VA Medical Records Confidentiality — 38 U.S.C. § 7332
VA substance use records are protected by one of the strongest confidentiality statutes in U.S. healthcare. 38 U.S.C. § 7332 provides stricter protection than HIPAA and prohibits disclosure outside VA treatment contexts without written patient consent. This is the legal foundation that makes honest disclosure to VA providers safe.
Stricter Than HIPAA
Your VA substance use records — including anything you tell a provider about cannabis use — cannot be disclosed to law enforcement, employers, courts, family members, or benefits administrators without your written consent. 38 U.S.C. § 7332 is the specific statute that provides this protection, and it carries penalties for VA employees who violate it.
What the Statute Covers
38 U.S.C. § 7332 protects medical records related to:
- Drug abuse
- Alcoholism or alcohol abuse
- Infection with HIV
- Sickle cell anemia
For cannabis use, the drug abuse provision applies. Any records documenting cannabis use, cannabis use disorder diagnoses, or treatment for cannabis-related concerns fall under § 7332 protection.
Who Cannot Access Your Records
Without your written consent, § 7332-protected records are not disclosed to:
- Federal law enforcement (DEA, FBI, etc.)
- State and local law enforcement
- State prosecutors
- Federal, state, or local civil courts (including family court, probate, and civil litigation)
- Employers — federal, state, or private
- Federal hiring agencies for background investigations
- Security clearance investigators
- VA Benefits Administration personnel making disability rating decisions
- Family members (except in narrow safety exceptions)
- Private insurance companies
- Researchers without specific IRB protocols and consent
Who Can Access Your Records (With Your Consent)
With your specific written authorization, records can be shared with:
- Non-VA treatment providers (e.g., a private psychiatrist you are also seeing)
- Attorneys representing you in legal proceedings
- Benefits representatives working on your behalf
- Specific research projects you consent to participate in
You can revoke authorizations at any time. Each authorization typically specifies the recipient, the purpose, the duration, and the scope of records that can be shared.
The Narrow Exceptions
There are narrow legal exceptions where § 7332-protected records can be disclosed without your consent:
- Medical emergency — if information is needed for immediate treatment of a life-threatening condition
- Specific criminal investigation warrants — under certain narrow circumstances involving a special court order (not a standard subpoena)
- Child abuse reporting — where state law requires mandatory reporting and the records are directly relevant
- Audit and program evaluation — anonymized data only
These exceptions are narrow in practice and rarely invoked for routine substance use records.
How § 7332 Differs from HIPAA
HIPAA (the Health Insurance Portability and Accountability Act) applies broadly to healthcare records and has many routine exceptions for "treatment, payment, and operations" (TPO). Under HIPAA alone, substance use records can sometimes be shared for billing, payment, internal quality improvement, and some coordination-of-care purposes without explicit consent.
38 U.S.C. § 7332 is more restrictive. For VA substance use records:
- TPO exceptions are narrower
- Written consent requirements are more specific
- Prohibitions on redisclosure are stricter
- Criminal penalties apply for unauthorized disclosure
What Happens If Records Are Disclosed Improperly
If a VA employee discloses § 7332-protected records without authorization, the consequences can include:
- Civil penalties (fines of up to $5,000 for first offense)
- Potential criminal penalties (misdemeanor or felony depending on circumstances)
- VA employment consequences (disciplinary action up to termination)
- Civil liability for damages to the affected veteran
In practice, the penalties work as deterrents, and improper disclosures are rare. When they occur, they are typically the result of clerical errors rather than deliberate violations.
What This Means for Honest Disclosure
The purpose of § 7332 is to encourage veterans to be honest about substance use with their providers. Congress recognized that veterans would hide substance use from clinicians if doing so could cost them benefits, employment, or legal status — and that hiding substance use produces worse clinical outcomes. The statute explicitly protects disclosure so that clinical care can happen.
This is the foundation of the VHA Directive 1315 protections. Together, § 7332 and the directive create a legal and policy framework designed to make honesty safe. Honest disclosure page.
Practical Implications
- Tell your VA provider about cannabis use. The information is protected, and your provider needs it for safe medication management.
- Your disclosure does not propagate. What you tell your primary care provider about cannabis use does not travel to your VA benefits officer, your security clearance investigator, or your spouse's VA provider.
- Watch what you put in writing to non-clinical VA staff. Disclosures to clinical staff are protected under § 7332. Disclosures to a benefits claims examiner, administrative staff, or on public forms may not have the same protections.
- Subpoenas do not override § 7332. If you are involved in legal proceedings and someone tries to subpoena your VA substance use records, specialized legal procedures apply, and VA does not automatically comply.
- If you are concerned about a specific disclosure, ask your VA Patient Advocate about specific § 7332 protections and whether written consent is being requested or required.