- Code of Virginia
- Virginia Administrative Code
- Constitution of Virginia
- Uncodified Acts
- RIS Users (account required)
- Bills & Resolutions
- Bill Summaries
- Reports to the General Assembly
House and Senate documents
Developed and maintained by the Division of Legislative Automated Systems.
Be it enacted by the General Assembly of Virginia:
1. That the Code of Virginia is amended by adding a section numbered 32.1-276.4:1 as follows:
§ 32.1-276.4:1. Limitations on the use, storage, sharing, and processing of medical data; participation in Nationwide Health Information Network; health information exchange prohibited; medical record confidentiality.
As used in this section:
"Facility" means any database operated or maintained by an operator at which medical data is regularly stored in an electronic or digital format.
"Health information exchange" means a statewide infrastructure that provides organizational and technical capabilities to enable the electronic exchange of health information between health care providers and other persons.
"Medical data" means information that identifies a patient and provides medical history information about that patient, including any of the patient level data elements described in subsections B and C of § 32.1-276.6.
"Nationwide Health Information Network" means the initiative for the exchange of health care information developed under the auspices of the U.S. Office of the National Coordinator for Health Information Technology.
"Operator" means any person that regularly stores medical data in an electronic or digital format, including (i) the nonprofit corporation designated to operate the All-Payer Claims Database and (ii) any agency of the Commonwealth or political subdivision of the Commonwealth.
"Patient" means any individual who has received health care from a health care provider.
"Population health management" means the utilization of a variety of individual, organizational, and cultural interventions to help improve the morbidity patterns and the health care use behavior of defined populations.
B. An operator shall not participate in the establishment or implementation of, or use any facility owned or operated by it to establish or implement, the Nationwide Health Information Network.
C. A facility shall not store or maintain in a manner that is accessible by the operator or any other person, in an electronic or digital format, at any one time, medical data regarding more than 10,000 patients.
D. An operator shall not:
1. Perform any analytic or statistical processing with regard to medical records from multiple patients for purposes of medical diagnosis or treatment, including population health management; or
2. Permit any other person to access medical data at any facility of an operator for the purpose of performing any analytic or statistical processing with regard to any medical records from multiple patients for purposes of medical diagnosis or treatment, including population health management.
E. An operator shall not process medical data at a facility within the Commonwealth in any instance where a majority of the patients whose medical data is being processed do not reside in the Commonwealth.
F. Any health care provider in the Commonwealth shall not be subject to any penalty, sanction, or other adverse action resulting from the health care provider's failure or refusal to implement an online computerized medical record system.
G. Any form of consent or agreement executed by a patient that purports evidence of the patient's consent to the sharing of his health care information by his health care provider shall be presumed not to grant consent to the electronic or digital storing or transmission of such health care information to any person other than any person providing health care coverage for all or a portion of the costs incurred by the patient in connection with the delivery of health care services by the health care provider. This presumption may be overcome only if the consent form or agreement includes a clear and conspicuous statement authorizing the health care provider to electronically or digitally store and transmit the patient's health care information to a person or persons, or categories or classes of persons, identified in the form or agreement.
H. The Commonwealth shall not authorize the establishment or operation within the Commonwealth of a health information exchange.