CHAMPVA Records: Privacy, Requests, Releases, and Corrections

Quick answer

CHAMPVA protects beneficiaries' health and claims information, but confidentiality does not mean VA must obtain a new signature for every permitted use of those records. 38 CFR § 17.279 directs CHAMPVA to maintain confidentiality under 38 CFR §§ 1.460–1.582. VA's CHAMPVA Guidebook explains that the Veterans Health Administration (VHA) Office of Integrated Veteran Care may use or disclose claim documentation, which can include medical information, without separate permission for treatment, payment, health care operations, and other circumstances permitted or required by law.

You can request your own CHAMPVA claim records, authorize VA to send them to someone else, ask VA to correct inaccurate records, or report a suspected privacy violation. The correct procedure depends on whether the records are CHAMPVA claims held by VA, treatment records held by a community provider, or VA medical records from care at a VA facility.

What does 38 CFR § 17.279 actually require?

38 CFR § 17.279 is the CHAMPVA confidentiality rule. Rather than laying out a separate CHAMPVA-specific release process, it incorporates VA confidentiality provisions in 38 CFR §§ 1.460 through 1.582.

Those incorporated provisions cover different circumstances. For example, 38 CFR § 1.460 defines the scope of additional protections for certain information connected with VA functions relating to substance use, HIV, or sickle cell anemia. Those specialized protections apply when their regulatory conditions are met; they are not a rule that every CHAMPVA claim requires written consent before VA can process it. Separately, VA identifies 38 CFR §§ 1.575–1.582 as its Privacy Act implementation rules, including certain access and amendment rights.

For day-to-day CHAMPVA claims, the most useful explanation is the CHAMPVA Guidebook's Privacy Practices Overview, printed pages 65–66. It describes VA's privacy duties and the actions available to beneficiaries.

When can VA use or share CHAMPVA information?

VHA Integrated Veteran Care processes claims and associated supporting documents, potentially including part or all of a medical record. Its privacy notice says it may use or disclose relevant information without obtaining separate permission for:

• Treatment, such as uses or disclosures allowed to support appropriate care.
• Payment, including assessing or paying a covered claim.
• Health care operations, and other uses or disclosures that applicable law permits or requires.

This does not authorize unlimited sharing. A proposed disclosure outside an applicable permission or legal exception may require your authorization, and certain types of sensitive information can have additional protections. If you need to know whether a particular disclosure is allowed, ask VA's privacy office about the records and recipient involved rather than assuming every request follows the same rule.

For providers, submitting a claim does not give an office unlimited permission to release a beneficiary's complete treatment history. Share information through your approved processes and confirm any disclosure requirements that apply to the specific records.

Which office has the records you need?

Records you want	Where to start
Your CHAMPVA claim or documents VA used to process that claim	VHA Integrated Veteran Care, using the claim-record request process described in the CHAMPVA Guidebook.
Records of treatment delivered by a community or foreign clinician	The actual treating provider. VA's Guidebook states these medical records are maintained by the provider who rendered care.
Medical records from care you received at a VA facility through the CHAMPVA In-House Treatment Initiative (CITI)	Your VA facility's records process; CITI beneficiaries may also be able to review and download available records through VA's online health tools.

A non-CITI CHAMPVA beneficiary may have access to Meds by Mail functions and some other information through VA's health tools, but should not assume that all care from outside clinicians will appear there. A claim record is also not necessarily the same thing as the treating clinician's complete medical record.

How to request, release, or correct records

Request a copy of your own CHAMPVA claim records

1. Decide which record you need. For a claim processed by VA, identify the beneficiary, claim, dates of service, and any particular claim documentation or correspondence. For a community clinician's full treatment record, request it from that provider instead.
2. Complete VA Form 10-5345a, Individuals' Request for a Copy of Their Own Health Information. The CHAMPVA Guidebook identifies this form when you request copies of your own CHAMPVA claim records. Describe the requested documents and date range rather than asking generically for "everything" if you only need a particular claim.
3. Prepare identity information. VA's privacy-access guidance describes a signed request containing the requester's date of birth, a copy of signed government identification, a description of the records, and the period requested. If another person is signing for you, ask the receiving office what documentation of their legal authority it needs; the form also includes a representative-authority field.
4. Send it to the office that holds the relevant records. The address for CHAMPVA claim records is not necessarily the normal claims-submission address. Retain a copy of your signed request and record when and how you submitted it.

Where should a CHAMPVA records request go?

VA's published privacy-access instructions distinguish CHAMPVA billing/claim records from eligibility records:

Records requested	VA records office identified in the privacy guidance
CHAMPVA billing, claim, or associated payment-file records	VHA Office of Integrated Veteran Care Privacy/FOIA Office, P.O. Box 700, Spring City, PA 19475
CHAMPVA eligibility or enrollment records	CHAMPVA Eligibility, P.O. Box 137, Spring City, PA 19475
Visit notes, tests, therapy notes, or other medical records made by a community or foreign provider	The provider that treated you, through that provider's medical-records process
Treatment records from care at a VA facility, including applicable CITI care	That VA facility's records office; eligible CITI users may also see available records using VA online health tools

The two mailing destinations appear in VA's privacy impact assessment (version dated October 1, 2024), and the CHAMPVA Guidebook also lists the P.O. Box 700 Integrated Veteran Care privacy office. Confirm the current submission address and any additional identity-verification requirements with the receiving VA office before mailing identification or medical information. Do not send sensitive records in an unsecured public message.

Authorize a third party to receive your records

If you want VA to send your CHAMPVA claim records to someone else—such as a lawyer or secondary insurer—use VA Form 10-5345, Request for and Authorization to Release Health Information, not the self-request form.

1. Identify the intended recipient and address, purpose of disclosure, requested records, and date range.
2. Review the form's separate choices for certain sensitive diagnoses when applicable and select the authorization's expiration condition or date.
3. Sign and date the form. If a legal representative will sign, check the form's representative section and ask the responsible records office what evidence of authority it requires.
4. Confirm the current submission method with the relevant VA records or privacy office, keep a copy, and send the authorization through the approved route.

An authorization permits the specific disclosure it describes; it does not mean a third party has unlimited access to every treatment or claim record. The May 2026 form provides options for a one-time disclosure or another defined expiration. If you withdraw an authorization, previously completed disclosures cannot necessarily be reversed.

Request a correction or amendment to information VA maintains

If a CHAMPVA record held by VA is inaccurate or incomplete, you can request a formal amendment in writing. This is different from requesting a copy of a record or appealing a CHAMPVA coverage or payment decision. 38 CFR § 17.279 incorporates VA confidentiality rules, while 38 CFR § 1.579 sets out VA's general record-amendment procedures. The CHAMPVA Guidebook, printed page 66, provides the CHAMPVA-specific submission address and fax.

Step 1: Check who holds the record and what needs changing

• A CHAMPVA file maintained by VA: The Guidebook says to send a written amendment request identifying the information and why it needs correction. It specifically identifies name changes, removal of a name element, Social Security number changes, and birth-sex changes as examples that require formal amendment requests.
• An existing CHAMPVA application needing a routine update: VA's post-application instructions allow applicants to update personal information, insurance, or school status without filing a new application. Follow that specific update process when it addresses your situation. Other-health-insurance updates for enrolled beneficiaries have a separate Form 10-7959c process.
• Medical notes from a community provider: Contact the clinician or organization that maintains the treatment record. VA processing a CHAMPVA claim does not mean VA holds or can rewrite the provider's entire chart.
• Treatment records created at a VA medical facility: VA's VHA Privacy Act guidance directs amendment requests to that facility's Privacy Officer or its specified My HealtheVet secure-message triage group.

A records amendment changes the accuracy of a record; it does not automatically reverse a claim denial or eligibility decision. A disputed CHAMPVA benefit determination may require its own decision-review procedure.

Step 2: Write a specific amendment request

Use a signed, dated written request. To help VA identify and evaluate it, include:

1. Your name, current contact details, and sufficient identifying information for the receiving office to locate your CHAMPVA record. Ask the office which sensitive identifiers or identity documents it requires; avoid sending them through unsecured messages.
2. The particular document, field, entry, or date at issue. If you have a copy, mark the exact information you dispute.
3. The correction you want and why the existing entry is inaccurate or incomplete. Attach copies of relevant supporting documents when appropriate.
4. A request for written acknowledgment and a written decision. Keep your submission and evidence of when you sent it.

A simple opening is: "I request amendment of the CHAMPVA record identified below. The current entry says [existing information]; I request [specific correction] because [reason]. Supporting documents are enclosed." This is a suggested structure, not a mandatory VA form.

The CHAMPVA Guidebook directs formal amendment requests to:

Eligibility, Enrollment and Verification (EEV)
P.O. Box 137
Spring City, PA 19475
Amendment-request fax: 303-331-7809

Those are the Guidebook's amendment contacts, not a general claims mailing address or the routine fax for every CHAMPVA task. Verify the current destination before sending sensitive documents. Forms 10-5345a and 10-5345 described above are for record-copy and third-party release requests; they are not substitutes for explaining the correction you seek.

Step 3: Track VA's response

Under 38 CFR § 1.579(a), VA must acknowledge receipt of a qualifying amendment request in writing within 10 days, excluding Saturdays, Sundays, and federal legal holidays. It must review the request as soon as reasonably possible, normally within 30 days with those same exclusions, unless unusual circumstances prevent timely completion. These are regulatory processing standards, not a guarantee that your requested correction will be approved.

If you do not receive a response, follow up with the office that has custody of the record or its Privacy Officer. No response is not the same as a written denial for purposes of the administrative appeal procedure in 38 CFR § 1.580.

Step 4: If VA refuses to amend the record

VA's CHAMPVA Guidebook says an amendment denial will be in writing with information about appeal rights. Under 38 CFR §§ 1.579–1.580, a written adverse determination must give reasons and appeal instructions. Follow the directions in the actual denial letter; the regulation identifies VA's Office of General Counsel as the reviewer of appeals of covered Privacy Act adverse determinations.

For that type of appeal, explain exactly why the disputed entry fails the applicable accuracy, relevance, timeliness, or completeness standard. The regulation calls for a copy of the denial and supporting documentation. Its stated Office of General Counsel mailing address is Office of General Counsel (024), 810 Vermont Avenue NW, Washington, DC 20420; follow any updated submission directions provided in your denial notice.

38 CFR § 1.579(c) generally requires VA to complete the requested administrative review within 30 days excluding weekends and federal legal holidays, unless the Secretary extends that period for good cause. If VA again declines to amend, the rule provides a right to file a concise statement of disagreement and requires notice of judicial-review provisions. Later VA disclosures of a disputed record must note the dispute and include the statement as required by § 1.579(d).

Keep the two appeal tracks separate: an appeal of a record amendment denial is not the same process as asking VA to review a CHAMPVA coverage, eligibility, or payment decision. The appropriate route depends on what VA denied.

What to do if you think CHAMPVA disclosed information improperly

Start by recording what information was involved, when the disclosure occurred, who received it if known, and why you believe it was improper. Avoid including Social Security numbers or detailed medical records in an unsecured public complaint or social media post.

The CHAMPVA Guidebook identifies VA/VHA and Integrated Veteran Care privacy offices as channels for privacy complaints. It also explains that you can complain to the U.S. Department of Health and Human Services. If you believe a HIPAA-covered organization or another entity within HHS's jurisdiction violated applicable health-information privacy rules, review the current HHS Office for Civil Rights complaint instructions. VA and HHS are separate complaint channels; follow the requirements of the one you choose.

The Guidebook says you will not be penalized for filing a privacy complaint. A privacy complaint is different from appealing a CHAMPVA benefit or payment decision: use the appropriate claims or decision-review process when the underlying disagreement is about coverage or payment.

Practical checklist for beneficiaries and providers

• Beneficiaries: Decide first whether you need a VA claim record or your provider's clinical record; use the appropriate record holder.
• Beneficiaries: Use Form 10-5345a for your own claim records and Form 10-5345 to authorize a third-party release.
• Providers: Use only the beneficiary and clinical information appropriate for the claim or other legally permitted purpose; follow your organization's privacy and security procedures.
• Everyone: If a record looks incorrect, identify the exact entry and send a documented correction request to the record holder. If a disclosure seems improper, document it and use the applicable privacy-complaint process.

For related administrative steps, see CHAMPVA Contacts, Mailing Addresses, and Official Forms, the CHAMPVA Claim Data Checklist for Provider Billing Staff, and What CHAMPVA Is and How It Works.