VA updates the privacy map for its patient medical records system

The Department of Veterans Affairs is updating the formal Privacy Act notice for "Patient Medical Records-VA," the system behind treatment, payment, operations, research, eligibility work, and other VA health system functions. The notice is effective July 2, 2026, with comments due August 3, 2026, giving privacy, health IT, and veterans' health watchers a short window to read the fine print before the comment period closes.

What It Is

This is a modified system-of-records notice from the Veterans Health Administration for Patient Medical Records-VA. System-of-records notices describe what records an agency keeps, why it keeps them, how they are retrieved, where they live, and when they can be disclosed. In health care, that is often where the real governance story hides: less press conference, more data dictionary with legal consequences.

What's Changing

VA says the system number is being updated from 24VA10A7 to 24VA10, and the notice revises the system locations, system manager, purposes, record categories, record sources, routine uses, storage and retrieval practices, safeguards, and access/amendment procedures. The updates expressly move the notice into the modern VA data environment: electronic records, telehealth, the federal EHR enclave, My VA Health, secure messages, Individual Longitudinal Exposure Record data, Integration Control Number, EDIPI, Financial Identification Number, VA Enterprise Cloud storage, and data repositories all show up in the revised map.

Why It Matters

For patients and clinicians, the practical signal is that VA is refreshing the legal wrapper around a very large health-record ecosystem, not just correcting a mailing address. The notice describes records used for treatment, payment, operations, research, analytics, eligibility, benefits work, clinical support, and information sharing with other health care organizations and public programs. That matters because privacy policy in health care often arrives less as a thunderclap than as a table of routine uses, identifiers, cloud locations, and retrieval fields.

The dry policy note is that the system is already effective unless VA modifies it after comments. Anyone tracking federal EHR modernization, veterans' health privacy, or the practical governance of health data should read the notice now, while the comment window is still open. Read the VA notice in the Federal Register (https://www.federalregister.gov/documents/2026/07/02/2026-13454/privacy-act-of-1974-system-of-records)

CMS and VA tee up a Marketplace eligibility data match

As of July 2, 2026, CMS has placed a Privacy Act matching-program notice on Federal Register public inspection for publication July 6, and it is exactly the kind of quiet eligibility plumbing that can matter more than the headline fights. The program links CMS and VA data for Affordable Care Act insurance affordability determinations, with comments due 30 days after publication, likely August 5 if the notice publishes as scheduled.

What It Is

The notice describes a matching program between CMS, as the recipient agency, and VA, as the source agency. Its title is "Verification of Eligibility for Insurance Affordability Programs Under the Patient Protection and Affordable Care Act," which says the job plainly enough: CMS wants VA data to help determine whether people applying for or enrolled in exchange coverage have other coverage or benefit status that affects eligibility for assistance.

What's Changing

Under the program, VA data would help verify whether an applicant or enrollee has minimum essential coverage through a VHA health care program. CMS says the information will flow through the Data Services Hub to state administering entities for eligibility determinations involving financial assistance, Medicaid, CHIP, the Basic Health Program, advance premium tax credits, and cost-sharing reductions. The notice lists identity fields, Social Security numbers, requested coverage dates, VHA enrollment-period data, and VA disability-rating data among the records used in the match.

Why It Matters

This is not a payment rule or a coverage mandate; it is a notice about data matching. But eligibility systems are where policy turns into yes, no, wait, or prove it, and consumer outcomes can depend on the data CMS and state administering entities use. For patients, the issue is whether the government can accurately verify other coverage without creating avoidable errors. For health systems, navigators, and assisters, the issue is whether Marketplace and public-program eligibility processes can be explained when the match matters.

The matching program would commence no sooner than 30 days after publication if comments do not require changes, and CMS describes an initial term running approximately May 15, 2026, to November 15, 2027, with a possible one-year renewal. Identity data, veterans' coverage, and ACA subsidies in the same pipe deserve a careful look. Read the unpublished CMS notice on Federal Register public inspection (https://www.federalregister.gov/public-inspection/2026-13572/privacy-act-matching-program)

CMS seeks OMB review of rural health reporting and Medicare Advantage audit paperwork

As of July 2, 2026, CMS has an unpublished PRA notice scheduled for July 6 that is more interesting than the genre usually promises. The agency is seeking OMB review for a new Rural Health Transformation Program reporting collection and revisions to Medicare Part C and Part D audit and timeliness-monitoring protocols, with comments due 30 days after publication, likely August 5 if the notice publishes as scheduled.

What It Is

This is a Paperwork Reduction Act notice, the federal government's formal process for asking whether a form, report, or data request is necessary, clear, and not too burdensome. Many PRA notices are small-bore housekeeping. This one has more policy oxygen because it touches a new rural health reporting collection and CMS oversight of Medicare Advantage and Part D organizations.

What's Changing

The first collection, CMS-10949, is a new request for Rural Health Transformation Program Reporting. CMS says the program stems from Public Law 119-21, includes up to $50 billion over five years, and would require approved state awardees to submit annual and quarterly reports on milestones, performance and evaluation metrics, and expenditures; CMS estimates 50 respondents, 200 annual responses, and 20,000 annual hours. The second, CMS-10717, revises Medicare Part C and Part D Program Audit and Industry-Wide Part C Timeliness Monitoring Project protocols, with CMS estimating 30 respondents and 12,795 annual hours.

Why It Matters

The rural health collection is a reminder that large federal health investments often become real through reporting systems before they become visible through outcomes. If state awardees' future workload funding turns partly on what they report, the design of the reporting apparatus matters for both accountability and administrative burden. The Medicare Advantage and Part D audit revision also lands in an active oversight area: CMS says the protocols support review of access to benefits, services, and drugs, formulary and transition-benefit administration, coverage requests and appeals, and SNP care coordination.

None of that means the notice is a blockbuster. It means the paperwork is pointing at two places where CMS is trying to measure and monitor rural health transformation, and oversee MA/Part D plan performance. That is enough to make this PRA notice worth reading before it disappears into the OMB inbox. Read the unpublished CMS notice on Federal Register public inspection (https://www.federalregister.gov/public-inspection/2026-13603/agency-information-collection-activities-proposals-submissions-and-approvals)