--- title: "Part III, Subpart ii, Chapter 3" document: "M-21-1" section: "Part III, Subpart ii, Chapter 3" canonical: "https://veteranai.co/va-regulations/m21-1/iii.ii.3" source: "https://www.knowva.ebenefits.va.gov/system/templates/selfservice/va_ssnew/help/customer/locale/en-US/portal/554400000001018/content/554400000181428/M21-1-Part-III-Subpart-ii-Chapter-3-Requesting-Evidence-From-Private-Health-Providers-PHPs" updated: "2026-09-07T14:37:08.581908Z" --- August 28, 2025 ### III.ii.3.1.a. Authorization Required by PHPs Treatment received from private healthcare providers (PHPs) is often identified as relevant to a claim. The PHP who holds these records will not release the treatment records without a Health Insurance Portability and Accountability Act (HIPAA) compliant authorization statement signed by the individual who is the subject of the information. When the Department of Veterans Affairs (VA) is attempting to secure the private medical records (PMR) on the claimant’s behalf, the claimant should provide an authorization form that is acceptable to the records holder by using the following: * [_VA Form 21-4142, Authorization to Disclose Information to the Department of Veterans Affairs (VA_)](), and * [_VA Form 21-4142a_ , _General Release for Medical Provider Information to the Department of Veterans Affairs (VA_)](), or * special authorization form prescribed by the PHP. **Note:** If [_VA Forms 21-4142_]() and [_21-4142a_]() or other required PHP authorization forms are **_not_** of record, send a request to the claimant, fiduciary, or next of kin, as appropriate. **Reference:** For more information on the HIPAA Privacy Rule, see M21-1 Part III, Subpart ii, 3.1.h. ### III.ii.3.1.b. VA Forms 21-4142 and 21-4142a [ _VA Forms 21-4142_]()and _[21-4142a]()_ are used in conjunction with each other and both forms **_must_** be completed in order to obtain a claimant’s PMRs from the identified PHP or Vet Center. The differences between these two forms are * [ _VA Form 21-4142_]() gives authorization to PHP's/Vet Centers to disclose information to VA, and * [ _VA Form 21-4142a_]() provides the PHP's/Vet Center's contact information. **Important:** If a PHP/Vet Center will not accept photographs taken of completed [_VA Form_ _s 21-4142_]() or _[21-4142a]()_ that have been submitted to VA in lieu of the actual document(s), the claims processor must request the actual form from the claimant, per instructions in M21-1, Part III, Subpart ii, 3.1.d. **Notes:** * A [_VA Form 21-4142a_]() is generally for VA internal use only. However, Vet Centers or PHPs will occasionally request a copy of [_VA Form 21-4142a_]() to identify treatment dates and other information not contained on [_VA Form 21-4142_](). * Releasing information about other PHPs is prohibited under the HIPAA Privacy Rule; therefore, a [_VA Form 21-4142a_]() with information about multiple PHPs must be redacted before it is sent to the treatment facility to obtain records. * Some PHPs may require the completion of a specialized authorization form before they will release the claimant’s PMRs. **Reference:** For more information on obtaining Vet Center records, see [M21-1, Part III, Subpart ii, 1.A.1.e](). ### III.ii.3.1.c. Expiration of Signed and Dated VA Forms 21-4142 The HIPPA Privacy Rule requires an authorization form to contain an expiration date or an expiration event that relates to the individual or the purpose of the disclosure _. _The completed [_VA Form 21-4142_]() will expire one year from the date the claimant signs it. **Important:** * [_VA Form 21-4142_]() must be signed _**and**_ dated to be considered complete. Request a completed form from the claimant if the signature or date is missing. * If [_VA Form 21-4142_]() expires before VA can obtain the PHP’s/Vet Center records, request the Veteran provide VA with an updated [_VA Form 21-4142_](). **_Do not_** request the Veteran complete an additional _[VA Form 21-4142a]()._ ### III.ii.3.1.d. Development Actions Related to VA Forms 21-4142 and 21-4142a The instructions in the table below determine what development actions to take when requesting authorization to obtain treatment records from a PHP or a Vet Center.**Important:** Prior to requesting completion of [_VA Forms 21-4142_]() or [_21-4142a_](), check the [VA Locator Facility List]() to determine if the identified provider is a VA facility. The only VA facilities that require completed [_VA Forms 21-4142_]() or _[21-4142a]() _to obtain records are Vet Centers. | **If ...**| **Then ...** a complete [_VA Form 21-4142_]() is of record but a [_VA Form 21-4142a_]() is * incomplete, or * not available * develop to the claimant by telephone and record any PHP/Vet Center source information provided by the claimant on [_VA Form 21-4142a_](), **_or_** * if unable to reach the claimant via telephone, generate a development letter to the claimant requesting the return of a completed [_VA Form 21-4142a_](). **Important:** If developing for a release for Vet Center records, users must alter the generated text to inform the claimant the form is needed for Vet Center records. a complete [_VA Form 21-4142a_]() is of record but a complete [_VA Form 21-4142_]() is **_not_**| generate a development letter to the claimant requesting the return of a completed [_VA Form 21-4142_](). _**Important**_ : If developing for a release for Vet Center records, users must alter the generated text to inform the claimant the form is needed for Vet Center records. * both [_VA Forms 21-4142_]() and [_21-4142a_]() are complete and of record, **_and_** * have not been processed by PMR contractor | follow the instructions in M21-1, Part III, Subpart ii, 3.2.f for development of the claimant’s PMRs. both [_VA Forms 21-4142_]() and [_21-4142a_]() are either incomplete or **_not_** of record | generate a development letter to the claimant to complete, sign, date and return **_both_** forms. **Important:** If developing for a release for Vet Center records, users must alter the generated text to inform the claimant of the form needed for Vet Center records. * a photograph(s) of [_VA Forms 21-4142_]() or [_21-4142a_]() was submitted rather than the actual form, **_and_** * the PHP/Vet Center refuses to accept the photographed copy | generate a development letter to the claimant requesting the return of the completed form(s). **Notes:** * If PHP source information is obtained from the claimant by telephone and recorded on [_VA Form 21-4142a_](), follow the instructions in M21-1, Part III, Subpart ii, 3.2.f to engage the PMR Retrieval Program process. * If the claimant fails to respond to the request for additional information, no further action to request the claimant’s PMRs is required. * The [PMR Retrieval Program]() utilizes a contractor to provide development assistance by attempting to retrieve all PMRs that Veterans and their dependents have identified on the [_VA Form 21-4142a_](). * The PMR contractor will _not_ request medical records from Vet Centers or Federal facilities, as indicated in M21-1, Part III, Subpart ii, 3.2.c. **References:** For more information on * sending a written request for records to a Federal facility, see [M21-1, Part III, Subpart ii, 1.A.1.c]() * requesting Vet Center records, see [M21-1, Part III, Subpart ii, 1.A.1.e]() * exceptions regarding versions of [_VA Form 21-4142_](), see M21-1, Part III, Subpart ii, 3.1.b, and * the PMR Retrieval Program, see M21-1, Part III, Subpart ii, 3.2. ### III.ii.3.1.e. RO Procedures for Requesting Medical Records Follow the steps in the table below to request medical records from sources other than VA. **Important:** * These procedures apply when the regional offices (ROs) are developing for medical records instead of the PMR contractor. * As discussed in M21-1, Part III, Subpart ii, 3.1.d, first check the [VA Locator Facility List]() to determine if the identified provider is a VA facility. Do not request VA medical center (VAMC) records using the PMR process. | **Step**| **Action** 1| * Prepare and send a request for any medical records that * the claimant has identified, and * are relevant to the claim. * Attach to the original letter * [ _VA Form 21-4142_](), signed by the claimant, and * an extra copy of the letter. * Advise the custodian of the records that VA cannot pay for records it requests. **Note:** When creating the letter in the Veterans Benefits Management System (VBMS), select the _Notice – VA Is Contacting Provider for Med Rcds_ letter. 2| Notify the claimant that * VA made the request, and * the claimant is ultimately responsible for ensuring VA receives the records. 3| Establish a suspense date that expires 15 days from the current date. 4| Did VA receive the records it requested within 15 days? * If _yes_ , * route the claim to the rating activity after all other development is complete, and * disregard the remaining steps in the table. * If _no_ , make one attempt to request the records from their custodian by telephone. 5| Was telephone contact made with the custodian of the records? * If _yes_ , * document the telephone call on [_VA Form 27-0820, Report of General Information_](), including the * name of the individual contacted * date and time of the call * reason for the call, and * substance of the conversation, and * allow the individual 15 days to respond, **_unless_** it is indicated that the records * are unavailable * do not exist, or * cannot be obtained without a fee. * If _no_ , * document the attempt to contact the custodian as a note in VBMS, including the * date and time of the call, and * reason for the call * send a follow-up letter to the custodian, and * allow 15 days for a response. **Note:** Whenever appropriate, ask the custodian to fax the requested records to VA. (Ensure the fax machine is in a secure location since the faxed documents may contain personally identifiable information.) **Reference:** For more information about using VBMS, see the _VBMS Core User Guide_. 6| After the 15-day response period ends, route the claim to the rating activity (if all other development is complete), regardless of whether or not the custodian of the records responded. **Exceptions:** * Return to Step 1 if a negative response from a records custodian suggests VA could obtain the records it is seeking by submitting another request to the same custodian or to a different one. * Follow the instructions in M21-1, Part III, Subpart ii, 3.1.f if a records custodian rejects VA’s request because one of the following is required: * an original signature on [_VA Form 21-4142_](), or * a special authorization form (other than [_VA Form 21-4142_]()). _**References**_ : For more information on * requesting Vet Center records, see [M21-1, Part III, Subpart ii, 1.A.1.e](), and * obtaining VAMC records, see [M21-1, Part III, Subpart ii, 1.A.2](). ### III.ii.3.1.f. Procedures When the RO Request for PMRs Is Rejected Follow the instructions in the table below if a records custodian refuses to give VA a copy of a claimant’s medical records because * the [_VA Form 21-4142_]() VA included in its initial request did not have an original signature, or * the records custodian requires the claimant to complete a special authorization form (other than [_VA Form 21-4142_]()). **Important:** * These procedures apply when ROs are developing for medical records instead of the PMR contractor. * If the claimant fails to respond to the request for medical records, and/or the response period ends, close out the corresponding tracked item(s) and route the claim to the rating activity after all other development is complete. | **If ...**| **Then ...** the records custodian requires the claimant to complete a special authorization form| * prepare a letter containing the paragraphs labeled _Private provider requires spec. release_ * change the time limit for responding to the letter to _30 days_ * send the letter to the claimant, along with the special authorization form (if available), and * allow 30 days for a response. **Notes:** * If the claimant returns the special authorization form to VA instead of obtaining the records, follow the instructions in M21-1, Part III, Subpart ii, 3.1.e. * If the medical care provider requires an _original_ signature on the form, and VA is processing the corresponding claim in a paperless environment, the _claimant_ must * send the form directly to the medical care provider, or * obtain the records and submit them to VA. * the medical care provider requires a [_VA Form 21-4142_]() with an original signature, and * the [_VA Form 21-4142_]() in the claims folder has an original signature * make a photocopy of the [_VA Form 21-4142_]() (with the original signature) and retain it in the claims folder * send the medical care provider the _Initial Private 3rd Party Letter_ with [_VA Form 21-4142_]() (with the original signature) * notify the claimant of the action taken, and * allow 15 days for a response. the medical care provider requires a [_VA Form 21-4142_]() with an original signature, and * the [_VA Form 21-4142_]() in the claims folder does **_not_** have an original signature, or * the claimant has an electronic claims folder (eFolder) instead of a claims folder * prepare a letter containing the paragraphs labeled _Private treatment records – 15-day notification – Claimant_ * change the time limit for responding to the letter to _30 days_ * send the letter to the claimant, and * allow 30 days for a response. **Notes:** * If the claimant returns [_VA Form 21-4142_]() to VA with an original signature instead of obtaining the records, follow the instructions in M21-1, Part III, Subpart ii, 3.1.e. * If VA is processing the corresponding claim in a paperless environment, the _claimant_ must * send the form directly to the medical care provider, or * obtain the records and submit them to VA. * a photograph(s) of [_VA Forms 21-4142_]() or [_21-4142a_]() was submitted rather than the actual form, **_and_** * the PHP/Vet Center refuses to accept the photographed copy | generate a development letter to the claimant requesting the return of the completed form(s). ### III.ii.3.1.g. Claimant Notification When PMRs Are Unavailable As noted in [M21-1, Part III, Subpart i, 2.C.3.a](), VA must notify the claimant of its inability to obtain relevant PMRs the claimant identified. This requirement is met by the rating activity when it enters the following text in the _Evidence_ section of the rating decision: _Private medical records requested from_**[name of provider]**_, but not received_. Claimants receive a copy of the rating decision with the corresponding decision notice. **Important:** The rating activity must enter the referenced text in the rating decision regardless of whether the records were requested by the PMR Program contractor or an RO. **References:** For more information on * determining relevance of records, see [M21-1, Part III, Subpart i, 2.E.1]() * documenting claims folder when evidence is not considered relevant, see [M21-1, Part III, Subpart i, 2.E.1.f]() * the _Evidence_ section of the rating decision, see [M21-1, Part V, Subpart iv, 1.A.4](), and * decision notices, see [M21-1, Part VI, Subpart i, 1.B](). ### III.ii.3.1.h. General Information About HIPAA The HIPAA Privacy Rule protects all _"individually identifiable health information"_ held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The HIPPA Privacy Rule calls this information protected health information (PHI). PHI includes the * individual’s past and present physical or mental health condition(s), and * health care provided to the individual. The HIPPA Privacy Rule limits the circumstances in which an individual’s PHI may be used or disclosed by covered entities. A covered entity may not use or disclose PHI, except when the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing the release of the PHI. **Note:** Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security numbers). ### III.ii.3.1.i. HIPAA’s Impact on VBA In Advisory Opinion ADV 3-2003, the Office of General Council determined that records in compensation and pension claims folders are _not_ subject to the HIPAA Privacy Rule. Its conclusion is based on the fact that the Veterans Benefits Administration (VBA) does not meet the definition of a “covered entity,” as described in [45 CFR 160.103](). However, the HIPAA Privacy Rule does affect [_VA Forms 21-4142_]() and [_21-4142a_](). **References:** For more information on * _[VA Forms 21-4142]() _and _[21-4142a]()_ , see M21-1, Part III, Subpart ii, 3.1.b. * development actions related to _[VA Forms 21-4142]() and [21-4142a]()_, see M21-1, Part III, Subpart ii, 3.1.d. ### III.ii.3.1.j. Covered Entities Under HIPAA The entities listed below are covered entities under HIPAA. | **Covered Entity**| **Definition** Health Plan| Provides or pays the cost of medical care. Health Care Clearinghouse| A public or private entity that translates health information from one format to another. Health Care Provider| * A provider of services as defined in [42 U.S.C.1395x(u)](). This includes hospitals, critical access hospitals, skilled nursing facilities, comprehensive outpatient rehabilitation facilities, home health agencies, and hospice programs. * A provider of medical or health services as defined in [42 U.S.C. 1395x(s)](). This includes physicians’ services, office-type services, and supplies furnished incident to a physician’s professional service, such as diagnostic tests, therapy, dressings, casts, durable medical equipment, ambulance service, prosthetic devices, vaccines, nurse anesthetist service, mammography, and other types of screening. This also includes anyone else who furnishes, bills, or is paid for health care in the normal course of business. ## 2. PMR Retrieval Program This topic contains information on the PMR retrieval program, including * purpose of the PMR Program * PMR contractor responsibilities * medical releases not processed by PMR contractor * RO leadership responsibilities * PMR Super Users * uploading _VA Forms 21-4142_ and _21-4142a_ via QuickSubmit * PMR Retrieval Program Tracked Items, and * requests rejected by the PMR contractor. April 28, 2025 ### III.ii.3.2.a. Purpose of PMR Program The purpose of this program is to have a PMR contractor obtain PMRs by contacting PHPs and requesting the treatment records identified on the medical release form(s). Obtaining PMRs on behalf of a claimant begins when the claimant, fiduciary, or next of kin provides VA with * _[VA Forms 21-4142]()_ and _[21-4142a]()_ * any private medical release form that is equivalent to the _[VA Forms 21-4142](). _ **Reference:** For more information on the PMR Program, see the * [PMR Retrieval Program home page](), and * [PMR Resource Documents](). ### III.ii.3.2.b. PMR Contractor Responsibilities The PMR Program was deployed nationally in November 2014, and was designed to work in collaboration with ROs to improve the receipt of medical records in support of Veterans’ or dependents of Veterans’ claims. The PMR contractor will process the medical release regardless of the benefit types from * ROs * pension management centers, and * decision review operations centers. Incoming medical release requests received through the Centralized Mail Portal (CMP) will be automatically processed by the PMR contractor via the VBA Automation Platform (VBAAP). Upon receipt, the PMR contractor will review the medical release forms to determine if the forms meet the processing requirements. The PMR contractor will develop any PMR release forms with sufficient information. The PMR contractor will also develop the PMR release form, if they can augment the form by obtaining the missing information from various VBA systems. **Notes:** * If the PMR contractor sends a third-party notice to an incorrect address for the PHP, the PMR Super User should contact the PMR help desk to advise the PMR contractor of the error. * The PMR contractor **_will not_** notify the Veteran of negative responses received from PHPs. Consequently, ROs must follow the notification procedures outlined in M21-1, Part III, Subpart ii, 3.1.g. * If the PMR contractor receives an undeliverable notice from the address of record, they will close out the medical release request unless they have a forwarding address provided by the U.S. Postal Service. **Reference:** For more information on the PMR contractor contact information and responsibilities, see the [PMR Resource Documents](). ### III.ii.3.2.c. Medical Releases Not Processed by PMR Contractor There are several circumstances when the PMR contractor will not process the medical release. The contractor will create a _Reject Notice_ which will be transmitted to the claims folder through VBAAP.Most commonly, this will occur when * the medical release is * illegible * a duplicate medical release (previously submitted) * identifying treatment at a * VA medical center * Vet Center * military treatment facility, or * other Federal facility (such as Indian Health Service) * missing PHP information that cannot be obtained by the PMR contractor, or * for a non-medical record request * PHP declines request for PMRs * a request is canceled, or * a death certificate is needed. **Important:** The RO employees who develop claims are required to review the rejected medical releases to ensure the medical release is truly incomplete and does not provide sufficient information that allows the PMR contractor the ability to process the form. **Reference:** For more information on how to handle medical release forms that are rejected by the PHP, see M21-1, Part III, Subpart ii, 3.2.h. ### III.ii.3.2.d. RO Leadership Responsibilities RO leadership is responsible for ensuring designated PMR Super Users complete the required training. The RO reserves the right to designate or replace assigned PMR Super Users. The RO must provide the PMR Program Management Office (PMO) staff with the contact information listed below for its designated PMR Super User and back-up Super User * name * phone number * e-mail address * date of completion of PMR training in VA’s Talent Management System (TMS), and * RO name and number. **Important:** The PMR Super Users’ contact information must be current and should be reported to the PMR PMO. This includes a change to update the RO’s Super User, as necessary. **References:** For more information on PMR * Super Users, see the [PMR Super User List](), and * PMO contact information, see the [PMR Retrieval Program homepage](). ### III.ii.3.2.e. PMR Super Users The ROs will identify PMR Super Users who will support the PMR contractor processing activity by * serving as their RO’s point of contact * monitoring the PMR workflow process locally * using [QuickSubmit]() to upload medical release requests which have not been previously submitted to the PMR contractor * communicating the provisions of the PMR Program to employees who are designated to develop claims * communicating any challenges to the PMR PMO staff, and * attending PMR conference calls. **References:** For more information on the * PMR Super User duties, responsibilities, and training requirements, see the [PMR Resource Documents ]() * list of current super users, see the [_PMR Super User List_](), and * PMR PMO contact information, see the [PMR Retrieval Program home page](). ### III.ii.3.2.f. Uploading VA Forms 21-4142 and 21-4142a via QuickSubmit There are instances in which the PMR requests will not be directly received through the CMP. In these instances, the ROs will be responsible for uploading **_both_** __ forms via [QuickSubmit]() for processing by the PMR contractor. [QuickSubmit]() is a secure online website that will allow ROs to upload _[VA Forms 21-4142]()_ and _[21-4142a]()_ into the CMP so VBAAP can begin processing the requests. **Important:** VBAAP requires receipt of both the valid _[VA Form 41-4142]()_ and _[21-4142a]()_ to begin processing PMR requests. Claims processors must ensure that both documents are uploaded together when using [QuickSubmit](). **References:** For more information on * [QuickSubmit](), see [M21-1, Part II, Subpart i, 1.A.3](), and * how to gain access to [QuickSubmit](), see [PMR Resource Documents](). ### III.ii.3.2.g. PMR Retrieval Program Tracked Items PMR requests processed through the PMR Retrieval Program will automatically have tracked items created and updated by VBAAP. Specifically, VBAAP will: * add the _PMR Pending_ tracked item with a 15-day suspense upon initial request of PMRs from the PHP * update the _PMR Pending_ tracked item * with an additional 15-day suspense upon making a follow-up request (if required), and * after PMRs have been received and verified complete, and * close the _PMR Pending_ tracked item if records are not received within 30 days. Additionally, VBAAP will complete subsequent development actions and add corresponding tracked items for the following PMR reject reasons: * _VA Form 21-4142_ is expired * _VA Form 21-4142/21-4142a_ is incomplete (missing claimant or PHP information), and * _VA Form 21-4142_ is outdated. **Important:** * All PMR Retrieval Program development actions will have a corresponding VBMS note. * An employee who determines a tracked item was improperly opened, updated, or closed by VBAAP should update the tracked item to the appropriate state, as necessary, and add a note in VBMS documenting the corrective action taken. ### III.ii.3.2.h. Requests Rejected by the PMR Contractor When the PMR contractor is unable to remediate a PMR reject, VBAAP will generate a reject notice and upload it to the eFolder for further action by VA employees. Upon discovery of a reject notice, claims processors should * attempt to obtain the missing information from the claims folder or VBMS * complete a new _[VA Form 21-4142a]()_ , and * upload the new _[VA Form 21-4142a]()_ and a corresponding valid [_VA Form 21-4142_]() together as a package via [QuickSubmit]() for processing by the PMR contractor. **Exception:** If the PMR reject cannot be resolved with information available in the claims folder or VA systems, the RO processing the claim will follow the instructions in M21-1, Part III, Subpart ii, 3.1.d, to resolve the issue. **Important:** * If the claimant fails to respond to VA’s request **_within 30 days_** , route the claim to the rating activity when all other development is complete. * VA processes claims in an electronic environment, which requires a [_VA Form 21-4142_]() with an original signature to be scanned into the claims folder through CMP. A [_VA Form 21-4142_]() with an original signature **_will not_** be returned to the ROs. **References:** For more information on * common reasons _Reject Notices_ are created by the PMR contractor, see M21-1, Part III, Subpart ii, 3.2.c * the requirement to submit both [_VA Forms 21-4142_]() and _[21-4142a]()_ together to initiate the automated PMR process, see M21-1, Part III, Subpart ii, 3.2.f, and * [QuickSubmit](), see [M21-1, Part II, Subpart i, 1.A.3]().