Handles health records, in Virginia

Va. Code Ann. § 32.1-127.1:03 · Read the law's page

• If you are a health care entity (a health care provider, health plan or health care clearinghouse), or another person working in a health care setting, do not disclose an individual's health records except as section 32.1-127.1:03 or other provisions of state law permit or require.
• Disclose health records, including an audit trail of additions, deletions and revisions where specifically requested, to the individual who is the subject of the record, and on the individual's request to other health care entities in any available format the requester chooses. Within 30 days of receiving a written, dated and signed request, furnish the records or electronic access, state that the information does not exist or cannot be found, name the entity that maintains it if known, or deny the request on a ground the section lists (section 32.1-127.1:03(A) and (E)).
• Do not redisclose or otherwise reveal health records you received, beyond the purpose for which they were disclosed, without first obtaining the individual's specific authorization, except for the subsequent disclosures another health care entity may make under the section and the federal HIPAA regulations and the research disclosures the section allows (section 32.1-127.1:03(A)(3)).
• Make a written authorization to release health records substantially include the information the section's model form lists, and honor an authorization until it is revoked in writing, expires under its own terms, or an expiration event it describes occurs (section 32.1-127.1:03(G) and (L)).
• Charge an individual who requests a copy of the individual's health record only a reasonable cost-based fee limited to the cost of supplies for and labor of copying, postage when mailing is requested, and preparation of an agreed explanation or summary (section 32.1-127.1:03(J)).