Before filing a FOIA request with DHA, please visit our FOIA Library to make sure we haven't already released the records you're requesting.

DHA’s preferred method of receiving FOIA requests is through the DHA FOIA Public Access Link (PAL). This website customized forms for each agency. The website will also give you insight into the FOIA process. This includes:

• What to do before you submit a request.
• How you submit a request.
• What happens after you submit a request.

All proper FOIA requests must:

1. Be submitted in writing.
2. Include a full name and contact method (i.e. email address, phone number, and/or mailing address).
3. Reasonably describe the records sought.
4. State a willingness to pay fees.

How to submit a FOIA request to DHA:

• Electronically (Preferred): National FOIA Portal Submission
• Email: DHA.FOIA@health.mil
• Mail: DHA FOIA Requester Service Center
  7700 Arlington Blvd., Ste 5101
  Falls Church, VA 22042-5101

The Privacy Act of 1974 establishes safeguards for the protection of records that the Federal government collects and maintains on United States citizens. It also allows a person to seek access to records retrievable by his/her own name or other personal identifier, as long as the records do not contain material that is covered by an exemption in the statute.

The Defense Health Agency has five categories of requesters who may submit requests for beneficiary records under the Privacy Act. These categories are:

1. TRICARE beneficiary
2. Established court, via court order
3. Attorney or law office
4. Legal services firm
5. Law enforcement, pursuant to an investigation

Each records request maintained by DHA must include the following:

• Social Security number (SSN) of the beneficiary or military sponsor
• Birthdate of the beneficiary
• Inclusive dates for the records requested

If the requested records contain Sensitive Diagnosis Codes, the request must include a separate form completed by the beneficiary authorizing which individual category of SDC information can be released. If requesting all categories, each SDC must be individually stated. In general, SDC categories include:

• Mental health
• Drug and/or alcohol abuse
• HIV/AIDS
• Sexually transmitted infections

If the requested records are for a minor and you're not the legal guardian, the request must also include verification from the minor’s legal guardian/custodial parent that the records can be released; or verification that you have the authority to act on behalf of the minor.

If you're an attorney or legal services firm, the request must also include an Authorization for Disclosure of Medical or Dental Information (DD Form 2870). The form must be completed and signed by the beneficiary.

• Requests from a TRICARE beneficiary should be mailed to (1st Party requests):
  Defense Health Agency
  Attn: Records Management Office
  7700 Arlington Blvd., Ste. 5101
  Falls Church, VA 22042-5101
• Requests from a court representative, law enforcement official, attorney, or legal services firm, should be mailed to:
  Defense Health Agency
  Attn: General Law Division
  16401 East Centretech Pkwy
  Aurora, CO 80011-9066

First-Party Requests

Visit TRICARE.mil to find out how to request copies of your medical records. You can request current or archived medical records.

Third-Party Requests 

Third-party requests are made by another person/entity who request records on behalf of the beneficiary.

• All third-party requests for medical records (both TRICARE records and medical files) must be submitted in writing to:
  Defense Health Agency
  Attn: General Law Division (FOIA)
  16401 East Centretech Pkwy
  Aurora, CO 80011-9066
• If you're an attorney or legal services firm, the request must also include a Health Insurance Portability and Accountability Act compliant authorization form (known as DD2870), completed and signed by the beneficiary.
• Additionally, the beneficiary must stipulate whether or not Sensitive Diagnosis Codes should be released. The request must include a separate form or statement completed by the beneficiary authorizing which individual category of SDC information can be released. If requesting all categories, each SDC must be individually stated. In general, SDC categories include:
  • Mental health
  • Drug and/or alcohol abuse
  • HIV/AIDS and
  • Sexually transmitted infections.
• All third-party requests for medical records will be processed solely under the FOIA.