in the Board of Veterans' Appeals process, where they become part of the appeal record. Veterans who later want those records sealed face the same limits as anyone else in an administrative proceeding; the statute governs VA's disclosure, not the contents of an adjudicative record once it is lawfully part of the case.

One practical step pays off here: request a copy of your own VA records through the Release of Information office before a claim, so you know what the file contains. Veterans who discover an error in a Section 7332-flagged record can ask for amendment under the Privacy Act, which forces VA to review the accuracy question even though it does not guarantee the change.

Worked Scenario: A Sickle Cell and HIV Record Request

Walk through a realistic request. A veteran with HIV and sickle cell trait asks a VA medical center to send records to a new private primary care physician. The evidence needed: the identity, diagnosis, prognosis, treatment content, the recipient's name, the purpose, and a revocation statement. A HIPAA-style release naming "all records" usually fails on specificity for the HIV portion and may fail for the trait portion if VA has tagged it under sickle cell anemia.

The work computation is small but real. VA's release of information offices generally quote a processing window of several business days for routine requests, and requests with a Section 7332 component often take longer because a privacy review is required. That extra review is the statute doing its job, and it is also why a veteran who needs records at a specialist visit days away should start the request early rather than assume same-day service.

The trait question is the edge case most likely to go wrong. Because sickle cell trait is not sickle cell anemia, a facility that treats only the anemia category as protected may release the trait result without Section 7332 review. A veteran who wants trait information withheld should request the restriction in writing and confirm it is in the chart, rather than assume the statute's category covers the trait finding.

If the private physician later shares the HIV result with an insurer without the veteran's authorization, that is a HIPAA problem for the physician, not a Section 7332 problem for VA. The statute protected the record while VA held it; once lawfully disclosed to a non-VA provider, the state and federal rules governing that provider take over.

Common Misreadings That Cost Veterans Time

The most common misreading is that Section 7332 protects all sensitive VA records. It protects four categories. Mental health treatment notes, which many veterans assume are covered by a similar rule, are handled under HIPAA and VA's general confidentiality policies, not this statute, unless the note also involves one of the four categories.

A second misreading is that the statute blocks VA from sharing records with other government agencies. VA can disclose Section 7332 records to another federal agency for certain law enforcement, national security, and public health purposes under conditions set in the regulations, and to state agencies in limited circumstances. The statute is a gate, not a wall.

A third is that consent signed once covers everything forever. Consent is purpose-specific and revocable, and VA's privacy staff should require a fresh authorization when the recipient or purpose changes. Veterans who signed a broad release at intake years ago may find it no longer valid for a new request, which is inconvenient but protective.

A fourth is that a violation entitles the veteran to money damages. Section 7332 does not carry the same civil remedy structure as some other privacy statutes. Remedies run through administrative complaints, Privacy Act claims where they fit, and oversight, which means documentation and prompt complaints matter more than litigation threats.

FAQ

Does Section 7332 apply to my private doctor's records?

No. It binds the Department of Veterans Affairs and certain records VA receives, not community providers. A private physician's HIV or alcohol treatment records are governed by HIPAA and state law, which may be stricter or more permissive than Section 7332 depending on the state. If you want a private provider's record treated like a VA record, ask that provider about state-specific confidentiality rules and written restriction requests.

Can VA share my HIV record with a life insurance company without my consent?

Not under Section 7332's ordinary rule, but VA can disclose in narrow circumstances such as a valid court order or a law enforcement purpose specified in the regulations. Life insurers typically request records through a HIPAA-style authorization that VA will not accept for a 7332 record without a compliant consent. Confirm with the facility's privacy officer before signing anything an insurer sends you.

Is sickle cell trait covered along with sickle cell anemia?

Usually not. The statute names sickle cell anemia, and trait is a different finding that many people carry without any disease. VA facilities vary in how they tag trait results, so ask for the restriction in writing and verify it is documented in your chart. Roughly 1 in 13 Black Americans carries the trait, per long-standing CDC figures, which makes the distinction a live issue rather than a technicality.

What happens if VA discloses my protected record by mistake?

The facility's privacy officer should document the incident, and you can file a complaint with the VA Office of Inspector General or through the facility. Remedies under Section 7332 are administrative rather than a guaranteed payout, and the Privacy Act may add a claim in some situations. Speed matters because VA's internal review depends on the record being preserved and the incident being logged.

Do my military treatment records fall under this statute?

No. Department of Defense records follow DoD privacy rules and HIPAA, not Section 7332. Once those records are transferred into VA's system and VA uses or rediscloses them, the statute can attach to VA's handling. Veterans preparing a discharge upgrade should assume both systems will see the treatment content and plan for disclosure rather than relying on either rule to keep it out.

Can I revoke a consent I already signed?

Yes, in writing, but revocation stops future disclosures only. Records VA already released under a valid consent stay released, which is why the purpose and recipient on the authorization matter so much. Send the revocation to the facility's release of information office and keep a copy; a phone call alone may not be enough to update the file.

Does Section 7332 cover mental health treatment notes?

Not by itself. Mental health records fall under HIPAA and VA's general confidentiality policies unless the content also involves drug abuse, alcoholism, HIV infection, or sickle cell anemia. Veterans who want mental health notes restricted should ask about VA's general confidentiality rules and the psychotherapy notes provisions under HIPAA, which are separate from this statute.

How long does a Section 7332 records request take through VA?

Expect longer than a routine request because a privacy review is typically required. VA release of information offices generally quote several business days for routine matters; requests touching the four protected categories usually add review time. Start the request at least two weeks before a scheduled specialist visit if you need the records in hand rather than sent directly to the provider.

This article is general educational information about a federal confidentiality statute. It is not legal advice, a diagnosis, a treatment plan, or an official VA interpretation, and it promises no particular outcome for any request, complaint, or claim. Rules, forms, and facility practices change, so confirm current requirements with the VA facility's privacy officer, a VA-accredited representative, or a licensed attorney in your state before acting. If you are in immediate danger or at risk of self-harm, contact local emergency services or a crisis line such as 988 in the United States.