Form 10-0400 VSO Access to VHA Electronic Health Records

OMB Approval Number 2900-0710
Estimated Burden Avg: 2 minutes
Expiration Date: XX/XX/XXXX

VSO Access to VHA Electronic Health Records
Section 1: To be completed by VSO Representative
1. Last Name

2. First Name

4. Office Phone Number

5. Extension

3. Middle Initial

6 Office E-mail

8. Date of Birth

7. SSN

9. Veteran Service Organizations(VSOs)

11. I am located at a (check one):

12. If located at a VAMC or VARO please provide:
Station Name

VAMC
VARO

Station Number

VSO Mailing Address:

By signing below, I affirm that I will notify HIG of any change in my position or duties as related to my EHR access
15. Date

14. Signature of Individual Requesting Access

Section 2: TO BE COMPLETED BY THE LOCAL VBA ISO
I affirm with my signature below that I have verified that the applicant has provided proof of the following:
§
The Requestor is an accredited representative of the Veteran Service Organization.
§
The Requestor has completed the VA Privacy and Information Security Awareness Course within the past 365 days.
§
The Requestor has completed Privacy and HIPAA Focused Training within the past 365 days.
§
The Requestor has completed the VBA VSO TRIP Training and has current access to VBA applications.
§
Record or copies of the requestor's training certificates of completion for both courses of instruction are on file at this facility.
If I learn the VSO representative no longer complies with requirements for access to VHA EHRs, I will immediately notify HIG
16. ISO Name

17. ISO E-mail Address

18. VHA Privacy and HIPAA Focused Training Date of VSP Rep.

19. VA Information Security Training Date of VSO Rep.

Date

20. ISO Signature

Section 3: Health Information Governance
Authorizing HIG Offical (check one):

Initials:

Director, VHA Office of Health Information Governance (10P2C)
VHA Privacy Officer

VA FORM
JAN 2008

10-0400

Date

Access Restriction:
Access will be restricted by a
Patient Restricted List.

Page 1 of 3

VSO Electronic Health Record Access Agreement
The following security policies and rules of behavior apply to accredited representatives of Veterans Service Organizations
(VSOs) who have requested access to Veterans Health Administration (VHA) electronic health records (EHRs) through
Compensation and Pension Record Interchange (CAPRI). Taking into consideration that written guidance cannot cover every
contingency, personnel are asked to go beyond the stated rules, using their best judgment and highest ethical standards to guide
their actions. Personnel must understand that these rules are based on Federal laws and regulations, as well as Department of
Veterans Affairs (VA) and VHA Directives. As such, there are consequences for noncompliance with these rules. Depending on
the severity of the violation, and as authorized in Title 38 Code of Federal Regulations (CFR) §14.633, consequences can include:
suspension of access privileges, termination of accreditation, and criminal and civil penalties.
As an authorized CAPRI user, the VSO agrees to the following:
1. I agree and understand that I will have access to individually-identifiable health information. I understand that I will be given
sufficient access to perform my assigned duties for this project. I will use this access only for its intended purpose. I
understand that I am personally accountable for my actions.
2. I agree to notify the Office of Health Information Governance (HIG) immediately upon expiration of any Power of
Attorney (POA) for which I have been granted access to a veteran's individually-identifiable health information through
CAPRI.
3. I agree to use CAPRI to view a veteran's EHR only when my respective service organization, or I as an individual
representative of the VSO, holds a valid POA for that veteran. VSO access is restricted to only those veterans' records for
which a VSO has a valid VA POA. I agree that prior to using CAPRI to view a veterans' EHR, I will query the VBA SHARE
application to verify that my respective VSO holds a valid POA. I will also communicate to HIG ([email protected]) that the
POA is no longer valid.
4. I understand that all conditions and obligations imposed upon me by these rules apply during the entire time I am granted
access to this system, unless and until VHA releases me from these requirements in writing. I understand that a violation of
this notice constitutes disregard of Federal law, as well as local and/or VHA policy and will result in appropriate disciplinary
action as authorized in 38 CFR §14.633, including potential termination of accreditation and access privileges, as well as
criminal and civil penalties.
The VSO representative plays a vital role in maintaining the privacy and confidentiality of a veteran's EHRs. The VA depends on
the full VSO cooperation and communication to prevent or minimize the risk of unauthorized disclosure of a veteran's health
information.
I affirm with my signature in above form that the statements are true and correct to the best of my knowledge and belief.
(PENALTY: The law provides severe penalties, which include fine or imprisonment, or both, for the willful submission of any
statement or evidence of material fact knowing it to be false.)

I affirm with my signature below that I have read and understand the VSO Electronic Health Record
Agreement.

Service Officer Signature:

VA FORM
JAN 2008

10-0400

Date:

Page 2 of 3

Submit this Completed form supporting documentation to your local VBA ISO.
General Information for VSO Representatives
•

•
•
•
•

Once your packet is approved, you will be granted access to the EHRs of veterans for whom you hold valid POA,
subject to Federal Law and VA Policy.
o You are not required to submit a separate VA Form 10-0400 for each veteran you represent.
o When your access to the EHR of an individual veteran is terminated, you will still be able to access EHRs of
veterans for whom you still hold valid POA.
If you receive notice that your POA for a veteran has been revoked, you are required to notify VHA immediately.
If you find that you still have electronic access to records for which you do not hold a POA, you do not hold legal
authority to access or view those records.
You are required to meet annual training requirements.
In accordance with VA policy, after thirty days of inactivity, your account will be placed in a disuse category,
which will prevent you from using CAPRI. After one year of inactivity, your account will be terminated. To have your
account reactivated and removed from the disuse category, contact HIG ([email protected]).
If your EHR access is terminated for any reason, you will be required to submit a new 10-0400 form and
supporting documentation.

Submitting Your Packet
For access to CAPRI:
•
Submit your CAPRI access request packet to your local VBA Regional Office Information Security Officer. If
you are unsure of who your VBA Regional Office Information Security Officer is, please contact HIG (vso.hia@va.
gov) for assistance.

Contacting the VHA Office of Health Information Governance
•

If you have any questions about access to VHA EHRs, or if you need assistance preparing or submitting your
packet, please contact HIG at: Email: [email protected]

The Paperwork Reduction Act of 1995 requires us to notify you that this information collection is in accordance with the
clearance requirements of section 3507 of the Paperwork Reduction Act of 1995. We may not conduct or sponsor, and you are
not required to respond to, a collection of information unless it displays a valid OMB number. We anticipate that the time
expended by all individuals who must complete this form will average 2 minutes. This includes the time it will take to read
instructions, gather the necessary facts and fill out the form. Although completion of this form is voluntary, VA will be unable to
provide reimbursement for services rendered without a completed form. Failure to complete the form will have no effect on any
other benefits to which you may be entitled. This information is collected under the authority of Title 38 CFR Parts 51 and 52.
Privacy Act Notice: VA will not disclose information collected on this form to any source other than what has been authorized
under the Privacy Act of 1974 or Title 38, Code of Federal Regulations 1.576 for routine uses (i.e., congressional
communications, Federal agencies in regards to health care practices, program review purposes and the seeking of accreditation
and/or certification, officials of labor organizations when relevant and necessary to their duties of representation) as identified in
the VA system of records, “Veterans Health Information Systems and Technology Architecture (VistA) RecordsVA” (79VA19) , published in the Federal Register. Your obligation to respond is voluntary. However, the requested information
is considered relevant and necessary to recognize a service organization as your representative and/or identify disclosable records.
Providing your SSN is also voluntary. However, refusal to provide your SSN will result in VA's inability to provide you access to
VHA electronic health records. The VHA electronic health records system requires SSN in order to establish an user account. The
responses you submit are considered confidential. Information submitted is subject to verification through computer matching
programs with other agencies.

VA FORM
JAN 2008

10-0400

Page 3 of 3