SEARCH SITE

VIRGINIA LAW PORTAL

SEARCHABLE DATABASES

ACROSS SESSIONS

Developed and maintained by the Division of Legislative Automated Systems.

2004 SESSION

044640440
HOUSE BILL NO. 877
Offered January 14, 2004
Prefiled January 14, 2004
A BILL to amend and reenact §§ 2.2-3705, 8.01-413, 32.1-127.1:03, 37.1-230, and 38.2-608 of the Code of Virginia, relating to health records privacy; procedure for certain patients to obtain access to their records.
----------
Patron-- O'Bannon
----------
Referred to Committee on Health, Welfare and Institutions
----------

Be it enacted by the General Assembly of Virginia:

1. That §§ 2.2-3705, 8.01-413, 32.1-127.1:03, 37.1-230, and 38.2-608 of the Code of Virginia are amended and reenacted as follows:

§ 2.2-3705. Exclusions to application of chapter.

A. The following records are excluded from the provisions of this chapter but may be disclosed by the custodian in his discretion, except where such disclosure is prohibited by law:

1. Confidential records of all investigations of applications for licenses and permits, and all licensees and permittees made by or submitted to the Alcoholic Beverage Control Board, the State Lottery Department, the Virginia Racing Commission, or the Department of Charitable Gaming.

2. State income, business, and estate tax returns, personal property tax returns, scholastic and confidential records held pursuant to § 58.1-3.

3. Scholastic records containing information concerning identifiable individuals, except that such access shall not be denied to the person who is the subject thereof, or the parent or legal guardian of the student. However, no student shall have access to (i) financial records of a parent or guardian or (ii) records of instructional, supervisory, and administrative personnel and educational personnel ancillary thereto, which are in the sole possession of the maker thereof and that are not accessible or revealed to any other person except a substitute.

The parent or legal guardian of a student may prohibit, by written request, the release of any individual information regarding that student until the student reaches the age of 18 years. For scholastic records of students under the age of 18 years, the right of access may be asserted only by his legal guardian or parent, including a noncustodial parent, unless such parent's parental rights have been terminated or a court of competent jurisdiction has restricted or denied such access. For scholastic records of students who are emancipated or attending a state-supported institution of higher education, the right of access may be asserted by the student.

Any person who is the subject of any scholastic record and who is 18 years of age or older may waive, in writing, the protections afforded by this subdivision. If the protections are so waived, the public body shall open such records for inspection and copying.

4. Personnel records containing information concerning identifiable individuals, except that access shall not be denied to the person who is the subject thereof. Any person who is the subject of any personnel record and who is 18 years of age or older may waive, in writing, the protections afforded by this subdivision. If the protections are so waived, the public body shall open such records for inspection and copying.

5. Medical and mental Health records, except that such records may be personally reviewed by the individual who is the subject person or a physician of the subject person's choice. However, the subject person's mental records may not be personally reviewed by such person when the subject person's treating physician has made a part of such person's records a written statement that in his opinion a review of such records by the subject person would be injurious to the subject person's physical or mental health or well-being of such records as provided in subsection F of § 32.1-127.1:03.

Where the person who is the subject of medical records is confined in a state or local correctional facility, the administrator or chief medical officer of such facility may assert such confined person's right of access to the medical records if the administrator or chief medical officer has reasonable cause to believe that such confined person has an infectious disease or other medical condition from which other persons so confined need to be protected. Medical records shall only be reviewed and shall not be copied by such administrator or chief medical officer. The information in the medical records of a person so confined shall continue to be confidential and shall not be disclosed by the administrator or chief medical officer of the facility to any person except the subject or except as provided by law.

Where the person who is the subject of medical and mental records is under the age of 18, his right of access may be asserted only by his guardian or his parent, including a noncustodial parent, unless such parent's parental rights have been terminated or a court of competent jurisdiction has restricted or denied such access. In instances where the person who is the subject thereof is an emancipated minor or a student in a public institution of higher education, the right of access may be asserted by the subject person.

For the purposes of this chapter, statistical summaries of incidents and statistical data concerning patient abuse as may be compiled by the Commissioner of the Department of Mental Health, Mental Retardation and Substance Abuse Services shall be open to inspection and copying as provided in § 2.2-3704. No such summaries or data shall include any patient-identifying information.

6. Working papers and correspondence of the Office of the Governor; Lieutenant Governor; the Attorney General; the members of the General Assembly or the Division of Legislative Services; the mayor or chief executive officer of any political subdivision of the Commonwealth; or the president or other chief executive officer of any public institution of higher education in Virginia. However, no record, which is otherwise open to inspection under this chapter, shall be deemed exempt by virtue of the fact that it has been attached to or incorporated within any working paper or correspondence.

As used in this subdivision:

"Office of the Governor" means the Governor; his chief of staff, counsel, director of policy, Cabinet Secretaries, and the Director of the Virginia Liaison Office; and those individuals to whom the Governor has delegated his authority pursuant to § 2.2-104.

"Working papers" means those records prepared by or for an above-named public official for his personal or deliberative use.

7. Written advice of legal counsel to state, regional or local public bodies or the officers or employees of such public bodies, and any other records protected by the attorney-client privilege.

8. Legal memoranda and other work product compiled specifically for use in litigation or for use in an active administrative investigation concerning a matter that is properly the subject of a closed meeting under § 2.2-3711.

9. Confidential letters and statements of recommendation placed in the records of educational agencies or institutions respecting (i) admission to any educational agency or institution, (ii) an application for employment, or (iii) receipt of an honor or honorary recognition.

10. Library records that can be used to identify both (i) any library patron who has borrowed material from a library and (ii) the material such patron borrowed.

11. Any test or examination used, administered or prepared by any public body for purposes of evaluation of (i) any student or any student's performance, (ii) any employee or employment seeker's qualifications or aptitude for employment, retention, or promotion, or (iii) qualifications for any license or certificate issued by a public body.

As used in this subdivision, "test or examination" shall include (a) any scoring key for any such test or examination and (b) any other document that would jeopardize the security of the test or examination. Nothing contained in this subdivision shall prohibit the release of test scores or results as provided by law, or limit access to individual records as provided by law. However, the subject of such employment tests shall be entitled to review and inspect all records relative to his performance on such employment tests.

When, in the reasonable opinion of such public body, any such test or examination no longer has any potential for future use, and the security of future tests or examinations will not be jeopardized, the test or examination shall be made available to the public. However, minimum competency tests administered to public school children shall be made available to the public contemporaneously with statewide release of the scores of those taking such tests, but in no event shall such tests be made available to the public later than six months after the administration of such tests.

12. Applications for admission to examinations or for licensure and scoring records maintained by the Department of Health Professions or any board in that department on individual licensees or applicants. However, such material may be made available during normal working hours for copying, at the requester's expense, by the individual who is the subject thereof, in the offices of the Department of Health Professions or in the offices of any health regulatory board, whichever may possess the material.

13. Records of active investigations being conducted by the Department of Health Professions or by any health regulatory board in the Commonwealth.

14. Records recorded in or compiled exclusively for use in closed meetings lawfully held pursuant to § 2.2-3711. However, no record that is otherwise open to inspection under this chapter shall be deemed exempt by virtue of the fact that it has been reviewed or discussed in a closed meeting.

15. Reports, documentary evidence and other information as specified in §§ 2.2-706 and 63.2-104.

16. Proprietary information gathered by or for the Virginia Port Authority as provided in § 62.1-132.4 or § 62.1-134.1.

17. Contract cost estimates prepared for the confidential use of the Department of Transportation in awarding contracts for construction or the purchase of goods or services, and records and automated systems prepared for the Department's Bid Analysis and Monitoring Program.

18. Vendor proprietary information software that may be in the official records of a public body. For the purpose of this subdivision, "vendor proprietary software" means computer programs acquired from a vendor for purposes of processing data for agencies or political subdivisions of the Commonwealth.

19. Financial statements not publicly available filed with applications for industrial development financings.

20. Data, records or information of a proprietary nature produced or collected by or for faculty or staff of public institutions of higher education, other than the institutions' financial or administrative records, in the conduct of or as a result of study or research on medical, scientific, technical or scholarly issues, whether sponsored by the institution alone or in conjunction with a governmental body or a private concern, where such data, records or information has not been publicly released, published, copyrighted or patented.

21. Lists of registered owners of bonds issued by a political subdivision of the Commonwealth, whether the lists are maintained by the political subdivision itself or by a single fiduciary designated by the political subdivision.

22. Confidential proprietary records, voluntarily provided by private business pursuant to a promise of confidentiality from the Department of Business Assistance, the Virginia Economic Development Partnership, the Virginia Tourism Authority, or local or regional industrial or economic development authorities or organizations, used by the Department, the Partnership, the Authority, or such entities for business, trade and tourism development; and memoranda, working papers or other records related to businesses that are considering locating or expanding in Virginia, prepared by the Partnership, where competition or bargaining is involved and where, if such records are made public, the financial interest of the governmental unit would be adversely affected.

23. Information that was filed as confidential under the Toxic Substances Information Act (§ 32.1-239 et seq.), as such Act existed prior to July 1, 1992.

24. Confidential records, including victim identity, provided to or obtained by staff in a rape crisis center or a program for battered spouses.

25. Computer software developed by or for a state agency, state-supported institution of higher education or political subdivision of the Commonwealth.

26. Investigator notes, and other correspondence and information, furnished in confidence with respect to an active investigation of individual employment discrimination complaints made to the Department of Human Resource Management or to such personnel of any local public body, including local school boards as are responsible for conducting such investigations in confidence. However, nothing in this section shall prohibit the disclosure of information taken from inactive reports in a form that does not reveal the identity of charging parties, persons supplying the information or other individuals involved in the investigation.

27. Fisheries data that would permit identification of any person or vessel, except when required by court order as specified in § 28.2-204.

28. Records of active investigations being conducted by the Department of Medical Assistance Services pursuant to Chapter 10 (§ 32.1-323 et seq.) of Title 32.1.

29. Records and writings furnished by a member of the General Assembly to a meeting of a standing committee, special committee or subcommittee of his house established solely for the purpose of reviewing members' annual disclosure statements and supporting materials filed under § 30-110 or of formulating advisory opinions to members on standards of conduct, or both.

30. Customer account information of a public utility affiliated with a political subdivision of the Commonwealth, including the customer's name and service address, but excluding the amount of utility service provided and the amount of money paid for such utility service.

31. Investigative notes and other correspondence and information furnished in confidence with respect to an investigation or conciliation process involving an alleged unlawful discriminatory practice under the Virginia Human Rights Act (§ 2.2-3900 et seq.) or under any local ordinance adopted in accordance with the authority specified in § 2.2-2638, or adopted pursuant to § 15.2-965, or adopted prior to July 1, 1987, in accordance with applicable law, relating to local human rights or human relations commissions. However, nothing in this section shall prohibit the distribution of information taken from inactive reports in a form that does not reveal the identity of the parties involved or other persons supplying information.

32. Investigative notes; proprietary information not published, copyrighted or patented; information obtained from employee personnel records; personally identifiable information regarding residents, clients or other recipients of services; and other correspondence and information furnished in confidence to the Department of Social Services in connection with an active investigation of an applicant or licensee pursuant to Chapters 17 (§ 63.2-1700 et seq.) and 18 (§ 63.2-1800 et seq.) of Title 63.2. However, nothing in this section shall prohibit disclosure of information from the records of completed investigations in a form that does not reveal the identity of complainants, persons supplying information, or other individuals involved in the investigation.

33. Personal information, as defined in § 2.2-3801, (i) filed with the Virginia Housing Development Authority concerning individuals who have applied for or received loans or other housing assistance or who have applied for occupancy of or have occupied housing financed, owned or otherwise assisted by the Virginia Housing Development Authority; (ii) concerning persons participating in or persons on the waiting list for federally funded rent-assistance programs; (iii) filed with any local redevelopment and housing authority created pursuant to § 36-4 concerning persons participating in or persons on the waiting list for housing assistance programs funded by local governments or by any such authority; or (iv) filed with any local redevelopment and housing authority created pursuant to § 36-4 or any other local government agency concerning persons who have applied for occupancy or who have occupied affordable dwelling units established pursuant to § 15.2-2304 or § 15.2-2305. However, access to one's own information shall not be denied.

34. Records regarding the siting of hazardous waste facilities, except as provided in § 10.1-1441, if disclosure of them would have a detrimental effect upon the negotiating position of a governing body or on the establishment of the terms, conditions and provisions of the siting agreement.

35. Appraisals and cost estimates of real property subject to a proposed purchase, sale or lease, prior to the completion of such purchase, sale or lease.

36. Records containing information on the site specific location of rare, threatened, endangered or otherwise imperiled plant and animal species, natural communities, caves, and significant historic and archaeological sites if, in the opinion of the public body that has the responsibility for such information, disclosure of the information would jeopardize the continued existence or the integrity of the resource. This exemption shall not apply to requests from the owner of the land upon which the resource is located.

37. Records, memoranda, working papers, graphics, video or audio tapes, production models, data and information of a proprietary nature produced by or for or collected by or for the State Lottery Department relating to matters of a specific lottery game design, development, production, operation, ticket price, prize structure, manner of selecting the winning ticket, manner of payment of prizes to holders of winning tickets, frequency of drawings or selections of winning tickets, odds of winning, advertising, or marketing, where such official records have not been publicly released, published, copyrighted or patented. Whether released, published or copyrighted, all game-related information shall be subject to public disclosure under this chapter upon the first day of sales for the specific lottery game to which it pertains.

38. Records of studies and investigations by the State Lottery Department of (i) lottery agents, (ii) lottery vendors, (iii) lottery crimes under §§ 58.1-4014 through 58.1-4018, (iv) defects in the law or regulations that cause abuses in the administration and operation of the lottery and any evasions of such provisions, or (v) the use of the lottery as a subterfuge for organized crime and illegal gambling where such official records have not been publicly released, published or copyrighted. All studies and investigations referred to under clauses (iii), (iv) and (v) shall be open to inspection and copying upon completion of the study or investigation.

39. Those portions of engineering and construction drawings and plans submitted for the sole purpose of complying with the Building Code in obtaining a building permit that would identify specific trade secrets or other information the disclosure of which would be harmful to the competitive position of the owner or lessee. However, such information shall be exempt only until the building is completed. Information relating to the safety or environmental soundness of any building shall not be exempt from disclosure.

Those portions of engineering and construction drawings and plans that reveal critical structural components, security equipment and systems, ventilation systems, fire protection equipment, mandatory building emergency equipment or systems, elevators, electrical systems, telecommunications equipment and systems, and other utility equipment and systems submitted for the purpose of complying with the Uniform Statewide Building Code (§ 36-97 et seq.) or the Statewide Fire Prevention Code (§ 27-94 et seq.), the disclosure of which would jeopardize the safety or security of any public or private commercial office, multi-family residential or retail building or its occupants in the event of terrorism or other threat to public safety, to the extent that the owner or lessee of such property, equipment or system in writing (i) invokes the protections of this paragraph; (ii) identifies the drawings, plans, or other materials to be protected; and (iii) states the reasons why protection is necessary.

Nothing in this subdivision shall prevent the disclosure of information relating to any building in connection with an inquiry into the performance of that building after it has been subjected to fire, explosion, natural disaster or other catastrophic event.

40. Records concerning reserves established in specific claims administered by the Department of the Treasury through its Division of Risk Management as provided in Article 5 (§ 2.2-1832 et seq.) of Chapter 18 of this title, or by any county, city, or town; and investigative notes, correspondence and information furnished in confidence with respect to an investigation of a claim or a potential claim against a public body's insurance policy or self-insurance plan. However, nothing in this subdivision shall prohibit the disclosure of information taken from inactive reports upon expiration of the period of limitations for the filing of a civil suit.

41. Information and records collected for the designation and verification of trauma centers and other specialty care centers within the Statewide Emergency Medical Services System and Services pursuant to Article 2.1 (§ 32.1-111.1 et seq.) of Chapter 4 of Title 32.1.

42. Reports and court documents required to be kept confidential pursuant to § 37.1-67.3.

43. Investigative notes, correspondence and information furnished in confidence, and records otherwise exempted by this chapter or any Virginia statute, provided to or produced by or for the (i) Auditor of Public Accounts; (ii) Joint Legislative Audit and Review Commission; (iii) Department of the State Internal Auditor with respect to an investigation initiated through the State Employee Fraud, Waste and Abuse Hotline; or (iv) committee or the auditor with respect to an investigation or audit conducted pursuant to § 15.2-825. Records of completed investigations shall be disclosed in a form that does not reveal the identity of the complainants or persons supplying information to investigators. Unless disclosure is prohibited by this section, the records disclosed shall include, but not be limited to, the agency involved, the identity of the person who is the subject of the complaint, the nature of the complaint, and the actions taken to resolve the complaint. If an investigation does not lead to corrective action, the identity of the person who is the subject of the complaint may be released only with the consent of the subject person.

44. Data formerly required to be submitted to the Commissioner of Health relating to the establishment of new or the expansion of existing clinical health services, acquisition of major medical equipment, or certain projects requiring capital expenditures pursuant to former § 32.1-102.3:4.

45. Documentation or other information that describes the design, function, operation or access control features of any security system, whether manual or automated, which is used to control access to or use of any automated data processing or telecommunications system.

46. Confidential financial statements, balance sheets, trade secrets, and revenue and cost projections provided to the Department of Rail and Public Transportation, provided such information is exempt under the federal Freedom of Information Act or the federal Interstate Commerce Act or other laws administered by the Surface Transportation Board or the Federal Railroad Administration with respect to data provided in confidence to the Surface Transportation Board and the Federal Railroad Administration.

47. Records of the Virginia Retirement System, acting pursuant to § 51.1-124.30, or of a local retirement system, acting pursuant to § 51.1-803, or of the Rector and Visitors of the University of Virginia, acting pursuant to § 23-76.1, relating to the acquisition, holding or disposition of a security or other ownership interest in an entity, where such security or ownership interest is not traded on a governmentally regulated securities exchange, to the extent that: (i) such records contain confidential analyses prepared for the Rector and Visitors of the University of Virginia, prepared by the retirement system or provided to the retirement system under a promise of confidentiality, of the future value of such ownership interest or the future financial performance of the entity, and (ii) disclosure of such confidential analyses would have an adverse effect on the value of the investment to be acquired, held or disposed of by the retirement system or the Rector and Visitors of the University of Virginia. Nothing in this subdivision shall be construed to prevent the disclosure of records relating to the identity of any investment held, the amount invested, or the present value of such investment.

48. Confidential proprietary records related to inventory and sales, voluntarily provided by private energy suppliers to the Department of Mines, Minerals and Energy, used by that Department for energy contingency planning purposes or for developing consolidated statistical information on energy supplies.

49. Confidential proprietary information furnished to the Board of Medical Assistance Services or the Medicaid Prior Authorization Advisory Committee pursuant to Article 4 (§ 32.1-331.12 et seq.) of Chapter 10 of Title 32.1.

50. Proprietary, commercial or financial information, balance sheets, trade secrets, and revenue and cost projections provided by a private transportation business to the Virginia Department of Transportation and the Department of Rail and Public Transportation for the purpose of conducting transportation studies needed to obtain grants or other financial assistance under the Transportation Equity Act for the 21st Century (P.L. 105-178) for transportation projects, provided such information is exempt under the federal Freedom of Information Act or the federal Interstate Commerce Act or other laws administered by the Surface Transportation Board or the Federal Railroad Administration with respect to data provided in confidence to the Surface Transportation Board and the Federal Railroad Administration. However, the exemption provided by this subdivision shall not apply to any wholly owned subsidiary of a public body.

51. Names and addresses of subscribers to Virginia Wildlife magazine, published by the Department of Game and Inland Fisheries, provided the individual subscriber has requested in writing that the Department not release such information.

52. Information required to be provided pursuant to § 54.1-2506.1.

53. Confidential information designated as provided in subsection D of § 2.2-4342 as trade secrets or proprietary information by any person who has submitted to a public body an application for prequalification to bid on public construction projects in accordance with subsection B of § 2.2-4317.

54. All information and records acquired during a review of any child death by the State Child Fatality Review team established pursuant to § 32.1-283.1, during a review of any child death by a local or regional child fatality review team established pursuant to § 32.1-283.2, and all information and records acquired during a review of any death by a family violence fatality review team established pursuant to § 32.1-283.3.

55. Financial, medical, rehabilitative and other personal information concerning applicants for or recipients of loan funds submitted to or maintained by the Assistive Technology Loan Fund Authority under Chapter 11 (§ 51.5-53 et seq.) of Title 51.5.

56. Confidential proprietary records that are voluntarily provided by a private entity pursuant to a proposal filed with a public entity or an affected local jurisdiction under the Public-Private Transportation Act of 1995 (§ 56-556 et seq.) or the Public-Private Education Facilities and Infrastructure Act of 2002 (§ 56-575.1 et seq.), pursuant to a promise of confidentiality from the responsible public entity or affected local jurisdiction, used by the responsible public entity or affected local jurisdiction for purposes related to the development of a qualifying transportation facility or qualifying project; and memoranda, working papers or other records related to proposals filed under the Public-Private Transportation Act of 1995 or the Public-Private Education Facilities and Infrastructure Act of 2002, where, if such records were made public, the financial interest of the public or private entity involved with such proposal or the process of competition or bargaining would be adversely affected. In order for confidential proprietary information to be excluded from the provisions of this chapter, the private entity shall (i) invoke such exclusion upon submission of the data or other materials for which protection from disclosure is sought, (ii) identify the data or other materials for which protection is sought, and (iii) state the reasons why protection is necessary. For the purposes of this subdivision, the terms "affected local jurisdiction", "public entity" and "private entity" shall be defined as they are defined in the Public-Private Transportation Act of 1995 or in the Public-Private Education Facilities and Infrastructure Act of 2002. However, nothing in this subdivision shall be construed to prohibit the release of procurement records as required by § 56-573.1 or § 56-575.16. Procurement records shall not be interpreted to include proprietary, commercial or financial information, balance sheets, financial statements, or trade secrets that may be provided by the private entity as evidence of its qualifications.

57. Plans and information to prevent or respond to terrorist activity, the disclosure of which would jeopardize the safety of any person, including (i) critical infrastructure sector or structural components; (ii) vulnerability assessments, operational, procedural, transportation, and tactical planning or training manuals, and staff meeting minutes or other records; and (iii) engineering or architectural records, or records containing information derived from such records, to the extent such records reveal the location or operation of security equipment and systems, elevators, ventilation, fire protection, emergency, electrical, telecommunications or utility equipment and systems of any public building, structure or information storage facility. The same categories of records of any governmental or nongovernmental person or entity submitted to a public body for the purpose of antiterrorism response planning may be withheld from disclosure if such person or entity in writing (a) invokes the protections of this subdivision, (b) identifies with specificity the records or portions thereof for which protection is sought, and (c) states with reasonable particularity why the protection of such records from public disclosure is necessary to meet the objective of antiterrorism planning or protection. Such statement shall be a public record and shall be disclosed upon request. Nothing in this subdivision shall be construed to prohibit the disclosure of records relating to the structural or environmental soundness of any building, nor shall it prevent the disclosure of information relating to any building in connection with an inquiry into the performance of that building after it has been subjected to fire, explosion, natural disaster or other catastrophic event.

58. All records of the University of Virginia or the University of Virginia Medical Center or Eastern Virginia Medical School, as the case may be, that contain proprietary, business-related information pertaining to the operations of the University of Virginia Medical Center or Eastern Virginia Medical School, as the case may be, including business development or marketing strategies and activities with existing or future joint venturers, partners, or other parties with whom the University of Virginia Medical Center or Eastern Virginia Medical School, as the case may be, has formed, or forms, any arrangement for the delivery of health care, if disclosure of such information would be harmful to the competitive position of the Medical Center or Eastern Virginia Medical School, as the case may be.

59. Patient level data collected by the Board of Health and not yet processed, verified, and released, pursuant to § 32.1-276.9, to the Board by the nonprofit organization with which the Commissioner of Health has contracted pursuant to § 32.1-276.4.

60. Records of the Virginia Commonwealth University Health System Authority pertaining to any of the following: an individual's qualifications for or continued membership on its medical or teaching staffs; proprietary information gathered by or in the possession of the Authority from third parties pursuant to a promise of confidentiality; contract cost estimates prepared for confidential use in awarding contracts for construction or the purchase of goods or services; data, records or information of a proprietary nature produced or collected by or for the Authority or members of its medical or teaching staffs; financial statements not publicly available that may be filed with the Authority from third parties; the identity, accounts or account status of any customer of the Authority; consulting or other reports paid for by the Authority to assist the Authority in connection with its strategic planning and goals; and the determination of marketing and operational strategies where disclosure of such strategies would be harmful to the competitive position of the Authority; and data, records or information of a proprietary nature produced or collected by or for employees of the Authority, other than the Authority's financial or administrative records, in the conduct of or as a result of study or research on medical, scientific, technical or scholarly issues, whether sponsored by the Authority alone or in conjunction with a governmental body or a private concern, when such data, records or information have not been publicly released, published, copyrighted or patented.

61. Confidential proprietary information or trade secrets, not publicly available, provided by a private person or entity to the Virginia Resources Authority or to a fund administered in connection with financial assistance rendered or to be rendered by the Virginia Resources Authority where, if such information were made public, the financial interest of the private person or entity would be adversely affected, and, after June 30, 1997, where such information was provided pursuant to a promise of confidentiality.

62. Confidential proprietary records that are provided by a franchisee under § 15.2-2108 to its franchising authority pursuant to a promise of confidentiality from the franchising authority that relates to the franchisee's potential provision of new services, adoption of new technologies or implementation of improvements, where such new services, technologies or improvements have not been implemented by the franchisee on a nonexperimental scale in the franchise area, and where, if such records were made public, the competitive advantage or financial interests of the franchisee would be adversely affected. In order for confidential proprietary information to be excluded from the provisions of this chapter, the franchisee shall (i) invoke such exclusion upon submission of the data or other materials for which protection from disclosure is sought, (ii) identify the data or other materials for which protection is sought, and (iii) state the reason why protection is necessary.

63. Records of the Intervention Program Committee within the Department of Health Professions, to the extent such records may identify any practitioner who may be, or who is actually, impaired to the extent disclosure is prohibited by § 54.1-2517.

64. Records submitted as a grant application, or accompanying a grant application, to the Commonwealth Neurotrauma Initiative Advisory Board pursuant to Chapter 3.1 (§ 51.5-12.1 et seq.) of Title 51.5, to the extent such records contain (i) medical or mental records, or other data identifying individual patients or (ii) proprietary business or research-related information produced or collected by the applicant in the conduct of or as a result of study or research on medical, rehabilitative, scientific, technical or scholarly issues, when such information has not been publicly released, published, copyrighted or patented, if the disclosure of such information would be harmful to the competitive position of the applicant.

65. Information that would disclose the security aspects of a system safety program plan adopted pursuant to 49 C.F.R. Part 659 by the Commonwealth's designated Rail Fixed Guideway Systems Safety Oversight agency; and information in the possession of such agency, the release of which would jeopardize the success of an ongoing investigation of a rail accident or other incident threatening railway safety.

66. Documents and other information of a proprietary nature furnished by a supplier of charitable gaming supplies to the Department of Charitable Gaming pursuant to subsection E of § 18.2-340.34.

67. Personal information, as defined in § 2.2-3801, provided to the Board of the Virginia College Savings Plan or its employees by or on behalf of individuals who have requested information about, applied for, or entered into prepaid tuition contracts or savings trust account agreements pursuant to Chapter 4.9 (§ 23-38.75 et seq.) of Title 23. Nothing in this subdivision shall be construed to prohibit disclosure or publication of information in a statistical or other form that does not identify individuals or provide personal information. Individuals shall be provided access to their own personal information.

68. Any record copied, recorded or received by the Commissioner of Health in the course of an examination, investigation or review of a managed care health insurance plan licensee pursuant to §§ 32.1-137.4 and 32.1-137.5, including books, records, files, accounts, papers, documents, and any or all computer or other recordings.

69. Engineering and architectural drawings, operational, procedural, tactical planning or training manuals, or staff meeting minutes or other records, the disclosure of which would reveal surveillance techniques, personnel deployments, alarm or security systems or technologies, or operational and transportation plans or protocols, to the extent such disclosure would jeopardize the security of any governmental facility, building or structure or the safety of persons using such facility, building or structure.

70. Records and reports related to Virginia apple producer sales provided to the Virginia State Apple Board pursuant to §§ 3.1-622 and 3.1-624.

71. Records of the Department of Environmental Quality, the State Water Control Board, State Air Pollution Control Board or the Virginia Waste Management Board relating to (i) active federal environmental enforcement actions that are considered confidential under federal law and (ii) enforcement strategies, including proposed sanctions for enforcement actions. Upon request, such records shall be disclosed after a proposed sanction resulting from the investigation has been proposed to the director of the agency. This subdivision shall not be construed to prohibit the disclosure of records related to inspection reports, notices of violation, and documents detailing the nature of any environmental contamination that may have occurred or similar documents.

72. As it pertains to any person, records related to the operation of toll facilities that identify an individual, vehicle, or travel itinerary including, but not limited to, vehicle identification data, vehicle enforcement system information; video or photographic images; Social Security or other identification numbers appearing on driver's licenses; credit card or bank account data; home addresses; phone numbers; or records of the date or time of toll facility use.

73. Records of the Virginia Office for Protection and Advocacy consisting of documentary evidence received or maintained by the Office or its agents in connection with specific complaints or investigations, and records of communications between employees and agents of the Office and its clients or prospective clients concerning specific complaints, investigations or cases. Upon the conclusion of an investigation of a complaint, this exclusion shall no longer apply, but the Office may not at any time release the identity of any complainant or person with mental illness, mental retardation, developmental disabilities or other disability, unless (i) such complainant or person or his legal representative consents in writing to such identification or (ii) such identification is required by court order.

74. Information furnished in confidence to the Department of Employment Dispute Resolution with respect to an investigation, consultation, or mediation under Chapter 10 (§ 2.2-1000 et seq.) of this title, and memoranda, correspondence and other records resulting from any such investigation, consultation or mediation. However, nothing in this section shall prohibit the distribution of information taken from inactive reports in a form that does not reveal the identity of the parties involved or other persons supplying information.

75. Trade secrets, as defined in the Uniform Trade Secrets Act (§ 59.1-336 et seq.) of Title 59.1, submitted by CMRS providers as defined in § 56-484.12 to the Wireless Carrier E-911 Cost Recovery Subcommittee created pursuant to § 56-484.15, relating to the provision of wireless E-911 service.

76. Records of the State Lottery Department pertaining to (i) the social security number, tax identification number, state sales tax number, home address and telephone number, personal and lottery banking account and transit numbers of a retailer, and financial information regarding the nonlottery operations of specific retail locations, and (ii) individual lottery winners, except that a winner's name, hometown, and amount won shall be disclosed.

77. Records, information and statistical registries required to be kept confidential pursuant to §§ 63.2-102 and 63.2-104.

78. Personal information, as defined in § 2.2-3801, including electronic mail addresses, furnished to a public body for the purpose of receiving electronic mail from the public body, provided that the electronic mail recipient has requested that the public body not disclose such information. However, access shall not be denied to the person who is the subject of the record.

79. (For effective date, see note) All data, records, and reports relating to the prescribing and dispensing of covered substances to recipients and any abstracts from such data, records, and reports that are in the possession of the Prescription Monitoring Program pursuant to Chapter 25.2 (§ 54.1-2519 et seq.) of Title 54.1 and any material relating to the operation or security of the Program.

80. Communications and materials required to be kept confidential pursuant to § 2.2-4119 of the Virginia Administrative Dispute Resolution Act.

81. The names, addresses and telephone numbers of complainants furnished in confidence with respect to an investigation of individual zoning enforcement complaints made to a local governing body.

82. Records relating to the negotiation and award of a specific contract where competition or bargaining is involved and where the release of such records would adversely affect the bargaining position or negotiating strategy of the public body. Such records shall not be withheld after the public body has made a decision to award or not to award the contract. In the case of procurement transactions conducted pursuant to the Virginia Public Procurement Act (§ 2.2-4300 et seq.), the provisions of this subdivision shall not apply, and any release of records relating to such transactions shall be governed by the Virginia Public Procurement Act.

83. Records submitted as a grant application, or accompanying a grant application, to the Commonwealth Health Research Board pursuant to Chapter 22 (§ 23-277 et seq.) of Title 23 to the extent such records contain proprietary business or research-related information produced or collected by the applicant in the conduct of or as a result of study or research on medical, rehabilitative, scientific, technical or scholarly issues, when such information has not been publicly released, published, copyrighted or patented, if the disclosure of such information would be harmful to the competitive position of the applicant.

84. Records of the Board for Branch Pilots relating to the chemical or drug testing of a person regulated by the Board, where such person has tested negative or has not been the subject of a disciplinary action by the Board for a positive test result.

85. Security plans and specific vulnerability assessment components of school safety audits, as provided in § 22.1-279.8.

Nothing in this subdivision shall be construed to prohibit the disclosure of records relating to the effectiveness of security plans after (i) any school building or property has been subjected to fire, explosion, natural disaster or other catastrophic event, or (ii) any person on school property has suffered or been threatened with any personal injury.

86. Records, investigative notes, correspondence, and information pertaining to the planning, scheduling and performance of examinations of holder records pursuant to the Uniform Disposition of Unclaimed Property Act (§ 55-210.1 et seq.) prepared by or for the State Treasurer, his agents, employees or persons employed to perform an audit or examination of holder records.

87. Records of the Virginia Birth-Related Neurological Injury Compensation Program required to be kept confidential pursuant to § 38.2-5002.2.

B. Neither any provision of this chapter nor any provision of Chapter 38 (§ 2.2-3800 et seq.) of this title shall be construed as denying public access to (i) contracts between a public body and its officers or employees, other than contracts settling public employee employment disputes held confidential as personnel records under subdivision A 4; (ii) records of the position, job classification, official salary or rate of pay of, and records of the allowances or reimbursements for expenses paid to any officer, official or employee of a public body; or (iii) the compensation or benefits paid by any corporation organized by the Virginia Retirement System or its officers or employees. The provisions of this subsection, however, shall not require public access to records of the official salaries or rates of pay of public employees whose annual rate of pay is $10,000 or less.

C. No provision of this chapter or Chapter 21 (§ 30-178 et seq.) of Title 30 shall be construed to afford any rights to any person incarcerated in a state, local or federal correctional facility, whether or not such facility is (i) located in the Commonwealth or (ii) operated pursuant to the Corrections Private Management Act (§ 53.1-261 et seq.). However, this subsection shall not be construed to prevent an incarcerated person from exercising his constitutionally protected rights, including, but not limited to, his rights to call for evidence in his favor in a criminal prosecution.

D. Nothing in this chapter shall be construed as denying public access to the nonexempt portions of a report of a consultant hired by or at the request of a local public body or the mayor or chief executive or administrative officer of such public body if (i) the contents of such report have been distributed or disclosed to members of the local public body or (ii) the local public body has scheduled any action on a matter that is the subject of the consultant's report.

§ 8.01-413. Certain copies of health care provider's records or papers of patient admissible; right of patient, his attorney and authorized insurer to copies of such records or papers; subpoena; damages, costs and attorney's fees.

A. In any case where the hospital, nursing facility, physician's, or other health care provider's original records or papers of any patient in a hospital or institution for the treatment of physical or mental illness are admissible or would be admissible as evidence, any typewritten copy, photograph, photostatted copy, or microphotograph or printout or other hard copy generated from computerized or other electronic storage, microfilm, or other photographic, mechanical, electronic or chemical storage process thereof shall be admissible as evidence in any court of this Commonwealth in like manner as the original, if the printout or hard copy or microphotograph or photograph is properly authenticated by the employees having authority to release or produce the original records.

Any hospital, nursing facility, physician, or other health care provider whose records or papers relating to any such patient are subpoenaed for production as provided by law may comply with the subpoena by a timely mailing to the clerk issuing the subpoena or in whose court the action is pending properly authenticated copies, photographs or microphotographs in lieu of the originals. The court whose clerk issued the subpoena or, in the case of an attorney-issued subpoena, in which the action is pending, may, after notice to such hospital, nursing facility, physician, or other health care provider, enter an order requiring production of the originals, if available, of any stored records or papers whose copies, photographs or microphotographs are not sufficiently legible. The party requesting the subpoena duces tecum or on whose behalf an attorney-issued subpoena duces tecum was issued shall be liable for the reasonable charges of the hospital, nursing facility, physician, or other health care provider for the service of maintaining, retrieving, reviewing, preparing, copying and mailing the items produced. Except for copies of X-ray photographs, however, such charges shall not exceed fifty cents for each page up to fifty pages and twenty-five cents a page thereafter for copies from paper or other hard copy generated from computerized or other electronic storage, or other photographic, mechanical, electronic, imaging or chemical storage process and one dollar per page for copies from microfilm or other micrographic process, plus all postage and shipping costs and a search and handling fee not to exceed ten dollars.

B. Copies of hospital, nursing facility, physician's, or other health care provider's records or papers shall be furnished within fifteen days of such request to the patient, his attorney or an authorized insurer upon such patient's, attorney's or authorized insurer's written request, which request shall comply with the requirements of subsection E of § 32.1-127.1:03.

However, copies of a patient's records shall not be furnished to such patient where when the patient's treating physician or clinical psychologist, in the exercise of professional judgment, has made a part of the patient's records a written statement that in his opinion the furnishing to or review by the patient of such records would be injurious reasonably likely to endanger the life or physical safety of the patient's health or well-being, but patient or another person, or that such health records make reference to a person, other than a health care provider, and the access requested would be reasonably likely to cause substantial harm to such referenced person. In any such case such records shall be furnished to the patient's, if requested by the patient or his attorney or authorized insurer, such records shall be furnished within fifteen 15 days of the date of such request to the patient's attorney or authorized insurer, rather than to the patient.

If the records are not provided to the patient in accordance with this section then, if requested by the patient, the hospital, nursing facility, physician, or other health care provider denying the request shall comply with the patient's request to either (i) provide a copy of the records to a physician or clinical psychologist of the patient's choice whose licensure, training, and experience, relative to the patient's condition, are at least equivalent to that of the treating physician or clinical psychologist upon whose opinion the denial is based, who shall, at the patient's expense, make a judgment as to whether to make the records available to the patient or (ii) designate a physician or clinical psychologist, whose licensure, training, and experience, relative to the patient's condition, are at least equivalent to that of the treating physician or clinical psychologist upon whose opinion the denial is based and who did not participate in the original decision to deny the patient's request for his records, who shall, at the expense of the provider denying access to the patient, review the records and make a judgment as to whether to make the records available to the patient. In either such event, the hospital, nursing facility, physician, or other health care provider denying the request shall comply with the judgment of the reviewing physician or clinical psychologist.

A reasonable charge may be made by the hospital, nursing facility, physician or other health care provider for the service of maintaining, retrieving, reviewing and preparing such copies cost of supplies for and labor of copying the records. Except for copies of X-ray photographs, however, such charges shall not exceed fifty cents$.50 per page for up to fifty50 pages and twenty-five cents$.25 a page thereafter for copies from paper or other hard copy generated from computerized or other electronic storage, or other photographic, mechanical, electronic, imaging or chemical storage process and one dollar$1 per page for copies from microfilm or other micrographic process, plus all postage and shipping costs and a search and handling fee not to exceed ten dollars. Any hospital, nursing facility, physician, or other health care provider receiving such a request from a patient's attorney or authorized insurer shall require a writing signed by the patient confirming the attorney's or authorized insurer's authority to make the request and shall accept a photocopy, facsimile, or other copy of the original signed by the patient as if it were an original.

C. Upon the failure of any hospital, nursing facility, physician, or other health care provider to comply with any written request made in accordance with subsection B within the period of time specified in that subsection and within the manner specified in subsections E and F of § 32.1-127.1:03, the patient, his attorney or authorized insurer may cause a subpoena duces tecum to be issued. The subpoena may be issued (i) upon filing a request therefor with the clerk of the circuit court wherein any eventual suit would be required to be filed, and upon payment of the fees required by subdivision A 18 of § 17.1-275, and fees for service or (ii) by the patient's attorney in a pending civil case in accordance with § 8.01-407 if issued by such attorney at least five business days prior to the date that production of the record is desired without payment of the fees established in subdivision A 23 of § 17.1-275. The subpoena shall be returnable within twenty days of proper service, directing the hospital, nursing facility, physician, or other health care provider to produce and furnish copies of the reports and papers to the clerk who shall then make the same available to the patient, his attorney or authorized insurer. If the court finds that a hospital, nursing facility, physician, or other health care provider willfully refused to comply with a written request made in accordance with subsection B, either by willfully or arbitrarily refusing or by imposing a charge in excess of the reasonable expense of making the copies and processing the request for records, the court may award damages for all expenses incurred by the patient or authorized insurer to obtain such copies, including court costs and reasonable attorney's fees.

D. The provisions of subsections A, B, and C hereof shall apply to any health care provider whose office is located within or without the Commonwealth if the records pertain to any patient who is a party to a cause of action in any court in the Commonwealth of Virginia, and shall apply only to requests made by an attorney, his client or any authorized insurer, in anticipation of litigation or in the course of litigation.

E. Health care provider, as used in this section, shall have the same meaning as provided in § 32.1-127.1:03 and shall also include an independent medical copy retrieval service contracted to provide the service of retrieving, reviewing, and preparing such copies for distribution.

F. Notwithstanding the authorization to admit as evidence patient records in the form of microphotographs, prescription dispensing records maintained in or on behalf of any pharmacy registered or permitted in Virginia shall only be stored in compliance with §§ 54.1-3410, 54.1-3411 and 54.1-3412.

§ 32.1-127.1:03. Health records privacy.

A. There is hereby recognized a patient's an individual's right of privacy in the content of a patient's medical record his health records. Patient Health records are the property of the provider health care entity maintaining them, and, except when permitted by this section or by another provision of state or federal law, no provider health care entity, or other person working in a health care setting, may disclose the an individual's health records of a patient.

Patient Health records shall not be removed from the premises where they are maintained without the approval of the provider health care entity that maintains such health records, except in accordance with a court order or subpoena consistent with § 8.01-413 C or with this section or in accordance with the regulations relating to change of ownership of patient health records promulgated by a health regulatory board established in Title 54.1.

No person to whom disclosure of patient health records was made by a patient or a provider are disclosed shall redisclose or otherwise reveal the health records of a patient an individual, beyond the purpose for which such disclosure was made, without first obtaining the patient's individual's specific consent authorization to such redisclosure. This redisclosure prohibition shall not, however, prevent (i) any provider health care entity who receives health records from another provider health care entity from making subsequent disclosures as permitted under this section and the federal Department of Health and Human Services regulations relating to the electronic transmission of data and patient privacy protected health information promulgated by the United States Department of Health and Human Services as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (42 U.S.C. § 1320d et seq.) or (ii) any provider health care entity from furnishing health records and aggregate or other data, from which patient- individually identifying prescription information has been removed, encoded or encrypted, to qualified researchers, including, but not limited to, pharmaceutical manufacturers and their agents or contractors, for purposes of clinical, pharmaco-epidemiological, pharmaco-economic, or other health services research.

B. As used in this section:

"Agent" means a person who has been appointed as a patient's an individual's agent under a power of attorney for health care or an advance directive under the Health Care Decisions Act (§ 54.1-2981 et seq.).

"Certification" means a written representation that is delivered by hand, by first-class mail, by overnight delivery service, or by facsimile if the sender obtains a facsimile-machine-generated confirmation reflecting that all facsimile pages were successfully transmitted.

"Guardian" means a court-appointed guardian of the person.

"Health services" includes, but is not limited to, examination, diagnosis, evaluation, treatment, pharmaceuticals, aftercare, habilitation or rehabilitation and mental health therapy of any kind."Parent" means a biological, adoptive or foster parent.

"Patient" means a person who is receiving or has received health services from a provider.

"Patient-identifying prescription information" means all prescriptions, drug orders or any other prescription information that specifically identifies an individual patient.

"Health care clearinghouse" means, consistent with the definition set out in 45 C.F.R. § 160.103, a public or private entity, such as a billing service, repricing company, community health management information system or community health information system, and "value-added" networks and switches, that performs either of the following functions: (i) processes or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction; or (ii) receives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity.

"Health care entity" means any health care provider, health plan or health care clearinghouse.

"ProviderHealth care provider" shall have the same meaning as set forth means those entities listed in the definition of "health care provider" in § 8.01-581.1, except that state-operated facilities shall also be considered health care providers for the purposes of this section. Provider Health care provider shall also include all persons who are licensed, certified, registered or permitted by any of the health regulatory boards within the Department of Health Professions, except persons regulated by the Board of Funeral Directors and Embalmers or the Board of Veterinary Medicine.

"Health plan" means an individual or group plan that provides, or pays the cost of, medical care. "Health plan" shall include any entity included in such definition as set out in 45 C.F.R. § 160.103.

"RecordHealth record" means any written, printed or electronically recorded material maintained by a provider health care entity in the course of providing health services to a patient an individual concerning the patient individual and the services provided. "RecordHealth record" also includes the substance of any communication made by a patient an individual to a provider health care entity in confidence during or in connection with the provision of health services to a patient or information otherwise acquired by the provider health care entity about a patient an individual in confidence and in connection with the provision of health services to the patient individual.

"Health services" means, but shall not be limited to, examination, diagnosis, evaluation, treatment, pharmaceuticals, aftercare, habilitation or rehabilitation and mental health therapy of any kind, as well as payment or reimbursement for any such services.

"Individual" means a patient who is receiving or has received health services from a health care entity.

"Individually identifying prescription information" means all prescriptions, drug orders or any other prescription information that specifically identifies an individual.

"Parent" means a biological, adoptive or foster parent.

C. Except as specifically provided herein, the provisions of this section shall not apply to any of the following:

1. The status of and release of information governed by §§ 65.2-604 and 65.2-607 of the Virginia Workers' Compensation Act;

2. Except where specifically provided herein, The health records of minor patients minors; or

3. The release of juvenile health records to a secure facility or a shelter care facility pursuant to § 16.1-248.3.

D. Providers Health care entities may disclose the health records of a patient:

1. As set forth in subsection E of this section, pursuant to the written consent authorization of the patient individual or in the case of a minor patient, his custodial parent, guardian or other person authorized to consent to treatment of minors pursuant to § 54.1-2969; also, in emergency cases or situations where it is impractical to obtain the patient's an individual's written consent authorization, pursuant to the patient's individual's oral consent authorization for a health care provider or health plan to discuss the patient's individual's health records with a third party specified by the patient individual;

2. In compliance with a subpoena issued in accord with subsection H of this section, pursuant to court order upon good cause shown or in compliance with a subpoena issued pursuant to subsection C of § 8.01-413;

3. In accord with subsection F of § 8.01-399 including, but not limited to, situations where disclosure is reasonably necessary to establish or collect a fee or to defend a provider health care entity or the provider's health care entity's employees or staff against any accusation of wrongful conduct; also as required in the course of an investigation, audit, review or proceedings regarding a provider's health care entity's conduct by a duly authorized law-enforcement, licensure, accreditation, or professional review entity;

4. In testimony in accordance with §§ 8.01-399 and 8.01-400.2;

5. In compliance with the provisions of § 8.01-413;

6. As required or authorized by law relating to public health activities, health oversight activities, serious threats to health or safety, or abuse, neglect or domestic violence, relating to contagious disease, public safety, and suspected child or adult abuse reporting requirements, including, but not limited to, those contained in §§ 32.1-36, 32.1-36.1, 32.1-40, 32.1-41, 32.1-127.1:04, 32.1-276.5, 32.1-283, 32.1-283.1, 37.1-98.2, 53.1-40.10, 54.1-2403.3, 54.1-2506, 54.1-2906, 54.1-2907, 54.1-2966, 54.1-2966.1, 54.1-2967, 54.1-2968, 63.2-1606 and 63.2-1509;

7. Where necessary in connection with the care of the patient individual, including in the implementation of a hospital routine contact process for organ donation pursuant to subdivision B. 4. of § 32.1-127;

8. In the normal course of business in accordance with accepted standards of practice within the health services setting; however, the maintenance, storage, and disclosure of the mass of prescription dispensing records maintained in a pharmacy registered or permitted in Virginia shall only be accomplished in compliance with §§ 54.1-3410, 54.1-3411 and 54.1-3412;

9. When the patient individual has waived his right to the privacy of the medical health records;

10. When examination and evaluation of a patient an individual are undertaken pursuant to judicial or administrative law order, but only to the extent as required by such order;

11. To the guardian ad litem and any attorney representing the respondent in the course of a guardianship proceeding of an adult patient authorized who is the respondent in a proceeding under Article 1.1 (§ 37.1-134.6 et seq.) of Chapter 4 of Title 37.1;

12. To the attorney appointed by the court to represent a patient in an individual who is or has been a patient who was the subject of a civil commitment proceeding under § 37.1-67.3 or a judicial authorization for treatment proceeding pursuant to § 37.1-134.21;

13. To the attorney and/or guardian ad litem of a minor patient who represents such minor in any judicial or administrative proceeding, provided that if the court or administrative hearing officer has entered an order granting the attorney or guardian ad litem this right and such attorney or guardian ad litem presents evidence to the provider health care entity of such order;

14. With regard to the Court-Appointed Special Advocate (CASA) program, a minor's health records in accord with § 9.1-156;

15. To an agent appointed under a patient's an individual's power of attorney or to an agent or decision maker designated in a patient's an individual's advance directive for health care or for decisions on anatomical gifts and organ, tissue or eye donation or to any other person consistent with the provisions of the Health Care Decisions Act (§ 54.1-2981 et seq.);

16. To third-party payors and their agents for purposes of reimbursement;

17. As is necessary to support an application for receipt of health care benefits from a governmental agency or as required by an authorized governmental agency reviewing such application or reviewing benefits already provided or as necessary to the coordination of prevention and control of disease, injury, or disability and delivery of such health care benefits pursuant to § 32.1-127.1:04;

18. Upon the sale of a medical practice as provided in § 54.1-2405; or upon a change of ownership or closing of a pharmacy pursuant to regulations of the Board of Pharmacy;

19. In accord with § 54.1-2400.1 B, to communicate a patient's an individual's specific and immediate threat to cause serious bodily injury or death of an identified or readily identifiable person;

20. To the patient individual who is the subject of the health record, except as provided in subsections E and F of this section and subsection B of § 8.01-413;

21. In the case of substance abuse records, when permitted by and in conformity with requirements of federal law found in 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2;

22. In connection with the work of any entity established as set forth in § 8.01-581.16 to evaluate the adequacy or quality of professional services or the competency and qualifications for professional staff privileges;

23. If the health records are those of a deceased or mentally incapacitated patient individual to the personal representative or executor of the deceased patient individual or the legal guardian or committee of the incompetent or incapacitated patient individual or if there is no personal representative, executor, legal guardian or committee appointed, to the following persons in the following order of priority: a spouse, an adult son or daughter, either parent, an adult brother or sister, or any other relative of the deceased patient individual in order of blood relationship;

24. For the purpose of conducting record reviews of inpatient hospital deaths to promote identification of all potential organ, eye, and tissue donors in conformance with the requirements of applicable federal law and regulations, including 42 C.F.R. § 482.45, (i) to the health care provider's designated organ procurement organization certified by the United States Health Care Financing Administration and (ii) to any eye bank or tissue bank in Virginia certified by the Eye Bank Association of America or the American Association of Tissue Banks;

25. To the Office of the Inspector General for Mental Health, Mental Retardation and Substance Abuse Services pursuant to Chapter 16 (§ 37.1-255 et seq.) of Title 37.1;

26. (Expires July 1, 2006) To an entity participating in the activities of a local health partnership authority established pursuant to Article 6.1 (§ 32.1-122.10:001 et seq.) of Chapter 4 of Title 32.1, pursuant to subdivision D 1 of this section; and

27. To law-enforcement officials by each licensed emergency medical services agency, (i) when the patient individual is the victim of a crime or (ii) when the patient individual has been arrested and has received emergency medical services or has refused emergency medical services and the health records consist of the prehospital patient care report required by § 32.1-116.1.

E. Requests for copies of medical health records shall (i) be in writing, dated and signed by the requester; (ii) identify the nature of the information requested; and (iii) include evidence of the authority of the requester to receive such copies and identification of the person to whom the information is to be disclosed. The provider health care entity shall accept a photocopy, facsimile, or other copy of the original signed by the requestor as if it were an original. Within 15 days of receipt of a request for copies of medical health records, the provider health care entity shall do one of the following: (i) furnish such copies to any requester authorized to receive them; (ii) inform the requester if the information does not exist or cannot be found; (iii) if the provider health care entity does not maintain a record of the information, so inform the requester and provide the name and address, if known, of the provider health care entity who maintains the record; or (iv) deny the request (a) under subsection F, (b) on the grounds that the requester has not established his authority to receive such health records or proof of his identity, or (c) as otherwise provided by law. Procedures set forth in this section shall apply only to requests for health records not specifically governed by other provisions of this Code, federal law or state or federal regulation.

F. Except as provided in subsection B of § 8.01-413, copies of a patient's an individual's health records shall not be furnished to such patient individual or anyone authorized to act on the patient's individual's behalf where when the patient's attending individual's treating physician or the patient's individual's treating clinical psychologist has made a part of the patient's individual's record a written statement that, in his opinion the exercise of his professional judgment, the furnishing to or review by the patient individual of such health records would be injurious reasonably likely to endanger the patient's health or well-being life or physical safety of the individual or another person, or that such health record makes reference to a person who is not a health care provider and the access requested would be reasonably likely to cause substantial harm to such referenced person. If any custodian of medical records health care entity denies a request for copies of health records based on such statement, the custodian shall permit examination and copying of the medical record by another such physician or clinical psychologist selected by the patient health care entity shall inform the individual of the individual's right to designate , in writing, at his own expense, another reviewing physician or clinical psychologist, whose licensure, training and experience relative to the patient's individual's condition are at least equivalent to that of the physician or clinical psychologist upon whose opinion the denial is based. The person or entity denying the request shall inform the patient of the patient's right to select another reviewing physician or clinical psychologist under this subsection who designated reviewing physician or clinical psychologist shall make a judgment as to whether to make the health record available to the patient individual.

The health care entity denying the request shall also inform the individual of the individual's right to request in writing that such health care entity designate, at its own expense, a physician or clinical psychologist, whose licensure, training, and experience relative to the individual's condition are at least equivalent to that of the physician or clinical psychologist upon whose professional judgment the denial is based and who did not participate in the original decision to deny the health records, who shall make a judgment as to whether to make the health record available to the individual. The health care entity shall comply with the judgment of the reviewing physician or clinical psychologist. The health care entity shall permit copying and examination of the health record by such other physician or clinical psychologist designated by either the individual at his own expense or by the health care entity at its expense.

Any health record copied for review by the any such designated physician or clinical psychologist selected by the patient shall be accompanied by a statement from the custodian of the health record that the patient's attending individual's treating physician or clinical psychologist determined that the patient's individual's review of his health record would be injurious to the patient's health or well-being reasonably likely to endanger the life or physical safety of the individual or would be reasonably likely to cause substantial harm to a person referenced in the health record who is not a health care provider.

G. A written consent authorization to allow release of patient an individual's health records may, but need not, be in shall substantially include the following form information:

CONSENT AUTHORIZATION TO RELEASE OF CONFIDENTIAL HEALTH CARE

INFORMATION RECORDS 

Patient Individual's Name .................................................................
Provider Health Care Entity's Name ................................................................
Person, agency or provider Health Care Entity to whom disclosure is to be made ..................
Person, agency or provider to whom disclosure is to be made ..................
Information or Health Records to be disclosed ......................................

Purpose of Disclosure or At the Request of the Individual

......................................

As the person signing this consent authorization, I understand that I am giving my permission to the above-named provider or other named third party health care entity for disclosure of confidential health care records. I understand that the health care entity may not condition treatment or payment on my willingness to sign this authorization unless the specific circumstances under which such conditioning is permitted by law are applicable and are set forth in this authorization. I also understand that I have the right to revoke this consent authorization at any time, but that my revocation is not effective until delivered in writing to the person who is in possession of my health records and that such revocation will be prospective and is not effective as to health records that were already disclosed under the authorization prior to delivery of my revocation. A copy of this consent authorization and a notation concerning the persons or agencies to whom disclosure was made shall be included with my original health records. The person who receives the records to which this consent pertains may not redisclose them to anyone else without my separate written consent unless such I understand that health information disclosed under this authorization might be redisclosed by a recipient is a provider who makes a disclosure permitted by law and may, as a result of such disclosure, no longer be protected to the same extent as such health information was protected by law while solely in the possession of the health care entity.

This consent authorization expires on (date) or (event)......................................,,,,,,,

Signature of Patient Individual or Individual's Legal Representative if Individual is Unable to Sign

........................................................

Relationship or Authority of Legal Representative

.............................................................................

Date of Signature

H. Pursuant to this subsection:

1. Unless excepted from these provisions in subdivision 9, no party to a civil, criminal or administrative action or proceeding shall request the issuance of a subpoena duces tecum for another party's medical health records or cause a subpoena duces tecum to be issued by an attorney unless a copy of the request for the subpoena or a copy of the attorney-issued subpoena is provided to the other party's counsel or to the other party if pro se, simultaneously with filing the request or issuance of the subpoena. No party to an action or proceeding shall request or cause the issuance of a subpoena duces tecum for the medical health records of a nonparty witness unless a copy of the request for the subpoena or a copy of the attorney-issued subpoena is provided to the nonparty witness simultaneously with filing the request or issuance of the attorney-issued subpoena.

No subpoena duces tecum for medical health records shall set a return date earlier than 15 days from the date of the subpoena except by order of a court or administrative agency for good cause shown. When a court or administrative agency directs that medical health records be disclosed pursuant to a subpoena duces tecum earlier than 15 days from the date of the subpoena, a copy of the order shall accompany the subpoena.

Any party requesting a subpoena duces tecum for medical health records or on whose behalf the subpoena duces tecum is being issued shall have the duty to determine whether the patient individual whose health records are being sought is pro se or a nonparty.

In instances where medical health records being subpoenaed are those of a pro se party or nonparty witness, the party requesting or issuing the subpoena shall deliver to the pro se party or nonparty witness together with the copy of the request for subpoena, or a copy of the subpoena in the case of an attorney-issued subpoena, a statement informing them of their rights and remedies. The statement shall include the following language and the heading shall be in boldface capital letters:

NOTICE TO PATIENTINDIVIDUAL

The attached document means that (insert name of party requesting or causing issuance of the subpoena) has either asked the court or administrative agency to issue a subpoena or a subpoena has been issued by the other party's attorney to your doctor or, other health care providers (names of health care providers inserted here) or other health care entity (name of health care entity to be inserted here) requiring them to produce your medical health records. Your doctor or, other health care provider or other health care entity is required to respond by providing a copy of your medical health records. If you believe your health records should not be disclosed and object to their disclosure, you have the right to file a motion with the clerk of the court or the administrative agency to quash the subpoena. If you elect to file a motion to quash, such motion must be filed within 15 days of the date of the request or of the attorney-issued subpoena. You may contact the clerk's office or the administrative agency to determine the requirements that must be satisfied when filing a motion to quash and you may elect to contact an attorney to represent your interest. If you elect to file a motion to quash, you must notify your doctor or, other health care provider(s), or other health care entity, that you are filing the motion so that the health care provider or health care entity knows to send the health records to the clerk of court or administrative agency in a sealed envelope or package for safekeeping while your motion is decided.

2. Any party filing a request for a subpoena duces tecum or causing such a subpoena to be issued for a patient's medical an individual's health records shall include a notice to Providers in the same part of the request in which the provider recipient of the subpoena duces tecum is directed where and when to return the health records. Such notice shall be in boldface capital letters and shall include the following language:

NOTICE TO PROVIDERS

A COPY OF THIS SUBPOENA DUCES TECUM HAS BEEN PROVIDED TO YOUR PATIENT OR YOUR PATIENT'S THE INDIVIDUAL WHOSE HEALTH RECORDS ARE BEING REQUESTED OR HIS COUNSEL. YOU OR YOUR PATIENT HAVE THAT INDIVIDUAL HAS THE RIGHT TO FILE A MOTION TO QUASH (OBJECT TO) THE ATTACHED SUBPOENA. IF YOU ELECT TO FILE A MOTION TO QUASH, YOU MUST FILE THE MOTION WITHIN 15 DAYS OF THE DATE OF THIS SUBPOENA.

YOU MUST NOT RESPOND TO THIS SUBPOENA UNTIL YOU HAVE RECEIVED WRITTEN CERTIFICATION FROM THE PARTY ON WHOSE BEHALF THE SUBPOENA WAS ISSUED THAT THE TIME FOR FILING A MOTION TO QUASH HAS ELAPSED AND THAT:

NO MOTION TO QUASH WAS FILED; OR

ANY MOTION TO QUASH HAS BEEN RESOLVED BY THE COURT OR THE ADMINISTRATIVE AGENCY AND THE DISCLOSURES SOUGHT ARE CONSISTENT WITH SUCH RESOLUTION.

IF YOU RECEIVE NOTICE THAT YOUR PATIENT THE INDIVIDUAL WHOSE HEALTH RECORDS ARE BEING REQUESTED HAS FILED A MOTION TO QUASH THIS SUBPOENA, OR IF YOU FILE A MOTION TO QUASH THIS SUBPOENA, YOU MUST SEND THE HEALTH RECORDS ONLY TO THE CLERK OF THE COURT OR ADMINISTRATIVE AGENCY THAT ISSUED THE SUBPOENA OR IN WHICH THE ACTION IS PENDING AS SHOWN ON THE SUBPOENA USING THE FOLLOWING PROCEDURE:

PLACE THE HEALTH RECORDS IN A SEALED ENVELOPE AND ATTACH TO THE SEALED ENVELOPE A COVER LETTER TO THE CLERK OF COURT OR ADMINISTRATIVE AGENCY WHICH STATES THAT CONFIDENTIAL HEALTH CARE RECORDS ARE ENCLOSED AND ARE TO BE HELD UNDER SEAL PENDING A RULING ON THE MOTION TO QUASH THE SUBPOENA. THE SEALED ENVELOPE AND THE COVER LETTER SHALL BE PLACED IN AN OUTER ENVELOPE OR PACKAGE FOR TRANSMITTAL TO THE COURT OR ADMINISTRATIVE AGENCY.

3. Upon receiving a valid subpoena duces tecum for medical health records, health care providers entities shall have the duty to respond to the subpoena in accordance with the provisions of subdivisions 4, 5, 6, 7, and 8.

4. Except to deliver to a clerk of the court or administrative agency subpoenaed medical health records in a sealed envelope as set forth, health care providers entities shall not respond to a subpoena duces tecum for such medical health records until they have received a certification as set forth in subdivisions 5 or 8 of this subsection from the party on whose behalf the subpoena duces tecum was issued.

If the health care provider entity has actual receipt of notice that a motion to quash the subpoena has been filed or if the health care provider entity files a motion to quash the subpoena for medical health records, then the health care provider entity shall produce the health records, in a securely sealed envelope, to the clerk of the court or administrative agency issuing the subpoena or in whose court or administrative agency the action is pending. The court or administrative agency shall place the health records under seal until a determination is made regarding the motion to quash. The securely sealed envelope shall only be opened on order of the judge or administrative agency. In the event the court or administrative agency grants the motion to quash, the health records shall be returned to the health care provider entity in the same sealed envelope in which they were delivered to the court or administrative agency. In the event that a judge or administrative agency orders the sealed envelope to be opened to review the health records in camera, a copy of the order shall accompany any health records returned to the provider health care entity. The health records returned to the provider health care entity shall be in a securely sealed envelope.

5. If no motion to quash is filed within 15 days of the date of the request or of the attorney-issued subpoena, the party on whose behalf the subpoena was issued shall have the duty to certify to the subpoenaed health care provider entity that the time for filing a motion to quash has elapsed and that no motion to quash was filed. Any provider health care entity receiving such certification shall have the duty to comply with the subpoena duces tecum by returning the specified medical health records by either the return date on the subpoena or 5 days after receipt of the certification, whichever is later.

6. In the event that the individual whose health records are being sought files a motion to quash the subpoena, the court or administrative agency shall decide whether good cause has been shown by the discovering party to compel disclosure of the patient's private individual's health records over the patient's individual's objections. In determining whether good cause has been shown, the court or administrative agency shall consider (i) the particular purpose for which the information was collected; (ii) the degree to which the disclosure of the records would embarrass, injure, or invade the privacy of the individual; (iii) the effect of the disclosure on the individual's future health care; (iv) the importance of the information to the lawsuit or proceeding; and (v) any other relevant factor.

7. Concurrent with the court or administrative agency's resolution of a motion to quash, if subpoenaed medical health records have been submitted by a health care provider entity to the court or administrative agency in a sealed envelope, the court or administrative agency shall: (i) upon determining that no submitted medical health records should be disclosed, return all submitted medical health records to the provider health care entity in a sealed envelope; (ii) upon determining that all submitted medical health records should be disclosed, provide all the submitted medical health records to the party on whose behalf the subpoena was issued; or (iii) upon determining that only a portion of the submitted medical health records should be disclosed, provide such portion to the party on whose behalf the subpoena was issued and return the remaining medical health records to the provider health care entity in a sealed envelope.

8. Following the court or administrative agency's resolution of a motion to quash, the party on whose behalf the subpoena duces tecum was issued shall have the duty to certify in writing to the subpoenaed health care provider entity a statement of one of the following:

a. All filed motions to quash have been resolved by the court or administrative agency and the disclosures sought in the subpoena duces tecum are consistent with such resolution; and, therefore, the medical health records previously delivered in a sealed envelope to the clerk of the court or administrative agency will not be returned to the provider health care entity;

b. All filed motions to quash have been resolved by the court or administrative agency and the disclosures sought in the subpoena duces tecum are consistent with such resolution and that, since no medical health records have previously been delivered to the court or administrative agency by the provider health care entity, the provider health care entity shall comply with the subpoena duces tecum by returning the medical health records designated in the subpoena by the return date on the subpoena or five days after receipt of certification, whichever is later;

c. All filed motions to quash have been resolved by the court or administrative agency and the disclosures sought in the subpoena duces tecum are not consistent with such resolution; therefore, no medical health records shall be disclosed and all medical health records previously delivered in a sealed envelope to the clerk of the court or administrative agency will be returned to the provider health care entity;

d. All filed motions to quash have been resolved by the court or administrative agency and the disclosures sought in the subpoena duces tecum are not consistent with such resolution and that only limited disclosure has been authorized. The certification shall state that only the portion of the health records as set forth in the certification, consistent with the court or administrative agency's ruling, shall be disclosed. The certification shall also state that medical health records that were previously delivered to the court or administrative agency for which disclosure has been authorized will not be returned to the provider health care entity; however, all medical health records for which disclosure has not been authorized will be returned to the provider health care entity; or

e. All filed motions to quash have been resolved by the court or administrative agency and the disclosures sought in the subpoena duces tecum are not consistent with such resolution and, since no medical health records have previously been delivered to the court or administrative agency by the provider health care entity, the provider health care entity shall return only those health records specified in the certification, consistent with the court or administrative agency's ruling, by the return date on the subpoena or five days after receipt of the certification, whichever is later.

A copy of the court or administrative agency's ruling shall accompany any certification made pursuant to this subdivision.

9. The provisions of this subsection have no application to subpoenas for medical health records requested under § 8.01-413, or issued by a duly authorized administrative agency conducting an investigation, audit, review or proceedings regarding a provider's health care entity's conduct.

The provisions of this subsection shall apply to subpoenas for the medical health records of both minors and adults and to subpoenas for the health records of individuals in connection with hearings pursuant to Title 65.2 or any action at law brought to recover damages against any employer that is subject to Title 65.2.

Nothing in this subsection shall have any effect on the existing authority of a court or administrative agency to issue a protective order regarding medical health records, including, but not limited to, ordering the return of medical health records to a health care provider entity, after the period for filing a motion to quash has passed.

A subpoena for substance abuse records must conform to the requirements of federal law found in 42 C.F.R. Part 2, Subpart E.

I. Providers Health care entities may testify about the medical health records of a patient an individual in compliance with §§ 8.01-399 and 8.01-400.2.

§ 37.1-230. Disclosure to patient of information released.

Any patient who is the subject of information received by a third party payor pursuant to the provisions of this chapter may request and shall be entitled to receive from such third party payor a statement as to the substance of such information. Provided, however

However, if either the professional treating the patient or the treatment facility, or both, have advised the third party payor that the patient's treating physician or treating clinical psychologist has determined that such information, if given to the patient might adversely affect the patient's health, would be reasonably likely to endanger the life or physical safety of the patient or another person, or that such record makes reference to a person other than a health care provider, and the access requested would be reasonably likely to cause substantial harm to such referenced person, the third party payor shall provide (i) such information to an attorney designated by the patient rather than to the patient or (ii) to a physician or clinical psychologist designated by the patient, at the patient's expense, whose licensure, training, and experience, relative to the patient's condition, are at least equivalent to that of the treating physician or treating clinical psychologist upon whose opinion the denial is based, who shall make a judgment as to whether to make the information available to the patient.

Upon the patient's request, the third party payor shall also provide such information to a physician or clinical psychologist, at the third party payor's expense, whose licensure, training, and experience relative to the patient's condition are at least equivalent to that of the physician or clinical psychologist who advised the third party payor to deny the patient access to his records and who did not participate in the original decision to make a judgment as to whether to make the information available to the patient.

§ 38.2-608. Access to recorded personal information.

A. If any individual, after proper identification, submits a written request to an insurance institution, agent, or insurance-support organization for access to recorded personal information about the individual that is reasonably described by the individual and reasonably able to be located and retrieved by the insurance institution, agent, or insurance-support organization, the insurance institution, agent, or insurance-support organization shall within thirty business days from the date the request is received:

1. Inform the individual of the nature and substance of the recorded personal information in writing, by telephone, or by other oral communication, whichever the insurance institution, agent, or insurance-support organization prefers;

2. Permit the individual to see and copy, in person, the recorded personal information pertaining to him or to obtain a copy of the recorded personal information by mail, whichever the individual prefers, unless the recorded personal information is in coded form, in which case an accurate translation in plain language shall be provided in writing;

3. Disclose to the individual the identity, if recorded, of those persons to whom the insurance institution, agent, or insurance-support organization has disclosed the personal information within two years prior to such request, and if the identity is not recorded, the names of those insurance institutions, agents, insurance-support organizations or other persons to whom such information is normally disclosed; and

4. Provide the individual with a summary of the procedures by which he may request correction, amendment, or deletion of recorded personal information.

B. Any personal information provided pursuant to subsection A of this section shall identify the source of the information if it is an institutional source.

C. Medical-record information supplied by a medical-care institution or medical professional and requested under subsection A of this section, together with the identity of the medical professional or medical care institution that provided the information, shall be supplied either directly to the individual or to a medical professional designated by the individual and licensed to provide medical care with respect to the condition to which the information relates, whichever the insurance institution, agent or insurance-support organization individual prefers. If it the individual elects to disclose have the information disclosed to a medical professional designated by the individual him, the insurance institution, agent or insurance-support organization shall notify the individual, at the time of the disclosure, that it has provided the information to the medical professional.

However, disclosure directly to the individual may be denied if a treating physician or treating clinical psychologist has determined, in the exercise of professional judgment, that the disclosure requested would be reasonably likely to endanger the life or physical safety of the individual or another person or that the information requested makes reference to a person other than a health care provider and disclosure of such information would be reasonably likely to cause substantial harm to the referenced person.

If disclosure to the individual is denied, upon the individual's request, the insurance institution, agent or insurance support organization shall either (i) designate a physician or clinical psychologist acceptable to the insurance institution, agent or insurance support organization, who was not directly involved in the denial, and whose licensure, training, and experience relative to the individual's condition are at least equivalent to that of the physician or clinical psychologist who made the original determination, who shall, at the expense of the insurance institution, agent or insurance support organization, make a judgment as to whether to make the information available to the individual; or (ii) if the individual so requests, make the information available, at the individual's expense to a physician or clinical psychologist selected by the individual, whose licensure, training and experience relative to the individual's condition are at least equivalent to that of the physician or clinical psychologist who made the original determination, who shall make a judgment as to whether to make the information available to the individual. The insurance institution, agent, or insurance support organization shall comply with the judgment of the reviewing physician or clinical psychologist made in accordance with the foregoing procedures.

D. Except for personal information provided under § 38.2-610, an insurance institution, agent, or insurance-support organization may charge a reasonable fee to cover the costs incurred in providing a copy of recorded personal information to individuals.

E. The obligations imposed by this section upon an insurance institution or agent may be satisfied by another insurance institution or agent authorized to act on its behalf. With respect to the copying and disclosure of recorded personal information pursuant to a request under subsection A of this section, an insurance institution, agent, or insurance-support organization may make arrangements with an insurance-support organization or a consumer reporting agency to copy and disclose recorded personal information on its behalf.

F. The rights granted to individuals in this section shall extend to all natural persons to the extent information about them is collected and maintained by an insurance institution, agent or insurance-support organization in connection with an insurance transaction. The rights granted to all natural persons by this subsection shall not extend to information about them that relates to and is collected in connection with or in reasonable anticipation of a claim or civil or criminal proceeding involving them.

G. For purposes of this section, the term "insurance-support organization" does not include "consumer reporting agency."