Law / United States / 
Virginia
Health records privacy: disclosure by health care entities
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Data subject rights
As of .
What it requires
- If you are a health care entity (a health care provider, health plan or health care clearinghouse), or another person working in a health care setting, do not disclose an individual's health records except as section 32.1-127.1:03 or other provisions of state law permit or require.
- Disclose health records, including an audit trail of additions, deletions and revisions where specifically requested, to the individual who is the subject of the record, and on the individual's request to other health care entities in any available format the requester chooses. Within 30 days of receiving a written, dated and signed request, furnish the records or electronic access, state that the information does not exist or cannot be found, name the entity that maintains it if known, or deny the request on a ground the section lists (section 32.1-127.1:03(A) and (E)).
- Do not redisclose or otherwise reveal health records you received, beyond the purpose for which they were disclosed, without first obtaining the individual's specific authorization, except for the subsequent disclosures another health care entity may make under the section and the federal Health Insurance Portability and Accountability Act (HIPAA) regulations and the research disclosures the section allows (section 32.1-127.1:03(A)(3)).
- Make a written authorization to release health records substantially include the information the section's model form lists, and honor an authorization until it is revoked in writing, expires under its own terms, or an expiration event it describes occurs (section 32.1-127.1:03(G) and (L)).
- Charge an individual who requests a copy of the individual's health record only a reasonable cost-based fee limited to the cost of supplies for and labor of copying, postage when mailing is requested, and preparation of an agreed explanation or summary (section 32.1-127.1:03(J)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 32.1-27(A) of Title 32.1: a person willfully violating any provision of the title is guilty of a Class 1 misdemeanor unless a different penalty is specified; section 32.1-127.1:03 specifies none.
Who enforces it
Enforcement body
The Board or the Commissioner named in Title 32.1, who may compel a person to comply with a provision of Title 32.1 by injunction, mandamus or other appropriate remedy in an appropriate court (section 32.1-27(B)).
Settledness
- As of
- Open questions
- Does subsection A's bar on disclosure by "other person working in a health care setting" reach a technology vendor that holds health records on behalf of a health care provider?
What this law does
A health care entity is any health care provider, health plan or health care clearinghouse. No health care entity, or other person working in a health care setting, may disclose an individual's health records except when the section or other provisions of state law permit or require it.
Within 30 days of receiving a request for copies of or electronic access to health records, the health care entity must furnish them, say that the information does not exist or cannot be found, name the entity that maintains it, or deny the request on a ground the section lists. A person to whom health records are disclosed may not redisclose them beyond the purpose of the disclosure without first obtaining the individual's specific authorization.
The section does not apply to the health records of minors except where it specifically provides, to information governed by the workers' compensation sections 65.2-604 and 65.2-607, or to releases of juvenile health records to a secure facility or of health records to a correctional facility. An individual who requests a copy of a health record may be charged only a reasonable cost-based fee covering supplies, copying labor, postage and the preparation of an agreed summary.
Section 32.1-27(A) of the Code of Virginia makes a willful violation of any provision of Title 32.1 a Class 1 misdemeanor unless a different penalty is specified. Section 32.1-27(B) of the Code of Virginia lets the Board of Health or the Commissioner compel a person violating any provision of Title 32.1 to comply by injunction, mandamus or other appropriate remedy in an appropriate court. The section took effect on . The section's history note lists Chapter 248 of the 2026 Acts of Assembly as its most recent amending act.
When LexLint raises it
When your app profile says your app handles health records.