32.1-127.1:05 - (Effective January 1, 2011) Breach of medical information notification.
§ 32.1-127.1:05. (Effective January 1, 2011) Breach of medical informationnotification.
A. As used in this section:
"Breach of the security of the system" means unauthorized access andacquisition of unencrypted and unredacted computerized data that compromisesthe security, confidentiality, or integrity of medical information maintainedby an entity. Good faith acquisition of medical information by an employee oragent of an entity for the purposes of the entity is not a breach of thesecurity of the system, provided that the medical information is not used fora purpose other than a lawful purpose of the entity or subject to furtherunauthorized disclosure.
"Encrypted" means the transformation of data through the use of analgorithmic process into a form in which there is a low probability ofassigning meaning without the use of a confidential process or key, or thesecuring of the information by another method that renders the data elementsunreadable or unusable.
"Entity" means any authority, board, bureau, commission, district or agencyof the Commonwealth or of any political subdivision of the Commonwealth,including cities, towns and counties, municipal councils, governing bodies ofcounties, school boards and planning commissions; boards of visitors ofpublic institutions of higher education; and other organizations,corporations, or agencies in the Commonwealth supported wholly or principallyby public funds.
"Medical information" means the first name or first initial and last namein combination with and linked to any one or more of the following dataelements that relate to a resident of the Commonwealth, when the dataelements are neither encrypted nor redacted:
1. Any information regarding an individual's medical or mental healthhistory, mental or physical condition, or medical treatment or diagnosis by ahealth care professional; or
2. An individual's health insurance policy number or subscriberidentification number, any unique identifier used by a health insurer toidentify the individual, or any information in an individual's applicationand claims history, including any appeals records.
The term does not include information that is lawfully obtained from publiclyavailable information, or from federal, state, or local government recordslawfully made available to the general public.
"Notice" means:
1. Written notice to the last known postal address in the records of theentity;
2. Telephone notice;
3. Electronic notice; or
4. Substitute notice, if the entity required to provide notice demonstratesthat the cost of providing notice will exceed $50,000, the affected class ofVirginia residents to be notified exceeds 100,000 residents, or the entitydoes not have sufficient contact information or consent to provide notice asdescribed in subdivisions 1, 2, or 3 of this definition. Substitute noticeconsists of the following:
a. E-mail notice if the entity has e-mail addresses for the members of theaffected class of residents;
b. Conspicuous posting of the notice on the website of the entity if theentity maintains a website; and
c. Notice to major statewide media.
Notice required by this section shall include a description of the following:
(1) The incident in general terms;
(2) The type of medical information that was subject to the unauthorizedaccess and acquisition;
(3) The general acts of the entity to protect the personal information fromfurther unauthorized access; and
(4) A telephone number that the person may call for further information andassistance, if one exists.
"Redact" means alteration or truncation of data such that no informationregarding an individual's medical history, mental or physical condition, ormedical treatment or diagnosis or no more than four digits of a healthinsurance policy number, subscriber number, or other unique identifier areaccessible as part of the medical information.
B. If unencrypted or unredacted medical information was or is reasonablybelieved to have been accessed and acquired by an unauthorized person, anentity that owns or licenses computerized data that includes medicalinformation shall disclose any breach of the security of the system followingdiscovery or notification of the breach of the security of the system to theOffice of the Attorney General, the Commissioner of Health, the subject ofthe medical information, and any affected resident of the Commonwealthwithout unreasonable delay. Notice required by this section may be reasonablydelayed to allow the entity to determine the scope of the breach of thesecurity of the system and restore the reasonable integrity of the system.Notice required by this section may be delayed if, after the entity notifiesa law-enforcement agency, the law-enforcement agency determines and advisesthe entity that the notice will impede a criminal or civil investigation, orhomeland or national security. Notice shall be made without unreasonabledelay after the law-enforcement agency determines that the notification willno longer impede the investigation or jeopardize national or homelandsecurity.
C. An entity shall disclose the breach of the security of the system ifencrypted information is accessed and acquired in an unencrypted form, or ifthe security breach involves a person with access to the encryption key.
D. An entity that maintains computerized data that includes medicalinformation that the entity does not own or license shall notify the owner orlicensee of the information of any breach of the security of the systemwithout unreasonable delay following discovery of the breach of the securityof the system, if the medical information was accessed and acquired by anunauthorized person or the entity reasonably believes the medical informationwas accessed and acquired by an unauthorized person.
E. In the event an entity provides notice to more than 1,000 persons at onetime, pursuant to this section, the entity shall notify, without unreasonabledelay, the Office of the Attorney General and the Commissioner of Health ofthe timing, distribution, and content of the notice.
F. This section shall not apply to (i) a person or entity who is a "coveredentity" or "business associate" under the Health Insurance Portability andAccountability Act of 1996 (42 USC § 1320d et seq.) and is subject torequirements for notification in the case of a breach of protected healthinformation (42 USC 17932 et seq.) or (ii) a person or entity who is anon-HIPAA-covered entity subject to the Health Breach Notification Rulepromulgated by the Federal Trade Commission pursuant to 42 USC § 17937 et seq.
G. An entity that complies with the notification requirements or procedurespursuant to the rules, regulations, procedures, and guidelines established bythe entity's primary or functional state or federal regulator shall be incompliance with this section.
(2010, c. 852.)