M21-1 Manual  /  Part III, Subpart ii, Chapter 3

Requesting Evidence From Private Health Providers (PHPs)

M21-1, Part III, Subpart ii, Chapter 3

Overview

In This Section
This section contains the following topics:
TopicTopic Name
1Requesting Private Medical Records (PMRs)
2PMR Retrieval Program

1. Requesting PMRs


Introduction

This topic contains general information on requesting PMRs, including
  • authorization required by PHPs
  • VA Forms 21-4142, Authorization to Disclose Information to the Department of Veterans Affairs (VA),and 21-4142a, General Release for Medical Provider Information to the Department of Veterans Affairs (VA)
  • expiration of signed and dated VA Forms 21-4142
  • development actions related to VA Forms 21-4142 and 21-4142a
  • regional office (RO) procedures for requesting medical records
  • procedures when the RO request for PMRs is rejected
  • claimant notification when PMRs are unavailable
  • general information about the Health Insurance Portability and Accountability Act (HIPAA)
  • HIPAA’s impact on the Veterans Benefits Administration (VBA), and
  • covered entities under HIPAA.

Change Date

August 28, 2025

III.ii.3.1.a. Authorization Required by PHPs

Treatment received from private healthcare providers (PHPs) is often identified as relevant to a claim. The PHP who holds these records will not release the treatment records without a Health Insurance Portability and Accountability Act (HIPAA) compliant authorization statement signed by the individual who is the subject of the information. When the Department of Veterans Affairs (VA) is attempting to secure the private medical records (PMR) on the claimant’s behalf, the claimant should provide an authorization form that is acceptable to the records holder by using the following:Note: If VA Forms 21-4142 and 21-4142a or other required PHP authorization forms are not of record, send a request to the claimant, fiduciary, or next of kin, as appropriate. Reference: For more information on the HIPAA Privacy Rule, see M21-1 Part III, Subpart ii, 3.1.h.

III.ii.3.1.b. VA Forms 21-4142 and 21-4142a

VA Forms 21-4142 and21-4142a are used in conjunction with each other and both forms must be completed in order to obtain a claimant’s PMRs from the identified PHP or Vet Center. The differences between these two forms are
  • VA Form 21-4142 gives authorization to PHP's/Vet Centers to disclose information to VA, and
  • VA Form 21-4142a provides the PHP's/Vet Center's contact information.
Important: If a PHP/Vet Center will not accept photographs taken of completed VA Forms 21-4142 or21-4142a that have been submitted to VA in lieu of the actual document(s), the claims processor must request the actual form from the claimant, per instructions in M21-1, Part III, Subpart ii, 3.1.d. Notes:
  • A VA Form 21-4142a is generally for VA internal use only. However, Vet Centers or PHPs will occasionally request a copy of VA Form 21-4142a to identify treatment dates and other information not contained on VA Form 21-4142.
  • Releasing information about other PHPs is prohibited under the HIPAA Privacy Rule; therefore, a VA Form 21-4142a with information about multiple PHPs must be redacted before it is sent to the treatment facility to obtain records.
  • Some PHPs may require the completion of a specialized authorization form before they will release the claimant’s PMRs.
Reference: For more information on obtaining Vet Center records, see M21-1, Part III, Subpart ii, 1.A.1.e.

III.ii.3.1.c. Expiration of Signed and Dated VA Forms 21-4142

The HIPPA Privacy Rule requires an authorization form to contain an expiration date or an expiration event that relates to the individual or the purpose of the disclosure. The completed VA Form 21-4142 will expire one year from the date the claimant signs it. Important:
  • VA Form 21-4142 must be signed and dated to be considered complete. Request a completed form from the claimant if the signature or date is missing.
  • If VA Form 21-4142 expires before VA can obtain the PHP’s/Vet Center records, request the Veteran provide VA with an updated VA Form 21-4142. Do not request the Veteran complete an additional VA Form 21-4142a.

III.ii.3.1.d. Development Actions Related to VA Forms 21-4142 and 21-4142a

The instructions in the table below determine what development actions to take when requesting authorization to obtain treatment records from a PHP or a Vet Center.Important: Prior to requesting completion of VA Forms 21-4142 or 21-4142a, check the VA Locator Facility List to determine if the identified provider is a VA facility. The only VA facilities that require completed VA Forms 21-4142 or 21-4142ato obtain records are Vet Centers.
If ...Then ...
a complete VA Form 21-4142 is of record but a VA Form 21-4142a is
  • incomplete, or
  • not available
  • develop to the claimant by telephone and record any PHP/Vet Center source information provided by the claimant on VA Form 21-4142a, or
  • if unable to reach the claimant via telephone, generate a development letter to the claimant requesting the return of a completed VA Form 21-4142a.
Important: If developing for a release for Vet Center records, users must alter the generated text to inform the claimant the form is needed for Vet Center records.
a complete VA Form 21-4142a is of record but a complete VA Form 21-4142 is notgenerate a development letter to the claimant requesting the return of a completed VA Form 21-4142. Important: If developing for a release for Vet Center records, users must alter the generated text to inform the claimant the form is needed for Vet Center records.
follow the instructions in M21-1, Part III, Subpart ii, 3.2.f for development of the claimant’s PMRs.
both VA Forms 21-4142 and 21-4142a are either incomplete or not of record generate a development letter to the claimant to complete, sign, date and return both forms. Important: If developing for a release for Vet Center records, users must alter the generated text to inform the claimant of the form needed for Vet Center records.
  • a photograph(s) of VA Forms 21-4142 or 21-4142a was submitted rather than the actual form, and
  • the PHP/Vet Center refuses to accept the photographed copy
generate a development letter to the claimant requesting the return of the completed form(s).
Notes: References: For more information on

III.ii.3.1.e. RO Procedures for Requesting Medical Records

Follow the steps in the table below to request medical records from sources other than VA. Important:
StepAction
1
  • Prepare and send a request for any medical records that
    • the claimant has identified, and
    • are relevant to the claim.
    • Attach to the original letter
    • Advise the custodian of the records that VA cannot pay for records it requests.
    Note: When creating the letter in the Veterans Benefits Management System (VBMS), select the Notice – VA Is Contacting Provider for Med Rcds letter.
2Notify the claimant that
  • VA made the request, and
  • the claimant is ultimately responsible for ensuring VA receives the records.
3Establish a suspense date that expires 15 days from the current date.
4Did VA receive the records it requested within 15 days?
  • If yes,
    • route the claim to the rating activity after all other development is complete, and
    • disregard the remaining steps in the table.
  • If no, make one attempt to request the records from their custodian by telephone.
5Was telephone contact made with the custodian of the records?
  • If yes,
    • document the telephone call on VA Form 27-0820, Report of General Information, including the
      • name of the individual contacted
      • date and time of the call
      • reason for the call, and
      • substance of the conversation, and
    • allow the individual 15 days to respond, unless it is indicated that the records
      • are unavailable
      • do not exist, or
      • cannot be obtained without a fee.
  • If no,
    • document the attempt to contact the custodian as a note in VBMS, including the
      • date and time of the call, and
      • reason for the call
    • send a follow-up letter to the custodian, and
    • allow 15 days for a response.
Note: Whenever appropriate, ask the custodian to fax the requested records to VA. (Ensure the fax machine is in a secure location since the faxed documents may contain personally identifiable information.) Reference: For more information about using VBMS, see the VBMS Core User Guide.
6After the 15-day response period ends, route the claim to the rating activity (if all other development is complete), regardless of whether or not the custodian of the records responded. Exceptions:
  • Return to Step 1 if a negative response from a records custodian suggests VA could obtain the records it is seeking by submitting another request to the same custodian or to a different one.
  • Follow the instructions in M21-1, Part III, Subpart ii, 3.1.f if a records custodian rejects VA’s request because one of the following is required:
References: For more information on

III.ii.3.1.f. Procedures When the RO Request for PMRs Is Rejected

Follow the instructions in the table below if a records custodian refuses to give VA a copy of a claimant’s medical records because
  • the VA Form 21-4142 VA included in its initial request did not have an original signature, or
  • the records custodian requires the claimant to complete a special authorization form (other than VA Form 21-4142).
Important:
  • These procedures apply when ROs are developing for medical records instead of the PMR contractor.
  • If the claimant fails to respond to the request for medical records, and/or the response period ends, close out the corresponding tracked item(s) and route the claim to the rating activity after all other development is complete.
If ...Then ...
the records custodian requires the claimant to complete a special authorization form
  • prepare a letter containing the paragraphs labeled Private provider requires spec. release
  • change the time limit for responding to the letter to 30 days
  • send the letter to the claimant, along with the special authorization form (if available), and
  • allow 30 days for a response.
Notes:
  • If the claimant returns the special authorization form to VA instead of obtaining the records, follow the instructions in M21-1, Part III, Subpart ii, 3.1.e.
  • If the medical care provider requires an original signature on the form, and VA is processing the corresponding claim in a paperless environment, the claimant must
    • send the form directly to the medical care provider, or
    • obtain the records and submit them to VA.
  • the medical care provider requires a VA Form 21-4142 with an original signature, and
  • the VA Form 21-4142 in the claims folder has an original signature
  • make a photocopy of the VA Form 21-4142 (with the original signature) and retain it in the claims folder
  • send the medical care provider the Initial Private 3rd Party Letter with VA Form 21-4142 (with the original signature)
  • notify the claimant of the action taken, and
  • allow 15 days for a response.
the medical care provider requires a VA Form 21-4142 with an original signature, and
  • the VA Form 21-4142 in the claims folder does not have an original signature, or
  • the claimant has an electronic claims folder (eFolder) instead of a claims folder
  • prepare a letter containing the paragraphs labeled Private treatment records – 15-day notification – Claimant
  • change the time limit for responding to the letter to 30 days
  • send the letter to the claimant, and
  • allow 30 days for a response.
Notes:
  • If the claimant returns VA Form 21-4142 to VA with an original signature instead of obtaining the records, follow the instructions in M21-1, Part III, Subpart ii, 3.1.e.
  • If VA is processing the corresponding claim in a paperless environment, the claimant must
    • send the form directly to the medical care provider, or
    • obtain the records and submit them to VA.
  • a photograph(s) of VA Forms 21-4142 or 21-4142a was submitted rather than the actual form, and
  • the PHP/Vet Center refuses to accept the photographed copy
generate a development letter to the claimant requesting the return of the completed form(s).

III.ii.3.1.g. Claimant Notification When PMRs Are Unavailable

As noted in M21-1, Part III, Subpart i, 2.C.3.a, VA must notify the claimant of its inability to obtain relevant PMRs the claimant identified. This requirement is met by the rating activity when it enters the following text in the Evidence section of the rating decision: Private medical records requested from [name of provider], but not received. Claimants receive a copy of the rating decision with the corresponding decision notice. Important: The rating activity must enter the referenced text in the rating decision regardless of whether the records were requested by the PMR Program contractor or an RO. References: For more information on

III.ii.3.1.h. General Information About HIPAA

The HIPAA Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The HIPPA Privacy Rule calls this information protected health information (PHI). PHI includes the
  • individual’s past and present physical or mental health condition(s), and
  • health care provided to the individual.
The HIPPA Privacy Rule limits the circumstances in which an individual’s PHI may be used or disclosed by covered entities. A covered entity may not use or disclose PHI, except when the individual who is the subject of the information (or the individual’s personal representative) authorizes in writing the release of the PHI. Note: Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security numbers).

III.ii.3.1.i. HIPAA’s Impact on VBA

In Advisory Opinion ADV 3-2003, the Office of General Council determined that records in compensation and pension claims folders are not subject to the HIPAA Privacy Rule. Its conclusion is based on the fact that the Veterans Benefits Administration (VBA) does not meet the definition of a “covered entity,” as described in 45 CFR 160.103. However, the HIPAA Privacy Rule does affect VA Forms 21-4142 and 21-4142a. References: For more information on

III.ii.3.1.j. Covered Entities Under HIPAA

The entities listed below are covered entities under HIPAA.
Covered EntityDefinition
Health PlanProvides or pays the cost of medical care.
Health Care ClearinghouseA public or private entity that translates health information from one format to another.
Health Care Provider
  • A provider of services as defined in 42 U.S.C.1395x(u). This includes hospitals, critical access hospitals, skilled nursing facilities, comprehensive outpatient rehabilitation facilities, home health agencies, and hospice programs.
  • A provider of medical or health services as defined in 42 U.S.C. 1395x(s). This includes physicians’ services, office-type services, and supplies furnished incident to a physician’s professional service, such as diagnostic tests, therapy, dressings, casts, durable medical equipment, ambulance service, prosthetic devices, vaccines, nurse anesthetist service, mammography, and other types of screening. This also includes anyone else who furnishes, bills, or is paid for health care in the normal course of business.

2. PMR Retrieval Program


Introduction

This topic contains information on the PMR retrieval program, including
  • purpose of the PMR Program
  • PMR contractor responsibilities
  • medical releases not processed by PMR contractor
  • RO leadership responsibilities
  • PMR Super Users
  • uploading VA Forms 21-4142 and 21-4142a via QuickSubmit
  • PMR Retrieval Program Tracked Items, and
  • requests rejected by the PMR contractor.

Change Date

April 28, 2025

III.ii.3.2.a. Purpose of PMR Program

The purpose of this program is to have a PMR contractor obtain PMRs by contacting PHPs and requesting the treatment records identified on the medical release form(s). Obtaining PMRs on behalf of a claimant begins when the claimant, fiduciary, or next of kin provides VA withReference: For more information on the PMR Program, see the

III.ii.3.2.b. PMR Contractor Responsibilities

The PMR Program was deployed nationally in November 2014, and was designed to work in collaboration with ROs to improve the receipt of medical records in support of Veterans’ or dependents of Veterans’ claims. The PMR contractor will process the medical release regardless of the benefit types from
  • ROs
  • pension management centers, and
  • decision review operations centers.
Incoming medical release requests received through the Centralized Mail Portal (CMP) will be automatically processed by the PMR contractor via the VBA Automation Platform (VBAAP). Upon receipt, the PMR contractor will review the medical release forms to determine if the forms meet the processing requirements. The PMR contractor will develop any PMR release forms with sufficient information. The PMR contractor will also develop the PMR release form, if they can augment the form by obtaining the missing information from various VBA systems. Notes:
  • If the PMR contractor sends a third-party notice to an incorrect address for the PHP, the PMR Super User should contact the PMR help desk to advise the PMR contractor of the error.
  • The PMR contractor will not notify the Veteran of negative responses received from PHPs. Consequently, ROs must follow the notification procedures outlined in M21-1, Part III, Subpart ii, 3.1.g.
  • If the PMR contractor receives an undeliverable notice from the address of record, they will close out the medical release request unless they have a forwarding address provided by the U.S. Postal Service.
Reference: For more information on the PMR contractor contact information and responsibilities, see the PMR Resource Documents.

III.ii.3.2.c. Medical Releases Not Processed by PMR Contractor

There are several circumstances when the PMR contractor will not process the medical release. The contractor will create a Reject Notice which will be transmitted to the claims folder through VBAAP.Most commonly, this will occur when
  • the medical release is
    • illegible
    • a duplicate medical release (previously submitted)
    • identifying treatment at a
      • VA medical center
      • Vet Center
      • military treatment facility, or
      • other Federal facility (such as Indian Health Service)
    • missing PHP information that cannot be obtained by the PMR contractor, or
    • for a non-medical record request
  • PHP declines request for PMRs
  • a request is canceled, or
  • a death certificate is needed.
Important: The RO employees who develop claims are required to review the rejected medical releases to ensure the medical release is truly incomplete and does not provide sufficient information that allows the PMR contractor the ability to process the form. Reference: For more information on how to handle medical release forms that are rejected by the PHP, see M21-1, Part III, Subpart ii, 3.2.h.

III.ii.3.2.d. RO Leadership Responsibilities

RO leadership is responsible for ensuring designated PMR Super Users complete the required training. The RO reserves the right to designate or replace assigned PMR Super Users. The RO must provide the PMR Program Management Office (PMO) staff with the contact information listed below for its designated PMR Super User and back-up Super User
  • name
  • phone number
  • e-mail address
  • date of completion of PMR training in VA’s Talent Management System (TMS), and
  • RO name and number.
Important: The PMR Super Users’ contact information must be current and should be reported to the PMR PMO. This includes a change to update the RO’s Super User, as necessary. References: For more information on PMR

III.ii.3.2.e. PMR Super Users

The ROs will identify PMR Super Users who will support the PMR contractor processing activity by
  • serving as their RO’s point of contact
  • monitoring the PMR workflow process locally
  • using QuickSubmit to upload medical release requests which have not been previously submitted to the PMR contractor
  • communicating the provisions of the PMR Program to employees who are designated to develop claims
  • communicating any challenges to the PMR PMO staff, and
  • attending PMR conference calls.
References: For more information on the

III.ii.3.2.f. Uploading VA Forms 21-4142 and 21-4142a via QuickSubmit

There are instances in which the PMR requests will not be directly received through the CMP. In these instances, the ROs will be responsible for uploading bothforms via QuickSubmit for processing by the PMR contractor. QuickSubmit is a secure online website that will allow ROs to upload VA Forms 21-4142 and 21-4142a into the CMP so VBAAP can begin processing the requests. Important: VBAAP requires receipt of both the valid VA Form 41-4142 and 21-4142a to begin processing PMR requests. Claims processors must ensure that both documents are uploaded together when using QuickSubmit. References: For more information on

III.ii.3.2.g. PMR Retrieval Program Tracked Items

PMR requests processed through the PMR Retrieval Program will automatically have tracked items created and updated by VBAAP. Specifically, VBAAP will:
  • add the PMR Pending tracked item with a 15-day suspense upon initial request of PMRs from the PHP
  • update the PMR Pending tracked item
    • with an additional 15-day suspense upon making a follow-up request (if required), and
    • after PMRs have been received and verified complete, and
    • close the PMR Pending tracked item if records are not received within 30 days.
    Additionally, VBAAP will complete subsequent development actions and add corresponding tracked items for the following PMR reject reasons:
    • VA Form 21-4142 is expired
    • VA Form 21-4142/21-4142a is incomplete (missing claimant or PHP information), and
    • VA Form 21-4142 is outdated.
    Important:
    • All PMR Retrieval Program development actions will have a corresponding VBMS note.
    • An employee who determines a tracked item was improperly opened, updated, or closed by VBAAP should update the tracked item to the appropriate state, as necessary, and add a note in VBMS documenting the corrective action taken.

III.ii.3.2.h. Requests Rejected by the PMR Contractor

When the PMR contractor is unable to remediate a PMR reject, VBAAP will generate a reject notice and upload it to the eFolder for further action by VA employees. Upon discovery of a reject notice, claims processors shouldException: If the PMR reject cannot be resolved with information available in the claims folder or VA systems, the RO processing the claim will follow the instructions in M21-1, Part III, Subpart ii, 3.1.d, to resolve the issue. Important:
  • If the claimant fails to respond to VA’s request within 30 days, route the claim to the rating activity when all other development is complete.
  • VA processes claims in an electronic environment, which requires a VA Form 21-4142 with an original signature to be scanned into the claims folder through CMP. A VA Form 21-4142 with an original signature will not be returned to the ROs.
References: For more information on

Source: VA M21-1 Adjudication Procedures Manual, M21-1, Part III, Subpart ii, Chapter 3 (U.S. government work, reproduced for reference). Browse all sections →