{"formats":[{"name":"JSON","format":"json","url":"\/downloads\/2025\/code-json\/38.2-613.json"},{"name":"Plain Text","format":"text","url":"\/downloads\/2025\/code-text\/38.2-613.txt"},{"name":"XML","format":"xml","url":"\/downloads\/2025\/code-xml\/38.2-613.xml"},{"name":"HTML","format":"html","url":"\/downloads\/2025\/code-html\/38.2-613.html"}],"law_id":55493,"edition_id":1,"section_id":55493,"structure_id":14255,"section_number":"38.2-613","catch_line":"Disclosure limitations and conditions","history":"1981, c. 389, \u00a7 38.1-57.16; 1986, c. 562; 1987, c. 325; 1996, c. 704; 2001, c. 371; 2020, c. 264.","full_text":"A\n\nAn insurance institution, agent, or insurance-support organization shall not disclose any medical-record information or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is with the written authorization of the individual, provided:1\n\nIf the authorization is submitted by another insurance institution, agent, or insurance-support organization, the authorization meets the requirements of § 38.2-606; or2\n\nIf the authorization is submitted by a person other than an insurance institution, agent, or insurance-support organization, the authorization is:\n\t\t\t\ta. Dated,\n\t\t\t\tb. Signed by the individual, and\n\t\t\t\tc. Obtained two years or less prior to the date a disclosure is sought pursuant to this subdivision.B\n\nNotwithstanding the provisions of subsection A, an insurance institution, agent, or insurance-support organization may disclose personal or privileged information about an individual collected or received in connection with an insurance transaction, without written authorization, if the disclosure is:1\n\nTo a person other than an insurance institution, agent, or insurance-support organization, provided the disclosure is reasonably necessary:\n\t\t\t\ta. To enable that person to perform a business, professional or insurance function for the disclosing insurance institution, agent, or insurance-support organization and that person agrees not to disclose the information further without the individual’s written authorization unless the further disclosure:1\n\nWould otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization; or2\n\nIs reasonably necessary for that person to perform its function for the disclosing insurance institution, agent, or insurance-support organization; or\n\t\t\t\t\tb. To enable that person to provide information to the disclosing insurance institution, agent, or insurance-support organization for the purpose of:1\n\nDetermining an individual’s eligibility for an insurance benefit or payment; or2\n\nDetecting or preventing criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with an insurance transaction; or2\n\nTo an insurance institution, agent, or insurance-support organization, or self-insurer, provided the information disclosed is limited to that which is reasonably necessary:\n\t\t\t\ta. To detect or prevent criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with insurance transactions; or\n\t\t\t\tb. For either the disclosing or receiving insurance institution, agent or insurance-support organization to perform its function in connection with an insurance transaction involving the individual; or3\n\nTo a medical-care institution or medical professional for the purpose of (i) verifying insurance coverage or benefits, (ii) informing an individual of a medical problem of which the individual may not be aware or (iii) conducting an operations or services audit, provided only that information is disclosed as is reasonably necessary to accomplish the foregoing purposes; or4\n\nTo an insurance regulatory authority; or5\n\nTo a law-enforcement or other government authority:\n\t\t\t\ta. To protect the interests of the insurance institution, agent or insurance-support organization in preventing or prosecuting the perpetration of fraud upon it; or\n\t\t\t\tb. If the insurance institution, agent, or insurance-support organization reasonably believes that illegal activities have been conducted by the individual; or\n\t\t\t\tc. Upon written request of any law-enforcement agency, for all insured or claimant information in the possession of an insurance institution, agent, or insurance-support organization which relates an ongoing criminal investigation. Such insurance institution, agent, or insurance-support organization shall release such information, including, but not limited to, policy information, premium payment records, record of prior claims by the insured or by another claimant, and information collected in connection with an insurance company’s investigation of an application or claim. Any information released to a law-enforcement agency pursuant to such request shall be treated as confidential criminal investigation information and not be disclosed further except as provided by law. Notwithstanding any provision in this article, no insurance institution, agent, or insurance-support organization shall notify any insured or claimant that information has been requested or supplied pursuant to this section prior to notification from the requesting law-enforcement agency that its criminal investigation is completed. Within ninety days following the completion of any such criminal investigation, the law-enforcement agency making such a request for information shall notify any insurance institution, agent, or insurance-support organization from whom information was requested that the criminal investigation has been completed; or6\n\nOtherwise permitted or required by law; or7\n\nIn response to a facially valid administrative or judicial order, including a search warrant or subpoena; or8\n\nMade for the purpose of conducting actuarial or research studies, provided:\n\t\t\t\ta. No individual may be identified in any actuarial or research report, and\n\t\t\t\tb. Materials allowing the individual to be identified are returned or destroyed as soon as they are no longer needed, and\n\t\t\t\tc. The actuarial or research organization agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization; or9\n\nTo a party or a representative of a party to a proposed or consummated sale, transfer, merger, or consolidation of all or part of the business of the insurance institution, agent, or insurance-support organization, provided:\n\t\t\t\ta. Prior to the consummation of the sale, transfer, merger, or consolidation only such information is disclosed as is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger, or consolidation, and\n\t\t\t\tb. The recipient agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization; or10\n\nTo a nonaffiliated third party whose only use of such information will be in connection with the marketing of a nonfinancial product or service, provided:\n\t\t\t\ta. No medical-record information, privileged information, or personal information relating to an individual’s character, personal habits, mode of living, or general reputation is disclosed, and no classification derived from the information is disclosed,\n\t\t\t\tb. The individual has been given an opportunity, in accordance with the provisions of subsection A of § 38.2-612.1, to indicate that he does not want financial information disclosed for marketing purposes and has given no indication that he does not want the information disclosed, and\n\t\t\t\tc. The nonaffiliated third party receiving such information agrees not to use it except in connection with the marketing of the product or service; or11\n\n(i) To a consumer reporting agency in accordance with the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) or (ii) from a consumer report reported by a consumer reporting agency; or12\n\nTo a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurance institution’s or agent’s operations or services, provided the information disclosed is reasonably necessary for the group policyholder to conduct the review or audit; or13\n\nTo a professional peer review organization for the purpose of reviewing the service or conduct of a medical-care institution or medical professional; or14\n\nTo a governmental authority for the purpose of determining the individual’s eligibility for health benefits for which the governmental authority may be liable; or15\n\nTo a certificate holder or policyholder for the purpose of providing information regarding the status of an insurance transaction; or16\n\nTo a lienholder, mortgagee, assignee, lessor or other person shown on the records of an insurance institution or agent as having a legal or beneficial interest in a policy of insurance, or to persons acting in a fiduciary or representative capacity on behalf of the individual, provided that:\n\t\t\t\ta. No medical record information is disclosed unless the disclosure would be permitted by this section; and\n\t\t\t\tb. The information disclosed is limited to that which is reasonably necessary to permit such person to protect his interest in the policy; or17\n\nNecessary to effect, administer, or enforce a transaction requested or authorized by the individual, or in connection with servicing or processing an insurance product or service requested or authorized by the individual, or necessary for reinsurance purposes, or for stop loss or excess loss agreements provided for in subsection B of § 38.2-109; or18\n\nPursuant to any federal Health Insurance Portability and Accountability Act privacy rules promulgated by the United States Department of Health and Human Services.C\n\nAn insurance institution, agent, or insurance-support organization may disclose information about an individual collected or received in connection with an insurance transaction, without written authorization, if the disclosure is:1\n\nTo a nonaffiliated third party whose only use of such information will be to perform services for or functions on behalf of the insurance institution in connection with the marketing of the insurance institution’s product or service or the marketing of products or services offered pursuant to a joint marketing agreement, provided:\n\t\t\t\ta. No medical-record information or privileged information is disclosed without the individual’s written authorization unless such disclosure is otherwise permitted by subsection B,\n\t\t\t\tb. With respect to financial information, the individual has been given the notice required by subsection B of § 38.2-604.1, and\n\t\t\t\tc. The person receiving such financial information agrees, by contract, (i) not to use it except to perform services for or functions on behalf of the insurance institution in connection with the marketing of the insurance institution’s product or service or the marketing of products or services offered pursuant to a joint marketing agreement, or as permitted under subsection B and (ii) to maintain the confidentiality of such information and not disclose it to any other nonaffiliated third party unless such disclosure would otherwise be permitted by this section if made by the insurance institution, agent, or insurance-support organization;2\n\nTo an affiliate, provided:\n\t\t\t\ta. No medical-record information or privileged information is disclosed without the individual’s written authorization unless such disclosure is otherwise permitted by subsection B, and\n\t\t\t\tb. The affiliate receiving the information does not disclose the information except as would otherwise be permitted by this section if such disclosure were made by the insurance institution, agent, or insurance-support organization.D\n\n1. No person proposing to issue, re-issue, or renew any policy, contract, or plan of accident and sickness insurance defined in \u00a7 38.2-109, but excluding disability income insurance, issued by any (i) insurer providing hospital, medical and surgical or major medical coverage on an expense incurred basis, (ii) corporation providing a health services plan, or (iii) health maintenance organization providing a health care plan for health care services shall disclose any genetic information about an individual or a member of such individual’s family collected or received in connection with any insurance transaction unless the disclosure is made with the written authorization of the individual.2\n\nFor the purpose of this subsection, “genetic information” means information about genes, gene products, or inherited characteristics that may derive from an individual or a family member.3\n\nAgents and insurance support organizations shall be subject to the provisions of this subsection to the extent of their participation in the issue, re-issue, or renewal of any policy, contract, or plan of accident and sickness insurance defined in § 38.2-109, but excluding disability income insurance.E\n\nAny notices, disclosures, or authorizations required by this section may be provided electronically if the individual agrees.F\n\nAny privileged information about an individual that is disclosed in violation of this section shall be available to that individual in accordance with the provisions of §§ 38.2-608 and 38.2-609.G\n\nExcept in the case of disclosures made pursuant to subdivision B 10, the requirements of subsection A of § 38.2-612.1 shall not apply when information is disclosed pursuant to this section.","order_by":null,"text":{"0":{"id":203396,"text":"An insurance institution, agent, or insurance-support organization shall not disclose any medical-record information or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is with the written authorization of the individual, provided:","type":"section","prefixes":["A"],"prefix":"A","entire_prefix":"A","prefix_anchor":"A","level":1,"next_prefix":"A1"},"1":{"id":203397,"text":"If the authorization is submitted by another insurance institution, agent, or insurance-support organization, the authorization meets the requirements of § 38.2-606; or","type":"section","prefixes":["A","1"],"prefix":"1","entire_prefix":"A1","prefix_anchor":"A1","level":2,"prior_prefix":"A","next_prefix":"A2"},"2":{"id":203398,"text":"If the authorization is submitted by a person other than an insurance institution, agent, or insurance-support organization, the authorization is:\n\t\t\t\ta. Dated,\n\t\t\t\tb. Signed by the individual, and\n\t\t\t\tc. Obtained two years or less prior to the date a disclosure is sought pursuant to this subdivision.","type":"section","prefixes":["A","2"],"prefix":"2","entire_prefix":"A2","prefix_anchor":"A2","level":2,"prior_prefix":"A1","next_prefix":"B"},"3":{"id":203399,"text":"Notwithstanding the provisions of subsection A, an insurance institution, agent, or insurance-support organization may disclose personal or privileged information about an individual collected or received in connection with an insurance transaction, without written authorization, if the disclosure is:","type":"section","prefixes":["B"],"prefix":"B","entire_prefix":"B","prefix_anchor":"B","level":1,"prior_prefix":"A2","next_prefix":"B1"},"4":{"id":203400,"text":"To a person other than an insurance institution, agent, or insurance-support organization, provided the disclosure is reasonably necessary:\n\t\t\t\ta. To enable that person to perform a business, professional or insurance function for the disclosing insurance institution, agent, or insurance-support organization and that person agrees not to disclose the information further without the individual’s written authorization unless the further disclosure:","type":"section","prefixes":["B","1"],"prefix":"1","entire_prefix":"B1","prefix_anchor":"B1","level":2,"prior_prefix":"B","next_prefix":"B11"},"5":{"id":203401,"text":"Would otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization; or","type":"section","prefixes":["B","1","1"],"prefix":"1","entire_prefix":"B11","prefix_anchor":"B11","level":3,"prior_prefix":"B1","next_prefix":"B12"},"6":{"id":203402,"text":"Is reasonably necessary for that person to perform its function for the disclosing insurance institution, agent, or insurance-support organization; or\n\t\t\t\t\tb. To enable that person to provide information to the disclosing insurance institution, agent, or insurance-support organization for the purpose of:","type":"section","prefixes":["B","1","2"],"prefix":"2","entire_prefix":"B12","prefix_anchor":"B12","level":3,"prior_prefix":"B11","next_prefix":"B11"},"7":{"id":203403,"text":"Determining an individual’s eligibility for an insurance benefit or payment; or","type":"section","prefixes":["B","1","1"],"prefix":"1","entire_prefix":"B11","prefix_anchor":"B11","level":3,"prior_prefix":"B12","next_prefix":"B12"},"8":{"id":203404,"text":"Detecting or preventing criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with an insurance transaction; or","type":"section","prefixes":["B","1","2"],"prefix":"2","entire_prefix":"B12","prefix_anchor":"B12","level":3,"prior_prefix":"B11","next_prefix":"B2"},"9":{"id":203405,"text":"To an insurance institution, agent, or insurance-support organization, or self-insurer, provided the information disclosed is limited to that which is reasonably necessary:\n\t\t\t\ta. To detect or prevent criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with insurance transactions; or\n\t\t\t\tb. For either the disclosing or receiving insurance institution, agent or insurance-support organization to perform its function in connection with an insurance transaction involving the individual; or","type":"section","prefixes":["B","2"],"prefix":"2","entire_prefix":"B2","prefix_anchor":"B2","level":2,"prior_prefix":"B12","next_prefix":"B3"},"10":{"id":203406,"text":"To a medical-care institution or medical professional for the purpose of (i) verifying insurance coverage or benefits, (ii) informing an individual of a medical problem of which the individual may not be aware or (iii) conducting an operations or services audit, provided only that information is disclosed as is reasonably necessary to accomplish the foregoing purposes; or","type":"section","prefixes":["B","3"],"prefix":"3","entire_prefix":"B3","prefix_anchor":"B3","level":2,"prior_prefix":"B2","next_prefix":"B4"},"11":{"id":203407,"text":"To an insurance regulatory authority; or","type":"section","prefixes":["B","4"],"prefix":"4","entire_prefix":"B4","prefix_anchor":"B4","level":2,"prior_prefix":"B3","next_prefix":"B5"},"12":{"id":203408,"text":"To a law-enforcement or other government authority:\n\t\t\t\ta. To protect the interests of the insurance institution, agent or insurance-support organization in preventing or prosecuting the perpetration of fraud upon it; or\n\t\t\t\tb. If the insurance institution, agent, or insurance-support organization reasonably believes that illegal activities have been conducted by the individual; or\n\t\t\t\tc. Upon written request of any law-enforcement agency, for all insured or claimant information in the possession of an insurance institution, agent, or insurance-support organization which relates an ongoing criminal investigation. Such insurance institution, agent, or insurance-support organization shall release such information, including, but not limited to, policy information, premium payment records, record of prior claims by the insured or by another claimant, and information collected in connection with an insurance company’s investigation of an application or claim. Any information released to a law-enforcement agency pursuant to such request shall be treated as confidential criminal investigation information and not be disclosed further except as provided by law. Notwithstanding any provision in this article, no insurance institution, agent, or insurance-support organization shall notify any insured or claimant that information has been requested or supplied pursuant to this section prior to notification from the requesting law-enforcement agency that its criminal investigation is completed. Within ninety days following the completion of any such criminal investigation, the law-enforcement agency making such a request for information shall notify any insurance institution, agent, or insurance-support organization from whom information was requested that the criminal investigation has been completed; or","type":"section","prefixes":["B","5"],"prefix":"5","entire_prefix":"B5","prefix_anchor":"B5","level":2,"prior_prefix":"B4","next_prefix":"B6"},"13":{"id":203409,"text":"Otherwise permitted or required by law; or","type":"section","prefixes":["B","6"],"prefix":"6","entire_prefix":"B6","prefix_anchor":"B6","level":2,"prior_prefix":"B5","next_prefix":"B7"},"14":{"id":203410,"text":"In response to a facially valid administrative or judicial order, including a search warrant or subpoena; or","type":"section","prefixes":["B","7"],"prefix":"7","entire_prefix":"B7","prefix_anchor":"B7","level":2,"prior_prefix":"B6","next_prefix":"B8"},"15":{"id":203411,"text":"Made for the purpose of conducting actuarial or research studies, provided:\n\t\t\t\ta. No individual may be identified in any actuarial or research report, and\n\t\t\t\tb. Materials allowing the individual to be identified are returned or destroyed as soon as they are no longer needed, and\n\t\t\t\tc. The actuarial or research organization agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization; or","type":"section","prefixes":["B","8"],"prefix":"8","entire_prefix":"B8","prefix_anchor":"B8","level":2,"prior_prefix":"B7","next_prefix":"B9"},"16":{"id":203412,"text":"To a party or a representative of a party to a proposed or consummated sale, transfer, merger, or consolidation of all or part of the business of the insurance institution, agent, or insurance-support organization, provided:\n\t\t\t\ta. Prior to the consummation of the sale, transfer, merger, or consolidation only such information is disclosed as is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger, or consolidation, and\n\t\t\t\tb. The recipient agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization; or","type":"section","prefixes":["B","9"],"prefix":"9","entire_prefix":"B9","prefix_anchor":"B9","level":2,"prior_prefix":"B8","next_prefix":"B10"},"17":{"id":203413,"text":"To a nonaffiliated third party whose only use of such information will be in connection with the marketing of a nonfinancial product or service, provided:\n\t\t\t\ta. No medical-record information, privileged information, or personal information relating to an individual’s character, personal habits, mode of living, or general reputation is disclosed, and no classification derived from the information is disclosed,\n\t\t\t\tb. The individual has been given an opportunity, in accordance with the provisions of subsection A of § 38.2-612.1, to indicate that he does not want financial information disclosed for marketing purposes and has given no indication that he does not want the information disclosed, and\n\t\t\t\tc. The nonaffiliated third party receiving such information agrees not to use it except in connection with the marketing of the product or service; or","type":"section","prefixes":["B","10"],"prefix":"10","entire_prefix":"B10","prefix_anchor":"B10","level":2,"prior_prefix":"B9","next_prefix":"B11"},"18":{"id":203414,"text":"(i) To a consumer reporting agency in accordance with the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) or (ii) from a consumer report reported by a consumer reporting agency; or","type":"section","prefixes":["B","11"],"prefix":"11","entire_prefix":"B11","prefix_anchor":"B11","level":2,"prior_prefix":"B10","next_prefix":"B12"},"19":{"id":203415,"text":"To a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurance institution’s or agent’s operations or services, provided the information disclosed is reasonably necessary for the group policyholder to conduct the review or audit; or","type":"section","prefixes":["B","12"],"prefix":"12","entire_prefix":"B12","prefix_anchor":"B12","level":2,"prior_prefix":"B11","next_prefix":"B13"},"20":{"id":203416,"text":"To a professional peer review organization for the purpose of reviewing the service or conduct of a medical-care institution or medical professional; or","type":"section","prefixes":["B","13"],"prefix":"13","entire_prefix":"B13","prefix_anchor":"B13","level":2,"prior_prefix":"B12","next_prefix":"B14"},"21":{"id":203417,"text":"To a governmental authority for the purpose of determining the individual’s eligibility for health benefits for which the governmental authority may be liable; or","type":"section","prefixes":["B","14"],"prefix":"14","entire_prefix":"B14","prefix_anchor":"B14","level":2,"prior_prefix":"B13","next_prefix":"B15"},"22":{"id":203418,"text":"To a certificate holder or policyholder for the purpose of providing information regarding the status of an insurance transaction; or","type":"section","prefixes":["B","15"],"prefix":"15","entire_prefix":"B15","prefix_anchor":"B15","level":2,"prior_prefix":"B14","next_prefix":"B16"},"23":{"id":203419,"text":"To a lienholder, mortgagee, assignee, lessor or other person shown on the records of an insurance institution or agent as having a legal or beneficial interest in a policy of insurance, or to persons acting in a fiduciary or representative capacity on behalf of the individual, provided that:\n\t\t\t\ta. No medical record information is disclosed unless the disclosure would be permitted by this section; and\n\t\t\t\tb. The information disclosed is limited to that which is reasonably necessary to permit such person to protect his interest in the policy; or","type":"section","prefixes":["B","16"],"prefix":"16","entire_prefix":"B16","prefix_anchor":"B16","level":2,"prior_prefix":"B15","next_prefix":"B17"},"24":{"id":203420,"text":"Necessary to effect, administer, or enforce a transaction requested or authorized by the individual, or in connection with servicing or processing an insurance product or service requested or authorized by the individual, or necessary for reinsurance purposes, or for stop loss or excess loss agreements provided for in subsection B of § 38.2-109; or","type":"section","prefixes":["B","17"],"prefix":"17","entire_prefix":"B17","prefix_anchor":"B17","level":2,"prior_prefix":"B16","next_prefix":"B18"},"25":{"id":203421,"text":"Pursuant to any federal Health Insurance Portability and Accountability Act privacy rules promulgated by the United States Department of Health and Human Services.","type":"section","prefixes":["B","18"],"prefix":"18","entire_prefix":"B18","prefix_anchor":"B18","level":2,"prior_prefix":"B17","next_prefix":"C"},"26":{"id":203422,"text":"An insurance institution, agent, or insurance-support organization may disclose information about an individual collected or received in connection with an insurance transaction, without written authorization, if the disclosure is:","type":"section","prefixes":["C"],"prefix":"C","entire_prefix":"C","prefix_anchor":"C","level":1,"prior_prefix":"B18","next_prefix":"C1"},"27":{"id":203423,"text":"To a nonaffiliated third party whose only use of such information will be to perform services for or functions on behalf of the insurance institution in connection with the marketing of the insurance institution’s product or service or the marketing of products or services offered pursuant to a joint marketing agreement, provided:\n\t\t\t\ta. No medical-record information or privileged information is disclosed without the individual’s written authorization unless such disclosure is otherwise permitted by subsection B,\n\t\t\t\tb. With respect to financial information, the individual has been given the notice required by subsection B of § 38.2-604.1, and\n\t\t\t\tc. The person receiving such financial information agrees, by contract, (i) not to use it except to perform services for or functions on behalf of the insurance institution in connection with the marketing of the insurance institution’s product or service or the marketing of products or services offered pursuant to a joint marketing agreement, or as permitted under subsection B and (ii) to maintain the confidentiality of such information and not disclose it to any other nonaffiliated third party unless such disclosure would otherwise be permitted by this section if made by the insurance institution, agent, or insurance-support organization;","type":"section","prefixes":["C","1"],"prefix":"1","entire_prefix":"C1","prefix_anchor":"C1","level":2,"prior_prefix":"C","next_prefix":"C2"},"28":{"id":203424,"text":"To an affiliate, provided:\n\t\t\t\ta. No medical-record information or privileged information is disclosed without the individual’s written authorization unless such disclosure is otherwise permitted by subsection B, and\n\t\t\t\tb. The affiliate receiving the information does not disclose the information except as would otherwise be permitted by this section if such disclosure were made by the insurance institution, agent, or insurance-support organization.","type":"section","prefixes":["C","2"],"prefix":"2","entire_prefix":"C2","prefix_anchor":"C2","level":2,"prior_prefix":"C1","next_prefix":"D"},"29":{"id":203425,"text":"1. No person proposing to issue, re-issue, or renew any policy, contract, or plan of accident and sickness insurance defined in \u00a7 38.2-109, but excluding disability income insurance, issued by any (i) insurer providing hospital, medical and surgical or major medical coverage on an expense incurred basis, (ii) corporation providing a health services plan, or (iii) health maintenance organization providing a health care plan for health care services shall disclose any genetic information about an individual or a member of such individual’s family collected or received in connection with any insurance transaction unless the disclosure is made with the written authorization of the individual.","type":"section","prefixes":["D"],"prefix":"D","entire_prefix":"D","prefix_anchor":"D","level":1,"prior_prefix":"C2","next_prefix":"D2"},"30":{"id":203426,"text":"For the purpose of this subsection, “genetic information” means information about genes, gene products, or inherited characteristics that may derive from an individual or a family member.","type":"section","prefixes":["D","2"],"prefix":"2","entire_prefix":"D2","prefix_anchor":"D2","level":2,"prior_prefix":"D","next_prefix":"D3"},"31":{"id":203427,"text":"Agents and insurance support organizations shall be subject to the provisions of this subsection to the extent of their participation in the issue, re-issue, or renewal of any policy, contract, or plan of accident and sickness insurance defined in § 38.2-109, but excluding disability income insurance.","type":"section","prefixes":["D","3"],"prefix":"3","entire_prefix":"D3","prefix_anchor":"D3","level":2,"prior_prefix":"D2","next_prefix":"E"},"32":{"id":203428,"text":"Any notices, disclosures, or authorizations required by this section may be provided electronically if the individual agrees.","type":"section","prefixes":["E"],"prefix":"E","entire_prefix":"E","prefix_anchor":"E","level":1,"prior_prefix":"D3","next_prefix":"F"},"33":{"id":203429,"text":"Any privileged information about an individual that is disclosed in violation of this section shall be available to that individual in accordance with the provisions of §§ 38.2-608 and 38.2-609.","type":"section","prefixes":["F"],"prefix":"F","entire_prefix":"F","prefix_anchor":"F","level":1,"prior_prefix":"E","next_prefix":"G"},"34":{"id":203430,"text":"Except in the case of disclosures made pursuant to subdivision B 10, the requirements of subsection A of § 38.2-612.1 shall not apply when information is disclosed pursuant to this section.","type":"section","prefixes":["G"],"prefix":"G","entire_prefix":"G","prefix_anchor":"G","level":1,"prior_prefix":"F"}},"ancestry":[{"id":14255,"edition_id":1,"name":"Collection, Use, and Dissemination of Information","identifier":"1","label":"article","depth":3,"order_by":1,"parent_id":12922,"metadata":{},"date_created":"2026-06-26 03:47:28","date_modified":"2026-06-26 03:47:28","permalink":{"id":218015,"object_type":"structure","relational_id":14255,"identifier":"1","token":"38.2\/6\/1","url":"\/38.2\/6\/1\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12922,"edition_id":1,"name":"Insurance Information and Privacy Protection","identifier":"6","label":"chapter","depth":2,"order_by":1,"parent_id":12698,"metadata":{},"date_created":"2026-06-26 03:44:01","date_modified":"2026-06-26 03:44:01","permalink":{"id":218013,"object_type":"structure","relational_id":12922,"identifier":"6","token":"38.2\/6","url":"\/38.2\/6\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12698,"edition_id":1,"name":"Insurance","identifier":"38.2","label":"title","depth":1,"order_by":1,"parent_id":null,"metadata":{},"date_created":"2026-06-26 03:43:49","date_modified":"2026-06-26 03:43:49","permalink":{"id":210661,"object_type":"structure","relational_id":12698,"identifier":"38.2","token":"38.2","url":"\/38.2\/","edition_id":1,"permalink":0,"preferred":1}}],"structure_contents":[{"id":64742,"structure_id":14255,"section_number":"38.2-600","catch_line":"Purposes","url":"\/38.2-600\/","token":"38.2\/6\/1\/38.2-600","metadata":false},{"id":61470,"structure_id":14255,"section_number":"38.2-601","catch_line":"Application of article","url":"\/38.2-601\/","token":"38.2\/6\/1\/38.2-601","metadata":false},{"id":73837,"structure_id":14255,"section_number":"38.2-602","catch_line":"Definitions","url":"\/38.2-602\/","token":"38.2\/6\/1\/38.2-602","metadata":false},{"id":63985,"structure_id":14255,"section_number":"38.2-603","catch_line":"Pretext interviews","url":"\/38.2-603\/","token":"38.2\/6\/1\/38.2-603","metadata":false},{"id":85852,"structure_id":14255,"section_number":"38.2-604","catch_line":"Notice of information collection and disclosure practices","url":"\/38.2-604\/","token":"38.2\/6\/1\/38.2-604","metadata":false},{"id":64388,"structure_id":14255,"section_number":"38.2-604.1","catch_line":"Notice of financial information collection and disclosure practices","url":"\/38.2-604.1\/","token":"38.2\/6\/1\/38.2-604.1","metadata":false},{"id":79870,"structure_id":14255,"section_number":"38.2-605","catch_line":"Marketing and research surveys","url":"\/38.2-605\/","token":"38.2\/6\/1\/38.2-605","metadata":false},{"id":64763,"structure_id":14255,"section_number":"38.2-606","catch_line":"Content of disclosure authorization forms","url":"\/38.2-606\/","token":"38.2\/6\/1\/38.2-606","metadata":false},{"id":69670,"structure_id":14255,"section_number":"38.2-607","catch_line":"Investigative consumer reports","url":"\/38.2-607\/","token":"38.2\/6\/1\/38.2-607","metadata":false},{"id":81752,"structure_id":14255,"section_number":"38.2-608","catch_line":"Access to recorded personal information","url":"\/38.2-608\/","token":"38.2\/6\/1\/38.2-608","metadata":false},{"id":56196,"structure_id":14255,"section_number":"38.2-609","catch_line":"Correction, amendment, or deletion of recorded personal information","url":"\/38.2-609\/","token":"38.2\/6\/1\/38.2-609","metadata":false},{"id":83133,"structure_id":14255,"section_number":"38.2-610","catch_line":"Notice of adverse underwriting decision; furnishing reasons for decisions and sources of information","url":"\/38.2-610\/","token":"38.2\/6\/1\/38.2-610","metadata":false},{"id":77789,"structure_id":14255,"section_number":"38.2-611","catch_line":"Information concerning previous adverse underwriting decisions","url":"\/38.2-611\/","token":"38.2\/6\/1\/38.2-611","metadata":false},{"id":60819,"structure_id":14255,"section_number":"38.2-612","catch_line":"Bases for adverse underwriting decisions","url":"\/38.2-612\/","token":"38.2\/6\/1\/38.2-612","metadata":false},{"id":64433,"structure_id":14255,"section_number":"38.2-612.1","catch_line":"Special requirements for providing financial information to nonaffiliated third parties","url":"\/38.2-612.1\/","token":"38.2\/6\/1\/38.2-612.1","metadata":false},{"id":56355,"structure_id":14255,"section_number":"38.2-612.2","catch_line":"Protection of the Fair Credit Reporting Act","url":"\/38.2-612.2\/","token":"38.2\/6\/1\/38.2-612.2","metadata":false},{"id":55493,"structure_id":14255,"section_number":"38.2-613","catch_line":"Disclosure limitations and conditions","url":"\/38.2-613\/","token":"38.2\/6\/1\/38.2-613","metadata":false},{"id":85509,"structure_id":14255,"section_number":"38.2-613.01","catch_line":"Commission to promulgate regulations on disclosure of certain medical test results to insurance applicants","url":"\/38.2-613.01\/","token":"38.2\/6\/1\/38.2-613.01","metadata":false},{"id":58399,"structure_id":14255,"section_number":"38.2-613.1","catch_line":"Disclosure of agent's moratorium required","url":"\/38.2-613.1\/","token":"38.2\/6\/1\/38.2-613.1","metadata":false},{"id":73940,"structure_id":14255,"section_number":"38.2-613.2","catch_line":"Repealed","url":"\/38.2-613.2\/","token":"38.2\/6\/1\/38.2-613.2","metadata":false},{"id":78057,"structure_id":14255,"section_number":"38.2-614","catch_line":"Powers of Commission","url":"\/38.2-614\/","token":"38.2\/6\/1\/38.2-614","metadata":false},{"id":84055,"structure_id":14255,"section_number":"38.2-615","catch_line":"Hearings and procedures","url":"\/38.2-615\/","token":"38.2\/6\/1\/38.2-615","metadata":false},{"id":68943,"structure_id":14255,"section_number":"38.2-616","catch_line":"Service of process on insurance-support organizations","url":"\/38.2-616\/","token":"38.2\/6\/1\/38.2-616","metadata":false},{"id":73310,"structure_id":14255,"section_number":"38.2-617","catch_line":"Individual remedies","url":"\/38.2-617\/","token":"38.2\/6\/1\/38.2-617","metadata":false},{"id":67050,"structure_id":14255,"section_number":"38.2-618","catch_line":"Immunity of persons disclosing information","url":"\/38.2-618\/","token":"38.2\/6\/1\/38.2-618","metadata":false},{"id":79983,"structure_id":14255,"section_number":"38.2-619","catch_line":"Obtaining information under false pretenses","url":"\/38.2-619\/","token":"38.2\/6\/1\/38.2-619","metadata":false},{"id":78715,"structure_id":14255,"section_number":"38.2-620","catch_line":"Repealed","url":"\/38.2-620\/","token":"38.2\/6\/1\/38.2-620","metadata":false}],"previous_section":{"id":56355,"structure_id":14255,"section_number":"38.2-612.2","catch_line":"Protection of the Fair Credit Reporting Act","url":"\/38.2-612.2\/","token":"38.2\/6\/1\/38.2-612.2","metadata":false},"next_section":{"id":85509,"structure_id":14255,"section_number":"38.2-613.01","catch_line":"Commission to promulgate regulations on disclosure of certain medical test results to insurance applicants","url":"\/38.2-613.01\/","token":"38.2\/6\/1\/38.2-613.01","metadata":false},"metadata":false,"official_url":"https:\/\/law.lis.virginia.gov\/vacode\/38.2-613\/","history_text":"

This law was first created in 1981. The record of its establishment is cataloged in chapter 389 of that year\u2019s edition of \u201cActs of Assembly,\u201d the annual state publication listing all changes made to the Code of Virginia in that year. Unfortunately, the 1981 \u201cActs\u201d aren\u2019t available online. It has been modified 5 times. Those modifications are cataloged by \u201cThe Acts of Assembly,\u201d a state publication, by year and chapter. Those modifications that can be read on the General Assembly\u2019s website will be linked accordingly. Those modifications are as follows: in 1986, chapter 562; in 1987, chapter 325; in 1996, chapter 704<\/a>; in 2001, chapter 371<\/a>; in 2020, chapter 264<\/a>.<\/p>","references":[{"id":74749,"section_number":"38.2-3456","catch_line":"Prohibited activities","order_by":null,"url":"\/38.2-3456\/"},{"id":73837,"section_number":"38.2-602","catch_line":"Definitions","order_by":null,"url":"\/38.2-602\/"},{"id":85852,"section_number":"38.2-604","catch_line":"Notice of information collection and disclosure practices","order_by":null,"url":"\/38.2-604\/"},{"id":64388,"section_number":"38.2-604.1","catch_line":"Notice of financial information collection and disclosure practices","order_by":null,"url":"\/38.2-604.1\/"},{"id":64433,"section_number":"38.2-612.1","catch_line":"Special requirements for providing financial information to nonaffiliated third parties","order_by":null,"url":"\/38.2-612.1\/"},{"id":73310,"section_number":"38.2-617","catch_line":"Individual remedies","order_by":null,"url":"\/38.2-617\/"},{"id":86136,"section_number":"52-41","catch_line":"Receipt of information; immunity from liability","order_by":null,"url":"\/52-41\/"}],"refers_to":[{"id":75359,"section_number":"38.2-109","catch_line":"Accident and sickness","order_by":null,"url":"\/38.2-109\/"},{"id":64388,"section_number":"38.2-604.1","catch_line":"Notice of financial information collection and disclosure practices","order_by":null,"url":"\/38.2-604.1\/"},{"id":64763,"section_number":"38.2-606","catch_line":"Content of disclosure authorization forms","order_by":null,"url":"\/38.2-606\/"},{"id":81752,"section_number":"38.2-608","catch_line":"Access to recorded personal information","order_by":null,"url":"\/38.2-608\/"},{"id":64433,"section_number":"38.2-612.1","catch_line":"Special requirements for providing financial information to nonaffiliated third parties","order_by":null,"url":"\/38.2-612.1\/"}],"permalink":{"id":218081,"object_type":"law","relational_id":55493,"identifier":"38.2-613","token":"38.2\/6\/1\/38.2-613","url":"\/38.2-613\/","edition_id":1,"permalink":0,"preferred":1},"url":"\/38.2-613\/","token":"38.2\/6\/1\/38.2-613","dublin_core":{"Title":"Disclosure limitations and conditions","Type":"Text","Format":"text\/html","Identifier":"\u00a7 38.2-613","Relation":"Code of Virginia"},"html":"\n\t\t\t\t\t\t

A.<\/span> An insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span> shall not disclose any medical-record information<\/span> or privileged information<\/span> about an individual<\/span> collected or received in connection with an insurance transaction<\/span> unless the disclosure is with the written authorization of the individual<\/span>, provided: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> If the authorization is submitted by another insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span>, the authorization meets the requirements of § 38.2-606<\/a>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> If the authorization is submitted by a person<\/span> other than an insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span>, the authorization is:\n\t\t\t\ta. Dated,\n\t\t\t\tb. Signed by the individual<\/span>, and\n\t\t\t\tc. Obtained two years or less prior to the date a disclosure is sought pursuant to this subdivision. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

B.<\/span> Notwithstanding the provisions of subsection A, an insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span> may disclose personal or privileged information<\/span> about an individual<\/span> collected or received in connection with an insurance transaction<\/span>, without written authorization, if the disclosure is: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> To a person<\/span> other than an insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span>, provided the disclosure is reasonably necessary:\n\t\t\t\ta. To enable that person<\/span> to perform a business, professional or insurance function for the disclosing insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span> and that person<\/span> agrees not to disclose the information further without the individual<\/span>’s written authorization unless the further disclosure: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Would otherwise be permitted by this section if made by an insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Is reasonably necessary for that person<\/span> to perform its function for the disclosing insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span>; or\n\t\t\t\t\tb. To enable that person<\/span> to provide information to the disclosing insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span> for the purpose of: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Determining an individual<\/span>’s eligibility for an insurance benefit or payment; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Detecting or preventing criminal activity, fraud<\/span>, material<\/span> misrepresentation, or material<\/span> nondisclosure in connection with an insurance transaction<\/span>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> To an insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span>, or self-insurer<\/span>, provided the information disclosed is limited to that which is reasonably necessary:\n\t\t\t\ta. To detect or prevent criminal activity, fraud<\/span>, material<\/span> misrepresentation, or material<\/span> nondisclosure in connection with insurance transactions<\/span>; or\n\t\t\t\tb. For either the disclosing or receiving insurance institution<\/span>, agent<\/span> or insurance-support organization<\/span> to perform its function in connection with an insurance transaction<\/span> involving the individual<\/span>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> To a medical-care institution<\/span> or medical professional<\/span> for the purpose of (i) verifying insurance coverage or benefits, (ii) informing an individual<\/span> of a medical problem of which the individual<\/span> may not be aware or (iii) conducting an operations or services audit, provided only that information is disclosed as is reasonably necessary to accomplish the foregoing purposes; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> To an insurance regulatory authority; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

5.<\/span> To a law<\/span>-enforcement or other government authority:\n\t\t\t\ta. To protect the interests of the insurance institution<\/span>, agent<\/span> or insurance-support organization<\/span> in preventing or prosecuting the perpetration of fraud<\/span> upon it; or\n\t\t\t\tb. If the insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span> reasonably believes that illegal activities have been conducted by the individual<\/span>; or\n\t\t\t\tc. Upon written request of any law<\/span>-enforcement agency, for all insured or claimant information in the possession<\/span> of an insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span> which relates an ongoing criminal investigation. Such insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span> shall release such information, including, but not limited to, policy information, premium payment records, record of prior claims by the insured or by another claimant, and information collected in connection with an insurance company<\/span>’s investigation of an application or claim. Any information released to a law<\/span>-enforcement agency pursuant to such request shall be treated as confidential criminal investigation information and not be disclosed further except as provided by law<\/span>. Notwithstanding any provision in this article, no insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span> shall notify any insured or claimant that information has been requested or supplied pursuant to this section prior to notification from the requesting law<\/span>-enforcement agency that its criminal investigation is completed. Within ninety days following the completion of any such criminal investigation, the law<\/span>-enforcement agency making such a request for information shall notify any insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span> from whom information was requested that the criminal investigation has been completed; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

6.<\/span> Otherwise permitted or required by law<\/span>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

7.<\/span> In response to a facially valid administrative or judicial order<\/span>, including a search warrant<\/span> or subpoena<\/span>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

8.<\/span> Made for the purpose of conducting actuarial or research studies, provided:\n\t\t\t\ta. No individual<\/span> may be identified in any actuarial or research report, and\n\t\t\t\tb. Materials<\/span> allowing the individual<\/span> to be identified are returned or destroyed as soon as they are no longer needed, and\n\t\t\t\tc. The actuarial or research organization agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

9.<\/span> To a party<\/span> or a representative of a party<\/span> to a proposed or consummated sale, transfer, merger, or consolidation<\/span> of all or part of the business of the insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span>, provided:\n\t\t\t\ta. Prior to the consummation of the sale, transfer, merger, or consolidation<\/span> only such information is disclosed as is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger, or consolidation<\/span>, and\n\t\t\t\tb. The recipient agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

10.<\/span> To a nonaffiliated third party<\/span> whose only use of such information will be in connection with the marketing of a nonfinancial product or service, provided:\n\t\t\t\ta. No medical-record information<\/span>, privileged information<\/span>, or personal information<\/span> relating to an individual<\/span>’s character, personal habits, mode of living, or general reputation is disclosed, and no classification derived from the information is disclosed,\n\t\t\t\tb. The individual<\/span> has been given an opportunity, in accordance with the provisions of subsection A of § 38.2-612.1<\/a>, to indicate that he does not want financial information<\/span> disclosed for marketing purposes and has given no indication that he does not want the information disclosed, and\n\t\t\t\tc. The nonaffiliated third party<\/span> receiving such information agrees not to use it except in connection with the marketing of the product or service; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

11.<\/span> (i) To a consumer reporting agency<\/span> in accordance with the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) or (ii) from a consumer report<\/span> reported by a consumer reporting agency<\/span>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

12.<\/span> To a group policyholder<\/span> for the purpose of reporting claims experience or conducting an audit of the insurance institution<\/span>’s or agent<\/span>’s operations or services, provided the information disclosed is reasonably necessary for the group policyholder<\/span> to conduct the review or audit; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

13.<\/span> To a professional peer review organization for the purpose of reviewing the service or conduct of a medical-care institution<\/span> or medical professional<\/span>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

14.<\/span> To a governmental authority for the purpose of determining the individual<\/span>’s eligibility for health benefits for which the governmental authority may be liable; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

15.<\/span> To a certificate holder or policyholder<\/span> for the purpose of providing information regarding the status of an insurance transaction<\/span>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

16.<\/span> To a lienholder, mortgagee, assignee, lessor or other person<\/span> shown on the records of an insurance institution<\/span> or agent<\/span> as having a legal or beneficial interest in a policy of insurance, or to persons<\/span> acting in a fiduciary or representative capacity on behalf of the individual<\/span>, provided that:\n\t\t\t\ta. No medical record information is disclosed unless the disclosure would be permitted by this section; and\n\t\t\t\tb. The information disclosed is limited to that which is reasonably necessary to permit such person<\/span> to protect his interest in the policy; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

17.<\/span> Necessary to effect, administer, or enforce a transaction requested or authorized by the individual<\/span>, or in connection with servicing or processing an insurance product or service requested or authorized by the individual<\/span>, or necessary for reinsurance purposes, or for stop loss or excess loss agreements provided for in subsection B of § 38.2-109<\/a>; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

18.<\/span> Pursuant to any federal Health Insurance Portability and Accountability Act privacy rules promulgated by the United States<\/span> Department of Health and Human Services. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

C.<\/span> An insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span> may disclose information about an individual<\/span> collected or received in connection with an insurance transaction<\/span>, without written authorization, if the disclosure is: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> To a nonaffiliated third party<\/span> whose only use of such information will be to perform services for or functions on behalf of the insurance institution<\/span> in connection with the marketing of the insurance institution<\/span>’s product or service or the marketing of products or services offered pursuant to a joint marketing agreement<\/span>, provided:\n\t\t\t\ta. No medical-record information<\/span> or privileged information<\/span> is disclosed without the individual<\/span>’s written authorization unless such disclosure is otherwise permitted by subsection B,\n\t\t\t\tb. With respect to financial information<\/span>, the individual<\/span> has been given the notice required by subsection B of § 38.2-604.1<\/a>, and\n\t\t\t\tc. The person<\/span> receiving such financial information<\/span> agrees, by contract<\/span>, (i) not to use it except to perform services for or functions on behalf of the insurance institution<\/span> in connection with the marketing of the insurance institution<\/span>’s product or service or the marketing of products or services offered pursuant to a joint marketing agreement<\/span>, or as permitted under subsection B and (ii) to maintain the confidentiality of such information and not disclose it to any other nonaffiliated third party<\/span> unless such disclosure would otherwise be permitted by this section if made by the insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> To an affiliate<\/span>, provided:\n\t\t\t\ta. No medical-record information<\/span> or privileged information<\/span> is disclosed without the individual<\/span>’s written authorization unless such disclosure is otherwise permitted by subsection B, and\n\t\t\t\tb. The affiliate<\/span> receiving the information does not disclose the information except as would otherwise be permitted by this section if such disclosure were made by the insurance institution<\/span>, agent<\/span>, or insurance-support organization<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

D.<\/span> 1. No person<\/span> proposing to issue<\/span>, re-issue<\/span>, or renew any policy, contract<\/span>, or plan of accident and sickness insurance defined in \u00a7 38.2-109<\/a>, but excluding disability income insurance, issued by any (i) insurer<\/span> providing hospital, medical and surgical or major medical coverage on an expense incurred basis, (ii) corporation providing a health services plan<\/span>, or (iii) health maintenance organization providing a health care plan for health care services shall disclose any genetic information<\/span> about an individual<\/span> or a member of such individual<\/span>’s family collected or received in connection with any insurance transaction<\/span> unless the disclosure is made with the written authorization of the individual<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> For the purpose of this subsection, “genetic information<\/span>” means information about genes, gene products, or inherited characteristics that may derive from an individual<\/span> or a family member. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Agents<\/span> and insurance support organizations shall be subject to the provisions of this subsection to the extent of their participation in the issue<\/span>, re-issue<\/span>, or renewal of any policy, contract<\/span>, or plan of accident and sickness insurance defined in § 38.2-109<\/a>, but excluding disability income insurance. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

E.<\/span> Any notices, disclosures, or authorizations required by this section may be provided electronically if the individual<\/span> agrees. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

F.<\/span> Any privileged information<\/span> about an individual<\/span> that is disclosed in violation of this section shall be available to that individual<\/span> in accordance with the provisions of §§ 38.2-608<\/a> and 38.2-609<\/a>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

G.<\/span> Except in the case of disclosures made pursuant to subdivision B 10, the requirements of subsection A of § 38.2-612.1<\/a> shall not apply when information is disclosed pursuant to this section. <\/i><\/a><\/p><\/section>","plain_text":" CODE OF VIRGINIA\n\nDISCLOSURE LIMITATIONS AND CONDITIONS (\u00a7 38.2-613)\n\nA. An insurance institution, agent, or insurance-support organization shall not\ndisclose any medical-record information or privileged information about an\nindividual collected or received in connection with an insurance transaction\nunless the disclosure is with the written authorization of the individual,\nprovided:\n\n 1. If the authorization is submitted by another insurance institution, agent,\n or insurance-support organization, the authorization meets the requirements of\n § 38.2-606; or\n\n 2. If the authorization is submitted by a person other than an insurance\n institution, agent, or insurance-support organization, the authorization is:\n \t\t\t\ta. Dated,\n \t\t\t\tb. Signed by the individual, and\n \t\t\t\tc. Obtained two years or less prior to the date a disclosure is sought\n pursuant to this subdivision.\n\nB. Notwithstanding the provisions of subsection A, an insurance institution,\nagent, or insurance-support organization may disclose personal or privileged\ninformation about an individual collected or received in connection with an\ninsurance transaction, without written authorization, if the disclosure is:\n\n 1. To a person other than an insurance institution, agent, or\n insurance-support organization, provided the disclosure is reasonably\n necessary:\n \t\t\t\ta. To enable that person to perform a business, professional or insurance\n function for the disclosing insurance institution, agent, or insurance-support\n organization and that person agrees not to disclose the information further\n without the individual’s written authorization unless the further\n disclosure:\n\n 1. Would otherwise be permitted by this section if made by an insurance\n institution, agent, or insurance-support organization; or\n\n 2. Is reasonably necessary for that person to perform its function for the\n disclosing insurance institution, agent, or insurance-support organization;\n or\n \t\t\t\t\tb. To enable that person to provide information to the disclosing\n insurance institution, agent, or insurance-support organization for the\n purpose of:\n\n 1. Determining an individual’s eligibility for an insurance benefit or\n payment; or\n\n 2. Detecting or preventing criminal activity, fraud, material\n misrepresentation, or material nondisclosure in connection with an insurance\n transaction; or\n\n 2. To an insurance institution, agent, or insurance-support organization, or\n self-insurer, provided the information disclosed is limited to that which is\n reasonably necessary:\n \t\t\t\ta. To detect or prevent criminal activity, fraud, material\n misrepresentation, or material nondisclosure in connection with insurance\n transactions; or\n \t\t\t\tb. For either the disclosing or receiving insurance institution, agent or\n insurance-support organization to perform its function in connection with an\n insurance transaction involving the individual; or\n\n 3. To a medical-care institution or medical professional for the purpose of\n (i) verifying insurance coverage or benefits, (ii) informing an individual of\n a medical problem of which the individual may not be aware or (iii) conducting\n an operations or services audit, provided only that information is disclosed\n as is reasonably necessary to accomplish the foregoing purposes; or\n\n 4. To an insurance regulatory authority; or\n\n 5. To a law-enforcement or other government authority:\n \t\t\t\ta. To protect the interests of the insurance institution, agent or\n insurance-support organization in preventing or prosecuting the perpetration\n of fraud upon it; or\n \t\t\t\tb. If the insurance institution, agent, or insurance-support organization\n reasonably believes that illegal activities have been conducted by the\n individual; or\n \t\t\t\tc. Upon written request of any law-enforcement agency, for all insured or\n claimant information in the possession of an insurance institution, agent, or\n insurance-support organization which relates an ongoing criminal\n investigation. Such insurance institution, agent, or insurance-support\n organization shall release such information, including, but not limited to,\n policy information, premium payment records, record of prior claims by the\n insured or by another claimant, and information collected in connection with\n an insurance company’s investigation of an application or claim. Any\n information released to a law-enforcement agency pursuant to such request\n shall be treated as confidential criminal investigation information and not be\n disclosed further except as provided by law. Notwithstanding any provision in\n this article, no insurance institution, agent, or insurance-support\n organization shall notify any insured or claimant that information has been\n requested or supplied pursuant to this section prior to notification from the\n requesting law-enforcement agency that its criminal investigation is\n completed. Within ninety days following the completion of any such criminal\n investigation, the law-enforcement agency making such a request for\n information shall notify any insurance institution, agent, or\n insurance-support organization from whom information was requested that the\n criminal investigation has been completed; or\n\n 6. Otherwise permitted or required by law; or\n\n 7. In response to a facially valid administrative or judicial order, including\n a search warrant or subpoena; or\n\n 8. Made for the purpose of conducting actuarial or research studies, provided:\n \t\t\t\ta. No individual may be identified in any actuarial or research report,\n and\n \t\t\t\tb. Materials allowing the individual to be identified are returned or\n destroyed as soon as they are no longer needed, and\n \t\t\t\tc. The actuarial or research organization agrees not to disclose the\n information unless the disclosure would otherwise be permitted by this section\n if made by an insurance institution, agent, or insurance-support organization;\n or\n\n 9. To a party or a representative of a party to a proposed or consummated\n sale, transfer, merger, or consolidation of all or part of the business of the\n insurance institution, agent, or insurance-support organization, provided:\n \t\t\t\ta. Prior to the consummation of the sale, transfer, merger, or\n consolidation only such information is disclosed as is reasonably necessary to\n enable the recipient to make business decisions about the purchase, transfer,\n merger, or consolidation, and\n \t\t\t\tb. The recipient agrees not to disclose the information unless the\n disclosure would otherwise be permitted by this section if made by an\n insurance institution, agent, or insurance-support organization; or\n\n 10. To a nonaffiliated third party whose only use of such information will be\n in connection with the marketing of a nonfinancial product or service,\n provided:\n \t\t\t\ta. No medical-record information, privileged information, or personal\n information relating to an individual’s character, personal habits, mode\n of living, or general reputation is disclosed, and no classification derived\n from the information is disclosed,\n \t\t\t\tb. The individual has been given an opportunity, in accordance with the\n provisions of subsection A of § 38.2-612.1, to indicate that he does not\n want financial information disclosed for marketing purposes and has given no\n indication that he does not want the information disclosed, and\n \t\t\t\tc. The nonaffiliated third party receiving such information agrees not to\n use it except in connection with the marketing of the product or service; or\n\n 11. (i) To a consumer reporting agency in accordance with the Fair Credit\n Reporting Act (15 U.S.C. § 1681 et seq.) or (ii) from a consumer report\n reported by a consumer reporting agency; or\n\n 12. To a group policyholder for the purpose of reporting claims experience or\n conducting an audit of the insurance institution’s or agent’s\n operations or services, provided the information disclosed is reasonably\n necessary for the group policyholder to conduct the review or audit; or\n\n 13. To a professional peer review organization for the purpose of reviewing\n the service or conduct of a medical-care institution or medical professional;\n or\n\n 14. To a governmental authority for the purpose of determining the\n individual’s eligibility for health benefits for which the governmental\n authority may be liable; or\n\n 15. To a certificate holder or policyholder for the purpose of providing\n information regarding the status of an insurance transaction; or\n\n 16. To a lienholder, mortgagee, assignee, lessor or other person shown on the\n records of an insurance institution or agent as having a legal or beneficial\n interest in a policy of insurance, or to persons acting in a fiduciary or\n representative capacity on behalf of the individual, provided that:\n \t\t\t\ta. No medical record information is disclosed unless the disclosure would\n be permitted by this section; and\n \t\t\t\tb. The information disclosed is limited to that which is reasonably\n necessary to permit such person to protect his interest in the policy; or\n\n 17. Necessary to effect, administer, or enforce a transaction requested or\n authorized by the individual, or in connection with servicing or processing an\n insurance product or service requested or authorized by the individual, or\n necessary for reinsurance purposes, or for stop loss or excess loss agreements\n provided for in subsection B of § 38.2-109; or\n\n 18. Pursuant to any federal Health Insurance Portability and Accountability\n Act privacy rules promulgated by the United States Department of Health and\n Human Services.\n\nC. An insurance institution, agent, or insurance-support organization may\ndisclose information about an individual collected or received in connection\nwith an insurance transaction, without written authorization, if the disclosure\nis:\n\n 1. To a nonaffiliated third party whose only use of such information will be\n to perform services for or functions on behalf of the insurance institution in\n connection with the marketing of the insurance institution’s product or\n service or the marketing of products or services offered pursuant to a joint\n marketing agreement, provided:\n \t\t\t\ta. No medical-record information or privileged information is disclosed\n without the individual’s written authorization unless such disclosure is\n otherwise permitted by subsection B,\n \t\t\t\tb. With respect to financial information, the individual has been given\n the notice required by subsection B of § 38.2-604.1, and\n \t\t\t\tc. The person receiving such financial information agrees, by contract,\n (i) not to use it except to perform services for or functions on behalf of the\n insurance institution in connection with the marketing of the insurance\n institution’s product or service or the marketing of products or\n services offered pursuant to a joint marketing agreement, or as permitted\n under subsection B and (ii) to maintain the confidentiality of such\n information and not disclose it to any other nonaffiliated third party unless\n such disclosure would otherwise be permitted by this section if made by the\n insurance institution, agent, or insurance-support organization;\n\n 2. To an affiliate, provided:\n \t\t\t\ta. No medical-record information or privileged information is disclosed\n without the individual’s written authorization unless such disclosure is\n otherwise permitted by subsection B, and\n \t\t\t\tb. The affiliate receiving the information does not disclose the\n information except as would otherwise be permitted by this section if such\n disclosure were made by the insurance institution, agent, or insurance-support\n organization.\n\nD. 1. No person proposing to issue, re-issue, or renew any policy, contract, or\nplan of accident and sickness insurance defined in \u00a7 38.2-109, but excluding\ndisability income insurance, issued by any (i) insurer providing hospital,\nmedical and surgical or major medical coverage on an expense incurred basis,\n(ii) corporation providing a health services plan, or (iii) health maintenance\norganization providing a health care plan for health care services shall\ndisclose any genetic information about an individual or a member of such\nindividual’s family collected or received in connection with any insurance\ntransaction unless the disclosure is made with the written authorization of the\nindividual.\n\n 2. For the purpose of this subsection, “genetic information” means\n information about genes, gene products, or inherited characteristics that may\n derive from an individual or a family member.\n\n 3. Agents and insurance support organizations shall be subject to the\n provisions of this subsection to the extent of their participation in the\n issue, re-issue, or renewal of any policy, contract, or plan of accident and\n sickness insurance defined in § 38.2-109, but excluding disability income\n insurance.\n\nE. Any notices, disclosures, or authorizations required by this section may be\nprovided electronically if the individual agrees.\n\nF. Any privileged information about an individual that is disclosed in violation\nof this section shall be available to that individual in accordance with the\nprovisions of §§ 38.2-608 and 38.2-609.\n\nG. Except in the case of disclosures made pursuant to subdivision B 10, the\nrequirements of subsection A of § 38.2-612.1 shall not apply when\ninformation is disclosed pursuant to this section.\n\nHISTORY: 1981, c. 389, \u00a7 38.1-57.16; 1986, c. 562; 1987, c. 325; 1996, c. 704;\n2001, c. 371; 2020, c. 264.","edition":{"id":1,"name":"2025","slug":"2025","date_created":"2026-06-21 22:39:22","date_modified":"2026-06-21 22:39:22","current":1,"order_by":1,"last_import":null}}