{"formats":[{"name":"JSON","format":"json","url":"\/downloads\/2025\/code-json\/32.1-276.9.json"},{"name":"Plain Text","format":"text","url":"\/downloads\/2025\/code-text\/32.1-276.9.txt"},{"name":"XML","format":"xml","url":"\/downloads\/2025\/code-xml\/32.1-276.9.xml"},{"name":"HTML","format":"html","url":"\/downloads\/2025\/code-html\/32.1-276.9.html"}],"law_id":80143,"edition_id":1,"section_id":80143,"structure_id":14841,"section_number":"32.1-276.9","catch_line":"Confidentiality, subsequent release of data and relief from liability for reporting; penalty for wrongful disclosure; individual action for damages","history":"1996, c. 902; 2001, c. 341.","full_text":"A\n\nPatient level data collected pursuant to this chapter shall be exempt from the provisions of the Virginia Freedom of Information Act (§ 2.2-3700 et seq.), shall be considered confidential, and shall not be disclosed other than as specifically authorized by this chapter; however, upon processing and verification by the nonprofit organization, all patient level data shall be publicly available, except patient, physician, and employer identifier elements, which may be released solely for research purposes if otherwise permitted by law and only if such identifier is encrypted and cannot be reasonably expected to reveal patient identities. No report published by the nonprofit organization, the Commissioner, or other person may present information that reasonably could be expected to reveal the identity of any patient. Publicly available information shall be designed to prevent persons from being able to gain access to combinations of patient characteristic data elements that reasonably could be expected to reveal the identity of any patient. The nonprofit organization, in its discretion, may release physician and employer identifier information. Outpatient surgical charge data shall be made publicly available only pursuant to a review by the Joint Commission on Health Care.B\n\nNo person or entity, including the nonprofit organization contracting with the Commissioner, shall be held liable in any civil action with respect to any report or disclosure of information made under this article unless such person or entity has knowledge of any falsity of the information reported or disclosed.C\n\nAny disclosure of information made in violation of this chapter shall be subject to a civil penalty of not more than $5,000 per violation. This provision shall be enforceable upon petition to the appropriate circuit court by the Attorney General, any attorney for the Commonwealth, or any attorney for the county, city or town in which the violation occurred. Any penalty imposed shall be payable to the Literary Fund. In addition, any person or entity who is the subject of any disclosure in violation of this article shall be entitled to initiate an action to recover actual damages, if any, or $500, whichever is greater, together with reasonable attorney’s fees and court costs.","order_by":null,"text":{"0":{"id":286943,"text":"Patient level data collected pursuant to this chapter shall be exempt from the provisions of the Virginia Freedom of Information Act (§ 2.2-3700 et seq.), shall be considered confidential, and shall not be disclosed other than as specifically authorized by this chapter; however, upon processing and verification by the nonprofit organization, all patient level data shall be publicly available, except patient, physician, and employer identifier elements, which may be released solely for research purposes if otherwise permitted by law and only if such identifier is encrypted and cannot be reasonably expected to reveal patient identities. No report published by the nonprofit organization, the Commissioner, or other person may present information that reasonably could be expected to reveal the identity of any patient. Publicly available information shall be designed to prevent persons from being able to gain access to combinations of patient characteristic data elements that reasonably could be expected to reveal the identity of any patient. The nonprofit organization, in its discretion, may release physician and employer identifier information. Outpatient surgical charge data shall be made publicly available only pursuant to a review by the Joint Commission on Health Care.","type":"section","prefixes":["A"],"prefix":"A","entire_prefix":"A","prefix_anchor":"A","level":1,"next_prefix":"B"},"1":{"id":286944,"text":"No person or entity, including the nonprofit organization contracting with the Commissioner, shall be held liable in any civil action with respect to any report or disclosure of information made under this article unless such person or entity has knowledge of any falsity of the information reported or disclosed.","type":"section","prefixes":["B"],"prefix":"B","entire_prefix":"B","prefix_anchor":"B","level":1,"prior_prefix":"A","next_prefix":"C"},"2":{"id":286945,"text":"Any disclosure of information made in violation of this chapter shall be subject to a civil penalty of not more than $5,000 per violation. This provision shall be enforceable upon petition to the appropriate circuit court by the Attorney General, any attorney for the Commonwealth, or any attorney for the county, city or town in which the violation occurred. Any penalty imposed shall be payable to the Literary Fund. In addition, any person or entity who is the subject of any disclosure in violation of this article shall be entitled to initiate an action to recover actual damages, if any, or $500, whichever is greater, together with reasonable attorney’s fees and court costs.","type":"section","prefixes":["C"],"prefix":"C","entire_prefix":"C","prefix_anchor":"C","level":1,"prior_prefix":"B"}},"ancestry":[{"id":14841,"edition_id":1,"name":"Health Care Data Reporting","identifier":"7.2","label":"chapter","depth":2,"order_by":1,"parent_id":12727,"metadata":{},"date_created":"2026-06-26 03:50:19","date_modified":"2026-06-26 03:50:19","permalink":{"id":204329,"object_type":"structure","relational_id":14841,"identifier":"7.2","token":"32.1\/7.2","url":"\/32.1\/7.2\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12727,"edition_id":1,"name":"Health","identifier":"32.1","label":"title","depth":1,"order_by":1,"parent_id":null,"metadata":{},"date_created":"2026-06-26 03:43:50","date_modified":"2026-06-26 03:43:50","permalink":{"id":201099,"object_type":"structure","relational_id":12727,"identifier":"32.1","token":"32.1","url":"\/32.1\/","edition_id":1,"permalink":0,"preferred":1}}],"structure_contents":[{"id":79337,"structure_id":14841,"section_number":"32.1-276.10","catch_line":"Chapter and actions thereunder not to be construed as approval of charges or costs","url":"\/32.1-276.10\/","token":"32.1\/7.2\/32.1-276.10","metadata":false},{"id":68729,"structure_id":14841,"section_number":"32.1-276.11","catch_line":"Violations","url":"\/32.1-276.11\/","token":"32.1\/7.2\/32.1-276.11","metadata":false},{"id":71744,"structure_id":14841,"section_number":"32.1-276.2","catch_line":"Health care data reporting; purpose","url":"\/32.1-276.2\/","token":"32.1\/7.2\/32.1-276.2","metadata":false},{"id":67276,"structure_id":14841,"section_number":"32.1-276.3","catch_line":"Definitions","url":"\/32.1-276.3\/","token":"32.1\/7.2\/32.1-276.3","metadata":false},{"id":56739,"structure_id":14841,"section_number":"32.1-276.4","catch_line":"Agreements for certain data services","url":"\/32.1-276.4\/","token":"32.1\/7.2\/32.1-276.4","metadata":false},{"id":84829,"structure_id":14841,"section_number":"32.1-276.5","catch_line":"Providers to submit data; civil penalty","url":"\/32.1-276.5\/","token":"32.1\/7.2\/32.1-276.5","metadata":false},{"id":62565,"structure_id":14841,"section_number":"32.1-276.5:1","catch_line":"Repealed","url":"\/32.1-276.5_1\/","token":"32.1\/7.2\/32.1-276.5_1","metadata":false},{"id":77566,"structure_id":14841,"section_number":"32.1-276.6","catch_line":"Patient level data system continued; reporting requirements","url":"\/32.1-276.6\/","token":"32.1\/7.2\/32.1-276.6","metadata":false},{"id":67668,"structure_id":14841,"section_number":"32.1-276.7","catch_line":"Methodology to review and measure the efficiency and productivity of health care providers","url":"\/32.1-276.7\/","token":"32.1\/7.2\/32.1-276.7","metadata":false},{"id":85887,"structure_id":14841,"section_number":"32.1-276.7:1","catch_line":"All-Payer Claims Database created; purpose; reporting requirements","url":"\/32.1-276.7_1\/","token":"32.1\/7.2\/32.1-276.7_1","metadata":false},{"id":73124,"structure_id":14841,"section_number":"32.1-276.8","catch_line":"Fees for processing, verification, and dissemination of data","url":"\/32.1-276.8\/","token":"32.1\/7.2\/32.1-276.8","metadata":false},{"id":80143,"structure_id":14841,"section_number":"32.1-276.9","catch_line":"Confidentiality, subsequent release of data and relief from liability for reporting; penalty for wrongful disclosure; individual action for damages","url":"\/32.1-276.9\/","token":"32.1\/7.2\/32.1-276.9","metadata":false},{"id":81074,"structure_id":14841,"section_number":"32.1-276.9:1","catch_line":"Health information needs related to reform; work group","url":"\/32.1-276.9_1\/","token":"32.1\/7.2\/32.1-276.9_1","metadata":false}],"previous_section":{"id":73124,"structure_id":14841,"section_number":"32.1-276.8","catch_line":"Fees for processing, verification, and dissemination of data","url":"\/32.1-276.8\/","token":"32.1\/7.2\/32.1-276.8","metadata":false},"next_section":{"id":81074,"structure_id":14841,"section_number":"32.1-276.9:1","catch_line":"Health information needs related to reform; work group","url":"\/32.1-276.9_1\/","token":"32.1\/7.2\/32.1-276.9_1","metadata":false},"metadata":false,"official_url":"https:\/\/law.lis.virginia.gov\/vacode\/32.1-276.9\/","history_text":"

This law was first created in 1996. The record of its establishment is cataloged in chapter 902<\/a> of that year\u2019s edition of \u201cActs of Assembly,\u201d the annual state publication listing all changes made to the Code of Virginia in that year. It has been modified 1 time. Those modifications are cataloged by \u201cThe Acts of Assembly,\u201d a state publication, by year and chapter. Those modifications that can be read on the General Assembly\u2019s website will be linked accordingly. That modification is as follows: in 2001, chapter 341<\/a>.<\/p>","references":[{"id":60253,"section_number":"2.2-3705.5","catch_line":"Exclusions to application of chapter; health and social services records","order_by":null,"url":"\/2.2-3705.5\/"},{"id":56739,"section_number":"32.1-276.4","catch_line":"Agreements for certain data services","order_by":null,"url":"\/32.1-276.4\/"}],"refers_to":[{"id":55569,"section_number":"2.2-3700","catch_line":"Short title; policy","order_by":null,"url":"\/2.2-3700\/"}],"permalink":{"id":204375,"object_type":"law","relational_id":80143,"identifier":"32.1-276.9","token":"32.1\/7.2\/32.1-276.9","url":"\/32.1-276.9\/","edition_id":1,"permalink":0,"preferred":1},"url":"\/32.1-276.9\/","token":"32.1\/7.2\/32.1-276.9","dublin_core":{"Title":"Confidentiality, subsequent release of data and relief from liability for reporting; penalty for wrongful disclosure; individual action for damages","Type":"Text","Format":"text\/html","Identifier":"\u00a7 32.1-276.9","Relation":"Code of Virginia"},"html":"\n\t\t\t\t\t\t

A.<\/span> Patient level data collected pursuant to this chapter shall be exempt from the provisions of the Virginia Freedom of Information Act (§ 2.2-3700<\/a> et seq.), shall be considered confidential, and shall not be disclosed other than as specifically authorized by this chapter; however, upon processing and verification by the nonprofit organization<\/span>, all patient level data shall be publicly available, except patient, physician<\/span>, and employer identifier elements, which may be released solely for research purposes if otherwise permitted by law<\/span> and only if such identifier is encrypted and cannot be reasonably expected to reveal patient identities. No report published by the nonprofit organization<\/span>, the Commissioner<\/span>, or other person<\/span> may present information that reasonably could be expected to reveal the identity of any patient. Publicly available information shall be designed to prevent persons<\/span> from being able to gain access to combinations of patient characteristic data elements that reasonably could be expected to reveal the identity of any patient. The nonprofit organization<\/span>, in its discretion, may release physician<\/span> and employer identifier information. Outpatient surgical charge data shall be made publicly available only pursuant to a review by the Joint Commission on Health Care. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

B.<\/span> No person<\/span> or entity, including the nonprofit organization<\/span> contracting with the Commissioner<\/span>, shall be held liable in any civil action<\/span> with respect to any report or disclosure of information made under this article unless such person<\/span> or entity has knowledge of any falsity of the information reported or disclosed. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

C.<\/span> Any disclosure of information made in violation of this chapter shall be subject to a civil penalty<\/span> of not more than $5,000 per violation. This provision shall be enforceable upon petition<\/span> to the appropriate circuit<\/span> court<\/span> by the Attorney General<\/span>, any attorney for the Commonwealth, or any attorney for the county, city or town in which the violation occurred. Any penalty<\/span> imposed shall be payable to the Literary Fund. In addition, any person<\/span> or entity who is the subject of any disclosure in violation of this article shall be entitled to initiate an action to recover actual damages<\/span>, if any, or $500, whichever is greater, together with reasonable attorney’s fees and court<\/span> costs. <\/i><\/a><\/p><\/section>","plain_text":" CODE OF VIRGINIA\n\nCONFIDENTIALITY, SUBSEQUENT RELEASE OF DATA AND RELIEF FROM LIABILITY FOR\nREPORTING; PENALTY FOR WRONGFUL DISCLOSURE; INDIVIDUAL ACTION FOR DAMAGES (\u00a7\n32.1-276.9)\n\nA. Patient level data collected pursuant to this chapter shall be exempt from\nthe provisions of the Virginia Freedom of Information Act (§ 2.2-3700 et\nseq.), shall be considered confidential, and shall not be disclosed other than\nas specifically authorized by this chapter; however, upon processing and\nverification by the nonprofit organization, all patient level data shall be\npublicly available, except patient, physician, and employer identifier elements,\nwhich may be released solely for research purposes if otherwise permitted by law\nand only if such identifier is encrypted and cannot be reasonably expected to\nreveal patient identities. No report published by the nonprofit organization,\nthe Commissioner, or other person may present information that reasonably could\nbe expected to reveal the identity of any patient. Publicly available\ninformation shall be designed to prevent persons from being able to gain access\nto combinations of patient characteristic data elements that reasonably could be\nexpected to reveal the identity of any patient. The nonprofit organization, in\nits discretion, may release physician and employer identifier information.\nOutpatient surgical charge data shall be made publicly available only pursuant\nto a review by the Joint Commission on Health Care.\n\nB. No person or entity, including the nonprofit organization contracting with\nthe Commissioner, shall be held liable in any civil action with respect to any\nreport or disclosure of information made under this article unless such person\nor entity has knowledge of any falsity of the information reported or disclosed.\n\nC. Any disclosure of information made in violation of this chapter shall be\nsubject to a civil penalty of not more than $5,000 per violation. This provision\nshall be enforceable upon petition to the appropriate circuit court by the\nAttorney General, any attorney for the Commonwealth, or any attorney for the\ncounty, city or town in which the violation occurred. Any penalty imposed shall\nbe payable to the Literary Fund. In addition, any person or entity who is the\nsubject of any disclosure in violation of this article shall be entitled to\ninitiate an action to recover actual damages, if any, or $500, whichever is\ngreater, together with reasonable attorney’s fees and court costs.\n\nHISTORY: 1996, c. 902; 2001, c. 341.","edition":{"id":1,"name":"2025","slug":"2025","date_created":"2026-06-21 22:39:22","date_modified":"2026-06-21 22:39:22","current":1,"order_by":1,"last_import":null}}