32.1-127.1:03 - Health records privacy
§ 32.1-127.1:03. Health records privacy.
A. There is hereby recognized an individual's right of privacy in the contentof his health records. Health records are the property of the health careentity maintaining them, and, except when permitted or required by thissection or by other provisions of state law, no health care entity, or otherperson working in a health care setting, may disclose an individual's healthrecords.
Pursuant to this subsection:
1. Health care entities shall disclose health records to the individual whois the subject of the health record, except as provided in subsections E andF of this section and subsection B of § 8.01-413.
2. Health records shall not be removed from the premises where they aremaintained without the approval of the health care entity that maintains suchhealth records, except in accordance with a court order or subpoenaconsistent with subsection C of § 8.01-413 or with this section or inaccordance with the regulations relating to change of ownership of healthrecords promulgated by a health regulatory board established in Title 54.1.
3. No person to whom health records are disclosed shall redisclose orotherwise reveal the health records of an individual, beyond the purpose forwhich such disclosure was made, without first obtaining the individual'sspecific authorization to such redisclosure. This redisclosure prohibitionshall not, however, prevent (i) any health care entity that receives healthrecords from another health care entity from making subsequent disclosures aspermitted under this section and the federal Department of Health and HumanServices regulations relating to privacy of the electronic transmission ofdata and protected health information promulgated by the United StatesDepartment of Health and Human Services as required by the Health InsurancePortability and Accountability Act (HIPAA) (42 U.S.C. § 1320d et seq.) or(ii) any health care entity from furnishing health records and aggregate orother data, from which individually identifying prescription information hasbeen removed, encoded or encrypted, to qualified researchers, including, butnot limited to, pharmaceutical manufacturers and their agents or contractors,for purposes of clinical, pharmaco-epidemiological, pharmaco-economic, orother health services research.
B. As used in this section:
"Agent" means a person who has been appointed as an individual's agentunder a power of attorney for health care or an advance directive under theHealth Care Decisions Act (§ 54.1-2981 et seq.).
"Certification" means a written representation that is delivered by hand,by first-class mail, by overnight delivery service, or by facsimile if thesender obtains a facsimile-machine-generated confirmation reflecting that allfacsimile pages were successfully transmitted.
"Guardian" means a court-appointed guardian of the person.
"Health care clearinghouse" means, consistent with the definition set outin 45 C.F.R. § 160.103, a public or private entity, such as a billingservice, repricing company, community health management information system orcommunity health information system, and "value-added" networks andswitches, that performs either of the following functions: (i) processes orfacilitates the processing of health information received from another entityin a nonstandard format or containing nonstandard data content into standarddata elements or a standard transaction; or (ii) receives a standardtransaction from another entity and processes or facilitates the processingof health information into nonstandard format or nonstandard data content forthe receiving entity.
"Health care entity" means any health care provider, health plan or healthcare clearinghouse.
"Health care provider" means those entities listed in the definition of"health care provider" in § 8.01-581.1, except that state-operatedfacilities shall also be considered health care providers for the purposes ofthis section. Health care provider shall also include all persons who arelicensed, certified, registered or permitted or who hold a multistatelicensure privilege issued by any of the health regulatory boards within theDepartment of Health Professions, except persons regulated by the Board ofFuneral Directors and Embalmers or the Board of Veterinary Medicine.
"Health plan" means an individual or group plan that provides, or pays thecost of, medical care. "Health plan" shall include any entity included insuch definition as set out in 45 C.F.R. § 160.103.
"Health record" means any written, printed or electronically recordedmaterial maintained by a health care entity in the course of providing healthservices to an individual concerning the individual and the servicesprovided. "Health record" also includes the substance of any communicationmade by an individual to a health care entity in confidence during or inconnection with the provision of health services or information otherwiseacquired by the health care entity about an individual in confidence and inconnection with the provision of health services to the individual.
"Health services" means, but shall not be limited to, examination,diagnosis, evaluation, treatment, pharmaceuticals, aftercare, habilitation orrehabilitation and mental health therapy of any kind, as well as payment orreimbursement for any such services.
"Individual" means a patient who is receiving or has received healthservices from a health care entity.
"Individually identifying prescription information" means allprescriptions, drug orders or any other prescription information thatspecifically identifies an individual.
"Parent" means a biological, adoptive or foster parent.
"Psychotherapy notes" means comments, recorded in any medium by a healthcare provider who is a mental health professional, documenting or analyzingthe contents of conversation during a private counseling session with anindividual or a group, joint, or family counseling session that are separatedfrom the rest of the individual's health record. "Psychotherapy notes"shall not include annotations relating to medication and prescriptionmonitoring, counseling session start and stop times, treatment modalities andfrequencies, clinical test results, or any summary of any symptoms,diagnosis, prognosis, functional status, treatment plan, or the individual'sprogress to date.
C. The provisions of this section shall not apply to any of the following:
1. The status of and release of information governed by §§ 65.2-604 and65.2-607 of the Virginia Workers' Compensation Act;
2. Except where specifically provided herein, the health records of minors; or
3. The release of juvenile health records to a secure facility or a sheltercare facility pursuant to § 16.1-248.3.
D. Health care entities may, and, when required by other provisions of statelaw, shall, disclose health records:
1. As set forth in subsection E, pursuant to the written authorization of (i)the individual or (ii) in the case of a minor, (a) his custodial parent,guardian or other person authorized to consent to treatment of minorspursuant to § 54.1-2969 or (b) the minor himself, if he has consented to hisown treatment pursuant to § 54.1-2969, or (iii) in emergency cases orsituations where it is impractical to obtain an individual's writtenauthorization, pursuant to the individual's oral authorization for a healthcare provider or health plan to discuss the individual's health records witha third party specified by the individual;
2. In compliance with a subpoena issued in accord with subsection H, pursuantto a search warrant or a grand jury subpoena, pursuant to court order upongood cause shown or in compliance with a subpoena issued pursuant tosubsection C of § 8.01-413. Regardless of the manner by which health recordsrelating to an individual are compelled to be disclosed pursuant to thissubdivision, nothing in this subdivision shall be construed to prohibit anystaff or employee of a health care entity from providing information aboutsuch individual to a law-enforcement officer in connection with suchsubpoena, search warrant, or court order;
3. In accord with subsection F of § 8.01-399 including, but not limited to,situations where disclosure is reasonably necessary to establish or collect afee or to defend a health care entity or the health care entity's employeesor staff against any accusation of wrongful conduct; also as required in thecourse of an investigation, audit, review or proceedings regarding a healthcare entity's conduct by a duly authorized law-enforcement, licensure,accreditation, or professional review entity;
4. In testimony in accordance with §§ 8.01-399 and 8.01-400.2;
5. In compliance with the provisions of § 8.01-413;
6. As required or authorized by law relating to public health activities,health oversight activities, serious threats to health or safety, or abuse,neglect or domestic violence, relating to contagious disease, public safety,and suspected child or adult abuse reporting requirements, including, but notlimited to, those contained in §§ 32.1-36, 32.1-36.1, 32.1-40, 32.1-41,32.1-127.1:04, 32.1-276.5, 32.1-283, 32.1-283.1, 37.2-710, 37.2-839,53.1-40.10, 54.1-2400.6, 54.1-2400.7, 54.1-2403.3, 54.1-2506, 54.1-2966,54.1-2966.1, 54.1-2967, 54.1-2968, 54.1-3408.2, 63.2-1509, and 63.2-1606;
7. Where necessary in connection with the care of the individual;
8. In connection with the health care entity's own health care operations orthe health care operations of another health care entity, as specified in 45C.F.R. § 164.501, or in the normal course of business in accordance withaccepted standards of practice within the health services setting; however,the maintenance, storage, and disclosure of the mass of prescriptiondispensing records maintained in a pharmacy registered or permitted inVirginia shall only be accomplished in compliance with §§ 54.1-3410,54.1-3411, and 54.1-3412;
9. When the individual has waived his right to the privacy of the healthrecords;
10. When examination and evaluation of an individual are undertaken pursuantto judicial or administrative law order, but only to the extent as requiredby such order;
11. To the guardian ad litem and any attorney representing the respondent inthe course of a guardianship proceeding of an adult patient who is therespondent in a proceeding under Chapter 10 (§ 37.2-1000 et seq.) of Title37.2;
12. To the guardian ad litem and any attorney appointed by the court torepresent an individual who is or has been a patient who is the subject of acommitment proceeding under § 19.2-169.6, Article 5 (§ 37.2-814 et seq.) ofChapter 8 of Title 37.2, Article 16 (§ 16.1-335 et seq.) of Chapter 11 ofTitle 16.1, or a judicial authorization for treatment proceeding pursuant toChapter 11 (§ 37.2-1100 et seq.) of Title 37.2;
13. To a magistrate, the court, the evaluator or examiner required underArticle 16 (§ 16.1-335 et seq.) of Chapter 11 of Title 16.1 or § 37.2-815, acommunity services board or behavioral health authority or a designee of acommunity services board or behavioral health authority, or a law-enforcementofficer participating in any proceeding under Article 16 (§ 16.1-335 et seq.)of Chapter 11 of Title 16.1, § 19.2-169.6, or Chapter 8 (§ 37.2-800 et seq.)of Title 37.2 regarding the subject of the proceeding, and to any health careprovider evaluating or providing services to the person who is the subject ofthe proceeding or monitoring the person's adherence to a treatment planordered under those provisions. Health records disclosed to a law-enforcementofficer shall be limited to information necessary to protect the officer, theperson, or the public from physical injury or to address the health careneeds of the person. Information disclosed to a law-enforcement officer shallnot be used for any other purpose, disclosed to others, or retained;
14. To the attorney and/or guardian ad litem of a minor who represents suchminor in any judicial or administrative proceeding, if the court oradministrative hearing officer has entered an order granting the attorney orguardian ad litem this right and such attorney or guardian ad litem presentsevidence to the health care entity of such order;
15. With regard to the Court-Appointed Special Advocate (CASA) program, aminor's health records in accord with § 9.1-156;
16. To an agent appointed under an individual's power of attorney or to anagent or decision maker designated in an individual's advance directive forhealth care or for decisions on anatomical gifts and organ, tissue or eyedonation or to any other person consistent with the provisions of the HealthCare Decisions Act (§ 54.1-2981 et seq.);
17. To third-party payors and their agents for purposes of reimbursement;
18. As is necessary to support an application for receipt of health carebenefits from a governmental agency or as required by an authorizedgovernmental agency reviewing such application or reviewing benefits alreadyprovided or as necessary to the coordination of prevention and control ofdisease, injury, or disability and delivery of such health care benefitspursuant to § 32.1-127.1:04;
19. Upon the sale of a medical practice as provided in § 54.1-2405; or upon achange of ownership or closing of a pharmacy pursuant to regulations of theBoard of Pharmacy;
20. In accord with subsection B of § 54.1-2400.1, to communicate anindividual's specific and immediate threat to cause serious bodily injury ordeath of an identified or readily identifiable person;
21. Where necessary in connection with the implementation of a hospital'sroutine contact process for organ donation pursuant to subdivision B 4 of §32.1-127;
22. In the case of substance abuse records, when permitted by and inconformity with requirements of federal law found in 42 U.S.C. § 290dd-2 and42 C.F.R. Part 2;
23. In connection with the work of any entity established as set forth in §8.01-581.16 to evaluate the adequacy or quality of professional services orthe competency and qualifications for professional staff privileges;
24. If the health records are those of a deceased or mentally incapacitatedindividual to the personal representative or executor of the deceasedindividual or the legal guardian or committee of the incompetent orincapacitated individual or if there is no personal representative, executor,legal guardian or committee appointed, to the following persons in thefollowing order of priority: a spouse, an adult son or daughter, eitherparent, an adult brother or sister, or any other relative of the deceasedindividual in order of blood relationship;
25. For the purpose of conducting record reviews of inpatient hospital deathsto promote identification of all potential organ, eye, and tissue donors inconformance with the requirements of applicable federal law and regulations,including 42 C.F.R. § 482.45, (i) to the health care provider's designatedorgan procurement organization certified by the United States Health CareFinancing Administration and (ii) to any eye bank or tissue bank in Virginiacertified by the Eye Bank Association of America or the American Associationof Tissue Banks;
26. To the Office of the Inspector General for Behavioral Health andDevelopmental Services pursuant to Article 3 (§ 37.2-423 et seq.) of Chapter4 of Title 37.2;
27. To an entity participating in the activities of a local healthpartnership authority established pursuant to Article 6.1 (§ 32.1-122.10:001et seq.) of Chapter 4, pursuant to subdivision 1;
28. To law-enforcement officials by each licensed emergency medical servicesagency, (i) when the individual is the victim of a crime or (ii) when theindividual has been arrested and has received emergency medical services orhas refused emergency medical services and the health records consist of theprehospital patient care report required by § 32.1-116.1;
29. To law-enforcement officials, in response to their request, for thepurpose of identifying or locating a suspect, fugitive, person required toregister pursuant to § 9.1-901 of the Sex Offender and Crimes Against MinorsRegistry Act, material witness, or missing person, provided that only thefollowing information may be disclosed: (i) name and address of the person,(ii) date and place of birth of the person, (iii) social security number ofthe person, (iv) blood type of the person, (v) date and time of treatmentreceived by the person, (vi) date and time of death of the person, whereapplicable, (vii) description of distinguishing physical characteristics ofthe person, and (viii) type of injury sustained by the person;
30. To law-enforcement officials regarding the death of an individual for thepurpose of alerting law enforcement of the death if the health care entityhas a suspicion that such death may have resulted from criminal conduct;
31. To law-enforcement officials if the health care entity believes in goodfaith that the information disclosed constitutes evidence of a crime thatoccurred on its premises;
32. To the State Health Commissioner pursuant to § 32.1-48.015 when suchrecords are those of a person or persons who are subject to an order ofquarantine or an order of isolation pursuant to Article 3.02 (§ 32.1-48.05 etseq.) of Chapter 2;
33. To the Commissioner of the Department of Labor and Industry or hisdesignee by each licensed emergency medical services agency when the recordsconsist of the prehospital patient care report required by § 32.1-116.1 andthe patient has suffered an injury or death on a work site while performingduties or tasks that are within the scope of his employment;
34. To notify a family member or personal representative of an individual whois the subject of a proceeding pursuant to Article 16 (§ 16.1-335 et seq.) ofChapter 11 of Title 16.1 or Chapter 8 (§ 37.2-800 et seq.) of Title 37.2 ofinformation that is directly relevant to such person's involvement with theindividual's health care, which may include the individual's location andgeneral condition, when the individual has the capacity to make health caredecisions and (i) the individual has agreed to the notification, (ii) theindividual has been provided an opportunity to object to the notification anddoes not express an objection, or (iii) the health care provider can, on thebasis of his professional judgment, reasonably infer from the circumstancesthat the individual does not object to the notification. If the opportunityto agree or object to the notification cannot practicably be provided becauseof the individual's incapacity or an emergency circumstance, the health careprovider may notify a family member or personal representative of theindividual of information that is directly relevant to such person'sinvolvement with the individual's health care, which may include theindividual's location and general condition if the health care provider, inthe exercise of his professional judgment, determines that the notificationis in the best interests of the individual. Such notification shall not bemade if the provider has actual knowledge the family member or personalrepresentative is currently prohibited by court order from contacting theindividual; and
35. To a threat assessment team established by a public institution of highereducation pursuant to § 23-9.2:10 when such records concern a student at thepublic institution of higher education, including a student who is a minor.
Notwithstanding the provisions of subdivisions 1 through 35, a health careentity shall obtain an individual's written authorization for any disclosureof psychotherapy notes, except when disclosure by the health care entity is(i) for its own training programs in which students, trainees, orpractitioners in mental health are being taught under supervision to practiceor to improve their skills in group, joint, family, or individual counseling;(ii) to defend itself or its employees or staff against any accusation ofwrongful conduct; (iii) in the discharge of the duty, in accordance withsubsection B of § 54.1-2400.1, to take precautions to protect third partiesfrom violent behavior or other serious harm; (iv) required in the course ofan investigation, audit, review, or proceeding regarding a health careentity's conduct by a duly authorized law-enforcement, licensure,accreditation, or professional review entity; or (v) otherwise required bylaw.
E. Requests for copies of health records shall (i) be in writing, dated andsigned by the requester; (ii) identify the nature of the informationrequested; and (iii) include evidence of the authority of the requester toreceive such copies and identification of the person to whom the informationis to be disclosed. The health care entity shall accept a photocopy,facsimile, or other copy of the original signed by the requestor as if itwere an original. Within 15 days of receipt of a request for copies of healthrecords, the health care entity shall do one of the following: (i) furnishsuch copies to any requester authorized to receive them; (ii) inform therequester if the information does not exist or cannot be found; (iii) if thehealth care entity does not maintain a record of the information, so informthe requester and provide the name and address, if known, of the health careentity who maintains the record; or (iv) deny the request (a) undersubsection F, (b) on the grounds that the requester has not established hisauthority to receive such health records or proof of his identity, or (c) asotherwise provided by law. Procedures set forth in this section shall applyonly to requests for health records not specifically governed by otherprovisions of state law.
F. Except as provided in subsection B of § 8.01-413, copies of anindividual's health records shall not be furnished to such individual oranyone authorized to act on the individual's behalf when the individual'streating physician or the individual's treating clinical psychologist hasmade a part of the individual's record a written statement that, in theexercise of his professional judgment, the furnishing to or review by theindividual of such health records would be reasonably likely to endanger thelife or physical safety of the individual or another person, or that suchhealth record makes reference to a person other than a health care providerand the access requested would be reasonably likely to cause substantial harmto such referenced person. If any health care entity denies a request forcopies of health records based on such statement, the health care entityshall inform the individual of the individual's right to designate, inwriting, at his own expense, another reviewing physician or clinicalpsychologist, whose licensure, training and experience relative to theindividual's condition are at least equivalent to that of the physician orclinical psychologist upon whose opinion the denial is based. The designatedreviewing physician or clinical psychologist shall make a judgment as towhether to make the health record available to the individual.
The health care entity denying the request shall also inform the individualof the individual's right to request in writing that such health care entitydesignate, at its own expense, a physician or clinical psychologist, whoselicensure, training, and experience relative to the individual's conditionare at least equivalent to that of the physician or clinical psychologistupon whose professional judgment the denial is based and who did notparticipate in the original decision to deny the health records, who shallmake a judgment as to whether to make the health record available to theindividual. The health care entity shall comply with the judgment of thereviewing physician or clinical psychologist. The health care entity shallpermit copying and examination of the health record by such other physicianor clinical psychologist designated by either the individual at his ownexpense or by the health care entity at its expense.
Any health record copied for review by any such designated physician orclinical psychologist shall be accompanied by a statement from the custodianof the health record that the individual's treating physician or clinicalpsychologist determined that the individual's review of his health recordwould be reasonably likely to endanger the life or physical safety of theindividual or would be reasonably likely to cause substantial harm to aperson referenced in the health record who is not a health care provider.
Further, nothing herein shall be construed as giving, or interpreted tobestow the right to receive copies of, or otherwise obtain access to,psychotherapy notes to any individual or any person authorized to act on hisbehalf.
G. A written authorization to allow release of an individual's health recordsshall substantially include the following information:
AUTHORIZATION TO RELEASE CONFIDENTIAL HEALTH RECORDS
Individual's Name ............
Health Care Entity's Name ............
Person, Agency, or Health Care Entity to whom disclosure is to
be made ............
Information or Health Records to be disclosed ............
Purpose of Disclosure or at the Request of the Individual ............
As the person signing this authorization, I understand that I am giving my
permission to the above-named health care entity for disclosure of
confidential health records. I understand that the health care entity may not
condition treatment or payment on my willingness to sign this authorization
unless the specific circumstances under which such conditioning is permitted
by law are applicable and are set forth in this authorization. I also
understand that I have the right to revoke this authorization at any time, but
that my revocation is not effective until delivered in writing to the person
who is in possession of my health records and is not effective as to health
records already disclosed under this authorization. A copy of this
authorization and a notation concerning the persons or agencies to whom
disclosure was made shall be included with my original health records. I
understand that health information disclosed under this authorization might be
redisclosed by a recipient and may, as a result of such disclosure, no longer
be protected to the same extent as such health information was protected by
law while solely in the possession of the health care entity.
This authorization expires on (date) or (event) ............
Signature of Individual or Individual's Legal Representative if Individual is
Unable to Sign ............
Relationship or Authority of Legal Representative ............
Date of Signature ............
H. Pursuant to this subsection:
1. Unless excepted from these provisions in subdivision 9, no party to acivil, criminal or administrative action or proceeding shall request theissuance of a subpoena duces tecum for another party's health records orcause a subpoena duces tecum to be issued by an attorney unless a copy of therequest for the subpoena or a copy of the attorney-issued subpoena isprovided to the other party's counsel or to the other party if pro se,simultaneously with filing the request or issuance of the subpoena. No partyto an action or proceeding shall request or cause the issuance of a subpoenaduces tecum for the health records of a nonparty witness unless a copy of therequest for the subpoena or a copy of the attorney-issued subpoena isprovided to the nonparty witness simultaneously with filing the request orissuance of the attorney-issued subpoena.
No subpoena duces tecum for health records shall set a return date earlierthan 15 days from the date of the subpoena except by order of a court oradministrative agency for good cause shown. When a court or administrativeagency directs that health records be disclosed pursuant to a subpoena ducestecum earlier than 15 days from the date of the subpoena, a copy of the ordershall accompany the subpoena.
Any party requesting a subpoena duces tecum for health records or on whosebehalf the subpoena duces tecum is being issued shall have the duty todetermine whether the individual whose health records are being sought is prose or a nonparty.
In instances where health records being subpoenaed are those of a pro separty or nonparty witness, the party requesting or issuing the subpoena shalldeliver to the pro se party or nonparty witness together with the copy of therequest for subpoena, or a copy of the subpoena in the case of anattorney-issued subpoena, a statement informing them of their rights andremedies. The statement shall include the following language and the headingshall be in boldface capital letters:
NOTICE TO INDIVIDUAL
The attached document means that (insert name of party requesting or causingissuance of the subpoena) has either asked the court or administrative agencyto issue a subpoena or a subpoena has been issued by the other party'sattorney to your doctor, other health care providers (names of health careproviders inserted here) or other health care entity (name of health careentity to be inserted here) requiring them to produce your health records.Your doctor, other health care provider or other health care entity isrequired to respond by providing a copy of your health records. If youbelieve your health records should not be disclosed and object to theirdisclosure, you have the right to file a motion with the clerk of the courtor the administrative agency to quash the subpoena. If you elect to file amotion to quash, such motion must be filed within 15 days of the date of therequest or of the attorney-issued subpoena. You may contact the clerk'soffice or the administrative agency to determine the requirements that mustbe satisfied when filing a motion to quash and you may elect to contact anattorney to represent your interest. If you elect to file a motion to quash,you must notify your doctor, other health care provider(s), or other healthcare entity, that you are filing the motion so that the health care provideror health care entity knows to send the health records to the clerk of courtor administrative agency in a sealed envelope or package for safekeepingwhile your motion is decided.
2. Any party filing a request for a subpoena duces tecum or causing such asubpoena to be issued for an individual's health records shall include aNotice in the same part of the request in which the recipient of the subpoenaduces tecum is directed where and when to return the health records. Suchnotice shall be in boldface capital letters and shall include the followinglanguage:
NOTICE TO HEALTH CARE ENTITIES
A COPY OF THIS SUBPOENA DUCES TECUM HAS BEEN PROVIDED TO THE INDIVIDUAL WHOSEHEALTH RECORDS ARE BEING REQUESTED OR HIS COUNSEL. YOU OR THAT INDIVIDUAL HASTHE RIGHT TO FILE A MOTION TO QUASH (OBJECT TO) THE ATTACHED SUBPOENA. IF YOUELECT TO FILE A MOTION TO QUASH, YOU MUST FILE THE MOTION WITHIN 15 DAYS OFTHE DATE OF THIS SUBPOENA.
YOU MUST NOT RESPOND TO THIS SUBPOENA UNTIL YOU HAVE RECEIVED WRITTENCERTIFICATION FROM THE PARTY ON WHOSE BEHALF THE SUBPOENA WAS ISSUED THAT THETIME FOR FILING A MOTION TO QUASH HAS ELAPSED AND THAT:
NO MOTION TO QUASH WAS FILED; OR
ANY MOTION TO QUASH HAS BEEN RESOLVED BY THE COURT OR THE ADMINISTRATIVEAGENCY AND THE DISCLOSURES SOUGHT ARE CONSISTENT WITH SUCH RESOLUTION.
IF YOU RECEIVE NOTICE THAT THE INDIVIDUAL WHOSE HEALTH RECORDS ARE BEINGREQUESTED HAS FILED A MOTION TO QUASH THIS SUBPOENA, OR IF YOU FILE A MOTIONTO QUASH THIS SUBPOENA, YOU MUST SEND THE HEALTH RECORDS ONLY TO THE CLERK OFTHE COURT OR ADMINISTRATIVE AGENCY THAT ISSUED THE SUBPOENA OR IN WHICH THEACTION IS PENDING AS SHOWN ON THE SUBPOENA USING THE FOLLOWING PROCEDURE:
PLACE THE HEALTH RECORDS IN A SEALED ENVELOPE AND ATTACH TO THE SEALEDENVELOPE A COVER LETTER TO THE CLERK OF COURT OR ADMINISTRATIVE AGENCY WHICHSTATES THAT CONFIDENTIAL HEALTH RECORDS ARE ENCLOSED AND ARE TO BE HELD UNDERSEAL PENDING A RULING ON THE MOTION TO QUASH THE SUBPOENA. THE SEALEDENVELOPE AND THE COVER LETTER SHALL BE PLACED IN AN OUTER ENVELOPE OR PACKAGEFOR TRANSMITTAL TO THE COURT OR ADMINISTRATIVE AGENCY.
3. Upon receiving a valid subpoena duces tecum for health records, healthcare entities shall have the duty to respond to the subpoena in accordancewith the provisions of subdivisions 4, 5, 6, 7, and 8.
4. Except to deliver to a clerk of the court or administrative agencysubpoenaed health records in a sealed envelope as set forth, health careentities shall not respond to a subpoena duces tecum for such health recordsuntil they have received a certification as set forth in subdivision 5 or 8from the party on whose behalf the subpoena duces tecum was issued.
If the health care entity has actual receipt of notice that a motion to quashthe subpoena has been filed or if the health care entity files a motion toquash the subpoena for health records, then the health care entity shallproduce the health records, in a securely sealed envelope, to the clerk ofthe court or administrative agency issuing the subpoena or in whose court oradministrative agency the action is pending. The court or administrativeagency shall place the health records under seal until a determination ismade regarding the motion to quash. The securely sealed envelope shall onlybe opened on order of the judge or administrative agency. In the event thecourt or administrative agency grants the motion to quash, the health recordsshall be returned to the health care entity in the same sealed envelope inwhich they were delivered to the court or administrative agency. In the eventthat a judge or administrative agency orders the sealed envelope to be openedto review the health records in camera, a copy of the order shall accompanyany health records returned to the health care entity. The health recordsreturned to the health care entity shall be in a securely sealed envelope.
5. If no motion to quash is filed within 15 days of the date of the requestor of the attorney-issued subpoena, the party on whose behalf the subpoenawas issued shall have the duty to certify to the subpoenaed health careentity that the time for filing a motion to quash has elapsed and that nomotion to quash was filed. Any health care entity receiving suchcertification shall have the duty to comply with the subpoena duces tecum byreturning the specified health records by either the return date on thesubpoena or five days after receipt of the certification, whichever is later.
6. In the event that the individual whose health records are being soughtfiles a motion to quash the subpoena, the court or administrative agencyshall decide whether good cause has been shown by the discovering party tocompel disclosure of the individual's health records over the individual'sobjections. In determining whether good cause has been shown, the court oradministrative agency shall consider (i) the particular purpose for which theinformation was collected; (ii) the degree to which the disclosure of therecords would embarrass, injure, or invade the privacy of the individual;(iii) the effect of the disclosure on the individual's future health care;(iv) the importance of the information to the lawsuit or proceeding; and (v)any other relevant factor.
7. Concurrent with the court or administrative agency's resolution of amotion to quash, if subpoenaed health records have been submitted by a healthcare entity to the court or administrative agency in a sealed envelope, thecourt or administrative agency shall: (i) upon determining that no submittedhealth records should be disclosed, return all submitted health records tothe health care entity in a sealed envelope; (ii) upon determining that allsubmitted health records should be disclosed, provide all the submittedhealth records to the party on whose behalf the subpoena was issued; or (iii)upon determining that only a portion of the submitted health records shouldbe disclosed, provide such portion to the party on whose behalf the subpoenawas issued and return the remaining health records to the health care entityin a sealed envelope.
8. Following the court or administrative agency's resolution of a motion toquash, the party on whose behalf the subpoena duces tecum was issued shallhave the duty to certify in writing to the subpoenaed health care entity astatement of one of the following:
a. All filed motions to quash have been resolved by the court oradministrative agency and the disclosures sought in the subpoena duces tecumare consistent with such resolution; and, therefore, the health recordspreviously delivered in a sealed envelope to the clerk of the court oradministrative agency will not be returned to the health care entity;
b. All filed motions to quash have been resolved by the court oradministrative agency and the disclosures sought in the subpoena duces tecumare consistent with such resolution and that, since no health records havepreviously been delivered to the court or administrative agency by the healthcare entity, the health care entity shall comply with the subpoena ducestecum by returning the health records designated in the subpoena by thereturn date on the subpoena or five days after receipt of certification,whichever is later;
c. All filed motions to quash have been resolved by the court oradministrative agency and the disclosures sought in the subpoena duces tecumare not consistent with such resolution; therefore, no health records shallbe disclosed and all health records previously delivered in a sealed envelopeto the clerk of the court or administrative agency will be returned to thehealth care entity;
d. All filed motions to quash have been resolved by the court oradministrative agency and the disclosures sought in the subpoena duces tecumare not consistent with such resolution and that only limited disclosure hasbeen authorized. The certification shall state that only the portion of thehealth records as set forth in the certification, consistent with the courtor administrative agency's ruling, shall be disclosed. The certificationshall also state that health records that were previously delivered to thecourt or administrative agency for which disclosure has been authorized willnot be returned to the health care entity; however, all health records forwhich disclosure has not been authorized will be returned to the health careentity; or
e. All filed motions to quash have been resolved by the court oradministrative agency and the disclosures sought in the subpoena duces tecumare not consistent with such resolution and, since no health records havepreviously been delivered to the court or administrative agency by the healthcare entity, the health care entity shall return only those health recordsspecified in the certification, consistent with the court or administrativeagency's ruling, by the return date on the subpoena or five days afterreceipt of the certification, whichever is later.
A copy of the court or administrative agency's ruling shall accompany anycertification made pursuant to this subdivision.
9. The provisions of this subsection have no application to subpoenas forhealth records requested under § 8.01-413, or issued by a duly authorizedadministrative agency conducting an investigation, audit, review orproceedings regarding a health care entity's conduct.
The provisions of this subsection shall apply to subpoenas for the healthrecords of both minors and adults.
Nothing in this subsection shall have any effect on the existing authority ofa court or administrative agency to issue a protective order regarding healthrecords, including, but not limited to, ordering the return of health recordsto a health care entity, after the period for filing a motion to quash haspassed.
A subpoena for substance abuse records must conform to the requirements offederal law found in 42 C.F.R. Part 2, Subpart E.
I. Health care entities may testify about the health records of an individualin compliance with §§ 8.01-399 and 8.01-400.2.
J. If an individual requests a copy of his health record from a health careentity, the health care entity may impose a reasonable cost-based fee, whichshall include only the cost of supplies for and labor of copying therequested information, postage when the individual requests that suchinformation be mailed, and preparation of an explanation or summary of suchinformation as agreed to by the individual. For the purposes of this section,"individual" shall subsume a person with authority to act on behalf of theindividual who is the subject of the health record in making decisionsrelated to his health care.
(1997, c. 682; 1998, c. 470; 1999, cc. 812, 956, 1010; 2000, cc. 810, 813,923, 927; 2001, c. 671; 2002, cc. 568, 658, 835, 860; 2003, cc. 471, 907,983; 2004, cc. 49, 64, 65, 66, 67, 163, 773, 1014, 1021; 2005, cc. 39, 101,642, 697; 2006, c. 433; 2007, c. 497; 2008, cc. 315, 782, 850, 870; 2009, cc.606, 651, 813, 840; 2010, cc. 185, 340, 406, 456, 524, 778, 825.)