SEARCH SITE

VIRGINIA LAW PORTAL

SEARCHABLE DATABASES

ACROSS SESSIONS

Developed and maintained by the Division of Legislative Automated Systems.

2002 SESSION


CHAPTER 835
An Act to amend and reenact § 32.1-127.1:03 of the Code of Virginia and to amend the Code of Virginia by adding a section numbered 32.1-127.1:04, relating to sharing of protected health information between state agencies.
[S 264]
Approved April 17, 2002

Be it enacted by the General Assembly of Virginia:

1. That § 32.1-127.1:03 of the Code of Virginia is amended and reenacted, and that the Code of Virginia is amended by adding a section numbered 32.1-127.1:04 as follows:

§ 32.1-127.1:03. Patient health records privacy.

A. There is hereby recognized a patient's right of privacy in the content of a patient's medical record. Patient records are the property of the provider maintaining them, and, except when permitted by this section or by another provision of state or federal law, no provider, or other person working in a health care setting, may disclose the records of a patient.

Patient records shall not be removed from the premises where they are maintained without the approval of the provider, except in accordance with a court order or subpoena consistent with § 8.01-413 C or with this section or in accordance with the regulations relating to change of ownership of patient records promulgated by a health regulatory board established in Title 54.1.

No person to whom disclosure of patient records was made by a patient or a provider shall redisclose or otherwise reveal the records of a patient, beyond the purpose for which such disclosure was made, without first obtaining the patient's specific consent to such redisclosure. This redisclosure prohibition shall not, however, prevent (i) any provider who receives records from another provider from making subsequent disclosures as permitted under this section and the federal Department of Health and Human Services regulations relating to the electronic transmission of data and patient privacy promulgated as required by the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. § 1320d et seq.) or (ii) any provider from furnishing records and aggregate or other data, from which patient-identifying prescription information has been removed, encoded or encrypted, to qualified researchers, including, but not limited to, pharmaceutical manufacturers and their agents or contractors, for purposes of clinical, pharmaco-epidemiological, pharmaco-economic, or other health services research.

B. As used in this section:

"Agent" means a person who has been appointed as a patient's agent under a power of attorney for health care or an advance directive under the Health Care Decisions Act (§ 54.1-2981 et seq.).

"Guardian" means a court-appointed guardian of the person.

"Health services" includes, but is not limited to, examination, diagnosis, evaluation, treatment, pharmaceuticals, aftercare, habilitation or rehabilitation and mental health therapy of any kind.

"Parent" means a biological, adoptive or foster parent.

"Patient" means a person who is receiving or has received health services from a provider.

"Patient-identifying prescription information" means all prescriptions, drug orders or any other prescription information that specifically identifies an individual patient.

"Provider" shall have the same meaning as set forth in the definition of "health care provider" in § 8.01-581.1, except that state-operated facilities shall also be considered providers for the purposes of this section. Provider shall also include all persons who are licensed, certified, registered or permitted by any of the health regulatory boards within the Department of Health Professions, except persons regulated by the Board of Funeral Directors and Embalmers or the Board of Veterinary Medicine.

"Record" means any written, printed or electronically recorded material maintained by a provider in the course of providing health services to a patient concerning the patient and the services provided. "Record" also includes the substance of any communication made by a patient to a provider in confidence during or in connection with the provision of health services to a patient or information otherwise acquired by the provider about a patient in confidence and in connection with the provision of health services to the patient.

C. The provisions of this section shall not apply to any of the following:

1. The status of and release of information governed by §§ 65.2-604 and 65.2-607 of the Virginia Workers' Compensation Act; or

2. Except where specifically provided herein, the records of minor patients.

D. Providers may disclose the records of a patient:

1. As set forth in subsection E of this section, pursuant to the written consent of the patient or in the case of a minor patient, his custodial parent, guardian or other person authorized to consent to treatment of minors pursuant to § 54.1-2969; also, in emergency cases or situations where it is impractical to obtain the patient's written consent, pursuant to the patient's oral consent for a provider to discuss the patient's records with a third party specified by the patient;

2. In compliance with a subpoena issued in accord with subsection H of this section, pursuant to court order upon good cause shown or in compliance with a subpoena issued pursuant to subsection C of § 8.01-413;

3. In accord with subsection F of § 8.01-399 including, but not limited to, situations where disclosure is reasonably necessary to establish or collect a fee or to defend a provider or the provider's employees or staff against any accusation of wrongful conduct; also as required in the course of an investigation, audit, review or proceedings regarding a provider's conduct by a duly authorized law-enforcement, licensure, accreditation, or professional review entity;

4. In testimony in accordance with §§ 8.01-399 and 8.01-400.2;

5. In compliance with the provisions of § 8.01-413;

6. As required or authorized by any other provision of law relating to public health activities, health oversight activities, serious threats to health or safety, or abuse, neglect or domestic violence, including relating to contagious disease, public safety, and suspected child or adult abuse reporting requirements, including, but not limited to, those contained in §§ 32.1-36, 32.1-36.1, 32.1-40, 32.1-41, 32.1-127.1:04, 32.1-276.5, 32.1-283, 32.1-283.1, 37.1-98.2, 53.1-40.10, 54.1-2403.3, 54.1-2906, 54.1-2907, 54.1-2966, 54.1-2966.1, 54.1-2967, 54.1-2968, 63.1-55.3 and 63.1-248.11;

7. Where necessary in connection with the care of the patient, including in the implementation of a hospital routine contact process;

8. In the normal course of business in accordance with accepted standards of practice within the health services setting; however, the maintenance, storage, and disclosure of the mass of prescription dispensing records maintained in a pharmacy registered or permitted in Virginia shall only be accomplished in compliance with §§ 54.1-3410, 54.1-3411 and 54.1-3412;

9. When the patient has waived his right to the privacy of the medical records;

10. When examination and evaluation of a patient are undertaken pursuant to judicial or administrative law order, but only to the extent as required by such;

11. To the guardian ad litem in the course of a guardianship proceeding of an adult patient authorized under Article 1.1 (§ 37.1-134.6 et seq.) of Chapter 4 of Title 37.1;

12. To the attorney appointed by the court to represent a patient in a civil commitment proceeding under § 37.1-67.3;

13. To the attorney and/or guardian ad litem of a minor patient who represents such minor in any judicial or administrative proceeding, provided that the court or administrative hearing officer has entered an order granting the attorney or guardian ad litem this right and such attorney or guardian ad litem presents evidence to the provider of such order;

14. With regard to the Court-Appointed Special Advocate (CASA) program, a minor's records in accord with § 9.1-156;

15. To an agent appointed under a patient's power of attorney or to an agent or decision maker designated in a patient's advance directive for health care or for decisions on anatomical gifts and organ, tissue or eye donation or to any other person consistent with the provisions of the Health Care Decisions Act (§ 54.1-2981 et seq.);

16. To third-party payors and their agents for purposes of reimbursement;

17. As is necessary to support an application for receipt of health care benefits from a governmental agency or as required by an authorized governmental agency reviewing such application or reviewing benefits already provided or as necessary to the coordination of prevention and control of disease, injury, or disability and delivery of such health care benefits pursuant to § 32.1-127.1:04;

18. Upon the sale of a medical practice as provided in § 54.1-2405; or upon a change of ownership or closing of a pharmacy pursuant to regulations of the Board of Pharmacy;

19. In accord with § 54.1-2400.1 B, to communicate a patient's specific and immediate threat to cause serious bodily injury or death of an identified or readily identifiable person;

20. To the patient, except as provided in subsections E and F of this section and subsection B of § 8.01-413;

21. In the case of substance abuse records, when permitted by and in conformity with requirements of federal law found in 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2;

22. In connection with the work of any entity established as set forth in § 8.01-581.16 to evaluate the adequacy or quality of professional services or the competency and qualifications for professional staff privileges;

23. If the records are those of a deceased or mentally incapacitated patient to the personal representative or executor of the deceased patient or the legal guardian or committee of the incompetent or incapacitated patient or if there is no personal representative, executor, legal guardian or committee appointed, to the following persons in the following order of priority: a spouse, an adult son or daughter, either parent, an adult brother or sister, or any other relative of the deceased patient in order of blood relationship;

24. For the purpose of conducting record reviews of inpatient hospital deaths to promote identification of all potential organ, eye, and tissue donors in conformance with the requirements of applicable federal law and regulations, including 42 C.F.R. § 482.45, (i) to the provider's designated organ procurement organization certified by the United States Health Care Financing Administration and (ii) to any eye bank or tissue bank in Virginia certified by the Eye Bank Association of America or the American Association of Tissue Banks;

25. To the Office of the Inspector General for Mental Health, Mental Retardation and Substance Abuse Services pursuant to Chapter 16 (§ 37.1-255 et seq.) of Title 37.1; and

26. (Expires July 1, 2003) To an entity participating in the activities of a local health partnership authority established pursuant to Article 6.1 (§ 32.1-122.10:001 et seq.) of Chapter 4 of Title 32.1, pursuant to subdivision D 1 of this section.

E. Requests for copies of medical records shall (i) be in writing, dated and signed by the requester; (ii) identify the nature of the information requested; and (iii) include evidence of the authority of the requester to receive such copies and identification of the person to whom the information is to be disclosed. The provider shall accept a photocopy, facsimile, or other copy of the original signed by the requestor as if it were an original. Within fifteen days of receipt of a request for copies of medical records, the provider shall do one of the following: (i) furnish such copies to any requester authorized to receive them; (ii) inform the requester if the information does not exist or cannot be found; (iii) if the provider does not maintain a record of the information, so inform the requester and provide the name and address, if known, of the provider who maintains the record; or (iv) deny the request (a) under subsection F, (b) on the grounds that the requester has not established his authority to receive such records or proof of his identity, or (c) as otherwise provided by law. Procedures set forth in this section shall apply only to requests for records not specifically governed by other provisions of this Code, federal law or state or federal regulation.

F. Except as provided in subsection B of § 8.01-413, copies of a patient's records shall not be furnished to such patient or anyone authorized to act on the patient's behalf where the patient's attending physician or the patient's clinical psychologist has made a part of the patient's record a written statement that, in his opinion, the furnishing to or review by the patient of such records would be injurious to the patient's health or well-being. If any custodian of medical records denies a request for copies of records based on such statement, the custodian shall permit examination and copying of the medical record by another such physician or clinical psychologist selected by the patient, whose licensure, training and experience relative to the patient's condition are at least equivalent to that of the physician or clinical psychologist upon whose opinion the denial is based. The person or entity denying the request shall inform the patient of the patient's right to select another reviewing physician or clinical psychologist under this subsection who shall make a judgment as to whether to make the record available to the patient. Any record copied for review by the physician or clinical psychologist selected by the patient shall be accompanied by a statement from the custodian of the record that the patient's attending physician or clinical psychologist determined that the patient's review of his record would be injurious to the patient's health or well-being.

G. A written consent to allow release of patient records may, but need not, be in the following form:

CONSENT TO RELEASE OF CONFIDENTIAL HEALTH CARE

INFORMATION

Patient Name ...............................................................

Provider Name ..............................................................

Person, agency or provider to whom disclosure is to be made ................

Information or Records to be disclosed .....................................

As the person signing this consent, I understand that I am giving my permission to the above-named provider or other named third party for disclosure of confidential health care records. I also understand that I have the right to revoke this consent, but that my revocation is not effective until delivered in writing to the person who is in possession of my records. A copy of this consent and a notation concerning the persons or agencies to whom disclosure was made shall be included with my original records. The person who receives the records to which this consent pertains may not redisclose them to anyone else without my separate written consent unless such recipient is a provider who makes a disclosure permitted by law.

This consent expires on (date) ............

Signature of Patient ............ Date ............

H. 1. No party to an action shall request the issuance of a subpoena duces tecum for an opposing party's medical records or cause a subpoena duces tecum to be issued by an attorney unless a copy of the request for the subpoena or a copy of the attorney-issued subpoena is provided to opposing counsel or the opposing party if they are pro se, simultaneously with filing the request or issuance of the subpoena. No party to an action shall request or cause the issuance of a subpoena duces tecum for the medical records of a nonparty witness unless a copy of the request for the subpoena or a copy of the attorney-issued subpoena is provided to the nonparty witness simultaneously with filing the request or issuance of the attorney-issued subpoena.

In instances where medical records being subpoenaed are those of a pro se party or nonparty witness, the party requesting or issuing the subpoena shall deliver to the pro se party or nonparty witness together with the copy of the request for subpoena, or a copy of the subpoena in the case of an attorney-issued subpoena, a statement informing them of their rights and remedies. The statement shall include the following language and the heading shall be in boldface capital letters:

NOTICE TO PATIENT

The attached document means that (insert name of party requesting or causing issuance of the subpoena) has either asked the court to issue a subpoena or a subpoena has been issued by the other party's attorney to your doctor or other health care providers (names of health care providers inserted here) requiring them to produce your medical records. Your doctor or other health care provider is required to respond by providing a copy of your medical records. If you believe your records should not be disclosed and object to their disclosure, you have the right to file a motion with the clerk of the court to quash the subpoena. You may contact the clerk's office to determine the requirements that must be satisfied when filing a motion to quash and you may elect to contact an attorney to represent your interest. If you elect to file a motion to quash, it must be filed as soon as possible before the provider sends out the records in response to the subpoena. If you elect to file a motion to quash, you must notify your doctor or other health care provider(s) that you are filing the motion so that the provider knows to send the records to the clerk of court in a sealed envelope or package for safekeeping while your motion is decided.

2. Any party filing a request for a subpoena duces tecum or causing such a subpoena to be issued for a patient's medical records shall include a Notice to Providers in the same part of the request where the provider is directed where and when to return the records. Such notice shall be in boldface capital letters and shall include the following language:

NOTICE TO PROVIDERS

IF YOU RECEIVE NOTICE THAT YOUR PATIENT HAS FILED A MOTION TO QUASH (OBJECTING TO) THIS SUBPOENA, OR IF YOU FILE A MOTION TO QUASH THIS SUBPOENA, SEND THE RECORDS ONLY TO THE CLERK OF THE COURT WHICH ISSUED THE SUBPOENA OR IN WHICH THE ACTION IS PENDING AS SHOWN ON THE SUBPOENA USING THE FOLLOWING PROCEDURE: PLACE THE RECORDS IN A SEALED ENVELOPE AND ATTACH TO THE SEALED ENVELOPE A COVER LETTER TO THE CLERK OF COURT WHICH STATES THAT CONFIDENTIAL HEALTH CARE RECORDS ARE ENCLOSED AND ARE TO BE HELD UNDER SEAL PENDING THE COURT'S RULING ON THE MOTION TO QUASH THE SUBPOENA. THE SEALED ENVELOPE AND THE COVER LETTER SHALL BE PLACED IN AN OUTER ENVELOPE OR PACKAGE FOR TRANSMITTAL TO THE COURT.

3. Health care providers shall provide a copy of all records as required by a subpoena duces tecum or court order for such medical records. If the health care provider has, however, actual receipt of notice that a motion to quash the subpoena has been filed or if the health care provider files a motion to quash the subpoena for medical records, then the health care provider shall produce the records to the clerk of the court issuing the subpoena or in whose court the action is pending, where the court shall place the records under seal until a determination is made regarding the motion to quash. The securely sealed envelope shall only be opened on order of the judge. In the event the court grants the motion to quash, the records shall be returned to the health care provider in the same sealed envelope in which they were delivered to the court. In the event that a judge orders the sealed envelope to be opened to review the records in camera, a copy of the judge's order shall accompany any records returned to the provider. The records returned to the provider shall be in a securely sealed envelope.

4. It is the duty of any party requesting a subpoena duces tecum for medical records or the attorney issuing the subpoena duces tecum to determine whether the patient whose records are sought is pro se or a nonparty. Any request for a subpoena duces tecum and any attorney-issued subpoena for the medical records of a nonparty or of a pro se party shall direct the provider (in boldface type) not to produce the records until ten days after the date on which the provider is served with the subpoena duces tecum and shall be produced no later than twenty days after the date of such service.

In the event that the individual whose records are being sought files a motion to quash the subpoena, the court shall decide whether good cause has been shown by the discovering party to compel disclosure of the patient's private records over the patient's objections. In determining whether good cause has been shown, the court shall consider (i) the particular purpose for which the information was collected; (ii) the degree to which the disclosure of the records would embarrass, injure, or invade the privacy of the individual; (iii) the effect of the disclosure on the individual's future health care; (iv) the importance of the information to the lawsuit or proceeding; and (v) any other relevant factor.

The provisions of this subsection have no application to subpoenas for medical records requested under § 8.01-413, or issued by a duly authorized administrative agency conducting an investigation, audit, review or proceedings regarding a provider's conduct. The provisions of this subsection apply to the medical records of both minors and adults.

A subpoena for substance abuse records must conform to the requirements of federal law found in 42 C.F.R. Part 2, Subpart E.

Providers may testify about the medical records of a patient in compliance with §§ 8.01-399 and 8.01-400.2.

§ 32.1-127.1:04. Use or disclosure of certain protected health information required.

A. The coordination of prevention and control of disease, injury, or disability and the delivery of health care benefits are hereby declared to be (i) necessary public health activities; (ii) necessary health oversight activities for the integrity of the health care system; and (iii) necessary to prevent serious harm and serious threats to the health and safety of individuals and the public.

B. The Departments of Health, Medical Assistance Services, Mental Health, Mental Retardation and Substance Abuse Services, and Social Services shall establish a secure system for sharing protected health information that may be necessary for the coordination of prevention and control of disease, injury, or disability and for the delivery of health care benefits when such protected information concerns individuals who (i) have contracted a reportable disease, including exposure to a toxic substance, as required by the Board of Health pursuant to § 32.1-35 or other disease or disability required to be reported by law; (ii) are the subjects of public health surveillance, public health investigations, or public health interventions or are applicants for or recipients of medical assistance services; (iii) have been or are the victims of child abuse or neglect or domestic violence; or (iv) may present a serious threat to health or safety of a person or the public or may be subject to a serious threat to their health or safety. Pursuant to the regulations concerning patient privacy promulgated by the federal Department of Health and Human Services, covered entities may disclose protected health information to the secure system without obtaining consent or authorization for such disclosure. Such protected health information shall be used exclusively for the purposes established in this section.

C. The Office of the Attorney General shall advise the Departments of Health, Mental Health, Mental Retardation and Substance Abuse Services, Medical Assistance Services, and Social Services in the implementation of this section.