Part III, Subpart ii, Chapter 3

Revised August 28, 2025

III.ii.3.1.aAuthorization Required by PHPs

Treatment received from private healthcare providers (PHPs) is often identified as relevant to a claim. The PHP who holds these records will not release the treatment records without a Health Insurance Portability and Accountability Act (HIPAA) compliant authorization statement signed by the individual who is the subject of the information. When the Department of Veterans Affairs (VA) is attempting to secure the private medical records (PMR) on the claimant’s behalf, the claimant should provide an authorization form that is acceptable to the records holder by using the following:

VA Form 21-4142, Authorization to Disclose Information to the Department of Veterans Affairs (VA), and
VA Form 21-4142a , General Release for Medical Provider Information to the Department of Veterans Affairs (VA), or
special authorization form prescribed by the PHP.

Note: If VA Forms 21-4142 and 21-4142a or other required PHP authorization forms are not of record, send a request to the claimant, fiduciary, or next of kin, as appropriate. Reference: For more information on the HIPAA Privacy Rule, see M21-1 Part III, Subpart ii, 3.1.h.

III.ii.3.1.bVA Forms 21-4142 and 21-4142a

VA Forms 21-4142and 21-4142a are used in conjunction with each other and both forms must be completed in order to obtain a claimant’s PMRs from the identified PHP or Vet Center. The differences between these two forms are

VA Form 21-4142 gives authorization to PHP's/Vet Centers to disclose information to VA, and
VA Form 21-4142a provides the PHP's/Vet Center's contact information.

Important: If a PHP/Vet Center will not accept photographs taken of completed VA Form s 21-4142 or 21-4142a that have been submitted to VA in lieu of the actual document(s), the claims processor must request the actual form from the claimant, per instructions in M21-1, Part III, Subpart ii, 3.1.d. Notes:

A VA Form 21-4142a is generally for VA internal use only. However, Vet Centers or PHPs will occasionally request a copy of VA Form 21-4142a to identify treatment dates and other information not contained on VA Form 21-4142.
Releasing information about other PHPs is prohibited under the HIPAA Privacy Rule; therefore, a VA Form 21-4142a with information about multiple PHPs must be redacted before it is sent to the treatment facility to obtain records.
Some PHPs may require the completion of a specialized authorization form before they will release the claimant’s PMRs.

Reference: For more information on obtaining Vet Center records, see M21-1, Part III, Subpart ii, 1.A.1.e.

III.ii.3.1.cExpiration of Signed and Dated VA Forms 21-4142

The HIPPA Privacy Rule requires an authorization form to contain an expiration date or an expiration event that relates to the individual or the purpose of the disclosure _. _The completed VA Form 21-4142 will expire one year from the date the claimant signs it. Important:

VA Form 21-4142 must be signed and dated to be considered complete. Request a completed form from the claimant if the signature or date is missing.
If VA Form 21-4142 expires before VA can obtain the PHP’s/Vet Center records, request the Veteran provide VA with an updated VA Form 21-4142. Do not request the Veteran complete an additional VA Form 21-4142a.

III.ii.3.1.dDevelopment Actions Related to VA Forms 21-4142 and 21-4142a

The instructions in the table below determine what development actions to take when requesting authorization to obtain treatment records from a PHP or a Vet Center.Important: Prior to requesting completion of VA Forms 21-4142 or 21-4142a, check the VA Locator Facility List to determine if the identified provider is a VA facility. The only VA facilities that require completed VA Forms 21-4142 or _21-4142a _to obtain records are Vet Centers.

If ...	Then ...
a complete VA Form 21-4142 is of record but a VA Form 21-4142a is incomplete, or not available develop to the claimant by telephone and record any PHP/Vet Center source information provided by the claimant on VA Form 21-4142a, or if unable to reach the claimant via telephone, generate a development letter to the claimant requesting the return of a completed VA Form 21-4142a. Important: If developing for a release for Vet Center records, users must alter the generated text to inform the claimant the form is needed for Vet Center records. a complete VA Form 21-4142a is of record but a complete VA Form 21-4142 is *not*	generate a development letter to the claimant requesting the return of a completed VA Form 21-4142. Important : If developing for a release for Vet Center records, users must alter the generated text to inform the claimant the form is needed for Vet Center records.
both VA Forms 21-4142 and 21-4142a are complete and of record, *and* have not been processed by PMR contractor	follow the instructions in M21-1, Part III, Subpart ii, 3.2.f for development of the claimant’s PMRs.
both VA Forms 21-4142 and 21-4142a are either incomplete or *not* of record	generate a development letter to the claimant to complete, sign, date and return *both* forms. Important: If developing for a release for Vet Center records, users must alter the generated text to inform the claimant of the form needed for Vet Center records.
a photograph(s) of VA Forms 21-4142 or 21-4142a was submitted rather than the actual form, *and* the PHP/Vet Center refuses to accept the photographed copy	generate a development letter to the claimant requesting the return of the completed form(s).

Notes:

If PHP source information is obtained from the claimant by telephone and recorded on VA Form 21-4142a, follow the instructions in M21-1, Part III, Subpart ii, 3.2.f to engage the PMR Retrieval Program process.
If the claimant fails to respond to the request for additional information, no further action to request the claimant’s PMRs is required.
The PMR Retrieval Program utilizes a contractor to provide development assistance by attempting to retrieve all PMRs that Veterans and their dependents have identified on the VA Form 21-4142a.
The PMR contractor will not request medical records from Vet Centers or Federal facilities, as indicated in M21-1, Part III, Subpart ii, 3.2.c.

References: For more information on

sending a written request for records to a Federal facility, see M21-1, Part III, Subpart ii, 1.A.1.c
requesting Vet Center records, see M21-1, Part III, Subpart ii, 1.A.1.e
exceptions regarding versions of VA Form 21-4142, see M21-1, Part III, Subpart ii, 3.1.b, and
the PMR Retrieval Program, see M21-1, Part III, Subpart ii, 3.2.

III.ii.3.1.eRO Procedures for Requesting Medical Records

Follow the steps in the table below to request medical records from sources other than VA. Important:

These procedures apply when the regional offices (ROs) are developing for medical records instead of the PMR contractor.
As discussed in M21-1, Part III, Subpart ii, 3.1.d, first check the VA Locator Facility List to determine if the identified provider is a VA facility. Do not request VA medical center (VAMC) records using the PMR process.

Step	Action
1	Prepare and send a request for any medical records that the claimant has identified, and are relevant to the claim. Attach to the original letter VA Form 21-4142, signed by the claimant, and an extra copy of the letter. Advise the custodian of the records that VA cannot pay for records it requests. Note: When creating the letter in the Veterans Benefits Management System (VBMS), select the Notice – VA Is Contacting Provider for Med Rcds letter.
2	Notify the claimant that VA made the request, and the claimant is ultimately responsible for ensuring VA receives the records.
3	Establish a suspense date that expires 15 days from the current date.
4	Did VA receive the records it requested within 15 days? If yes , route the claim to the rating activity after all other development is complete, and disregard the remaining steps in the table. If no , make one attempt to request the records from their custodian by telephone.
5	Was telephone contact made with the custodian of the records? If yes , document the telephone call on VA Form 27-0820, Report of General Information, including the name of the individual contacted date and time of the call reason for the call, and substance of the conversation, and allow the individual 15 days to respond, *unless* it is indicated that the records are unavailable do not exist, or cannot be obtained without a fee. If no , document the attempt to contact the custodian as a note in VBMS, including the date and time of the call, and reason for the call send a follow-up letter to the custodian, and allow 15 days for a response. Note: Whenever appropriate, ask the custodian to fax the requested records to VA. (Ensure the fax machine is in a secure location since the faxed documents may contain personally identifiable information.) Reference: For more information about using VBMS, see the VBMS Core User Guide.
6	After the 15-day response period ends, route the claim to the rating activity (if all other development is complete), regardless of whether or not the custodian of the records responded. Exceptions: Return to Step 1 if a negative response from a records custodian suggests VA could obtain the records it is seeking by submitting another request to the same custodian or to a different one. Follow the instructions in M21-1, Part III, Subpart ii, 3.1.f if a records custodian rejects VA’s request because one of the following is required: an original signature on VA Form 21-4142, or a special authorization form (other than VA Form 21-4142).

References : For more information on

requesting Vet Center records, see M21-1, Part III, Subpart ii, 1.A.1.e, and
obtaining VAMC records, see M21-1, Part III, Subpart ii, 1.A.2.

III.ii.3.1.fProcedures When the RO Request for PMRs Is Rejected

Follow the instructions in the table below if a records custodian refuses to give VA a copy of a claimant’s medical records because

the VA Form 21-4142 VA included in its initial request did not have an original signature, or
the records custodian requires the claimant to complete a special authorization form (other than VA Form 21-4142).

Important:

These procedures apply when ROs are developing for medical records instead of the PMR contractor.
If the claimant fails to respond to the request for medical records, and/or the response period ends, close out the corresponding tracked item(s) and route the claim to the rating activity after all other development is complete.

If ...	Then ...
the records custodian requires the claimant to complete a special authorization form
prepare a letter containing the paragraphs labeled Private provider requires spec. release change the time limit for responding to the letter to 30 days send the letter to the claimant, along with the special authorization form (if available), and allow 30 days for a response. Notes: If the claimant returns the special authorization form to VA instead of obtaining the records, follow the instructions in M21-1, Part III, Subpart ii, 3.1.e. If the medical care provider requires an original signature on the form, and VA is processing the corresponding claim in a paperless environment, the claimant must send the form directly to the medical care provider, or obtain the records and submit them to VA. the medical care provider requires a VA Form 21-4142 with an original signature, and the VA Form 21-4142 in the claims folder has an original signature make a photocopy of the VA Form 21-4142 (with the original signature) and retain it in the claims folder send the medical care provider the Initial Private 3rd Party Letter with VA Form 21-4142 (with the original signature) notify the claimant of the action taken, and allow 15 days for a response. the medical care provider requires a VA Form 21-4142 with an original signature, and the VA Form 21-4142 in the claims folder does *not* have an original signature, or the claimant has an electronic claims folder (eFolder) instead of a claims folder prepare a letter containing the paragraphs labeled Private treatment records – 15-day notification – Claimant change the time limit for responding to the letter to 30 days send the letter to the claimant, and allow 30 days for a response. Notes: If the claimant returns VA Form 21-4142 to VA with an original signature instead of obtaining the records, follow the instructions in M21-1, Part III, Subpart ii, 3.1.e. If VA is processing the corresponding claim in a paperless environment, the claimant must send the form directly to the medical care provider, or obtain the records and submit them to VA. a photograph(s) of VA Forms 21-4142 or 21-4142a was submitted rather than the actual form, *and* the PHP/Vet Center refuses to accept the photographed copy	generate a development letter to the claimant requesting the return of the completed form(s).

If ...

Then ...

the records custodian requires the claimant to complete a special authorization form

prepare a letter containing the paragraphs labeled Private provider requires spec. release
- change the time limit for responding to the letter to 30 days
- send the letter to the claimant, along with the special authorization form (if available), and
- allow 30 days for a response.

Notes:

If the claimant returns the special authorization form to VA instead of obtaining the records, follow the instructions in M21-1, Part III, Subpart ii, 3.1.e.
If the medical care provider requires an original signature on the form, and VA is processing the corresponding claim in a paperless environment, the claimant must
- send the form directly to the medical care provider, or
- obtain the records and submit them to VA.
the medical care provider requires a VA Form 21-4142 with an original signature, and
the VA Form 21-4142 in the claims folder has an original signature
make a photocopy of the VA Form 21-4142 (with the original signature) and retain it in the claims folder
send the medical care provider the Initial Private 3rd Party Letter with VA Form 21-4142 (with the original signature)
notify the claimant of the action taken, and
allow 15 days for a response.

the medical care provider requires a VA Form 21-4142 with an original signature, and

the VA Form 21-4142 in the claims folder does not have an original signature, or
the claimant has an electronic claims folder (eFolder) instead of a claims folder
prepare a letter containing the paragraphs labeled Private treatment records – 15-day notification – Claimant
change the time limit for responding to the letter to 30 days
send the letter to the claimant, and
allow 30 days for a response.

Notes:

If the claimant returns VA Form 21-4142 to VA with an original signature instead of obtaining the records, follow the instructions in M21-1, Part III, Subpart ii, 3.1.e.
If VA is processing the corresponding claim in a paperless environment, the claimant must
- send the form directly to the medical care provider, or
- obtain the records and submit them to VA.
a photograph(s) of VA Forms 21-4142 or 21-4142a was submitted rather than the actual form, and
the PHP/Vet Center refuses to accept the photographed copy

generate a development letter to the claimant requesting the return of the completed form(s).

III.ii.3.1.gClaimant Notification When PMRs Are Unavailable

As noted in M21-1, Part III, Subpart i, 2.C.3.a, VA must notify the claimant of its inability to obtain relevant PMRs the claimant identified. This requirement is met by the rating activity when it enters the following text in the Evidence section of the rating decision: Private medical records requested from[name of provider], but not received. Claimants receive a copy of the rating decision with the corresponding decision notice. Important: The rating activity must enter the referenced text in the rating decision regardless of whether the records were requested by the PMR Program contractor or an RO. References: For more information on

determining relevance of records, see M21-1, Part III, Subpart i, 2.E.1
documenting claims folder when evidence is not considered relevant, see M21-1, Part III, Subpart i, 2.E.1.f
the Evidence section of the rating decision, see M21-1, Part V, Subpart iv, 1.A.4, and
decision notices, see M21-1, Part VI, Subpart i, 1.B.

III.ii.3.1.hGeneral Information About HIPAA

The HIPAA Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The HIPPA Privacy Rule calls this information protected health information (PHI). PHI includes the

individual’s past and present physical or mental health condition(s), and
health care provided to the individual.

The HIPPA Privacy Rule limits the circumstances in which an individual’s PHI may be used or disclosed by covered entities. A covered entity may not use or disclose PHI, except when the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing the release of the PHI. Note: Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security numbers).

III.ii.3.1.iHIPAA’s Impact on VBA

In Advisory Opinion ADV 3-2003, the Office of General Council determined that records in compensation and pension claims folders are not subject to the HIPAA Privacy Rule. Its conclusion is based on the fact that the Veterans Benefits Administration (VBA) does not meet the definition of a “covered entity,” as described in 45 CFR 160.103. However, the HIPAA Privacy Rule does affect VA Forms 21-4142 and 21-4142a. References: For more information on

_VA Forms 21-4142 _and 21-4142a , see M21-1, Part III, Subpart ii, 3.1.b.
development actions related to VA Forms 21-4142 and 21-4142a, see M21-1, Part III, Subpart ii, 3.1.d.

III.ii.3.1.jCovered Entities Under HIPAA

The entities listed below are covered entities under HIPAA.

Covered Entity	Definition
Health Plan	Provides or pays the cost of medical care.
Health Care Clearinghouse	A public or private entity that translates health information from one format to another.
Health Care Provider	A provider of services as defined in 42 U.S.C.1395x(u). This includes hospitals, critical access hospitals, skilled nursing facilities, comprehensive outpatient rehabilitation facilities, home health agencies, and hospice programs. A provider of medical or health services as defined in 42 U.S.C. 1395x(s). This includes physicians’ services, office-type services, and supplies furnished incident to a physician’s professional service, such as diagnostic tests, therapy, dressings, casts, durable medical equipment, ambulance service, prosthetic devices, vaccines, nurse anesthetist service, mammography, and other types of screening. This also includes anyone else who furnishes, bills, or is paid for health care in the normal course of business.

2PMR Retrieval Program

This topic contains information on the PMR retrieval program, including

purpose of the PMR Program
PMR contractor responsibilities
medical releases not processed by PMR contractor
RO leadership responsibilities
PMR Super Users
uploading VA Forms 21-4142 and 21-4142a via QuickSubmit
PMR Retrieval Program Tracked Items, and
requests rejected by the PMR contractor.

Revised April 28, 2025

III.ii.3.2.aPurpose of PMR Program

The purpose of this program is to have a PMR contractor obtain PMRs by contacting PHPs and requesting the treatment records identified on the medical release form(s). Obtaining PMRs on behalf of a claimant begins when the claimant, fiduciary, or next of kin provides VA with

VA Forms 21-4142 and 21-4142a
any private medical release form that is equivalent to the _VA Forms 21-4142. _

Reference: For more information on the PMR Program, see the

III.ii.3.2.bPMR Contractor Responsibilities

The PMR Program was deployed nationally in November 2014, and was designed to work in collaboration with ROs to improve the receipt of medical records in support of Veterans’ or dependents of Veterans’ claims. The PMR contractor will process the medical release regardless of the benefit types from

ROs
pension management centers, and
decision review operations centers.

Incoming medical release requests received through the Centralized Mail Portal (CMP) will be automatically processed by the PMR contractor via the VBA Automation Platform (VBAAP). Upon receipt, the PMR contractor will review the medical release forms to determine if the forms meet the processing requirements. The PMR contractor will develop any PMR release forms with sufficient information. The PMR contractor will also develop the PMR release form, if they can augment the form by obtaining the missing information from various VBA systems. Notes:

If the PMR contractor sends a third-party notice to an incorrect address for the PHP, the PMR Super User should contact the PMR help desk to advise the PMR contractor of the error.
The PMR contractor will not notify the Veteran of negative responses received from PHPs. Consequently, ROs must follow the notification procedures outlined in M21-1, Part III, Subpart ii, 3.1.g.
If the PMR contractor receives an undeliverable notice from the address of record, they will close out the medical release request unless they have a forwarding address provided by the U.S. Postal Service.

Reference: For more information on the PMR contractor contact information and responsibilities, see the PMR Resource Documents.

III.ii.3.2.cMedical Releases Not Processed by PMR Contractor

There are several circumstances when the PMR contractor will not process the medical release. The contractor will create a Reject Notice which will be transmitted to the claims folder through VBAAP.Most commonly, this will occur when

the medical release is
- illegible
- a duplicate medical release (previously submitted)
- identifying treatment at a
  - VA medical center
  - Vet Center
  - military treatment facility, or
  - other Federal facility (such as Indian Health Service)
- missing PHP information that cannot be obtained by the PMR contractor, or
- for a non-medical record request
PHP declines request for PMRs
a request is canceled, or
a death certificate is needed.

Important: The RO employees who develop claims are required to review the rejected medical releases to ensure the medical release is truly incomplete and does not provide sufficient information that allows the PMR contractor the ability to process the form. Reference: For more information on how to handle medical release forms that are rejected by the PHP, see M21-1, Part III, Subpart ii, 3.2.h.

III.ii.3.2.dRO Leadership Responsibilities

RO leadership is responsible for ensuring designated PMR Super Users complete the required training. The RO reserves the right to designate or replace assigned PMR Super Users. The RO must provide the PMR Program Management Office (PMO) staff with the contact information listed below for its designated PMR Super User and back-up Super User

name
phone number
e-mail address
date of completion of PMR training in VA’s Talent Management System (TMS), and
RO name and number.

Important: The PMR Super Users’ contact information must be current and should be reported to the PMR PMO. This includes a change to update the RO’s Super User, as necessary. References: For more information on PMR

Super Users, see the PMR Super User List, and
PMO contact information, see the PMR Retrieval Program homepage.

III.ii.3.2.ePMR Super Users

The ROs will identify PMR Super Users who will support the PMR contractor processing activity by

serving as their RO’s point of contact
monitoring the PMR workflow process locally
using QuickSubmit to upload medical release requests which have not been previously submitted to the PMR contractor
communicating the provisions of the PMR Program to employees who are designated to develop claims
communicating any challenges to the PMR PMO staff, and
attending PMR conference calls.

References: For more information on the

PMR Super User duties, responsibilities, and training requirements, see the PMR Resource Documents
list of current super users, see the PMR Super User List, and
PMR PMO contact information, see the PMR Retrieval Program home page.

III.ii.3.2.fUploading VA Forms 21-4142 and 21-4142a via QuickSubmit

There are instances in which the PMR requests will not be directly received through the CMP. In these instances, the ROs will be responsible for uploading both __ forms via QuickSubmit for processing by the PMR contractor. QuickSubmit is a secure online website that will allow ROs to upload VA Forms 21-4142 and 21-4142a into the CMP so VBAAP can begin processing the requests. Important: VBAAP requires receipt of both the valid VA Form 41-4142 and 21-4142a to begin processing PMR requests. Claims processors must ensure that both documents are uploaded together when using QuickSubmit. References: For more information on

QuickSubmit, see M21-1, Part II, Subpart i, 1.A.3, and
how to gain access to QuickSubmit, see PMR Resource Documents.

III.ii.3.2.gPMR Retrieval Program Tracked Items

PMR requests processed through the PMR Retrieval Program will automatically have tracked items created and updated by VBAAP. Specifically, VBAAP will:

add the PMR Pending tracked item with a 15-day suspense upon initial request of PMRs from the PHP
update the PMR Pending tracked item
- with an additional 15-day suspense upon making a follow-up request (if required), and
- after PMRs have been received and verified complete, and
close the PMR Pending tracked item if records are not received within 30 days.

Additionally, VBAAP will complete subsequent development actions and add corresponding tracked items for the following PMR reject reasons:

VA Form 21-4142 is expired
VA Form 21-4142/21-4142a is incomplete (missing claimant or PHP information), and
VA Form 21-4142 is outdated.

Important:

All PMR Retrieval Program development actions will have a corresponding VBMS note.
An employee who determines a tracked item was improperly opened, updated, or closed by VBAAP should update the tracked item to the appropriate state, as necessary, and add a note in VBMS documenting the corrective action taken.

III.ii.3.2.hRequests Rejected by the PMR Contractor

When the PMR contractor is unable to remediate a PMR reject, VBAAP will generate a reject notice and upload it to the eFolder for further action by VA employees. Upon discovery of a reject notice, claims processors should

attempt to obtain the missing information from the claims folder or VBMS
complete a new VA Form 21-4142a , and
upload the new VA Form 21-4142a and a corresponding valid VA Form 21-4142 together as a package via QuickSubmit for processing by the PMR contractor.

Exception: If the PMR reject cannot be resolved with information available in the claims folder or VA systems, the RO processing the claim will follow the instructions in M21-1, Part III, Subpart ii, 3.1.d, to resolve the issue. Important:

If the claimant fails to respond to VA’s request within 30 days , route the claim to the rating activity when all other development is complete.
VA processes claims in an electronic environment, which requires a VA Form 21-4142 with an original signature to be scanned into the claims folder through CMP. A VA Form 21-4142 with an original signature will not be returned to the ROs.

References: For more information on

common reasons Reject Notices are created by the PMR contractor, see M21-1, Part III, Subpart ii, 3.2.c
the requirement to submit both VA Forms 21-4142 and 21-4142a together to initiate the automated PMR process, see M21-1, Part III, Subpart ii, 3.2.f, and
QuickSubmit, see M21-1, Part II, Subpart i, 1.A.3.

End of Part III, Subpart ii, Chapter 3

III.ii.3.1.aAuthorization Required by PHPs

III.ii.3.1.bVA Forms 21-4142 and 21-4142a

III.ii.3.1.cExpiration of Signed and Dated VA Forms 21-4142

III.ii.3.1.dDevelopment Actions Related to VA Forms 21-4142 and 21-4142a

III.ii.3.1.eRO Procedures for Requesting Medical Records

III.ii.3.1.fProcedures When the RO Request for PMRs Is Rejected

III.ii.3.1.gClaimant Notification When PMRs Are Unavailable

III.ii.3.1.hGeneral Information About HIPAA

III.ii.3.1.iHIPAA’s Impact on VBA

III.ii.3.1.jCovered Entities Under HIPAA

2PMR Retrieval Program

III.ii.3.2.aPurpose of PMR Program

III.ii.3.2.bPMR Contractor Responsibilities

III.ii.3.2.cMedical Releases Not Processed by PMR Contractor

III.ii.3.2.dRO Leadership Responsibilities

III.ii.3.2.ePMR Super Users

III.ii.3.2.fUploading VA Forms 21-4142 and 21-4142a via QuickSubmit

III.ii.3.2.gPMR Retrieval Program Tracked Items

III.ii.3.2.hRequests Rejected by the PMR Contractor

Using this section

Cite it by number

Find the rest of the rule

Check the percentages

See what this means for your claim.