{"formats":[{"name":"JSON","format":"json","url":"\/downloads\/2025\/code-json\/32.1-127.1_05.json"},{"name":"Plain Text","format":"text","url":"\/downloads\/2025\/code-text\/32.1-127.1_05.txt"},{"name":"XML","format":"xml","url":"\/downloads\/2025\/code-xml\/32.1-127.1_05.xml"},{"name":"HTML","format":"html","url":"\/downloads\/2025\/code-html\/32.1-127.1_05.html"}],"law_id":78997,"edition_id":1,"section_id":78997,"structure_id":12729,"section_number":"32.1-127.1:05","catch_line":"Breach of medical information notification","history":"2010, c. 852.","full_text":"A\n\nAs used in this section:\n\t\t\t“Breach of the security of the system” means unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security, confidentiality, or integrity of medical information maintained by an entity. Good faith acquisition of medical information by an employee or agent of an entity for the purposes of the entity is not a breach of the security of the system, provided that the medical information is not used for a purpose other than a lawful purpose of the entity or subject to further unauthorized disclosure.\n\t\t\t“Encrypted” means the transformation of data through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without the use of a confidential process or key, or the securing of the information by another method that renders the data elements unreadable or unusable.\n\t\t\t“Entity” means any authority, board, bureau, commission, district or agency of the Commonwealth or of any political subdivision of the Commonwealth, including cities, towns and counties, municipal councils, governing bodies of counties, school boards and planning commissions; boards of visitors of public institutions of higher education; and other organizations, corporations, or agencies in the Commonwealth supported wholly or principally by public funds.\n\t\t\t“Medical information” means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of the Commonwealth, when the data elements are neither encrypted nor redacted:1\n\nAny information regarding an individual’s medical or mental health history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or2\n\nAn individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records.\n\t\t\t\tThe term does not include information that is lawfully obtained from publicly available information, or from federal, state, or local government records lawfully made available to the general public.\n\t\t\t\t“Notice” means:1\n\nWritten notice to the last known postal address in the records of the entity;2\n\nTelephone notice;3\n\nElectronic notice; or4\n\nSubstitute notice, if the entity required to provide notice demonstrates that the cost of providing notice will exceed $50,000, the affected class of Virginia residents to be notified exceeds 100,000 residents, or the entity does not have sufficient contact information or consent to provide notice as described in subdivisions 1, 2, or 3 of this definition. Substitute notice consists of the following:\n\t\t\t\ta. E-mail notice if the entity has e-mail addresses for the members of the affected class of residents;\n\t\t\t\tb. Conspicuous posting of the notice on the website of the entity if the entity maintains a website; and\n\t\t\t\tc. Notice to major statewide media.\n\t\t\t\tNotice required by this section shall include a description of the following:1\n\nThe incident in general terms;2\n\nThe type of medical information that was subject to the unauthorized access and acquisition;3\n\nThe general acts of the entity to protect the personal information from further unauthorized access; and4\n\nA telephone number that the person may call for further information and assistance, if one exists.\n\t\t\t\t\t“Redact” means alteration or truncation of data such that no information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis or no more than four digits of a health insurance policy number, subscriber number, or other unique identifier are accessible as part of the medical information.B\n\nIf unencrypted or unredacted medical information was or is reasonably believed to have been accessed and acquired by an unauthorized person, an entity that owns or licenses computerized data that includes medical information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to the Office of the Attorney General, the Commissioner of Health, the subject of the medical information, and any affected resident of the Commonwealth without unreasonable delay. Notice required by this section may be reasonably delayed to allow the entity to determine the scope of the breach of the security of the system and restore the reasonable integrity of the system. Notice required by this section may be delayed if, after the entity notifies a law-enforcement agency, the law-enforcement agency determines and advises the entity that the notice will impede a criminal or civil investigation, or homeland or national security. Notice shall be made without unreasonable delay after the law-enforcement agency determines that the notification will no longer impede the investigation or jeopardize national or homeland security.C\n\nAn entity shall disclose the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key.D\n\nAn entity that maintains computerized data that includes medical information that the entity does not own or license shall notify the owner or licensee of the information of any breach of the security of the system without unreasonable delay following discovery of the breach of the security of the system, if the medical information was accessed and acquired by an unauthorized person or the entity reasonably believes the medical information was accessed and acquired by an unauthorized person.E\n\nIn the event an entity provides notice to more than 1,000 persons at one time, pursuant to this section, the entity shall notify, without unreasonable delay, the Office of the Attorney General and the Commissioner of Health of the timing, distribution, and content of the notice.F\n\nThis section shall not apply to (i) a person or entity who is a “covered entity” or “business associate” under the Health Insurance Portability and Accountability Act of 1996 (42 USC § 1320d et seq.) and is subject to requirements for notification in the case of a breach of protected health information (42 USC 17932 et seq.) or (ii) a person or entity who is a non-HIPAA-covered entity subject to the Health Breach Notification Rule promulgated by the Federal Trade Commission pursuant to 42 USC § 17937 et seq.G\n\nAn entity that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures, and guidelines established by the entity’s primary or functional state or federal regulator shall be in compliance with this section.","order_by":null,"text":{"0":{"id":282943,"text":"As used in this section:\n\t\t\t“Breach of the security of the system” means unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security, confidentiality, or integrity of medical information maintained by an entity. Good faith acquisition of medical information by an employee or agent of an entity for the purposes of the entity is not a breach of the security of the system, provided that the medical information is not used for a purpose other than a lawful purpose of the entity or subject to further unauthorized disclosure.\n\t\t\t“Encrypted” means the transformation of data through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without the use of a confidential process or key, or the securing of the information by another method that renders the data elements unreadable or unusable.\n\t\t\t“Entity” means any authority, board, bureau, commission, district or agency of the Commonwealth or of any political subdivision of the Commonwealth, including cities, towns and counties, municipal councils, governing bodies of counties, school boards and planning commissions; boards of visitors of public institutions of higher education; and other organizations, corporations, or agencies in the Commonwealth supported wholly or principally by public funds.\n\t\t\t“Medical information” means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of the Commonwealth, when the data elements are neither encrypted nor redacted:","type":"section","prefixes":["A"],"prefix":"A","entire_prefix":"A","prefix_anchor":"A","level":1,"next_prefix":"A1"},"1":{"id":282944,"text":"Any information regarding an individual’s medical or mental health history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or","type":"section","prefixes":["A","1"],"prefix":"1","entire_prefix":"A1","prefix_anchor":"A1","level":2,"prior_prefix":"A","next_prefix":"A2"},"2":{"id":282945,"text":"An individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records.\n\t\t\t\tThe term does not include information that is lawfully obtained from publicly available information, or from federal, state, or local government records lawfully made available to the general public.\n\t\t\t\t“Notice” means:","type":"section","prefixes":["A","2"],"prefix":"2","entire_prefix":"A2","prefix_anchor":"A2","level":2,"prior_prefix":"A1","next_prefix":"A1"},"3":{"id":282946,"text":"Written notice to the last known postal address in the records of the entity;","type":"section","prefixes":["A","1"],"prefix":"1","entire_prefix":"A1","prefix_anchor":"A1","level":2,"prior_prefix":"A2","next_prefix":"A2"},"4":{"id":282947,"text":"Telephone notice;","type":"section","prefixes":["A","2"],"prefix":"2","entire_prefix":"A2","prefix_anchor":"A2","level":2,"prior_prefix":"A1","next_prefix":"A3"},"5":{"id":282948,"text":"Electronic notice; or","type":"section","prefixes":["A","3"],"prefix":"3","entire_prefix":"A3","prefix_anchor":"A3","level":2,"prior_prefix":"A2","next_prefix":"A4"},"6":{"id":282949,"text":"Substitute notice, if the entity required to provide notice demonstrates that the cost of providing notice will exceed $50,000, the affected class of Virginia residents to be notified exceeds 100,000 residents, or the entity does not have sufficient contact information or consent to provide notice as described in subdivisions 1, 2, or 3 of this definition. Substitute notice consists of the following:\n\t\t\t\ta. E-mail notice if the entity has e-mail addresses for the members of the affected class of residents;\n\t\t\t\tb. Conspicuous posting of the notice on the website of the entity if the entity maintains a website; and\n\t\t\t\tc. Notice to major statewide media.\n\t\t\t\tNotice required by this section shall include a description of the following:","type":"section","prefixes":["A","4"],"prefix":"4","entire_prefix":"A4","prefix_anchor":"A4","level":2,"prior_prefix":"A3","next_prefix":"A41"},"7":{"id":282950,"text":"The incident in general terms;","type":"section","prefixes":["A","4","1"],"prefix":"1","entire_prefix":"A41","prefix_anchor":"A41","level":3,"prior_prefix":"A4","next_prefix":"A42"},"8":{"id":282951,"text":"The type of medical information that was subject to the unauthorized access and acquisition;","type":"section","prefixes":["A","4","2"],"prefix":"2","entire_prefix":"A42","prefix_anchor":"A42","level":3,"prior_prefix":"A41","next_prefix":"A43"},"9":{"id":282952,"text":"The general acts of the entity to protect the personal information from further unauthorized access; and","type":"section","prefixes":["A","4","3"],"prefix":"3","entire_prefix":"A43","prefix_anchor":"A43","level":3,"prior_prefix":"A42","next_prefix":"A44"},"10":{"id":282953,"text":"A telephone number that the person may call for further information and assistance, if one exists.\n\t\t\t\t\t“Redact” means alteration or truncation of data such that no information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis or no more than four digits of a health insurance policy number, subscriber number, or other unique identifier are accessible as part of the medical information.","type":"section","prefixes":["A","4","4"],"prefix":"4","entire_prefix":"A44","prefix_anchor":"A44","level":3,"prior_prefix":"A43","next_prefix":"B"},"11":{"id":282954,"text":"If unencrypted or unredacted medical information was or is reasonably believed to have been accessed and acquired by an unauthorized person, an entity that owns or licenses computerized data that includes medical information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to the Office of the Attorney General, the Commissioner of Health, the subject of the medical information, and any affected resident of the Commonwealth without unreasonable delay. Notice required by this section may be reasonably delayed to allow the entity to determine the scope of the breach of the security of the system and restore the reasonable integrity of the system. Notice required by this section may be delayed if, after the entity notifies a law-enforcement agency, the law-enforcement agency determines and advises the entity that the notice will impede a criminal or civil investigation, or homeland or national security. Notice shall be made without unreasonable delay after the law-enforcement agency determines that the notification will no longer impede the investigation or jeopardize national or homeland security.","type":"section","prefixes":["B"],"prefix":"B","entire_prefix":"B","prefix_anchor":"B","level":1,"prior_prefix":"A44","next_prefix":"C"},"12":{"id":282955,"text":"An entity shall disclose the breach of the security of the system if encrypted information is accessed and acquired in an unencrypted form, or if the security breach involves a person with access to the encryption key.","type":"section","prefixes":["C"],"prefix":"C","entire_prefix":"C","prefix_anchor":"C","level":1,"prior_prefix":"B","next_prefix":"D"},"13":{"id":282956,"text":"An entity that maintains computerized data that includes medical information that the entity does not own or license shall notify the owner or licensee of the information of any breach of the security of the system without unreasonable delay following discovery of the breach of the security of the system, if the medical information was accessed and acquired by an unauthorized person or the entity reasonably believes the medical information was accessed and acquired by an unauthorized person.","type":"section","prefixes":["D"],"prefix":"D","entire_prefix":"D","prefix_anchor":"D","level":1,"prior_prefix":"C","next_prefix":"E"},"14":{"id":282957,"text":"In the event an entity provides notice to more than 1,000 persons at one time, pursuant to this section, the entity shall notify, without unreasonable delay, the Office of the Attorney General and the Commissioner of Health of the timing, distribution, and content of the notice.","type":"section","prefixes":["E"],"prefix":"E","entire_prefix":"E","prefix_anchor":"E","level":1,"prior_prefix":"D","next_prefix":"F"},"15":{"id":282958,"text":"This section shall not apply to (i) a person or entity who is a “covered entity” or “business associate” under the Health Insurance Portability and Accountability Act of 1996 (42 USC § 1320d et seq.) and is subject to requirements for notification in the case of a breach of protected health information (42 USC 17932 et seq.) or (ii) a person or entity who is a non-HIPAA-covered entity subject to the Health Breach Notification Rule promulgated by the Federal Trade Commission pursuant to 42 USC § 17937 et seq.","type":"section","prefixes":["F"],"prefix":"F","entire_prefix":"F","prefix_anchor":"F","level":1,"prior_prefix":"E","next_prefix":"G"},"16":{"id":282959,"text":"An entity that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures, and guidelines established by the entity’s primary or functional state or federal regulator shall be in compliance with this section.","type":"section","prefixes":["G"],"prefix":"G","entire_prefix":"G","prefix_anchor":"G","level":1,"prior_prefix":"F"}},"ancestry":[{"id":12729,"edition_id":1,"name":"Hospital and Nursing Home Licensure and Inspection","identifier":"1","label":"article","depth":3,"order_by":1,"parent_id":12728,"metadata":{},"date_created":"2026-06-26 03:43:50","date_modified":"2026-06-26 03:43:50","permalink":{"id":202857,"object_type":"structure","relational_id":12729,"identifier":"1","token":"32.1\/5\/1","url":"\/32.1\/5\/1\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12728,"edition_id":1,"name":"Regulation of Medical Care Facilities and Services","identifier":"5","label":"chapter","depth":2,"order_by":1,"parent_id":12727,"metadata":{},"date_created":"2026-06-26 03:43:50","date_modified":"2026-06-26 03:43:50","permalink":{"id":202855,"object_type":"structure","relational_id":12728,"identifier":"5","token":"32.1\/5","url":"\/32.1\/5\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12727,"edition_id":1,"name":"Health","identifier":"32.1","label":"title","depth":1,"order_by":1,"parent_id":null,"metadata":{},"date_created":"2026-06-26 03:43:50","date_modified":"2026-06-26 03:43:50","permalink":{"id":201099,"object_type":"structure","relational_id":12727,"identifier":"32.1","token":"32.1","url":"\/32.1\/","edition_id":1,"permalink":0,"preferred":1}}],"structure_contents":[{"id":80727,"structure_id":12729,"section_number":"32.1-123","catch_line":"(Effective January 1, 2026) Definitions","url":"\/32.1-123\/","token":"32.1\/5\/1\/32.1-123","metadata":false},{"id":75042,"structure_id":12729,"section_number":"32.1-124","catch_line":"Exemptions","url":"\/32.1-124\/","token":"32.1\/5\/1\/32.1-124","metadata":false},{"id":58545,"structure_id":12729,"section_number":"32.1-125","catch_line":"Establishment or operation of hospitals and nursing homes prohibited without license or certification; licenses not transferable","url":"\/32.1-125\/","token":"32.1\/5\/1\/32.1-125","metadata":false},{"id":63548,"structure_id":12729,"section_number":"32.1-125.01","catch_line":"Failing to report; penalty","url":"\/32.1-125.01\/","token":"32.1\/5\/1\/32.1-125.01","metadata":false},{"id":59071,"structure_id":12729,"section_number":"32.1-125.1","catch_line":"Inspection of hospitals by state agencies generally","url":"\/32.1-125.1\/","token":"32.1\/5\/1\/32.1-125.1","metadata":false},{"id":78537,"structure_id":12729,"section_number":"32.1-125.2","catch_line":"Disclosure of other providers of services","url":"\/32.1-125.2\/","token":"32.1\/5\/1\/32.1-125.2","metadata":false},{"id":58917,"structure_id":12729,"section_number":"32.1-125.3","catch_line":"Bed capacity and licensure in hospitals designated as critical access hospitals; designation as rural hospital","url":"\/32.1-125.3\/","token":"32.1\/5\/1\/32.1-125.3","metadata":false},{"id":55275,"structure_id":12729,"section_number":"32.1-125.4","catch_line":"Retaliation or discrimination against complainants","url":"\/32.1-125.4\/","token":"32.1\/5\/1\/32.1-125.4","metadata":false},{"id":70129,"structure_id":12729,"section_number":"32.1-125.5","catch_line":"Confidentiality of complainant's identity","url":"\/32.1-125.5\/","token":"32.1\/5\/1\/32.1-125.5","metadata":false},{"id":60850,"structure_id":12729,"section_number":"32.1-126","catch_line":"Commissioner to inspect and to issue licenses to or assure compliance with certification requirements for hospitals, nursing homes, and certified nursing facilities; notice of denial of license; consultative advice and assistance; notice to electric utilities","url":"\/32.1-126\/","token":"32.1\/5\/1\/32.1-126","metadata":false},{"id":77692,"structure_id":12729,"section_number":"32.1-126.01","catch_line":"Employment for compensation of persons convicted of barrier crimes prohibited; criminal records check required; suspension or revocation of license","url":"\/32.1-126.01\/","token":"32.1\/5\/1\/32.1-126.01","metadata":false},{"id":57301,"structure_id":12729,"section_number":"32.1-126.02","catch_line":"Hospital pharmacy employees; criminal records check required","url":"\/32.1-126.02\/","token":"32.1\/5\/1\/32.1-126.02","metadata":false},{"id":71970,"structure_id":12729,"section_number":"32.1-126.1","catch_line":"Asbestos inspection for hospitals","url":"\/32.1-126.1\/","token":"32.1\/5\/1\/32.1-126.1","metadata":false},{"id":65858,"structure_id":12729,"section_number":"32.1-126.2","catch_line":"Fire suppression systems required in nursing facilities and nursing homes","url":"\/32.1-126.2\/","token":"32.1\/5\/1\/32.1-126.2","metadata":false},{"id":83484,"structure_id":12729,"section_number":"32.1-126.3","catch_line":"Fire suppression systems required in hospitals","url":"\/32.1-126.3\/","token":"32.1\/5\/1\/32.1-126.3","metadata":false},{"id":70496,"structure_id":12729,"section_number":"32.1-126.4","catch_line":"Hospital standing orders or protocols for certain vaccinations","url":"\/32.1-126.4\/","token":"32.1\/5\/1\/32.1-126.4","metadata":false},{"id":73579,"structure_id":12729,"section_number":"32.1-126.5","catch_line":"Consolidation of inspections","url":"\/32.1-126.5\/","token":"32.1\/5\/1\/32.1-126.5","metadata":false},{"id":85883,"structure_id":12729,"section_number":"32.1-127","catch_line":"(Effective January 1, 2026) Regulations","url":"\/32.1-127\/","token":"32.1\/5\/1\/32.1-127","metadata":false},{"id":71680,"structure_id":12729,"section_number":"32.1-127.001","catch_line":"Certain design and construction standards to be incorporated in hospital and nursing home licensure regulations","url":"\/32.1-127.001\/","token":"32.1\/5\/1\/32.1-127.001","metadata":false},{"id":63277,"structure_id":12729,"section_number":"32.1-127.01","catch_line":"Regulations to authorize certain disciplinary actions and guidelines","url":"\/32.1-127.01\/","token":"32.1\/5\/1\/32.1-127.01","metadata":false},{"id":71135,"structure_id":12729,"section_number":"32.1-127.1","catch_line":"Immunity from liability for routine referral for organ and tissue donation","url":"\/32.1-127.1\/","token":"32.1\/5\/1\/32.1-127.1","metadata":false},{"id":81314,"structure_id":12729,"section_number":"32.1-127.1:01","catch_line":"Record storage","url":"\/32.1-127.1_01\/","token":"32.1\/5\/1\/32.1-127.1_01","metadata":false},{"id":56243,"structure_id":12729,"section_number":"32.1-127.1:02","catch_line":"Repealed","url":"\/32.1-127.1_02\/","token":"32.1\/5\/1\/32.1-127.1_02","metadata":false},{"id":58930,"structure_id":12729,"section_number":"32.1-127.1:03","catch_line":"Health records privacy","url":"\/32.1-127.1_03\/","token":"32.1\/5\/1\/32.1-127.1_03","metadata":false},{"id":84892,"structure_id":12729,"section_number":"32.1-127.1:04","catch_line":"Use or disclosure of certain protected health information required","url":"\/32.1-127.1_04\/","token":"32.1\/5\/1\/32.1-127.1_04","metadata":false},{"id":78997,"structure_id":12729,"section_number":"32.1-127.1:05","catch_line":"Breach of medical information notification","url":"\/32.1-127.1_05\/","token":"32.1\/5\/1\/32.1-127.1_05","metadata":false},{"id":55917,"structure_id":12729,"section_number":"32.1-127.2","catch_line":"Repealed","url":"\/32.1-127.2\/","token":"32.1\/5\/1\/32.1-127.2","metadata":false},{"id":77664,"structure_id":12729,"section_number":"32.1-127.3","catch_line":"Immunity from liability for certain free health care services","url":"\/32.1-127.3\/","token":"32.1\/5\/1\/32.1-127.3","metadata":false},{"id":59266,"structure_id":12729,"section_number":"32.1-128","catch_line":"Applicability to hospitals and nursing homes for practice of religious tenets","url":"\/32.1-128\/","token":"32.1\/5\/1\/32.1-128","metadata":false},{"id":70347,"structure_id":12729,"section_number":"32.1-129","catch_line":"Application for license","url":"\/32.1-129\/","token":"32.1\/5\/1\/32.1-129","metadata":false},{"id":54055,"structure_id":12729,"section_number":"32.1-130","catch_line":"Fees; Hospital and Nursing Home Licensure and Inspection Program Fund","url":"\/32.1-130\/","token":"32.1\/5\/1\/32.1-130","metadata":false},{"id":76878,"structure_id":12729,"section_number":"32.1-131","catch_line":"Expiration and renewal of licenses","url":"\/32.1-131\/","token":"32.1\/5\/1\/32.1-131","metadata":false},{"id":83021,"structure_id":12729,"section_number":"32.1-132","catch_line":"(Effective July 1, 2028) Alterations or additions to hospitals and nursing homes; when new license required; use of inpatient hospital beds for furnishing skilled care services","url":"\/32.1-132\/","token":"32.1\/5\/1\/32.1-132","metadata":false},{"id":81019,"structure_id":12729,"section_number":"32.1-133","catch_line":"Display of license","url":"\/32.1-133\/","token":"32.1\/5\/1\/32.1-133","metadata":false},{"id":82010,"structure_id":12729,"section_number":"32.1-133.1","catch_line":"Human trafficking hotline; posted notice required; civil penalty","url":"\/32.1-133.1\/","token":"32.1\/5\/1\/32.1-133.1","metadata":false},{"id":76056,"structure_id":12729,"section_number":"32.1-134","catch_line":"Family planning information in hospitals providing maternity care","url":"\/32.1-134\/","token":"32.1\/5\/1\/32.1-134","metadata":false},{"id":73607,"structure_id":12729,"section_number":"32.1-134.01","catch_line":"Certain information required for maternity patients","url":"\/32.1-134.01\/","token":"32.1\/5\/1\/32.1-134.01","metadata":false},{"id":87288,"structure_id":12729,"section_number":"32.1-134.02","catch_line":"Infants; blood sample provided to parents","url":"\/32.1-134.02\/","token":"32.1\/5\/1\/32.1-134.02","metadata":false},{"id":70187,"structure_id":12729,"section_number":"32.1-134.03","catch_line":"Maternal health; protocols and resources for hospitals and outpatient providers; report","url":"\/32.1-134.03\/","token":"32.1\/5\/1\/32.1-134.03","metadata":false},{"id":65119,"structure_id":12729,"section_number":"32.1-134.1","catch_line":"When denial, etc., to duly licensed physician of staff membership or professional privileges improper","url":"\/32.1-134.1\/","token":"32.1\/5\/1\/32.1-134.1","metadata":false},{"id":71090,"structure_id":12729,"section_number":"32.1-134.2","catch_line":"Clinical privileges for certain practitioners","url":"\/32.1-134.2\/","token":"32.1\/5\/1\/32.1-134.2","metadata":false},{"id":68078,"structure_id":12729,"section_number":"32.1-134.3","catch_line":"Response to applications for clinical privileges","url":"\/32.1-134.3\/","token":"32.1\/5\/1\/32.1-134.3","metadata":false},{"id":55369,"structure_id":12729,"section_number":"32.1-134.4","catch_line":"Right of podiatrists or advanced practice registered nurses to injunction","url":"\/32.1-134.4\/","token":"32.1\/5\/1\/32.1-134.4","metadata":false},{"id":75670,"structure_id":12729,"section_number":"32.1-135","catch_line":"Revocation or suspension of license or certification of hospital or certified nursing facility; restriction or prohibition of new admissions to certified nursing facility","url":"\/32.1-135\/","token":"32.1\/5\/1\/32.1-135","metadata":false},{"id":77485,"structure_id":12729,"section_number":"32.1-135.1","catch_line":"Certain advertisements prohibited","url":"\/32.1-135.1\/","token":"32.1\/5\/1\/32.1-135.1","metadata":false},{"id":83084,"structure_id":12729,"section_number":"32.1-135.2","catch_line":"Offer or payment of remuneration in exchange for referral prohibited","url":"\/32.1-135.2\/","token":"32.1\/5\/1\/32.1-135.2","metadata":false},{"id":53943,"structure_id":12729,"section_number":"32.1-136","catch_line":"Violation; penalties","url":"\/32.1-136\/","token":"32.1\/5\/1\/32.1-136","metadata":false},{"id":68332,"structure_id":12729,"section_number":"32.1-137","catch_line":"Certification of medical care facilities under Title XVIII of Social Security Act","url":"\/32.1-137\/","token":"32.1\/5\/1\/32.1-137","metadata":false},{"id":59084,"structure_id":12729,"section_number":"32.1-137.01","catch_line":"Posting of charity care policies","url":"\/32.1-137.01\/","token":"32.1\/5\/1\/32.1-137.01","metadata":false},{"id":76816,"structure_id":12729,"section_number":"32.1-137.010","catch_line":"Financial assistance; payment plans","url":"\/32.1-137.010\/","token":"32.1\/5\/1\/32.1-137.010","metadata":false},{"id":75514,"structure_id":12729,"section_number":"32.1-137.011","catch_line":"Childbirth; postpartum process; doulas","url":"\/32.1-137.011\/","token":"32.1\/5\/1\/32.1-137.011","metadata":false},{"id":65869,"structure_id":12729,"section_number":"32.1-137.02","catch_line":"Hospital discharge procedures","url":"\/32.1-137.02\/","token":"32.1\/5\/1\/32.1-137.02","metadata":false},{"id":65455,"structure_id":12729,"section_number":"32.1-137.03","catch_line":"Discharge planning; designation of individual to provide care","url":"\/32.1-137.03\/","token":"32.1\/5\/1\/32.1-137.03","metadata":false},{"id":79498,"structure_id":12729,"section_number":"32.1-137.04","catch_line":"Patient notice of observation or outpatient status","url":"\/32.1-137.04\/","token":"32.1\/5\/1\/32.1-137.04","metadata":false},{"id":60024,"structure_id":12729,"section_number":"32.1-137.05","catch_line":"Information regarding standard charges; advance estimate of patient payment amount for elective procedure, test, or service","url":"\/32.1-137.05\/","token":"32.1\/5\/1\/32.1-137.05","metadata":false},{"id":65804,"structure_id":12729,"section_number":"32.1-137.06","catch_line":"Lyme disease test result information","url":"\/32.1-137.06\/","token":"32.1\/5\/1\/32.1-137.06","metadata":false},{"id":61126,"structure_id":12729,"section_number":"32.1-137.07","catch_line":"Violations of certain provisions; penalty","url":"\/32.1-137.07\/","token":"32.1\/5\/1\/32.1-137.07","metadata":false},{"id":81633,"structure_id":12729,"section_number":"32.1-137.08","catch_line":"Medical care facilities; persons with disabilities; designated support persons","url":"\/32.1-137.08\/","token":"32.1\/5\/1\/32.1-137.08","metadata":false},{"id":80169,"structure_id":12729,"section_number":"32.1-137.09","catch_line":"Hospital emergency department CPT code data reporting","url":"\/32.1-137.09\/","token":"32.1\/5\/1\/32.1-137.09","metadata":false}],"previous_section":{"id":84892,"structure_id":12729,"section_number":"32.1-127.1:04","catch_line":"Use or disclosure of certain protected health information required","url":"\/32.1-127.1_04\/","token":"32.1\/5\/1\/32.1-127.1_04","metadata":false},"next_section":{"id":55917,"structure_id":12729,"section_number":"32.1-127.2","catch_line":"Repealed","url":"\/32.1-127.2\/","token":"32.1\/5\/1\/32.1-127.2","metadata":false},"metadata":false,"official_url":"https:\/\/law.lis.virginia.gov\/vacode\/32.1-127.1:05\/","history_text":"

This law was first created in 2010. The record of its establishment is cataloged in chapter 852<\/a> of that year\u2019s edition of \u201cActs of Assembly,\u201d the annual state publication listing all changes made to the Code of Virginia in that year.<\/p>","references":[{"id":86812,"section_number":"22.1-287.02","catch_line":"Students' personally identifiable information","order_by":null,"url":"\/22.1-287.02\/"}],"refers_to":false,"permalink":{"id":202959,"object_type":"law","relational_id":78997,"identifier":"32.1-127.1:05","token":"32.1\/5\/1\/32.1-127.1_05","url":"\/32.1-127.1_05\/","edition_id":1,"permalink":0,"preferred":1},"url":"\/32.1-127.1_05\/","token":"32.1\/5\/1\/32.1-127.1_05","dublin_core":{"Title":"Breach of medical information notification","Type":"Text","Format":"text\/html","Identifier":"\u00a7 32.1-127.1:05","Relation":"Code of Virginia"},"html":"\n\t\t\t\t\t\t

A.<\/span> As used in this section:\n\t\t\t“Breach of the security of the system<\/span>” means unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises the security, confidentiality, or integrity of medical information<\/span> maintained by an entity<\/span>. Good faith acquisition of medical information<\/span> by an employee or agent of an entity<\/span> for the purposes of the entity<\/span> is not a breach of the security of the system<\/span>, provided that the medical information<\/span> is not used for a purpose other than a lawful purpose of the entity<\/span> or subject to further unauthorized disclosure.\n\t\t\t“Encrypted<\/span>” means the transformation of data through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without the use of a confidential process or key, or the securing of the information by another method that renders the data elements unreadable or unusable.\n\t\t\t“Entity<\/span>” means any authority, board<\/span>, bureau, commission, district or agency of the Commonwealth or of any political subdivision of the Commonwealth, including cities, towns and counties, municipal councils, governing bodies of counties, school boards<\/span> and planning commissions; boards<\/span> of visitors of public institutions of higher education; and other organizations, corporations, or agencies in the Commonwealth supported wholly or principally by public funds.\n\t\t\t“Medical information<\/span>” means the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of the Commonwealth, when the data elements are neither encrypted<\/span> nor redacted: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Any information regarding an individual’s medical or mental health history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> An individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals<\/span> records.\n\t\t\t\tThe term does not include information that is lawfully obtained from publicly available information, or from federal, state, or local government records lawfully made available to the general public.\n\t\t\t\t“Notice” means: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Written notice to the last known postal address in the records of the entity<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Telephone notice; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Electronic notice; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Substitute notice, if the entity<\/span> required to provide notice demonstrates that the cost of providing notice will exceed $50,000, the affected class of Virginia residents to be notified exceeds 100,000 residents, or the entity<\/span> does not have sufficient contact information or consent to provide notice as described in subdivisions 1, 2, or 3 of this definition. Substitute notice consists of the following:\n\t\t\t\ta. E-mail notice if the entity<\/span> has e-mail addresses for the members of the affected class of residents;\n\t\t\t\tb. Conspicuous posting of the notice on the website of the entity<\/span> if the entity<\/span> maintains a website; and\n\t\t\t\tc. Notice to major statewide media.\n\t\t\t\tNotice required by this section shall include a description of the following: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> The incident in general terms; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> The type of medical information<\/span> that was subject to the unauthorized access and acquisition; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> The general acts of the entity<\/span> to protect the personal information from further unauthorized access; and <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> A telephone number that the person<\/span> may call for further information and assistance, if one exists.\n\t\t\t\t\t“Redact<\/span>” means alteration or truncation of data such that no information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis or no more than four digits of a health insurance policy number, subscriber number, or other unique identifier are accessible as part of the medical information<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

B.<\/span> If unencrypted or unredacted medical information<\/span> was or is reasonably believed to have been accessed and acquired by an unauthorized person<\/span>, an entity<\/span> that owns or licenses computerized data that includes medical information<\/span> shall disclose any breach of the security of the system<\/span> following discovery<\/span> or notification of the breach of the security of the system<\/span> to the Office of the Attorney General<\/span>, the Commissioner<\/span> of Health, the subject of the medical information<\/span>, and any affected resident of the Commonwealth without unreasonable delay. Notice required by this section may be reasonably delayed to allow the entity<\/span> to determine the scope of the breach of the security of the system<\/span> and restore the reasonable integrity of the system. Notice required by this section may be delayed if, after the entity<\/span> notifies a law<\/span>-enforcement agency, the law<\/span>-enforcement agency determines and advises the entity<\/span> that the notice will impede a criminal or civil investigation, or homeland or national security. Notice shall be made without unreasonable delay after the law<\/span>-enforcement agency determines that the notification will no longer impede the investigation or jeopardize national or homeland security. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

C.<\/span> An entity<\/span> shall disclose the breach of the security of the system<\/span> if encrypted<\/span> information is accessed and acquired in an unencrypted form, or if the security breach involves a person<\/span> with access to the encryption key. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

D.<\/span> An entity<\/span> that maintains computerized data that includes medical information<\/span> that the entity<\/span> does not own or license shall notify the owner or licensee of the information of any breach of the security of the system<\/span> without unreasonable delay following discovery<\/span> of the breach of the security of the system<\/span>, if the medical information<\/span> was accessed and acquired by an unauthorized person<\/span> or the entity<\/span> reasonably believes the medical information<\/span> was accessed and acquired by an unauthorized person<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

E.<\/span> In the event an entity<\/span> provides notice to more than 1,000 persons<\/span> at one time, pursuant to this section, the entity<\/span> shall notify, without unreasonable delay, the Office of the Attorney General<\/span> and the Commissioner<\/span> of Health of the timing, distribution, and content of the notice. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

F.<\/span> This section shall not apply to (i) a person<\/span> or entity<\/span> who is a “covered entity<\/span>” or “business associate” under the Health Insurance Portability and Accountability Act of 1996 (42 USC § 1320d et seq.) and is subject to requirements for notification in the case of a breach of protected health information (42 USC 17932 et seq.) or (ii) a person<\/span> or entity<\/span> who is a non-HIPAA-covered entity<\/span> subject to the Health Breach Notification Rule promulgated by the Federal Trade Commission pursuant to 42 USC § 17937 et seq. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

G.<\/span> An entity<\/span> that complies with the notification requirements or procedures pursuant to the rules, regulations, procedures, and guidelines established by the entity<\/span>’s primary or functional state or federal regulator shall be in compliance with this section. <\/i><\/a><\/p><\/section>","plain_text":" CODE OF VIRGINIA\n\nBREACH OF MEDICAL INFORMATION NOTIFICATION (\u00a7 32.1-127.1:05)\n\nA. As used in this section:\n\t\t\t“Breach of the security of the system” means unauthorized access\nand acquisition of unencrypted and unredacted computerized data that compromises\nthe security, confidentiality, or integrity of medical information maintained by\nan entity. Good faith acquisition of medical information by an employee or agent\nof an entity for the purposes of the entity is not a breach of the security of\nthe system, provided that the medical information is not used for a purpose\nother than a lawful purpose of the entity or subject to further unauthorized\ndisclosure.\n\t\t\t“Encrypted” means the transformation of data through the use of\nan algorithmic process into a form in which there is a low probability of\nassigning meaning without the use of a confidential process or key, or the\nsecuring of the information by another method that renders the data elements\nunreadable or unusable.\n\t\t\t“Entity” means any authority, board, bureau, commission, district\nor agency of the Commonwealth or of any political subdivision of the\nCommonwealth, including cities, towns and counties, municipal councils,\ngoverning bodies of counties, school boards and planning commissions; boards of\nvisitors of public institutions of higher education; and other organizations,\ncorporations, or agencies in the Commonwealth supported wholly or principally by\npublic funds.\n\t\t\t“Medical information” means the first name or first initial and\nlast name in combination with and linked to any one or more of the following\ndata elements that relate to a resident of the Commonwealth, when the data\nelements are neither encrypted nor redacted:\n\n 1. Any information regarding an individual’s medical or mental health\n history, mental or physical condition, or medical treatment or diagnosis by a\n health care professional; or\n\n 2. An individual’s health insurance policy number or subscriber\n identification number, any unique identifier used by a health insurer to\n identify the individual, or any information in an individual’s\n application and claims history, including any appeals records.\n \t\t\t\tThe term does not include information that is lawfully obtained from\n publicly available information, or from federal, state, or local government\n records lawfully made available to the general public.\n \t\t\t\t“Notice” means:\n\n 1. Written notice to the last known postal address in the records of the\n entity;\n\n 2. Telephone notice;\n\n 3. Electronic notice; or\n\n 4. Substitute notice, if the entity required to provide notice demonstrates\n that the cost of providing notice will exceed $50,000, the affected class of\n Virginia residents to be notified exceeds 100,000 residents, or the entity\n does not have sufficient contact information or consent to provide notice as\n described in subdivisions 1, 2, or 3 of this definition. Substitute notice\n consists of the following:\n \t\t\t\ta. E-mail notice if the entity has e-mail addresses for the members of the\n affected class of residents;\n \t\t\t\tb. Conspicuous posting of the notice on the website of the entity if the\n entity maintains a website; and\n \t\t\t\tc. Notice to major statewide media.\n \t\t\t\tNotice required by this section shall include a description of the\n following:\n\n 1. The incident in general terms;\n\n 2. The type of medical information that was subject to the unauthorized\n access and acquisition;\n\n 3. The general acts of the entity to protect the personal information from\n further unauthorized access; and\n\n 4. A telephone number that the person may call for further information and\n assistance, if one exists.\n \t\t\t\t\t“Redact” means alteration or truncation of data such that\n no information regarding an individual’s medical history, mental or\n physical condition, or medical treatment or diagnosis or no more than four\n digits of a health insurance policy number, subscriber number, or other\n unique identifier are accessible as part of the medical information.\n\nB. If unencrypted or unredacted medical information was or is reasonably\nbelieved to have been accessed and acquired by an unauthorized person, an entity\nthat owns or licenses computerized data that includes medical information shall\ndisclose any breach of the security of the system following discovery or\nnotification of the breach of the security of the system to the Office of the\nAttorney General, the Commissioner of Health, the subject of the medical\ninformation, and any affected resident of the Commonwealth without unreasonable\ndelay. Notice required by this section may be reasonably delayed to allow the\nentity to determine the scope of the breach of the security of the system and\nrestore the reasonable integrity of the system. Notice required by this section\nmay be delayed if, after the entity notifies a law-enforcement agency, the\nlaw-enforcement agency determines and advises the entity that the notice will\nimpede a criminal or civil investigation, or homeland or national security.\nNotice shall be made without unreasonable delay after the law-enforcement agency\ndetermines that the notification will no longer impede the investigation or\njeopardize national or homeland security.\n\nC. An entity shall disclose the breach of the security of the system if\nencrypted information is accessed and acquired in an unencrypted form, or if the\nsecurity breach involves a person with access to the encryption key.\n\nD. An entity that maintains computerized data that includes medical information\nthat the entity does not own or license shall notify the owner or licensee of\nthe information of any breach of the security of the system without unreasonable\ndelay following discovery of the breach of the security of the system, if the\nmedical information was accessed and acquired by an unauthorized person or the\nentity reasonably believes the medical information was accessed and acquired by\nan unauthorized person.\n\nE. In the event an entity provides notice to more than 1,000 persons at one\ntime, pursuant to this section, the entity shall notify, without unreasonable\ndelay, the Office of the Attorney General and the Commissioner of Health of the\ntiming, distribution, and content of the notice.\n\nF. This section shall not apply to (i) a person or entity who is a\n“covered entity” or “business associate” under the\nHealth Insurance Portability and Accountability Act of 1996 (42 USC § 1320d\net seq.) and is subject to requirements for notification in the case of a breach\nof protected health information (42 USC 17932 et seq.) or (ii) a person or\nentity who is a non-HIPAA-covered entity subject to the Health Breach\nNotification Rule promulgated by the Federal Trade Commission pursuant to 42 USC\n§ 17937 et seq.\n\nG. An entity that complies with the notification requirements or procedures\npursuant to the rules, regulations, procedures, and guidelines established by\nthe entity’s primary or functional state or federal regulator shall be in\ncompliance with this section.\n\nHISTORY: 2010, c. 852.","edition":{"id":1,"name":"2025","slug":"2025","date_created":"2026-06-21 22:39:22","date_modified":"2026-06-21 22:39:22","current":1,"order_by":1,"last_import":null}}