Closing the gap in access to military health care records: mandating civilian compliance with the military command exception to the HIPAA privacy rule.
A Reserve Component (RC) commander of a signal battalion is assigned to the 335th Signal Command (Theater), a multi-composition (2) Army Reserve (AR) command. The nearest military installation with a Medical Treatment Facility (MTF) is two hours away from each of his units. Although the battalion consists almost exclusively of Troop Program Unit (TPU) (3) Soldiers, the commander also has a number of Active Guard Reserve (AGR) (4) and Active Duty (AD) Soldiers. The AD Soldiers are the backbone of the unit since they are its principal frill-time asset and act as the commander's eyes, ears, and hands between regularly-scheduled battle assemblies (BAs). (5)
The battalion is deploying in six months. In preparation for deployment, the commander works closely with Human Resources Command (HRC) to obtain a knowledgeable, experienced operations sergeant. Human Resources Command assigns a senior active duty E-8 with two previous deployments and eighteen-and-a-half years of active federal service. The closer the unit gets to deployment, however, the more the noncommissioned officer (NCO) begins to miss duty, ostensibly for medical reasons, which adversely impacts the unit's ability to adequately plan and prepare for deployment. The NCO tells the commander he is currently seeing four civilian health care providers (CHPs): (6) a primary care physician, a neurologist, a pain management specialist, and a psychiatrist. The NCO also claims that CHPs have diagnosed him with fibromyalgia and an anxiety disorder, restricted his duties, and placed him on medication that impairs his ability to drive and stay awake during duty hours. The commander directs the NCO to sign a Department of Defense Form 2870, (7) authorizing release of his civilian medical records (protected health information (PHI)) (8) so the command surgeon can review his records, substantiate his condition, and determine his fitness for duty.
The commander contacts Headquarters, explains the situation, and requests a replacement. Headquarters informs him that it will not replace the NCO until he obtains the NCO's PHI and has the command surgeon substantiate the NCO's diagnosis, prognosis, duty limitations, and deployability. In the meantime, the NCO begins to absent himself from duty between three to four times a week, and, on at least three occasions, faxes in cryptic notes from a local civilian Urgent Care Clinic on the signature of two different physicians' assistants stating, "Cannot perform duties--remain off work."
During the weekend BA, the NCO is overheard saying, "I'll be damned if I'm going to deploy again," and, "I have a plan to avoid deployment, get my twenty years of active federal service, and retire with a Veteran's Administration disability determination." Later that week, two of the NCO's CHPs respond to the commander's medical release requests and deny them, indicating they will only provide the NCO's PHI if he executes civilian release forms in the commander's favor, which the NCO has declined to do. To make matters worse, the Sergeant Major subsequently receives a frantic call from the NCO's wife stating her husband became extremely intoxicated while cleaning his semi-automatic pistol, got a strange look in his eye and said, "I am never going to let them deploy us again."
The commander needs the NCO's PHI as soon as possible to determine his continued fitness for duty and assess whether he may pose a danger to himself and others. In writing, he directs the NCO to do the following: (1) provide him with copies of his PHI as soon as possible; (2) sign civilian medical release forms in his favor, allowing him direct access to the NCO's PHI and authorizing CHPs to discuss the NCO's condition with the commander; (9) and (3) bring copies of relevant portions of his PHI to an emergency mental health care appointment the commander has scheduled.
The NCO drags his feet. First, he claims the CHPs have informed him it will take at least forty-five to sixty days to copy and forward his PHI to the unit, and even though he initially signs civilian medical release forms, he later inexplicably revokes these releases. (10) Next, he misses several MTF appointments, and when he does attend, he fails to bring his civilian PHI, thus impairing the ability of Department of Defense (DoD) health care providers (11) to fully substantiate his claim of fibromyalgia. He then instructs CHPs not to disclose his PHI directly to DoD health care providers. Finally, he fails to cooperate with the DoD behavioral health care specialist by failing to fully answer her questions.
As the unit's judge advocate (JA), you advise the commander of his nonjudicial, adverse administrative, and medical separation options; however, none of these courses of action will provide the commander with a timely solution to the problem of how to gain immediate access to the NCO's PHI, evaluate his physical and mental condition, coordinate adequate mental health care services if and as needed, and obtain a replacement before the unit deploys in thirty days.
Frustrated, the commander calls the CHPs and asks to discuss the NCO's physical and mental condition with them directly, requesting copies of the NCO's PHI. Civilian health care providers tell the commander the Health Insurance Portability and Accountability Act's (HIPAA's) (12) Privacy Regulation (the Privacy Rule) (13) prevents them from discussing the NCO's physical and mental condition with him and providing him with copies of the NCO's PHI absent a signed civilian release. You respond by informing attorneys for the CHPs of the Military Command Exception (14) to HIPAA's Privacy Rule, but they counter by noting that the Military Command Exception is discretionary, not mandatory, and indicate their clients will not honor it in the absence of a signed release from the NCO out of concern for violating HIPAA's Privacy Rule.
This unfortunate scenario highlights the existing disparity in commanders' access to Soldiers' PHI under the current federal regulatory framework governing the privacy of military PHI. Under the current regulatory scheme, military command authorities (15) whose commands, attachments, detachments, and schools are located within the catchment area--defined as forty to fifty miles within the radius of a MTF (16)--benefit from unrestricted (17) access to their Soldiers' PHI as a matter of Army policy. Conversely, military command authorities whose AD and RC Soldiers utilize CHPs under the TR1CARE Prime Remote Program (TPR) (18) lack the same unrestricted access to their Soldiers' PHI as a matter of law. This is because the Military Command Exception is permissive, not compulsory. (19) Consequently, while the DoD mandates DoD health care providers comply with the Military Command Exception within the catchment area, (20) CHPs outside the catchment area can, and regularly do, decline to honor it. (21) Unfortunately for military command authorities outside the catchment area, there is no existing Department of Health and Human Services (DHHS) regulation or TRICARE contractual provision to compel CHPs to comply with the Military Command Exception and provide Soldiers' PHI to military command authorities.
The problem is neither esoteric nor academic. There are approximately 77,000 AGR Soldiers in the RC. (22) Over 44,000 of these Soldiers utilize TPR outside the catchment area. (23) In the AR alone, there are over 16,000 AGR Soldiers, (24) most of who utilize TPR, (25) and the inability of AR commanders to obtain unrestricted access to these Soldiers' PHI has impaired commanders' ability to fulfill their regulatory duty to ensure their Soldiers' medical readiness complies with Army Regulation (AR) 40-501, Standards of Medical Fitness. (26)
While the adverse consequences from the lack of unrestricted access to Soldiers' PHI outside the catchment area are felt most acutely in the RC, the problem is neither unique nor limited to the RC. At present, there are approximately 11,528 AD Soldiers who utilize TPR outside the catchment area. (27) The ability to obtain unrestricted access to AD Soldiers' mental health care PHI when an AD Soldier has demonstrated behavior suggesting he may pose a danger to himself or others is just as important outside the catchment area as it is within the catchment area, and the potential adverse consequences of being unable to access and act upon this information in a timely manner are just as real.
Acknowledging Soldiers' privacy rights must be balanced with the government's interest in ensuring military medical readiness, the DoD has directed changes to the Military Healthcare System (MHS) (28) that will, if implemented, assist commanders and military health care providers in the early identification and treatment of suicidal behaviors by Soldiers outside the catchment area. Pursuant to Department of Defense Instruction (DoDI) 6490.08, (29) issued on 17 August 2011, the Under Secretary of Defense for Personnel and Readiness (USD(P&R)) (30) directed the Director of the Tricare Management Activity (TMA) (31) to implement procedures whereby CHPs outside the catchment area will be required to disclose Soldiers' mental health care PHI to military command authorities under the nine specific circumstances listed in DoDI 6490.08, (32) just as DoD mental health care providers are currently required to do under the DoDI. Although it remains to be seen if, how, and when TMA's successor organization, the Defense Health Agency (DHA), (33) will implement this requirement, it is doubtful this objective can be accomplished without the federal government making significant structural changes to the existing regulatory and/or contractual landscape governing the privacy of Soldiers' PHI.
Part II of this article begins by providing a brief overview of the current statutory, regulatory, and policy framework governing the privacy of Soldiers' PHI in the military. Part III explains how the current regulatory framework has created an illogical, counterintuitive system of disparate command access that is susceptible to abuse by medically non-compliant (34) Soldiers, disregarded by unknowledgeable and uncooperative CHPs, and characterized by a lack of uniformity that has adversely impacted medical readiness and ultimately, national security. Part IV of this article proposes two solutions to this problem and examines arguments for and against implementing these changes. Part V of this article describes how the DHHS and DoD could implement these proposed solutions within and across the MHS. This article concludes with the proposition that the benefits of implementing one or both of these proposed solutions clearly outweigh the potential adverse consequences of maintaining the current counterintuitive and counterproductive status quo.
II. The Statutory, Regulatory, and Policy Framework Governing the Privacy of PHI in the Military
A. HIPAA (35)
Congress passed HIPAA in 1996 and subsequently delegated responsibility to the DHHS to promulgate regulatory standards to protect the privacy of PHI under the authority of HIPAA. (36) Despite its extensive size and scope, HIPAA's substance lies in its implementing regulations. (37) The comprehensive set of regulations governing both the security and privacy of PHI are known as the Administrative Simplification (38) provisions. The portion of the Administrative Simplification provisions designed to protect the security of PHI are referred to singularly as the Security Rule, (39) while the set of regulations designed to protect the privacy of PHI is collectively known as the Standards for Privacy of Individuals' Identifiable Health Information, (40) and unitarily identified as the Privacy Rule. (41)
B. The Privacy Rule
The Privacy Rule is the centerpiece in the legal framework to protect the privacy of PHI. (42) The Privacy Rule's goals are two-fold: to protect the privacy of individual PHI while simultaneously promoting the disclosure of PHI that is reasonably necessary "to protect the public's health and well-being." (43) In this way, the Privacy Rule seeks to strike a balance between individual rights and societal interests. (44)
In disclosing PHI, (45) a covered entity must comply with the Minimum Necessary Rule (MNR), (46) which requires a covered entity to "make reasonable efforts" (47) to request, use, and disclose only the "minimum [amount of information] necessary" (48) to "satisfy a particular purpose or carry out a [particular] function" (49) under one of the twelve Privacy Rule exceptions. (50)
The Privacy Rule exception for military personnel is the "essential government functions" exception, (51) which encompasses the Military Command Exception. (52) In creating the Military Command Exception, the DHHS acknowledged that the unique nature of military service requires Soldiers' privacy rights to be balanced with the public interest in maintaining a strong national defense, a goal that is advanced by ensuring military command authorities have the ability to access their Soldiers' PHI and evaluate their physical and mental conditions to achieve and maintain medical readiness. (53)
C. DoD Regulations
The DoD implemented the Privacy Rule and the Military Command Exception for all DoD components on 24 January 2003 with the issuance of the Health Information Privacy Regulation, DoD 6025.18-R. (54) In addition to reiterating the general principle that military command authorities may use and disclose Soldiers' PHI "for activities deemed necessary ... to assure the proper execution of the military mission," (55) DoD 6025.18-R identifies five specific purposes for which military command authorities may request and use Soldiers' PHI:
(1) to determine a Soldier's fitness for duty, including compliance with other DoD regulatory programs, standards, and directives; (56)
(2) to determine a Soldier's fitness to perform a specific order, assignment, or mission, "including compliance with any actions required as a precondition to performance of such mission, assignment, order, or duty," (57)
(3) to carry out comprehensive medical surveillance activities; (58)
(4) to report casualties in connection with military operations or activities; (59) and
(5) to "carry out any other activity necessary to the proper execution of the mission of the Armed Forces." (60)
Army Regulation 40-66, Medical Records and Administration and Healthcare Documentation, (61) implements the provision of DoD 6025.18-R within the Department of the Army. The regulation clarifies which personnel qualify as military command authorities that "have an official need [to] access [Soldiers' PHI] in the performance of their duties...." (62) Army Regulation 40-66 also identifies nineteen specific activities "necessary to the proper execution of the [military] mission...." (63) Lastly, and significantly, AR 40-66 also imposes an affirmative obligation on MTF commanders to contact military command authorities and disclose Soldiers' PHI sua sponte when they believe a "Soldier's judgment or clarity of thought might be suspect by the clinician and/or .. . [disclosure is necessary] to avert a serious and imminent threat to health or safety of a person, such as suicide, homicide, or other violent action." (64)
D. The DoD Message and Instruction
Former Vice Chief of Staff of the Army (VCSA) General Peter W. Chiarelli clarified Army policy on the privacy of Soldiers' PHI in an All Army Activities (ALARACT) Message 160/2/10. (65) Acknowledging the "critical role [commanders play] in the health and well-being of their Soldiers," (66) the VCSA stated it was essential for commanders to have access to their Soldiers' PHI in a timely manner when Soldiers' health issues adversely affect their fitness for duty. (67) The VCSA stressed the need for continuous and ongoing "collaborative communication" (68) between military command authorities and health care providers. (69) In an attempt to balance Soldiers' privacy interests in their PHI with a commander's need to access this information to maintain medical readiness, the VCSA identified two general categories of access to Soldiers' PHI: unrestricted and excluded. (70)
Commanders have unrestricted access (71) to Soldiers' PHI when it relates to: (1) DoD drug test results; (2) medical readiness and fitness for deployability (e.g., profile status, medical board, immunization and allergy information, etc.); (3) line of duty investigations; (4) changes in duty status resulting from medical conditions (e.g., appointments, hospitalizations); (5) the weight control program; (6) medical conditions or treatments (72) that limit or restrict Soldiers' abilities to perform their duties; and (7) "any perceived threat to life or health." (73)
Commanders are excluded from accessing Soldiers' PHI (74) when it: (1) has no impact on Soldiers' medical readiness or duty fitness (e.g., the taking of routine medicines such as birth control pills, etc.); (2) relates to "the reason for [Soldiers'] medical appointments, routine medical treatments, clinical service seen, or other information that does not directly affect fitness for duty;" (75) and (3) relates to family members, except where a family member is in the exceptional family member program and the circumstances of their enrollment will limit a Soldier's duty assignment. (76)
Department of Defense Instruction 6490.08 provides important additional guidance for DoD providers and military command authorities on the use and disclosure of Soldiers' mental health care PHI. (77) The DoDI establishes a rebuttable presumption of non-disclosure for Soldiers' mental health care PHI and instructs DoD mental health care providers not to disclose Soldiers' mental health care PHI to military command authorities unless a DoD health care provider first determines the information falls within one of the nine exceptions listed in the DoDI. (78) While eight exceptions are the same as those listed in DTM 09-006, (79) the ninth is a catch-all exception that permits DoD mental health care providers to disclose mental health care PHI when they determine the special circumstances of the Soldier's military mission outweigh the Soldier's interests in maintaining the privacy of their PHI. (80) Lastly, and most importantly, the DoDI requires the DoD to establish procedures requiring CHPs who provide mental health care services to Soldiers outside the catchment area to comply with the same mandatory disclosure requirements applicable to DoD mental health providers within the catchment area. This provision states,
[t]he director, TRICARE Management Activity, under the authority, direction, and control of the Under Secretary of Defense for Personnel and Readiness, shall establish procedures comparable to those in Enclosure 2 for applicability to non-DoD health care providers in the context of mental health care services provided to servicemembers under the TRICARE program. (81)
While it is unclear whether this provision constitutes a proactive effort to close an obvious gap in uniform access to Soldiers' mental health care PHI inside and outside the catchment area, or a response to the alarming number of military suicides, (82) it is arguably the most far-reaching action the DoD has directed to date relating to the privacy of Soldiers' PHI within and across the MHS.
E. Regulatory and Policy Goals
While the penultimate goal of the statutory, regulatory, and policy scheme governing the privacy of Soldiers' PHI is balance, the ultimate objective is national security. (83) In implementing these regulations, both DHHS and DoD recognized the national security interest in providing commanders access to "needed medical information held by covered entities so that they can make appropriate determinations regarding ... [their Soldiers'] medical fitness or suitability for military service" (84) to achieve and maintain the overall health of the force. Given the importance of this national security objective, the DHHS rightfully made no distinction between military command authorities inside and outside the catchment area in promulgating the Military Command Exception. Unfortunately, as DHHS and DoD began to implement the Military Command Exception within and across the MHS, the problems inherent in the DHHS choice of discretionary, as opposed to compulsory language in the Military Command Exception began to surface, and the disparate and adverse impact on the MHS became apparent to Military Command Authorities outside the catchment area.
While recognizing the military imperative for commanders to access their Soldiers' PHI to achieve medical readiness and maintain national security, DHHS unfortunately stripped commanders outside the catchment area of the means necessary to accomplish this end by making the Military Command Exception discretionary, not mandatory. In doing so, DHHS thwarted the fundamental objective of the Military Command Exception--to allow commanders much needed access to their Soldiers' PHI in order to achieve and maintain national security.
III. The Problem: The Current Regulatory Framework Creates a Disparity in Commanders' Access to Soldiers' PHI
Despite the discretionary language of the Military Command Exception and DoD 6025.18-R, Army policy mandates DoD health care providers who provide physical health care services to Soldiers within the catchment area comply with the Military Command Exception and provide military command authorities unrestricted access to Soldiers' PHI when relevant to their duty status and medical readiness. (85) Moreover, DoDI 6490.08 mandates DoD behavioral health care providers comply with the Military Command Exception and provide military command authorities with Soldiers' mental health care PHI under the nine circumstances enumerated in the DoDI. (86)
On the other hand, there is no comparable regulatory or contractual mechanism outside the catchment area to compel CHPs to comply with the Military Command Exception. Consequently, while military command authorities within the catchment area are able to rely on Army policy to ensure DoD providers provide them with unrestricted access to their Soldiers' PHI, military command authorities outside the catchment area are wholly dependent on the unpredictable and unreliable willingness of CHPs to become familiar with, understand the purpose of, and voluntarily honor the Military Command Exception. (87)
A. Examination of the Problem in the Army Reserve
The inability of RC commanders in the AR to obtain unrestricted access to their active duty Soldiers' PHI outside the catchment area has impaired their ability to fulfill their regulatory responsibilities under AR 40-501 and ensure their active duty Soldiers are medically fit for duty and deployment. An examination of this problem as it relates to AGR medical readiness in the AR illustrates this fact. (88)
1. The Regulatory Framework for Medical Readiness in the AR
As in the AD, medical readiness in the AR is a shared responsibility between commanders and Soldiers. (89) Army Regulation 40-501 requires AR commanders to ensure AGR Soldiers assigned to their units "complete all medical readiness requirements" (90) and ensure their Soldiers' medical status is "properly documented ... and ... [that] the appropriate follow-up action is taken in regards to ... [their] medical or readiness status." (91) Like their AD counterparts, AR commanders have a right and responsibility to collect, review, and continually monitor AGR Soldiers' PHI to determine their duty restrictions; whether they are taking medications that may adversely affect or limit their duty performance; current immunization status; the need for, and the basis of, temporary or permanent profiles; and their Soldiers' general fitness for duty. (92) Conversely, AR 40-501 requires AGR Soldiers to maintain their medical and dental readiness by "seeking] timely medical advice whenever they have reason to believe that a medical condition or physical defect affects, or is likely to affect, their physical or mental well-being, or readiness status." (93) In addition, AGR Soldiers are required to "seek medical care and report such medical care to their unit commanders (94) ... [and] provide ... commanderfs with] all medical documentation, including civilian health records, and completef] ... annual physical health assessments]." (95) The regulation requires AGR Soldiers to provide AR commanders with their PHI and to regularly supplement this documentation. (96)
2. Problems with Regulatory Compliance
Unfortunately, a number of factors unique to the AR have made it difficult for AR commanders to fully comply with and enforce the requirements of AR 40-501 by actively collecting and reviewing their AGR Soldiers' PHI. First, AR 40-501 fails to fully account for the unique structure and composition of the RC and adequately address the unique challenges RC commanders face in enforcing the Regulation's medical readiness requirements outside the catchment area. For example, while AR 40-501 requires "civilian health records documenting a change which may impact ... readiness status [to be collected] and placed in the ... Soldier's military health record[s]," (97) the regulation contains no discussion of the means, methods, and regulatory and practical obstacles to enforcing compliance with this provision outside the catchment area. Second, because the AR is a part-time force, it must spend most of its limited training time preparing for its primary support mission. Consequently, AR commanders and their Soldiers have had to prioritize their training objectives based upon the limited number of hours and duty days they have each year to train, and this has left them inadequate time to devote the necessary level of focus and attention on fulfilling their joint responsibilities under AR 40-501. (98) Finally, even when AR commanders have found the time to familiarize themselves with their rights and responsibilities under AR 40-501, as a part-time force, they typically do not have the staff and funds necessary to actively enforce AR 40-501's medical readiness requirements to ensure their AGR Soldiers provide military command authorities with initial copies of their PHI and regularly supplement these records each and every time they see CHPs." (99)
3. Resistance from Medically Non-Compliant AGRs
In addition to the above factors, a disproportionate and unacceptably high number of AGR Soldiers have exploited their AR commanders' inability to obtain unrestricted access to their PHI outside the catchment area by failing and refusing to provide military command authorities with initial and ongoing access to their civilian PHI. (100) Moreover, the ongoing problem of medically non-deployable (101) AGRs has been significantly exacerbated by medically non-compliant AGR Soldiers, i.e., AGR Soldiers who "regularly and consistently" (102) willfully fail to cooperate with their commanders' efforts to obtain access to their PHI in accordance with AR 40-501. (103) While the number of medically non-deployable and medically non-compliant AGR Soldiers may seem small in comparison to total AR end strength, (104) it is highly significant when considering the disproportionate impact AGR Soldiers have on the AR since they are the AR commander's principal full-time active duty force in charge of managing the day-to-day operations of the AR unit. (105)
4. Frustration with Current Enforcement Tools
Army Reserve commanders have been consistently frustrated with the tools available to compel medically noncompliant AGRs to meet their obligations under AR 40-501 and provide AR military command authorities with access to their PHI. (106) Nonjudicial punishment and adverse administrative action are often times the only means AR commanders have to compel medically non-compliant AGR Soldiers to comply with AR 40-501 and provide access to their PHI. (107) Even when these disciplinary and administrative measures have achieved their desired result, many AR commanders have found them to be blunt, cumbersome, excessively time-consuming, and ultimately cost-ineffective given the part-time nature of the force. (108) This is because AR commanders, unlike their AD counterparts, are not on active duty approximately twenty-four to twenty-eight days a month, usually do not have fulltime medical and legal staffs to assist them in working these actions, and must divert increasingly limited resources from other operational and administrative needs to compel medically non-compliant AGR Soldiers to comply with their legal obligations under AR 40-501 and provide initial and ongoing access to their PHI.
5. CHPs' Resistance to, and Disregard of, the Military Command Exception
In response, AR commanders have attempted to circumvent medically non-compliant AGR Soldiers by contacting CHPs and requesting CHPs provide them with unrestricted access to their Soldiers' PHI and discuss their Soldiers' physical and mental conditions directly. (109) Unfortunately, AR commanders and their medical and legal staffs have routinely found CHPs to be resistant to the Military Command Exception. (110) Civilian health care providers are usually unfamiliar with the Military Command Exception, and when they learn of it, many of them are uncomfortable complying with it. (111) Consequently, CHPs have routinely declined to honor the Military Command Exception outside the catchment area based on an overabundance of caution for fear of violating HIPAA's Privacy Rule and concerns about potentially gamering a professional responsibility complaint. (112) This, in turn, has exacerbated the inability of AR commanders to effectively deal with the problem of medically non-compliant AGRs. (113)
6. Adverse Impact on AR and AD Medical Readiness
The inability of AR commanders to adequately fulfill their regulatory responsibilities under AR 40-501 as it relates to medically non-compliant AGRs has negatively impacted overall AR medical readiness. (114) This is because AGR Soldiers are the military backbone of the AR (115) and, a fortiori, problems with AGR medical readiness directly impact the entire AR and the Reserve Component. According to Major Missy Delk, former Manager of the Reserve Readiness Health Program (RHRP), Office of the Surgeon, U.S. Army Reserve Command (USARC), who participated in a seminal nationwide Lean Sigma Six Study of AR medical readiness, the number of medically non-deployable AGR Soldiers in the AR has at times posed a serious problem. (116) The Study found that at one time, 7.5% of the extant AR AGR population was medically nondeployable. (117) 118 National statistics also show the AR has failed to meet overall DoD medical readiness standards. (118) Moreover, the AR's integration in the AD's organizational structure has all but ensured that problems with AR medical readiness have negatively impacted AD medical readiness. The RC makes up approximately twenty percent of the Army's organizational structure, (119) provides almost half of the Army's combat support units, and supplies approximately twenty-five percent of its mobilization base expansion capability. (120) As a result, the AR has become a "fully integrated and critical part of an operational, expeditionary Army." (121) The fact that AR medical readiness has negatively impacted AD medical readiness is further supported by statistical data demonstrating that the AD, like the RC, has at times also "been unable to meet [its] minimum [medical readiness] goals." (122)
B. Broader Implications
The inability of commanders outside the catchment area to obtain unrestricted access to Soldiers' PHI is not limited to the RC. Active Duty commanders outside the catchment area face the same obstacle. At present, there are approximately 11,528 AD Soldiers enrolled in TPR outside the catchment area. (123) While this number is less than the RC, the need for AD commanders to obtain unrestricted access to their Soldiers' PHI to achieve and maintain medical readiness is no less important outside the catchment area than it is inside the catchment area. Army suicide statistics (124) among AD Soldiers demonstrate the military's suicide problem is unaffected by geography. Active Duty commanders need the same level of access to their Soldiers' mental health care PHI outside the catchment as their AD counterparts within the catchment possess if they are to play a meaningful and proactive role in assisting CHPs in identifying suicidal ideations and preventing Soldiers from harming themselves and others.
In implicit recognition of this fact, the DoD directed the TMA, (125) under the authority of the USD(P&R), to direct CHPs to disclose Soldiers' mental health care PHI to military command authorities outside the catchment area under the same circumstances DoD mental health care providers are required to do under DoDI 6490.08. (126) According to Paul Bley, Chief, Administrative and Civil Law Branch, Defense Health Agency, how, when, and even if, the DHA will accomplish this goal is still unclear. (127) Two potential solutions exist to implement this mandate and solve the problem of disparate command access to PHI.
IV. The Solution: Regulatory Revision and Contractual Mandate
There are two potential ways for the DHA to comply with the USD(P&R)'s directive and eliminate the gap in commanders' access to Soldiers' PHI outside the catchment area:
(1) change the discretionary language of Military Command Exception in the Privacy Rule to mandate CHPs honor the Military Command Exception and provide military command authorities with unrestricted access to Soldiers' PHI; and/or
(2) change the TRICARE network provider contract and non-network reimbursement requirements to make compliance with the Military Command Exception a mandatory precondition to becoming a TRICARE network provider or approving reimbursement to non-network providers for providing health care services to active duty Soldiers enrolled in TPR outside the catchment area.
As the arguments below demonstrate, either of these proposed solutions--alone or in concert--would remedy the lack of uniformity in the current bifurcated regulatory framework, improve the MHS, and ultimately enhance our national security posture.
A. Arguments for Mandating Unrestricted Access to Soldiers' PHI Outside the Catchment Area
1. The Current Regulatory Framework is Illogical and Counterintuitive
The DHHS's decision to make the Military Command Exception discretionary is illogical and counterintuitive. While recognizing the importance of creating an exception to the Privacy Rule to ensure military command authorities have access to their Soldiers' PHI to achieve and maintain medical readiness, the DHHS thwarted this objective by allowing CHPs to disregard the Military Command Exception at will. Consequently, as written, the Military Command Exception undermines its ostensible goal of ensuring military command authorities can access their Soldiers' PHI to accomplish their military mission and maintain national security. Rather than providing military command authorities outside the catchment area with a right to access this information, the Military Command Exception merely gives military command authorities the right to hope CHPs will provide them access to this information. In this way, the Military Command Exception gives military command authorities a right without a remedy.
By withholding the means necessary for military command authorities outside the catchment to ensure they can achieve and maintain medical readiness by gaining access to their Soldiers' PHI when active duty Soldiers fail or refuse to provide ready access to these records, as written, the Military Command Exception impairs, rather than advances, the ultimate goal of national security. (128) If it is a national security imperative that military command authorities within the catchment be provided unrestricted access to their Soldiers' PHI, then it is just as critical to national security that military command authorities outside the catchment area be given that same level of access. With that in mind, it is completely illogical to allow geographic location, as opposed to legitimate need, to determine whether military command authorities are provided unrestricted access to their Soldiers' PHI.
2. The Current Regulatory Framework Lacks Essential Uniformity
The current bifurcated regulatory system lacks the uniformity necessary and essential for an efficient and effective national MHS. Uniformity imbues the MHS with the consistency, stability, predictability, and efficiency it needs to ensure military command authorities can achieve and maintain medical readiness in order to accomplish their military missions and maintain national security. Military command authorities need to be able to rely on clear, unambiguous, uniform, and consistent standards when it comes to fulfilling their responsibilities under AR 40-501 and ensuring they have a medically ready force.
As written, the Military Command Exception is disuniform and injects an unnecessary and unacceptable degree of inconsistency and uncertainty into the MHS. This reasoning is supported by the findings of a recent RAND study on medical readiness in the RC, which found that "inconsistencies in procedures for obtaining medical readiness compliance" (129) were impediments to military medical readiness. By placing obstacles to medical readiness in the path of commanders outside the catchment area by denying them the ability to rely on uniform, standardized, medical readiness compliance procedures to achieve and maintain Soldiers' medical readiness, policymakers are unfairly impairing commanders' ability to fulfill their regulatory-mandated military medical readiness mission. In light of the solutions available to remedy this problem, this is not only unnecessary, it is unacceptable.
3. The Current Regulatory Framework Is Vulnerable to Abuse by Medically Non-Compliant Soldiers
As demonstrated by problems with AGR medical readiness in the AR, (130) medically non-compliant active duty Soldiers stationed outside the catchment area can, and routinely do, exploit the inability of military command authorities to obtain unrestricted access to their PHI. The absence of a regulatory or contractual mechanism to allow military command authorities to effectively counter this problem by going directly to CHPs and obtaining unrestricted access to their Soldiers' PHI places medically non-compliant Soldiers, rather than commanders, at the helm of the medical readiness compliance procedures outside the catchment area. It gives medically non-compliant Soldiers-many of whom have a disincentive to cooperate with their commanders by providing their PHI to military command authorities when facing medical separation or other adverse administrative action--the ability to control the pace and speed at which military command authorities and the MHS are able to access Soldiers' PHI, evaluate their mental and physical conditions, ensure their continued fitness for duty, get them necessary mental health care services if and when needed, and reassign and/or medically separate them if and as necessary.
The DoD does not allow Soldiers within the catchment area to exert this type and degree of control over the medical readiness compliance process, and it should not allow Soldiers outside the catchment area to do so either Doing so allows medically non-compliant Soldiers outside the catchment the ability to weaken the MHS in a way that is unacceptable.
4. The Current Regulatory Framework Allows CHPs to Disregard the Military Command Exception to the Detriment of RC Medical Readiness and National Security
The current regulatory framework also gives CHPs outside the catchment area the ability to exert an unacceptable degree of influence over the military medical readiness compliance process to the detriment of RC medical readiness. As experience in the AR has demonstrated, CHPs can, and routinely do, decline to honor the Military Command Exception. (131) This has impaired the ability of RC commanders to fully comply with AR 40-501 and hampered the AR's efforts to meet its medical readiness goals. (132) Even in those instances where CHPs do honor the Military Command Exception, the Privacy Rule's Minimally Necessary Rule (133) still gives CHPs outside the catchment area a de facto veto power over commanders' ability to review a Soldiers' PHI by giving CHPs the ability to second-guess commanders and limit their access to the information CHPs--not commanders--deem relevant to Soldiers' military duties. While this level of influence may be acceptable within the catchment area when exercised by DoD health care providers who are familiar with the military and its culture, the wisdom of leaving this authority in the hands of CHPs is highly questionable.
Department of Defense health care providers are generally familiar with the military, its mission, and their patient's military responsibilities. They are required to closely coordinate with military command authorities in making minimally necessary determinations. Civilian health care providers, on the other hand, are generally unfamiliar with the military, its culture, mission, and their military patients' working environments and occupational specialties. (134) The fact that DoD does not allow DoD health care providers within the catchment area to exert this level of influence over the military medical readiness compliance process by declining to comply with the Military Command Exception is strong evidence that CHPs outside the catchment area should also not possess this level of influence over the MHS. We cannot afford to leave this dimension of our national security to the discretion of unpredictable and potentially unsympathetic CHPs.
B. Arguments Against Mandating Unrestricted Access to Soldiers' PHI Outside the Catchment Area
1. The DHHS Does Not Possess the Constitutional Authority to Mandate CHPs Comply with the Military Command Exception Outside the Catchment Area
While neither DHHS' commentary to the Military Command Exception nor DoD public comments to the proposed Privacy Rule discuss the issue, the argument that the DHHS lacks the constitutional authority to mandate CHPs comply with the Military Command Exception outside the catchment area is a legitimate concern. It is an issue that at least one senior attorney in the MHS who played a significant role in the regulatory process of drafting and implementing the Military Command Exception believes is a potential impediment to changing the Military Command Exception. (135) However, both case law and existing regulatory language in the Privacy Rule support the argument that DHHS has the constitutional and regulatory authority to compel CHPs to comply with the Military Command Exception outside the catchment area under the Commerce Clause. (136)
a. Case Law
In Association of American Physicians v. U.S. Department of Health, (137) plaintiffs argued that the DHHS exceeded its statutory authority under HIPAA by regulating non-electronic, as well as electronic, PHI under the Privacy Rule. In rejecting this argument, the court held that the enactment of HIPAA was within Congress's power under the Commerce Clause, and that DHHS' promulgation of the Privacy Rule was within the scope of its authority under HIPAA. More importantly, citing the Supreme Court's decision in Thorpe v. Housing Authority of City of Durham (138) for the proposition that a regulation is proper as long as it is "reasonably related to the purposes of the enabling legislation," (139) the court held that the DHHS had the authority to promulgate privacy regulations under the Privacy Rule as long as they were "reasonably related to [one of the enumerated] purposes of HIPAA." (140) Two years later, in Citizens For Health, et al., v. Thompson, (141) plaintiffs challenged the final version of the Privacy Rule on grounds that it impermissibly authorized disclosure of PHI without a patient's consent.
Dismissing the plaintiffs' contention that HIPAA only allowed the DHHS to promulgate regulations under the Privacy Rule that enhanced, not reduced, a patient's privacy, the court affirmed the principle that as long as a regulation is reasonably related to a legitimate exercise of validly delegated legislative authority, it will withstand constitutional challenge. In doing so, the court stated that "[although HIPAA also required the Secretary to protect the privacy of health information, the court finds nothing ... requiring the Secretary to maximize privacy interests over efficiency interests." (142) Based on this reasoning, the court upheld the DHHS's action in authorizing the release of PHI without patient consent as constitutionally permissible because the DHHS's actions were reasonably related to HIPAA's purpose of improving the efficiency and effectiveness of the healthcare system. Read together, the holdings in Association of American Physicians & Surgeons and Citizens for Health support the argument that as long as the DHHS can demonstrate a Privacy Rule regulation is reasonably related to HIPAA's constitutionally permissible purpose of improving the efficacy and efficiency of the health care system, there is a reasonable basis to conclude its actions will be deemed a valid exercise of its legitimately delegated authority under the Commerce Clause.
b. Existing Regulatory Authority
The Privacy Rule already grants the DHHS the ability to compel disclosure of an individual's PHI in the context of mandatory compliance reviews, (143) and the DHHS's right to do so in that context has not been successfully challenged on constitutional grounds. Consequently, allowing the DHHS to compel disclosure of individual PHI under a second set of circumstances--albeit for the different, but similarly legitimate reason of advancing HIPAA's goal of maximizing the efficiency and effectiveness of the healthcare system--would simply be a logical and legitimate extension of the DHHS's current regulatory authority to compel disclosure of PHI under HIPAA if, when, and where warranted to accomplish HIPAA's ends.
2. The DoD Lacks Regulatory Authority to Impose a Contractual Mandate on CHPs Under TRICARE
A second argument against mandating compliance with the Military Command Exception outside the catchment area is that DoD lacks the regulatory authority to impose a contractual mandate on CHPs absent specific congressional authorization or the DHHS's affirmative amendment of the Military Command Exception. A review of existing federal statutes and regulations granting DoD authority to promulgate rules, regulations, and contractual provisions governing the provision of military health care to Soldiers, however, belies this argument. The statutory basis for the DoD's authority to impose a contractual mandate on CHPs to comply with the Military Command Exception as a precondition to joining the TRICARE network or authorizing the payment of non-network CHPs for treating Soldiers outside the catchment area is Title 10, Chapter 55 of the U.S. Code. (144) This statute authorizes the Secretary of Defense to administer the Civilian Health and Medical Program of the Uniformed Services (CHAMPUS/TRICARE) for the Army, Navy, Air Force, and Marine Corps. (145) Pursuant to this authority, the DoD has the right to "[establish policies, procedures, and standards that shall govern management of DoD health and medical programs, including ... patient rights and responsibilities, medical quality assurance, medical records ... [and] health information privacy." (146)
The DHA falls under the USD(P&R) (147) and operates under the authority, direction, and control of the Assistant Secretary of Defense for Health Affairs (ASD(HA)). (148) Since the DHA assumed the TMA's functions on 1 October 2013, it now has the authority and responsibility to administer all DoD medical and dental programs in the MHS. (149) Prior to its disestablishment, the DoD delegated authority to the TMA to promulgate regulations (150) to implement medical programs that are "necessary to achieve important Federal interests, including but not limited to the assurance of uniform national health programs for military families ... that have a direct and substantial effect on the conduct of military affairs and national security policy of the United States." (151) By directive of the Deputy Secretary of Defense, the DHA now possesses this same authority. (152)
This regulatory mandate includes the authority to enter into and establish the terms and conditions of agreements with CHPs to become network providers (153) through TRICARE's three geographically based Managed Care Support Contractors (MCSCs). Moreover, it also includes the authority to establish reimbursement criteria for non-network CHPs who choose not to become TRICARE network providers by signing a TRICARE provider agreement, but who nevertheless choose to treat Soldiers outside the catchment area and seek subsequent reimbursement. (154) This grant of statutory and regulatory authority to advance the important federal interest in ensuring uniform military health care arguably encompasses the right to impose a contractual mandate on CHPs network providers, as well as to set reimbursement conditions on non-network providers as a precondition for being reimbursed for treating Soldiers. As federal courts have recognized, when Congress provides the DoD the authority to promulgate regulations to accomplish a legislatively-mandated purpose, it also grants the DoD the discretion to determine the mechanisms by which it will accomplish those ends. (155) Consistent with this authority, imposing a contractual condition on network CHPs and the establishment of reimbursement criteria for non-network CHPs that mandates their compliance with the Military Command Exception are legitimate means to establish and maintain a uniform MHS.
3. Imposing a Regulatory Mandate or Contractual Precondition Would Erode the Quality of Health Care in the MHS by Reducing the Number of CHPs
A third argument against mandating compliance with the Military Command Exception outside the catchment area is that it would discourage CHPs from becoming TRICARE providers, reduce the pool of available CHPs, and erode the quality of health care throughout the MHS. While this is a legitimate concern, it is nevertheless unlikely for three reasons. First, analogous arguments were raised in opposition to the Privacy Rule and its mandatory and discretionary disclosure requirements (156) when first proposed, and these fears proved unfounded. (157) Extending the DHHS's existing authority to compel disclosure of individual PHI under one more set of circumstances to encompass military PHI is similarly unlikely to reduce the pool of available CHPs willing to treat Soldiers outside the catchment area.
Second, it would encourage rather than discourage CHPs from providing health care services to Soldiers outside the catchment area because it would give CHPs the confidence they need to comply with the Military Command Exception without undue fear of violating HIPAA's Privacy Rule or subjecting themselves to an unwarranted, frivolous lawsuit or charge of breach of confidentiality and professional ethics. According to AR physician Dr. (Lieutenant Colonel) (LTC) Bedemi Alaniyi-Leyimu and Dr. (LTC) (Promotable) Robert Butts, mandating compliance with the Military Command Exception would incentivize CHPs to treat Soldiers by providing CHPs with a bright-line rule granting them clear and unequivocal regulatory and/or contractual authority (protection) to disclose PHI in the absence of a Soldier's verbal consent or signed release. (158)
Third, assuming arguendo that some CHPs might decline to become TRICARE network providers, or existing TRICARE network providers might decline to renew their contracts, the overall benefit of a uniform national military health care medical compliance system and the resulting benefit to national security far outweigh the possible adverse consequences of a potentially small decrease in the pool of CHPs willing to treat Soldiers outside the catchment area. Even if this did happen, Congress could effectively counter this problem by following the example of Oregon and creating an individual income tax incentive for CHPs to become and remain TRICARE providers. (159)
V. Implementing Change
To fully understand how either or both of these proposed solutions could be implemented, it is helpful to provide an overview of the structure of the DoD's Health Program and the principal authorities, officials, agencies, programs, and processes within the MHS that would play a role in implementing these changes.
A. The DoD Authorities, Principals, Agencies, Programs, and Processes
Chapter 55 of Title 10 of the U.S. Code 160 and 32 C.F.R. parts 199.1-199.26 (161) provide the authority for DHHS and DoD to jointly proscribe regulations for the administration of the MHS. Department of Defense principals responsible for managing the MHS are the Under Secretary of Defense for Personnel and Readiness (USD(P&R)) (162) and the Assistant Secretary of Defense for Health Affairs ASD(HA). (163) The USD(P&R) is the principal staff assistant and advisor to the Secretary of Defense for Health Affairs and develops policies, plans, and programs for health and medical affairs to provide and maintain medical readiness. (164) The ASD(HA) is the principal advisor to the Secretary of Defense (SECDEF) and the USD(P&R) for all DoD health policies and programs. (165) His duties include ensuring the effective execution of the DoD's medical mission, which includes "establish[ing] policies, procedures, and standards that ... govern management of the DoD health and medical programs, including ... medical records, health information privacy ..." (166) and exercising authority, direction, and control over the Director, TMA.167
The DHA has assumed TMA's responsibilities for supervising and administering all TRICARE programs. (168) TRICARE manages the DoD's managed health care program for the MHS. (169) TRICARE contracts with three geographically based MCSCs. The MCSCs are private sector managed care companies that are delegated the overall responsibility of managing health care services provided to active duty servicemembers and their families outside the catchment area. (170) The rules and regulations of TRICARE are contained in the Code of Federal Regulations (CFR), (171) the TRICARE Operations Manual (TOM), (172) and the TRICARE Provider Handbook (TPH).173 Together, these regulations establish the following hierarchy of CHPs: (1) network CHP; (2) non-network CHP; (3) participating non-network CHP; and (4) non-participating non-network CHP. (174)
The regulations establishes four primary categories of CFIPs. First, as an initial matter, all CHPs who provide health care to Soldiers outside the catchment area must be TRICARE authorized. (175) TRICARE, through its MCSCs, establishes the terms and conditions for certifying that CHPs meet TRICARE's authorization requirements, which include basic licensing and medical specialization accreditation. (176) Civilian Health Care Providers cannot participate in TRICARE, submit claims, and/or be reimbursed for treating Soldiers outside the catchment area unless and until they obtain authorization status. (177)
Second, network CHPs are TRICARE authorized providers who sign contractual agreements with TRICARE through its MCSCs and agree to accept TRICARE's negotiated rates as payment in full for treating Soldiers outside the catchment area, as well as abide by all the TRICARE rules and regulations contained within the TOM and the TPH. (178) Third, non-network CHPs are TRICARE authorized providers who do not sign contractual agreements with TRICARE. (179) These CHPs are further classified as either participating or non-participating, depending on whether they agree or decline to accept TRICARE's maximum allowable reimbursement rates for treating Soldiers. (180)
Importantly, TRICARE's contractual provisions require network CHPs to maintain a Soldier's "signature on file" (SOF) authorization to release a Soldier's PHI to the MCSCs, in part to verify the Soldier's TRICARE eligibility. (181) Although TRICARE-authorized non-network CHPs do not have contracts with TRICARE, they must still comply with TRICARE's claims processing procedures in order to submit and be reimbursed for claims, one of which is the SOF requirement. (182)
With this framework in mind, the following steps would be the most effective and efficient way to implement the proposed regulatory and contractual solutions to the problem of disparate command access to Soldiers' PHI within and across the MHS.
B. Changing the Language of the Military Command Exception to the Privacy Rule
First, ASD(HA) should conduct a formal study to document the nature and extent of the problem of CHPs' non-compliance with the Military Command Exception within and across the MHS. Second, assuming the study confirms the problem is extant, pervasive, and imposes an ongoing impediment to medical readiness and national security, ASD(HA) should draft a proposed amendment to the Military Command Exception and staff the proposal through the USD(P&R) to the SECDEF. The following additional language would accomplish this goal:
A covered entity (including a covered entity not part of or affiliated with the Department of Defense, wherever located) shall use and disclose the protected health information of individuals who are Armed Forces personnel for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission.... (183)
In conjunction with this change, the DHHS should amend the Privacy Rule's SOF authorization provision (184) to reflect the fact that Soldiers' SOF authorizations are no longer required to release Soldiers' PHI to military command authorities.
Consistent with their authority to prescribe joint regulations for the administration of the MHS, the DoD should work closely with the DHHS in drafting these proposed changes to facilitate the DHHS's ultimate approval of this language. Once the proposed regulatory amendment to the Military Command Exception has been staffed through the DoD, the SECDEF should submit a formal request to change the Military Command Exception to the Secretary of the DHHS. The DHHS should then staff this proposed change to the Military Command Exception and publish it for public comment in the Federal Register for at least sixty days. (185) After review and consideration of public comment, the DHHS should publish the newly revised Military Command Exception in the CFR. Once published, the DoD should subsequently amend DoD 6025.18-R to reflect the fact that all health care providers, both the DoD and CHPs, wherever located, must comply with the Military Command Exception consistent with existing Army policy as embodied in the VCSA Sends Message. The DHA should then amend the TOM to reflect Soldiers' SOF authorizations are no longer required to release Soldiers' PHI to military command authorities. (186) Lastly, the DHHS, DoD, and the DHA should initiate a nationally-coordinated educational effort to ensure all CHPs, military command authorities, and Soldiers outside the catchment area are familiar with their rights and responsibilities under the new Military Command Exception.
C. Imposing a Contractual Mandate on CHPs Through TRICARE
Title 10 of the U.S. Code provides the SECDEF with the authority to enter into contracts with CHPs for the provision of health care outside the catchment area. (187) Pursuant to this authority, implementing TRICARE regulations (188) permits the DHA to establish the contractual terms and conditions for TRICARE authorized network CHPs. These contractual provisions are contained in both the CFR189 and the TRICARE Policy Manual (TPM). (190)
To impose a contractual mandate on TRICARE authorized network and non-network CHPs, the DoD should take the following steps: (1) change the TRICARE regulations; (191) (2) change the "Participation Agreement Requirements" in the TPM; (192) and (3) require its MCSC to insert language mandating CHPs comply with the Military Command Exception in its individual CHPs network contracts as a precondition to joining the network, and in its CHPs non-network claims forms as a precondition for non-network CHPs to be reimbursed for treating Soldiers.
Next, TMA should amend its TPM, Chapter 11, section 12.3, paragraph 2.0, entitled "Participation Agreement Requirements', (193) which lists the basic contractual provisions that must be included in TRICARE agreements for participating network CHPs.
Lastly, to ensure TRICARE-authorized, non-network CHPs who have not contracted with TRICARE but who seek reimbursement for treating Soldiers outside the catchment area on a claim-by-claim basis comply with the MCE, similar language should be included in TRICARE's electronic or paper claims forms. (194)
Revisit the scenario of the medically non-compliant active duty Soldier in the introduction. This time, the Military Command Exception is compulsory for CHPs outside the catchment area as the result of the DHHS's amendment of the Military Command Exception and/or DoD's imposition of a TRICARE contractual mandate. The commander contacts the CHPs directly and asks them to discuss his NCO's physical and mental condition and provide him with relevant portions of his NCO's PHI. The commander provides them with copies of the DHHS's newly revised Military Command Exception and/or the newly revised TPH. Civilian health care providers review the material, call the commander back, discuss the Soldier's condition with him directly and provide him with relevant portions of the NCO's PHI. Armed with this information, the commander is able to provide the NCO's PHI to the 335th Signal Command (Theater) command surgeon and, together, adequately assess the NCO's medical readiness status, get the NCO the help he needs, avoid a potential suicide, and provide HRC with the information it needs to coordinate a replacement.
This scenario demonstrates what most commanders who have faced this problem outside the catchment area already know: the benefits from remedying the existing problem of disparate command access to Soldier's PHI within and across the MHS clearly outweigh the potential adverse consequences from maintaining the current counterintuitive and counterproductive status quo. It is now time for the DHHS and DoD to reach this same conclusion and close the gap in the current bifurcated system of disparate command access to Soldiers' PHI by mandating CHPs comply with the Military Command Exception.
(1) All Army Activities Message, 282049Z May 10, U.S. Dep't of Army, subject: ALARACT Vice Chief of Staff of the Army (VCSA) Sends on Protected Health Information (PHI) para. 1 [hereinafter VCSA Sends Message] (from the former Vice Chief of Staff of the Army, General Peter W. Chiarelli).
(2) The Army Reserve (AR) has a number of multi-component units consisting of Troop Program Unit (TPU), Active Guard Reserve (AGR), and Active Duty (AD) Soldiers. For example, the 9th Theater Support Command at Fort Belvoir, VA. See Paul Turk, Army Creates Multi-Compo Training Support Command, 46 ARMY RES. MAG. 11 (2003). As of 1 May 2014, there are approximately 212 AD Soldiers serving in multicomposition Army Reserve (AR) units. E-mail from Chief Warrant Officer Three Pamela Elliott, USARC G-l (1 May 2014) (on fde with author) [hereinafter Elliott e-mail].
(3) U.S. Dep't of Army, Reg. 140-1, Army Reserve Mission, Organization, and Training app. A, at 94 (20 Jan. 2004). While AR 140-1 defines a TPU as "[a] TOE or TDA unit of the USAR organization which serves as a unit on mobilization or one that is assigned a mobilization mission[,]" the Reserve Component (RC) also uses this as an adjectival term to denote all Soldiers (TPU Soldiers) assigned to RC units who do not serve under the authority of Title 10 of the U.S. Code on a full-time basis (i.e., AGR and AD Soldiers). See, e.g., id. para. 3-9a.
(4) U.S. Dep't of Army, Reg. 135-18, The Active Guard Reserve (AGR) Program glossary, at 24 (1 Nov. 2004). Army Regulation 135-18 defines AGR Soldiers as members of "[t]he Army National Guard of the United States (ARNGUS) and Army Reserve personnel serving on AD under Title 10, U.S. Code, section 12301(d), and Army National Guard (ARNG) personnel serving on full-time National Guard duty (FTNGD) under Title 32, U.S. Code, section 502(f)." Id.
(5) Battle assembly was historically known as drill. It is now the current term used to describe the AR weekend training assembly. See Rob Schuette, Battle Assembly, Army Reserve Expeditionary Force New Terms, TRIAD ONLINE, May 13, 2005, http://www.mccoy.army.mil/vnewspaper/ triad/05132005/battleassembly.htm.
(6) For purposes of this article, civilian health care providers (CHPs) refer to the following persons/entities: (1) all licensed civilian medical doctors, including those who specialize in family medicine, internal medicine, general and specialized surgery, podiatry, anesthesiology, otolaryngology, neurology, pain management, and all other areas of physical specialization; (2) all licensed mental health care professionals to include psychologists, psychiatrists, therapists, and counselors; (3) all licensed physicians' assistants, registered nurses (emergency, operating, general, etc.), radiologists, physical therapists, pharmacists and laboratory technicians; (4) all civilian hospitals, medical clinics, and pharmacies; and (5) all dentists and dental assistants.
(7) U.S. Dep't of Def., DD Form 2870, Authorization for Disclosure of Medical or Dental Information (Dec. 2003); see infra note 9 (discussing the legality of such an order).
(8) The term protected health information (PHI) is used throughout the article to refer to both civilian and military electronic and paper PHI See the definition provided in the Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. [section] 160.103 (2012). The Privacy Rule defines PHI as "health information," which includes "individually protected health information," that lists or describes an individual's past, present, and future mental and physical diagnosis, medication and treatment history and plan, demographic information, and any other information that provides a reasonable basis to identify an individual. Id. [section] 160.103.
(9) Although a reasonable reading of both U.S. Dep't OF ARMY, REG. 40501, Standards of Fitness (14 Dec. 2007) (RAR, 4 Aug. 2011) [hereinafter AR 40-501] and the TRICARE OPERATIONS Man. 6010.56-M (Feb. 1, 2008) [hereinafter TOM], available at http://www.manuals.tricare.osd.mil.DisplayManual.aspx?Series=T3TOM, support the argument that commanders have the authority to order AGR and AD Soldiers to sign civilian medical release forms in their favor and/or turn over copies of their civilian PHI directly to commanders, the legality of these orders could be challenged. A counterargument is that the Department of Health and Human Services (DHHS) and the Department of Defense (DoD) purposely omitted such a specific requirement in the Standards for Privacy of Individually Identifiable Health Information, as well as the TRICARE regulations because neither the DHHS nor DoD wanted commanders to exercise such authority. Assuming for a moment the validity of this argument, this raises the question: what right does an 0-3 commander have to invalidate the regulatory protections provided by the Secretary of the DHHS and/or the Secretary of Defense? Although the author believes such orders are valid and enforceable under current military law and regulation, the author found no case law specifically addressing the legality of such an order in this context. Consequently, the issue must be regarded as open to debate. Notwithstanding this fact, regulatory support for such orders can be found at AR 40-501, infra, paras. 8-3, 9-3, and the TOM, infra, ch. 17, sec. 2, para. 7.2.
(10) Under current federal regulation, Soldiers are entitled to revoke civilian medical release forms at any time, for any reason, provided the revocation is in writing. Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. [section] 164.508(b)(5) (2012); see U.S. Dep't of Health & Human SERVS., Frequently Asked Questions, Authorization Use and Disclosure, http://www.hhs.gov/ocr/privacy/hipaa/faq/authorizations/474.html.
(11) For purposes of this article, "DoD health care providers" refer to the following persons/entities: all DoD military physicians, physical therapists, physicians' assistants, dentists, dental assistants, pharmacies, nurses, laboratory and radiological technicians, and their supporting medical and dental staffs that provide or assist in providing physical or mental or dental health care services to members of the Armed Forces and/or their families within fifty miles of a medical treatment facility (MTF) or military medical or dental facility. It also includes all federal civilian employees or contract employees who work for the federal government on a full- or part-time basis and who provide physical, mental, or dental health care services to members of the Armed Forces and/or their families within fifty miles of an MTF or military or civilian medical or dental facility. It does not include civilian health care providers or their assistants, staffs, hospitals, clinics, and pharmacies that provide medical, mental, or dental services to active duty servicemembers and/or their family members more than fifty miles from a MTF or military medical or dental facility and who are neither federal civilian employees nor full- or part-time federal health care contractors.
(12) Health Insurance Portability and Accountability Act, Pub. L. No. 104191, 110 Stat. 1936 (1996) [hereinafter HIPAA],
(13) Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. [section][section] 160, 164 (2012). The entire group of HIPAA PHI Privacy Regulations is collectively known as "the Privacy Rule." U.S. Dep't OF Health & Human Servs., Office of Civil Rights, Summary of The HIPAA Privacy Rule (2003) [hereinafter the DHHS Privacy Rule SUMMARY], available at http://www.hhs.gov/ocr/privacy/hipaa/under standing/summary/privacysummary.pdf.
(14) 45 C.F.R [section] 164.512 (k)(1)(i) (2012) (Standard: Uses and Disclosure for Specialized Government Functions--Military and Veterans Activities--Armed Forces Personnel).
(15) Although the Privacy Rule uses the term "appropriate military command authorities," it does not define the term. Id. [section] 164.512(k)(1)(i) (emphasis added). The DoD defines the term as follows: "All Commanders who exercise authority over an individual who is a member of the Armed Forces, or other person designated by such a commander to receive protected health information in order to carry out an activity under the authority of the Commander." U.S. DEP'T of Def., Reg. 6025.18-R, DoD Health Information Privacy Regulation para. C126.96.36.199.1 (23 Jan. 2003) [hereinafter DoD 6025.18-R], In its implementing guidance to DoD health care providers and commanders, the U.S. Army Medical Command (MEDCOM) uses the term "unit command officials " and defines the term as "commanders, executive officers, first sergeants, platoon leaders and platoon sergeants." Memorandum from Office of the Surgeon Gen./MEDCOM, to Commanders, MEDCOM Major Subordinate Commands, subject: Release of Protected Health Information (PHI), to Unit Command Officials para. 5e (24 Aug. 2012) [hereinafter MEDCOM PHI Policy Memorandum 12-062]. U.S. DEP'T OF ARMY, Reg. 40-66, Medical Records and Administration and Healthcare Documentation (17 June 2008) [hereinafter AR 40-66] (RAR, 4 Jan. 2010) uses the term "nonmedical personnel" and includes "inspectors general; officers, civilian attorneys, and military and civilian personnel of the Judge Advocate General's Corps; military personnel officers; and members of the U.S. Army Criminal Investigation Command or military police performing official investigations." Id. para. 5-23e. Although there is no discussion in these Regulations on the difference between the terms "appropriate military command authorities," "unit command officials," and "nonmedical personnel," both MEDCOM PHI Policy Memorandum 12-062 and AR 40-66 make reasonable attempts to delineate the full panoply of military personnel commanders routinely authorize access to Soldiers' PHI. To be as inclusive as possible in recognition of the wide range of personnel who routinely access Soldiers' PHI for commanders, the term "military command authorities" in this article refers to commanders, executive officers, sergeants major, first sergeants, platoon leaders, platoon sergeants, medical officers and their medical staffs, judge advocates and their paralegals, DoD civilian attorneys, and military criminal authorities conducting official investigations.
(16) The TOM appendix defines the catchment area as those "[geographic areas determined by the Assistant Secretary of Defense (Health Affairs) (ASD(HA)) that are defined by a set of five digit zip codes, usually within an approximate 40 mile radius of military inpatient treatment facility." TOM, supra note 9, app. B, at 8. However, the TRICARE Prime Remote (TPR) eligibility provisions of the TOM state that for AD Soldiers to receive health care benefits under TPR, they must have "a permanent duty assignment [and reside at a location] that is greater than 50 miles ... or approximately [a] one-hour drive from a military medical treatment facility (MTF) or military clinic...." Id. ch. 17, sec. 1, para. 2.2.1-2.2.2.
(17) The term "unrestricted" is not synonymous with "unfettered." The VCSA Sends Message recognizes two levels of access to Soldiers' PHI--unrestricted and "excluded" (the author's term--not used in the VCSA Sends Message). VCSA Sends Message, supra note 1, para. 4; see discussion infra Part II.D and accompanying notes.
(18) TRICARE is "[t]he uniformed services health care program for active duty service members and their families, retired service members and their dependents, members of the National Guard and Reserve and their families, survivors, and others who are eligible. TRICARE's primary objective is to deliver world-class health care benefits for all Military Health System (MHS) beneficiaries that provide the highest level of patient satisfaction." Tricare Provider Handbook, United Healthcare (2013) [hereinafter TPH], available at https://www.unitedhealthcareonline.com/ccmcontent/ ProviderII/UHC/en-US/Assets/ProviderStaticFiles/ProviderStaticFilesPdf/ Tools%20and%20Resources/Policies%20and%20Protoco!s/TRICARE_Pro vider_Handbook_2013.pdf. Tricare Prime Remote is one of the three health care plan options available to Soldiers who receive health care under the TRICARE Program (Tricare Prime, Extra, and Standard). Tricare Prime Remote is mandatory for AD servicemembers outside the catchment area. TRICARE Program, 32 C.F.R. [section] 99.17(b)(2) (2012).
(19) 45 C.F.R [section] 164.512(k)(1)(i) (2012).
(20) This policy is embodied in a combination of three documents: (1) the VCSA Sends Message, supra note 1; (2) MEDCOM PHI Policy Memorandum 12-062, supra note 15; and (3) U.S. Dep't of Def., Instr. 6490.08, Command Notification Requirements to Dispel Stigma in Providing Mental Health Care Service to Service Members (17 Aug. 2011) [hereinafter DoDI 6490.08]; see discussion infra Part II.D and Part III.
(21) See discussion infra Part III.A.5 and accompanying notes.
(22) E-mail from Lawrence Knapp, Ph.D., Specialist in Military Manpower Pol'y, Foreign Affairs, Def., and Trade Div., Congressional Research Serv., Library of Congress (6 May 2014) [hereinafter Knapp e-mail] (on file with author); see also LAWRENCE Kapp, CONG. RESEARCH SERV., RL30802, Reserve Component Personnel Issues: Questions and Answers (2013), http://www.fas.org/sgp/crs/natsec/RL30802.pdf. The RC consists of the Army National Guard of the United States, the Army Reserve, the Navy Reserve, the Marine Corps Reserve, the Air National Guard of the United States, the Air Force Reserve, and the Coast Guard Reserve. Id.
(23) E-mail from Michael P. Griffin, Fellow of Amer. Coll, of Healthcare Execs., Deputy Chief, TRICARE Div., MEDCOM, to author (May 9, 2014) [hereinafter Griffin e-mail] (on file with author). The total number of AD Soldiers who utilize TPR is 119,803, including National Guard personnel. Id. In light of the large number of National Guard personnel on AD who utilize TPR, the problem of inadequate access to Soldiers' PHI outside the catchment areas is clearly not limited to the AR.
(24) Elliott e-mail, supra note 2.
(25) Griffin e-mail, supra note 23.
(26) AR 40-501, supra note 9; see discussion infra Part III.A.2 and accompanying notes.
(27) E-mail from Christin Kim, Axiom Resource Mgmt., Defense Health Agency, Health Plan Execution and Operations (May 5, 2014) [hereinafter Kim e-mail] (on file with author).
(28) The Military Healthcare System (MHS) is the name given to the collective group of organizations, agencies, positions, and persons within the DoD whose goal is to achieve DoD's health care mission. See generally U.S. Dep't of Def., Department of Defense Task Force on the Future of Military Health Care, Final Report 9 (Dec. 2007). The MHS consists of the Service Surgeons General, eleven MHS component offices and programs, the Defense Centers of Excellence for Psychological Health and Traumatic Brain Injury, Forces, Health Protection and Readiness, TRICARE, the Hearing Center of Excellence, the Vision Center of Excellence, and the Office of the Chief Information Officer. U.S. Dep't OF Def., MILITARY Health SYS., Military Health Organizations, About the MHS, http://www.health.mil/About_MHS/Organizations/Index.aspx (last visited Mar. 7, 2013).
(29) DoDI 6940.08, supra note 20.
(30) The USD(P&R) is the principal staff assistant and advisor to the Secretary of Defense for Health Affairs and develops policies, plans, and programs for health and medical affairs to provide and maintain medical readiness. U.S. Dep't of Def., Dir. 5124.02, Under Secretary of Defense for Personnel and Readiness (USD(P&R)) (23 June 2008) [hereinafter DoDD 5124.02],
(31) The TRICARE Management Activity (TMA) was originally established by DoDD on 31 May 2001. U.S. DEP'T OF Def., Dir. 5136.12, TRICARE Management Activity (TMA) (31 May 2001) [hereinafter DoDD 5136.12]. The TMA's mission was to manage the TRICARE health care program for active duty members and their families, retired service-members and their families, RC and National Guard members and their families, survivors, and all others entitled to DoD medical care. See News Release, U.S. Dep't of Def., Tricare Management Activity Established (Feb. 24, 1998), http://www.defense.gov/Releases/Release.aspx?ReleaseID=1591 (last visited June 23, 2014). On 1 October 2013, the DoD established the "Defense Health Agency to manage the activities of the Military Health System, ... [including those functions] ... previously managed by the Tricare Management Activity (TMA)," and disestablished the TMA. About DHA, Defense Health Agency, http://www.tricare.mil/tma/ About/DHA.aspx. This was done pursuant to the Deputy Secretary of Defense's 11 March 2013 Memorandum entitled, "Implementation of Military Health System Governance Reform." Memorandum from Deputy Sec'y of Def. to Sec'ys of the Military Dep'ts et al., subject: Implementation of Military Health System Governance Reform para. 9(11 Mar. 2013) [hereinafter MHS Governance Reform Memorandum].
(32) DoDI 6490.08, supra note 20, para. 4b; see infra notes 77-79 and accompanying text (listing the nine circumstances for disclosure).
(33) E-mail from Paul Bley, Chief, Admin. & Civil Law Branch, DHA, to author (Oct. 1, 2012) [hereinafter Bley e-mail] (on file with author).
(34) As used in this article, the term "medically non-compliant" refers to Soldiers who intentionally or negligently fail to cooperate in providing full and complete access to PHI to military command authorities. Medical noncompliance includes failure to provide copies of PHI relating to medical readiness, duty status, deployability, and mission capability to military command authorities; failure to execute medical release forms in favor of military command authorities when necessary to determine a Soldier's medical readiness, mission capability, deployability or duty status; and initially providing military command authorities with access to relevant portions of PHI, but subsequently intentionally or negligently impairing, impeding, delaying, or obstructing supplemental access to this information.
(35) HIPAA, supra note 12. For an overview of the relevant portions of HIPAA related to PHI and additional guidance regarding HIPAA's application within the DoD and the Department of the Army, see Major Temidayo L. Anderson, Navigating HIPAA's Hidden Minefields: A Leader's Guide to Using HIPAA Correctly to Decrease Suicide and Homicide in the Military, Army Law., Dec. 2013, at 15.
(36) Pursuant to its mandate, the DHHS promulgated a comprehensive set of regulatory standards addressing three primary issues: (1) the privacy rights each individual should have in PHI; (2) the procedures for exercising these privacy rights; and (3) "the uses and disclosures of such information that should be authorized or required." Standards for Privacy of Individual Health Information; Final Rule, 67 Fed. Reg. 53,182 (Aug. 14, 2002) (codified at 45 C.F.R. [section][section] 160, 164 (2012)); HIPAA, supra note 12, [section] 264(b)(l)-(b)(3). The DHHS enforces HIPAA's privacy regulations through a series of civil and criminal fines and imprisonment. Id. [section] 1176(a)(l)-(b)(3).
(37) Stephen K. Phillips, A Legal Research Guide to HIPAA, 3 J. HEALTH & LIFE SCI. L. 134, 144 (2010).
(38) HIPAA Administrative Simplification, 45 C.F.R. [section][section] 160, 162, 164 (2012). The DHHS Office of Civil Rights publishes the unofficial text of the combined texts of the Privacy and Security Rules. U.S. Dep't of Health & Human Servs., Office of Civil Rights, Administrative SIMPLIFICATION (unofficial version, as amended through Feb. 16, 2006), available at http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyp rule/adminsimpregtext.pdf.
(39) 45 C.F.R. [section][section] 164.302-164.318 (2012); see OFFICE OF CIVIL RIGHTS, U.S. Dep't of Health & Human Servs., Health Information PRIVACY, The Security Rule, available at http://www.hhs.gov/ocr/privacy/ hipaa/administrative/securityrule/ (last visited June 23, 2014).
(40) 45 C.F.R. [section][section] 164, 162 (2012); DHHS Privacy Rule Summary, supra note 13, at 1.
(41) DHHS Privacy Rule Summary, supra note 13, at 1.
(42) See supra note 8 (defining PHI).
(43) DHHS Privacy Rule Summary, supra note 13, at 1.
(44) Id. The Privacy Rule applies to covered entities, i.e., health plans, healthcare clearinghouses and health care providers "who transmit any health information in electronic form in connection with a transaction covered by this subchapter...." 45 C.F.R. [section] 160.103 (2012).
(45) The Privacy Rule authorizes disclosure of individual PHI under four circumstances: (1) When mandated by the Privacy Rule. Disclosure is mandated when an individual or their personal representative requests access to their own PHI or an accounting of PHI disclosure to another person or entity, and when the DHHS conducts a compliance investigation to determine whether a covered entity complied with the Privacy Rule. (2) Pursuant to an identified exception and individual authorization and the opportunity to agree or object is not required. Disclosure is permitted, but not required, without an individual's authorization and opportunity to agree or object pursuant to one of the twelve "national priority purposes" (exceptions) listed in the Privacy Rule. Id. [section] 164.502(a)(2)(i)--(ii); DHHS PRIVACY rule Summary, supra note 13, at 6; see infra note 49 and accompanying text. (3) When permitted pursuant to an exception and the individual is provided the right to consent, acquiesce, or object. A covered entity must obtain a person's written authorization to disclose PHI for any purpose other than "treatment, payment or health care operations otherwise permitted or required by the Privacy Rule," such as, before disclosing psychotherapy notes. Id. at 6, 9; 45 C.F.R. [section][section] 164.508, 164.512(i)(A) (2012). The rule relating to the disclosure of psychotherapy notes is subject to eight exceptions, one of which is to "prevent or lessen a serious and imminent threat to the health or safety of a person or the public." Id. (4) When permitted, but only with authorization. DHHS PRIVACY RULE SUMMARY, supra note 13, at 9. A covered entity must maintain a patient's written authorization on file to disclose PHI pursuant to the Privacy Rule's authorization provision, and the patient maintains the right to revoke their authorization at any time. 45 C.F.R [section] 164.508, 164.508(b)(5) (2012).
(46) 45 C.F.R [section][section] 164.502(b), 164.514(d).
(47) Id. [section] 164.502(b)(1).
(49) U.S. Dep't of Health & Human Servs., Office of Civil Rights, HEALTH Information Privacy: Health Information Privacy, Minimum Necessary Requirements, http://www.hhs.gov/ocr/privacy/hipaa/under standing/coveredentities/minimumnecessary.html (last visited June 11, 2014).
(50) The twelve exceptions are: when required by law; for public health activities; for health oversight activities; for judicial and administrative proceedings; for law enforcement purposes; for decedents (funeral directors, coroners, or medical examiners); for cadaveric organ, eye, or tissue donations; for research purposes; regarding victims of abuse, neglect, or domestic violence; to avert serious threat to health or safety; regarding workers' compensation (or similar) laws; and for specialized (essential) government functions, including military, intelligence and national security functions. DHHS PRIVACY RULE SUMMARY, supra note 13, at 6.
(51) 45 C.F.R. [section] 164.512(k)(l)(i). These functions include "assuring proper execution of a military mission, conducting intelligence and national security activities that are authorized by law, providing protective services to the President, [and] making medical suitability determinations for U.S. State Department employees...." DHHS PRIVACY RULE SUMMARY, supra note 13, at 8.
(52) Information Paper, TMA Privacy and Civil Liberties Office, Military Command Exception and Disclosing PHI of Armed Forces Personnel (Mar. 2013), available at http://www.tricare.mil/tma/privacy/downloads/Information%20Paper%20- %20Military%20Command%20Exception%20-%20 Approved%20March%202013.pdf. The Military Command Exception (MCE) authorizes appropriate military command authorities to use and disclose Soldiers' PHI "for activities deemed necessary ... to assure the proper execution of the military mission ...," subject to the condition that DoD publish notice in the Federal Register defining the term "appropriate military command authorities" and listing the purposes for which they may use and disclose Soldiers' PHI. 45 C.F.R. [section] 164.512(k)(l)(i). The DoD published required notice on 9 April 2003. DoD Health Information Privacy Program, 68 Fed. Reg. 17,357-02 (Apr. 9, 2003) (codified at 45 C.F.R. [section] 164.512(k)(1)(i)).
(53) The DHHS's commentary succinctly articulates the MCE's national security rationale.
This provision's primary intent is to ensure that proper military command authorities can obtain needed medical information held by covered entities so that they can make appropriate determinations regarding the individual's medical fitness or suitability for military service.... Such actions are necessary in order foe the Armed Forces to have medically qualified personnel, ready to perform assigned duties. Medically unqualified personnel not only jeopardize the possible success of a mission, but also pose an unacceptable risk or danger to others. We have allowed such uses and disclosures for military activities because it is in the Nation's interest.
Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462, 82,705 (Dec. 28, 2000) [hereinafter DHHS Commentary on the Public Comments to the Privacy Rule] (containing the Privacy Rule and the DHHS's commentary on the public comments elicited in response to the Privacy Rule when first published). As the Army's Report 2020, Generating Health & Discipline in the Force Ahead of the Strategic Reset, 2012, states, "Ultimately, the goal is to achieve the optimum balance that permits commanders access to the necessary information to enable them to better protect and promote the safety and well-being of Soldiers under their command while at the same time maintaining Soldiers' right to privacy." U.S. Dep't of Army Report: Army 2020, Generating Health & Discipline in the Force Ahead of the Strategic Reset, 2012, at 65 (Jan. 19, 2012), available at http://usarmy.vo.llnwd.net/e2/c/downloads/ 235822.pdf.
(54) DODD 6025.18-R, supra note 15.
(55) Id. para. C188.8.131.52.
(56) Id. para. C184.108.40.206.1; see, e.g., U.S. Dep't of Def., Dir. 1308.1, DoD Physical Fitness and Body Fat Program (30 June 2004); U.S. Dep't of Def., Dir. 5210.42, Nuclear Weapons Reliability Program (16 July 2012).
(57) DODD 6025. 18-R, supra note 15, para. C220.127.116.11.2.
(58) Id. para. C18.104.22.168.3.
(59) Id. para. C22.214.171.124.4.
(60) Id. para. C7.ll. 1.3.5.
(61) AR 40-66, supra note 15.
(62) Id. para. 2-4a(1).
(63) Id. para. 2-4a(1)(a)1-19. Some of the grounds for disclosure include "to coordinate sick call, routine and emergency care, quarters, hospitalization, and care from civilian providers ...," as well as to "report the results of physical examinations and profiling according to AR 40-501," line of duty investigations, accident investigations, the Army Weight Control Program, the Family Advocacy Program, the identification and surveillance of HIV, MEB/PEBs, to conduct "Soldier Readiness Program and mobilization processing requirements according to AR 600-8-101," and when a Soldier is taking medications that "could impair the Soldier's duty performance." Id.
(64) Id. para. 2-4a(2), 2-4a(2)(a).
(65) VCSA Sends Message, supra note 1.
(66) Id. para. 1.
(68) Id. para. 5.
(69) Id. para. 7 A.
(70) Id. paras. 3-4; see supra note 17 (concerning the author's use of the term "excluded").
(71) Id. para. 3.
(72) Id. paras. 3A-3G.
(74) Id. paras. 4A--4C.
(75) Id. para. 4B.
(76) Id. para. 4C.
(77) DoDI 6490.08, supra note 20.
(78) Id. para. 3b.
(79) The eight exceptions are: (1) pursuant to a command-directed mental health evaluation; (2) when a provider believes a Soldier poses a serious risk of harm to himself; or (3) a serious risk of harm to others; or (4) a serious risk of harm to a specific military mission; (5) the Soldier is admitted or discharged from any inpatient mental health or substance abuse treatment facility; (6) the Soldier has an acute mental health condition or is undergoing an acute mental health care treatment regimen that impairs his ability to perform his duties; (7) the Soldier has entered into a formal outpatient or inpatient treatment program for the treatment of substance abuse or dependence; (8) the Soldier is in the Personnel Reliability Program or has been identified as having responsibilities so sensitive or critical that such notification is necessitated. Memorandum from Office of the Under Sec'y of Def. to Sec'ys of the Military Dep'ts et al., subject: Revising Command Notification Requirements to Dispel Stigma in Providing Mental Health Care to Military Personnel attach. 2, para. 1a(1)-(8) (July 2, 2009), available al http://www.nellis.af.mil/shared/media/document/AFD-l 10614048.pdf.
(80) DoDI 6490.08, supra note 20, encl. 2, para. lb(l)(2).
(81) Id. para. 4b (emphasis added); see supra note 31 (discussing the disestablishment of the TMA and DHA's assumption of TMA's functions and responsibilities).
(82) See Lolita Baldor, Active Duty Military Suicides Dropped Last Year. But Reserves' Went Up, Stars & STRIPES, Apr. 25, 2014, http://www.stripes.com/news/us/active-duty-military-suicides-dropped-lastyear-but-reserves-went-up-1.279834; see also Eli Clifton, Suicide Rate in Military Highest Level in 10 Years, THINKPROGRESS SECURITY, June 8, 2012, http://thinkprogress.org/security/2012/06/08/496604/military-suicide/; Megan McCloskey, More Soldier Suicides Than Combat Deaths in 2012, Dec. 20, 2012, STARS & STRIPES, http://www.stripes.com/news/moresoldier-suicides-than-combat-deaths-in-2012- 1.201440.
(83) General Peter W. Chiarelli recognized the link between medical readiness and national security in a speech at the National Security Symposium in Washington, D.C., when he said, Soldiers' medical [fitness] "is absolutely critical to the security of our nation." Ass'n of the U.S. Army News, Soldier Health, Well-Being, Critical' to National Security (Apr. 1, 2011), WWW.AUSA.ORG, http://www.ausa.org/publication/ausanews/special reports/201 l/4/Pages/Soldierhealth, well-being%E2%80%98critical%E2%8 0%99tonationalsecurity.aspx.
(84) DHHS Commentary on the Public Comments to the Privacy Rule, supra note 53, at 82,705.
(85) VCSA Sends Message, supra note 1; DoD 6025.18-R, supra note 15; see also discussion supra Part II.C.D.
(86) DoDI 6490.08, supra note 20, encl. 2, para, cl; see supra notes 77-79 and accompanying text (listing the nine circumstances warranting disclosure).
(87) Although RC military command authorities can try to circumvent this problem by ordering Soldiers to provide them with copies of their PHI and/or execute civilian medical release forms in their favor, as discussed above, supra note 9, these orders can be contested. According to AR physician Dr. (Lieutenant Colonel) (LTC) Bedemi Alaniyi-Leyimu, RC military command authorities routinely encounter problems getting medically non-compliant AGR Soldiers to comply with their orders to provide full and complete initial and supplemental access to their PHI outside the catchment area. Lieutenant Colonel Alaniyi-Leyimu has routinely seen AR and AD Soldiers impair and impede commanders' full and complete access to their PHI when undergoing medical or administrative separation board processing in order to extend their military service as long as possible and stave off potential separation, or when feigning illness. Lieutenant Colonel Alaniyi-Leyimu has served as an AD DoD military health care provider at Martin Army Community Hospital, Fort Benning, Georgia, and as a DoD CHP at Fort McPherson, Georgia. In her civilian capacity, LTC Alaniyi-Leyimu currently works as a CHP in the Piedmont Health Care System in Atlanta, Georgia. In her military capacity, LTC Alaniyi-Leyimu serves as the Command Surgeon for the 335th Signal Command (Theater) as a TPU officer in the AR. Telephone Interview with LTC Alaniyi-Leyimu, Command Surgeon, 335th Signal Command (Theater) (Nov. 23, 2012) [hereinafter Alaniyi-Leyimu Telephone Interview] (on file with author). This has also been the experience of AR physician Dr. LTC (P) Robert Butts, Individual Mobilization Augmentee (IMA), Martin Army Hospital, Fort Benning, Georgia. Telephone Interview with LTC (P) Robert Butts (17 Nov. 2012) [hereinafter Butts Telephone Interview] (on file with author). Lieutenant Colonel (P) Butts has practiced medicine extensively in both the military and civilian community. He has been a physician for eighteen years and has served in the military for twenty-seven years. Lieutenant Colonel (P) Butts' military medical assignments include company commander, 900th Surgical Hospital (mobile), Peoria, IL; flight surgeon, 244th Aviation Command, Fort Sheridan, IL; flight surgeon, 5th Special Force Group, Fort Campbell, K.Y; medical officer, 723d Main Support Company, Special Operations Command, Perrine, FL. In his present civilian capacity, LTC (P) Butts is the Regional Medical Director of eight hospital emergency rooms throughout Illinois and supervises forty full- and part-time CHPs. This has also been the author's professional experience as an AGR judge advocate in the AR from 2002 to 2014 [hereinafter Professional Experience]; see also discussion, infra Part III.A.3-5.
(88) While AR 40-50l's medical readiness requirements apply to all Soldiers in the AR, including AD Soldiers assigned or attached to multi-component units, this article focuses on the problem as it relates to AGRs since they are the AR's principle full-time military support. Knapp e-mail, supra note 22, at 6.
(89) See Memorandum from Assistant Sec'y of Def,. to Sec'ys of the Military Dep'ts et al., subject: Policy Guidance for Deployment-Limiting Psychiatric Conditions and Medications, attach. 1, para. 3 (7 Nov. 2006).
(90) AR 40-501, supra note 9, para. 8-3c.
(91) Id. para. 8-3b.
(92) See id. at i (noting the regulation's applicability to both the AD and AR), para. 8-3 b, c.
(93) Id. para. 8-3a.
(95) Id. para. 9-3b.
(96) Id. paras. 8-3 and 9-3.
(97) Id. para. 9-3b.
(98) Alaniyi-Leyimu Telephone Interview, supra note 87; Butts Telephone Interview, supra note 87.
(99) Alaniyi-Leyimu Telephone Interview, supra note 87; Butts Telephone Interview, supra note 87. Battalion and brigade headquarters typically only have one to ten full-time civilian and/or military personnel, depending on the level of command, to carry out the day-to-day operational and administrative functions for the entire unit. Professional Experience, supra note 87.
(100) Telephone interviews with Major Missy Delk, S3 Clinical Operations Officer for the Cent. Area Med. Support Grp. (CE-MARSG), AR MEDCOM, Fort Sheridan, IL. At the time of these interviews, MAJ Delk was the Manager of the Reserve Health Readiness Program (RHRP), Office of the Surgeon, U.S. Army Reserve Command (USARC), Fort Bragg, NC. (12 & 20 Nov. 2012) [hereinafter Delk Telephone Interviews]; see also Alaniyi-Leyimu Telephone Interview, supra note 87; Butts Telephone Interview, supra note 87.
(101) See discussion, infra, Part III.A. 6 (regarding non-deployable AGRs).
(102) Delk Telephone Interviews, supra note 100; see discussion supra note 34 (concerning the author's definition of medical non-compliance in the context of the release of Soldiers' PHI). While the AR has routinely compiled statistics on the number of medically non-deployable AGRs each year (see discussion infra Part III.A.6), the author's research disclosed no analogous AR statistics documenting the number of medically noncompliant AGRs, i.e., Soldiers who intentionally or negligently fail to cooperate with medical command authorities in providing full and complete access to their PHI outside the catchment area. While anecdotal evidence from discussions with AGR JAG officers suggests the problem is pervasive and ongoing, the absence of easily accessible/widely available statistics concerning the number of medically non-compliant AGR Soldiers in the AR is, in this author's opinion, attributable largely to the fact that AR units typically do not capture these metrics, and if they do, they are usually compiled under the rubric of medical non-deployability (for whatever reason), and/or adverse administrative and/or non-judicial action. Professional Experience, supra note 87.
(103) Delk Telephone Interviews, supra note 100; Professional Experience, supra note 87.
(104) As of 2013, Army Reserve end-strength was 205,000. CHIEF, ARMY Reserve and Commanding General, USARC and Command Sergeant Major, USARC, America's Army Reserve: A Life-Saving and Life-Sustaining Force for the Nation, 2013 Posture Statement 3 (Mar. 2013) [hereinafter AR POSTURE Statement 2013], available at http://www.usar.army.mil/resources/Media/ARPS_2013_6-6-13%20%282 %29. pdf.
The ... AGR ... program ... provides the bulk of full-time support at the unit level. They provide day-to-day operational support needed to ensure Army Reserve units are trained and ready to mobilize within the ARFORGEN model. The AGR program is absolutely vital to the successful transition to, and sustainment of, an operational force.
Chief, Army Reserve and Commanding Gen., USARC and Command Sergeant Major, USARC, The United States Army Reserve 2011 Posture Statement 11 (Mar. 2011) [hereinafter AR Posture STATEMENT 2011], available at http://armedservices.house.gov/index.cfm/ files/serve?File_id=866fb710-2d71 -44af-b67c-2629b6e6acd4 (last visited July 23,2014).
(106) Alaniyi-Leyimu Telephone Interview, supra note 87; Butts Telephone Interview, supra note 87; Professional Experience, supra note 87.
(107) Professional Experience, supra note 87.
(108) Alaniyi-Leyimu Telephone Interview, supra note 87; Butts Telephone Interview, supra note 87. As discussed earlier, the contestability of these orders is another reason some AR commanders have chosen not to fight medically non-compliant AGR Soldiers for direct access to their civilian PHI. Professional Experience, supra note 87; see also supra note 9 (discussing the legality of an order to provide direct access to civilian PHI).
(109) Alaniyi-Leyimu Telephone Interview, supra note 87; Butts Telephone Interview, supra note 87; Professional Experience, supra note 87.
(110) Alaniyi-Leyimu Telephone Interview, supra note 87; Butts Telephone Interview, supra note 87. Both LTC Alaniyi-Leyimu and LTC(P) Butts have unique and insightful perspectives on this issue because they have extensive experience in both the civilian and military medical communities. Both physicians expressed the professional opinion that it is rare to find a CHP who is aware of the MCE, and both stated that most of their professional colleagues who are familiar with the MCE are uncomfortable complying with it and often decline to honor it. This has also been the author's professional experience. Professional Experience, supra note 87.
(111) Alaniyi-Leyimu Telephone Interview, supra note 87; Butts Telephone Interview, supra note 87; Professional Experience, supra note 87.
(112) Alaniyi-Leyimu Telephone Interview, supra note 87; Butts Telephone Interview, supra note 87. The author has also routinely encountered resistance to the MCE from CHP and their legal counsel over the past
twelve years while serving as an active duty judge advocate officer in the AR. Professional Experience, supra note 87.
(113) Delk Telephone Interviews, supra note 100; see also Marygail K. Brauner et al., Medical Readiness of the Reserve Component 22, Santa Monica, CA: RAND Corp. (Apr. 16, 2012), available at http://www.rand.org.pubs.mongraphs/MG1105. html.
(114) Delk Telephone Interviews, supra note 100.
(115) In recognition of this fact, the former chief of the AR, Lieutenant General James R. Helmly stated, "The AGR program is absolutely vital to the training and readiness of our units.... [AGR Soldiers] are an essential part of our Army..., enabling mission accomplishment and executing important missions on behalf of the nation." Army News Serv., Army Reserve to Open More Full-Time AGR Positions, WWW.ABOUT.COM, May 4, 2004, http://usmilitary.about.eom/cs/guardandreserve/a/arreservefiill.htm; see also AR Posture Statement 2011, supra note 104.
(116) Delk Telephone Interviews, supra note 100; see supra note 102 (discussing statistics (or lack thereof) for medically non-compliant AGRs in the AR).
(117) Delk Telephone Interviews, supra note 100.
(118) Although progress has been made, overall medical readiness targets have consistently gone unmet. According to the AR Posture Statement 2012, over one-third of AR Soldiers (approximately thirty-seven percent) were classified as not medically ready in 2012. Chief, Army Reserve and Commanding General, USARC and Command Sergeant Major, USARC, An Enduring Operational Army Reserve; Providing Indispensable Capabilities to the Total Force: 2012 Posture Statement 9 (Mar. 2012), available at http://www.appropriations.senaate.gov/sites/default/ files/hearing/ARPS%202012%20FINAL.PDF. However, AR medical readiness improved in 2013. See AR Posture Statement 2013, supra note 104, at v (as of May 2014 the AR had still not met its overall medical readiness goal of 82%). E-mail from MAJ Missy Delk, S3 Clinical Operations Officer for the Central Area Med. Support Grp. (CE-MARSG), AR MEDCOM, Fort Sheridan, IL (May 1, 2014) (on file with author); Email from LTC John Mann, AN, Chief, Clinical Branch, Office of the Surgeon, USARC, Fort Bragg, N.C. (May 2, 2014) (on file with author).
(119) Stephen J. Glenz & Colonel (Retired) Gary C. Howard, Full-Time Support for Part-Time Soldiers Is Essential for Unit Readiness, 55 Army Res. Mag. at 11 (2005).
(121) AR Posture Statement 2011, supra note 104, at 11.
(122) Brauner et al., supra note 113, at 25.
(123) Kim e-mail, supra note 27.
(124) Baldor, supra note 82; Clifton, supra note 82; McCloskey, supra note 82.
(125) See supra note 31 (explaining how the DHA assumed the responsibilities of the TMA when the latter was disestablished).
(126) DoDI 6940.08, supra note 20, para. 4b.
(127) Bley e-mail, supra note 33; Telephone Conversation with Paul Bley (Sept. 27, 2012).
(128) See supra note 83.
(129) Brauner et al., supra note 113, at iv.
(130) See discussion supra Part III. C.1.-5.
(131) See supra note 87; see also discussion supra Part. III. A.5 and accompanying notes.
(132) See supra note 117; see also discussion supra Part III. A.6.
(133) See supra notes 46-50 and accompanying text (discussing the Minimally Necessary Rule).
(134) See Susan D. Hosek & Gary Cecchine, Reorganizing the Military Health System: Should There Be a Joint Command? 46 (2001) Rand CORP., available at http://www.rand.org/pubs/monograph_reports/MR1350.html (discussing the need for medical providers who treat Soldiers to be familiar with their mission and duty environments to provide optimal health care to Soldiers).
(135) Telephone Conversation with John Casciotti, Senior Assoc. Deputy Gen. Counsel (Health Affairs), Dep't of Def. (Nov. 8, 2012). Mr. Casciotti
is a senior attorney in the MHS and previously served as Associate General Counsel for Enforcement, DHHS.
(136) U.S. CONST, art. 1, [section] 8; art. 3. Although the author believes the DHHS and DoD have the constitutional and regulatory authority to compel CHP to comply with the Military Command Exception outside the catchment area, the issue as to whether the DHHS and DOD possess the legal authority to implement this change is separate and distinct from whether it may be good policy to do so. As Mr. Casciotti pointed out in his telephone conversation, he believes HIPPA and its implementing regulations were designed to protect PHI, not provide a means to compel access to this information. Notwithstanding this reasoning, the Military Command Exception does just that within the catchment area as it relates to Soldiers' PHI. Moreover, the Privacy Rule itself compels the disclosure of PHI in the context of regulatorily mandated compliance reviews. See infra Part B.1.b.
(137) Ass'n of Am. Physicians & Surgeons, Inc. v. U.S. Dep't of Health & Hum. Servs., 224 F. Supp. 2d 1115 (S.D. Tex. 2002), aff'd without opinion, 67 Fed. Appx. 253 (5th Cir. 2003).
(138) Thorpe v. Hous. Auth. of City of Durham, 393 U.S. 268 (1969).
(139) Ass 'n of Am. Physicians & Surgeons, 224 F. Supp. 2d at 1127 (quoting Thorpe v. Hous. Auth. of City of Durham, 393 U.S. 268, 281 (1969)).
(141) Citizens for Health v. Thompson et al., No. 03-2267, 2004 WL 765356 (E.D. Pa. Apr. 2, 2004), aff'd on other grounds, Citizens For Health v. Leavitt, 428 F.3d 167 (3d Cir.(Pa.) 2005).
(142) Id. at 14.
(143) The DHHS mandates Covered Entities disclose PHI under the Privacy Rule when the DHHS conducts an investigation to determine if a Covered Entity violated the provisions of the Privacy Rule. 45 C.F.R. [section] 164.502(a)(2)(ii).
(144) 10 U.S.C. [section] [section] 1071-111 Ob(2006).
(145) Civilian Health and Medical Program of the Uniformed Services (CHAMPUS), 32 C.F.R. [section] 199.1(c) (2012).
(146) U.S. Dep't of Def., Dir. 5136.01, Assistant Sec'y of Def. for Health Aff. (ASD(HA)) para. 4.1.2 (4 June 2008) [hereinafter DoDD 5136.01] (emphasis added).
(147) DODD 5124.02, supra note 30.
(149) DoDD 5136.12, supra note 31, para. 6.1.2.
(150) Id. para. 6.2.7. TRICARE regulations are contained at 32 C.F.R. [section] 199.1-199.26(2012).
(151) 32 C.F.R. [section] 199.17(a)(7).
(152) MHS Governance Reform Memorandum, supra note 31.
(153) See 32 C.F.R. [section] 199.17(q)(1)-(5). TPH, supra note 18, at 6. The three Managed Healthcare Support Contractors are HealthNet (North/Northeast), Humana Military (South/Southeast), UnitedHealthcare (West). See Managed Health Support Contracts, Def. Health Agency, http://www.tricare.mil/tma/ams/ams_mcsc.aspx.
(154) 32 C.F.R. [section][section] 199.6(a)(8)(ii)(B); 199.140); see also TRICARE Reimbursement Man. 6010.55-M, ch. 3, sec. 1 (Feb. l, 2008).
(155) Coal, for Common Sense in Gov't Procurement v. United States, 821 F. Supp. 2d 275, 283 (D.D.C. 2011) affd, Coal, for Common Sense in Gov't Procurement v. U.S., 707 F.3d 311 (D.C. Cir. Jan. 4,2013).
(156) See the DFIHS Commentary on the Public Comments to the Privacy Rule, supra note 53. Many of the public comments to the proposed Privacy Rule expressed analogous concerns that the Rule's disclosure requirements would have a similarly dampening effect on the healthcare industry. Id. (discussing the public comments elicited in response to the Privacy Rule when first proposed).
(157) Indeed, research has demonstrated the primary reasons CHPs decline to provide services to Soldiers is TRICARE's low reimbursement rates, not its regulatory or administrative requirements. See U.S. Gov't Accountability Office, GAO-11-500, Defense Health Care: Access to Civilian Providers Under Tricare Standard and Extra 14-15 (2011).
(158) Alaniyi-Leyimu Telephone interview, supra note 87; Butts Telephone Interview, supra note 87.
(159) H.B. 3201, 77th Leg. Assemb., Reg. Sess. (Or. 2007); see Janet. L. Kaminski, OLS Research Report 2007-R-0510, Encouraging Health Care Providers to Participate in TRICARE (2007), http://www.cga.ct.gOv/2007/rpt/2007-R-0510.htm. The Oregon statute creates an individual income tax deduction of $2,500.00 for a CHP who becomes a TRICARE provider. To incentivize CHPs to become and remain TRICARE providers, the federal government could significantly increase this amount and/or provide additional tax incentives to CHPs under the federal tax code.
(160) 10 U.S.C. [section][section] 1071-1110b (2006).
(161) 32 C.F.R. [section][section] 199.1-199.26 (2012).
(162) DoDD 5124.02, supra note 30.
(163) DODD 5136.01, supra note 146.
(164) DODD 5124.02, supra note 30.
(165) DODD 5136.01, supra note 146.
(166) Id. para. 4.1.2.
(167) Id. para 126.96.36.199.
(168) DODD 5136.12, supra note 31, para. 6.2.3.
(169) See generally Katherine Blakeley, Cong. Research Serv., RL33537, Military Medical Care: Questions and Answers (2013), http://www.fas.org/sgp/crs/misc/RL33537.pdf.
(170) TPH supra note 18, at 6; see supra note 153.
(171) 32 C.F.R. [section] [section] 199.1-199.26 (2012).
(172) TOM, supra note 9.
(173) TPH, supra note 18.
(174) See id. at 9 (providing a helpful diagram of provider types).
(176) Id. at 9-10.
(177) 3 2 C.F.R. [section] 199.6.
(178) TPH, supra note 18, at 9-10.
(181) TOM, supra note 9, ch. 8, sec. 4, paras. 6.0-6.2. This is known as the "signature on file" (SOF) requirement. Civilian health care providers must comply with this requirement in order to submit and receive reimbursement for claims. Id. para. 6.0.
(182) Id. ch. 8, sec. 4, paras. 6.6-10.3. The TOM provides an exception under some circumstances if the CHP is unable to provide proof of the Soldier's SOF. Id. para. 8.2.
(183) 45 C.F.R. [section] 164.512(k)(1)(i) (newly recommended language in italics).
(184) Id. [section] 164.508 (b)(5).
(185) Pursuant to the Administrative Procedures Act (APA), 5 U.S.C. [section] [section] 551-559 (2006). The Department of Health and Human Services has the discretion to publish the proposed change to the MCE for a longer period under the APA.
(186) See discussion supra note 12; see also TOM, supra note 9, ch. 19, sec. 3, para. 2.6.1-2.6.2.
(187) 10 U.S.C. [section] [section] 1071, 1079 (2006).
(188) 32 C.F.R. [section] 199.6(a)(13)(i)-(xii) (2012).
(190) TRICARE POL'Y MAN. 6017.57-M, ch. 11, sec. 12.3 (Feb. 1, 2008) [hereinafter TPM],
(191) 32 C.F.R. [section] 199.6(a)(13)(i)-(xii).
(192) TPM, supra note 190.
(193) Id. ch. 11, sec. 12.3.
(194) TRICARE Form CMS-1500, Health Insurance Claim Form (08/05); TRICARE Form CMS 1450, UB-04 (2007); see TRICARE Electronic Claims Filing (Apr. 2014), http://www.humana-military.com/library/pdf/claims.pdf.
Major Dane B. Getz, Judge Advocate, U.S. Army Reserve. Presently assigned as the Deputy G3/5/7 for the U.S. Army Reserve Legal Command (USARLC) in Gaithersburg, Maryland. This article was submitted in partial completion of the Master of Laws requirements of the 61st Judge Advocate Officer Graduate Course.
|Printer friendly Cite/link Email Feedback|
|Title Annotation:||Health Insurance Portability and Accountability Act of 1996|
|Author:||Getz, Dane B.|
|Date:||Jul 1, 2014|
|Previous Article:||"JAG Corps couples": a short history of married lawyers in the Corps.|
|Next Article:||Congress offends Eisenhower and Cicero by annihilating Article 60, UCMJ.|