38 CFR §1.481

1. (a)VA may disclose records referred to in 38 U.S.C. 7332(a) to a non-VA entity (including private entities and other Federal agencies) for purposes of providing health care to patients or performing other health care-related activities or functions.
2. (b)An entity to which a record is disclosed under this section may not disclose or use such record for a purpose other than that for which the disclosure was made or as permitted by law.