{"formats":[{"name":"JSON","format":"json","url":"\/downloads\/2025\/code-json\/59.1-594.json"},{"name":"Plain Text","format":"text","url":"\/downloads\/2025\/code-text\/59.1-594.txt"},{"name":"XML","format":"xml","url":"\/downloads\/2025\/code-xml\/59.1-594.xml"},{"name":"HTML","format":"html","url":"\/downloads\/2025\/code-html\/59.1-594.html"}],"law_id":58499,"edition_id":1,"section_id":58499,"structure_id":14495,"section_number":"59.1-594","catch_line":"Exclusions","history":"2023, c. 526.","full_text":"This chapter shall not apply to any of the following:\n\n1\n\nProtected health information that is collected, maintained, used, or disclosed by a covered entity or business associate governed by the privacy, security, and data breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the federal Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009, P.L. 111-5;2\n\nA covered entity governed by the privacy, security, and data breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009, P.L. 111-5, to the extent that the covered entity maintains, uses, and discloses genetic data in the same manner as protected health information, as described in subdivision 1;3\n\nA business associate of a covered entity governed by the privacy, security, and data breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the federal Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009, P.L. 111-5, to the extent that the business associate maintains, uses, and discloses genetic data in the same manner as protected health information, as described in subdivision 1;4\n\nScientific research or educational activities conducted by a public or private nonprofit institution of higher education that holds an assurance with the U.S. Department of Health and Human Services pursuant to 45 C.F.R. Part 46, to the extent that such scientific research and educational activities comply with all applicable federal and state laws and regulations for the protection of human subjects in research, including the Common Rule pursuant to 45 C.F.R. Part 46, U.S. Food and Drug Administration regulations pursuant to 21 C.F.R. Parts 50 and 56, and the federal Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g;5\n\nThe newborn screening program established pursuant to Article 7 (§ 32.1-65 et seq.) of Chapter 2 of Title 32.1;6\n\nTests conducted exclusively to diagnose whether an individual has a specific disease, to the extent that all persons involved in the conduct of the test maintain, use, and disclose genetic data in the same manner as protected health information, as described in subdivision 1; or7\n\nGenetic data used or maintained by an employer, or disclosed by an employee to an employer, to the extent that the use, maintenance, or disclosure of such data is necessary to comply with a local, state, or federal workplace health and safety ordinance, law, or regulation.","order_by":null,"text":{"0":{"id":214396,"text":"This chapter shall not apply to any of the following:","type":"section","prefixes":[""],"prefix":"","entire_prefix":"","prefix_anchor":"","level":1,"next_prefix":"1"},"1":{"id":214397,"text":"Protected health information that is collected, maintained, used, or disclosed by a covered entity or business associate governed by the privacy, security, and data breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the federal Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009, P.L. 111-5;","type":"section","prefixes":["1"],"prefix":"1","entire_prefix":"1","prefix_anchor":"1","level":1,"prior_prefix":"","next_prefix":"2"},"2":{"id":214398,"text":"A covered entity governed by the privacy, security, and data breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009, P.L. 111-5, to the extent that the covered entity maintains, uses, and discloses genetic data in the same manner as protected health information, as described in subdivision 1;","type":"section","prefixes":["2"],"prefix":"2","entire_prefix":"2","prefix_anchor":"2","level":1,"prior_prefix":"1","next_prefix":"3"},"3":{"id":214399,"text":"A business associate of a covered entity governed by the privacy, security, and data breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the federal Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009, P.L. 111-5, to the extent that the business associate maintains, uses, and discloses genetic data in the same manner as protected health information, as described in subdivision 1;","type":"section","prefixes":["3"],"prefix":"3","entire_prefix":"3","prefix_anchor":"3","level":1,"prior_prefix":"2","next_prefix":"4"},"4":{"id":214400,"text":"Scientific research or educational activities conducted by a public or private nonprofit institution of higher education that holds an assurance with the U.S. Department of Health and Human Services pursuant to 45 C.F.R. Part 46, to the extent that such scientific research and educational activities comply with all applicable federal and state laws and regulations for the protection of human subjects in research, including the Common Rule pursuant to 45 C.F.R. Part 46, U.S. Food and Drug Administration regulations pursuant to 21 C.F.R. Parts 50 and 56, and the federal Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g;","type":"section","prefixes":["4"],"prefix":"4","entire_prefix":"4","prefix_anchor":"4","level":1,"prior_prefix":"3","next_prefix":"5"},"5":{"id":214401,"text":"The newborn screening program established pursuant to Article 7 (§ 32.1-65 et seq.) of Chapter 2 of Title 32.1;","type":"section","prefixes":["5"],"prefix":"5","entire_prefix":"5","prefix_anchor":"5","level":1,"prior_prefix":"4","next_prefix":"6"},"6":{"id":214402,"text":"Tests conducted exclusively to diagnose whether an individual has a specific disease, to the extent that all persons involved in the conduct of the test maintain, use, and disclose genetic data in the same manner as protected health information, as described in subdivision 1; or","type":"section","prefixes":["6"],"prefix":"6","entire_prefix":"6","prefix_anchor":"6","level":1,"prior_prefix":"5","next_prefix":"7"},"7":{"id":214403,"text":"Genetic data used or maintained by an employer, or disclosed by an employee to an employer, to the extent that the use, maintenance, or disclosure of such data is necessary to comply with a local, state, or federal workplace health and safety ordinance, law, or regulation.","type":"section","prefixes":["7"],"prefix":"7","entire_prefix":"7","prefix_anchor":"7","level":1,"prior_prefix":"6"}},"ancestry":[{"id":14495,"edition_id":1,"name":"Genetic Data Privacy","identifier":"56","label":"chapter","depth":2,"order_by":1,"parent_id":12809,"metadata":{},"date_created":"2026-06-26 03:48:21","date_modified":"2026-06-26 03:48:21","permalink":{"id":262825,"object_type":"structure","relational_id":14495,"identifier":"56","token":"59.1\/56","url":"\/59.1\/56\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12809,"edition_id":1,"name":"Trade and Commerce","identifier":"59.1","label":"title","depth":1,"order_by":1,"parent_id":null,"metadata":{},"date_created":"2026-06-26 03:43:54","date_modified":"2026-06-26 03:43:54","permalink":{"id":259521,"object_type":"structure","relational_id":12809,"identifier":"59.1","token":"59.1","url":"\/59.1\/","edition_id":1,"permalink":0,"preferred":1}}],"structure_contents":[{"id":63239,"structure_id":14495,"section_number":"59.1-593","catch_line":"Definitions","url":"\/59.1-593\/","token":"59.1\/56\/59.1-593","metadata":false},{"id":58499,"structure_id":14495,"section_number":"59.1-594","catch_line":"Exclusions","url":"\/59.1-594\/","token":"59.1\/56\/59.1-594","metadata":false},{"id":79801,"structure_id":14495,"section_number":"59.1-595","catch_line":"Information to be made available to consumers","url":"\/59.1-595\/","token":"59.1\/56\/59.1-595","metadata":false},{"id":71838,"structure_id":14495,"section_number":"59.1-596","catch_line":"Express consent required; revocation of express consent","url":"\/59.1-596\/","token":"59.1\/56\/59.1-596","metadata":false},{"id":56619,"structure_id":14495,"section_number":"59.1-597","catch_line":"Other requirements applicable to direct-to-consumer genetic testing companies","url":"\/59.1-597\/","token":"59.1\/56\/59.1-597","metadata":false},{"id":78669,"structure_id":14495,"section_number":"59.1-598","catch_line":"Contracts with service providers","url":"\/59.1-598\/","token":"59.1\/56\/59.1-598","metadata":false},{"id":56035,"structure_id":14495,"section_number":"59.1-599","catch_line":"Certain disclosures of genetic data prohibited","url":"\/59.1-599\/","token":"59.1\/56\/59.1-599","metadata":false},{"id":55900,"structure_id":14495,"section_number":"59.1-600","catch_line":"Discrimination prohibited","url":"\/59.1-600\/","token":"59.1\/56\/59.1-600","metadata":false},{"id":61312,"structure_id":14495,"section_number":"59.1-601","catch_line":"Enforcement; civil penalty","url":"\/59.1-601\/","token":"59.1\/56\/59.1-601","metadata":false},{"id":68507,"structure_id":14495,"section_number":"59.1-602","catch_line":"Limitations","url":"\/59.1-602\/","token":"59.1\/56\/59.1-602","metadata":false}],"previous_section":{"id":63239,"structure_id":14495,"section_number":"59.1-593","catch_line":"Definitions","url":"\/59.1-593\/","token":"59.1\/56\/59.1-593","metadata":false},"next_section":{"id":79801,"structure_id":14495,"section_number":"59.1-595","catch_line":"Information to be made available to consumers","url":"\/59.1-595\/","token":"59.1\/56\/59.1-595","metadata":false},"metadata":false,"official_url":"https:\/\/law.lis.virginia.gov\/vacode\/59.1-594\/","history_text":"

This law was first created in 2023. The record of its establishment is cataloged in chapter 526<\/a> of that year\u2019s edition of \u201cActs of Assembly,\u201d the annual state publication listing all changes made to the Code of Virginia in that year.<\/p>","references":false,"refers_to":[{"id":79113,"section_number":"32.1-65","catch_line":"Certain newborn screening required","order_by":null,"url":"\/32.1-65\/"}],"permalink":{"id":262831,"object_type":"law","relational_id":58499,"identifier":"59.1-594","token":"59.1\/56\/59.1-594","url":"\/59.1-594\/","edition_id":1,"permalink":0,"preferred":1},"url":"\/59.1-594\/","token":"59.1\/56\/59.1-594","dublin_core":{"Title":"Exclusions","Type":"Text","Format":"text\/html","Identifier":"\u00a7 59.1-594","Relation":"Code of Virginia"},"html":"\n\t\t\t\t\t\t

This chapter shall not apply to any of the following:<\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Protected health information that is collected, maintained, used, or disclosed by a covered entity or business associate governed by the privacy, security, and data breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the federal Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009, P.L. 111-5; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> A covered entity governed by the privacy, security, and data breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009, P.L. 111-5, to the extent that the covered entity maintains, uses, and discloses genetic data<\/span> in the same manner as protected health information, as described in subdivision 1; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> A business associate of a covered entity governed by the privacy, security, and data breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the federal Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and the federal Health Information Technology for Economic and Clinical Health Act, Title XIII of the federal American Recovery and Reinvestment Act of 2009, P.L. 111-5, to the extent that the business associate maintains, uses, and discloses genetic data<\/span> in the same manner as protected health information, as described in subdivision 1; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Scientific research or educational activities conducted by a public or private nonprofit institution of higher education that holds an assurance with the U.S. Department of Health and Human Services pursuant to 45 C.F.R. Part 46, to the extent that such scientific research and educational activities comply with all applicable federal and state laws<\/span> and regulations for the protection of human subjects in research, including the Common Rule pursuant to 45 C.F.R. Part 46, U.S. Food and Drug Administration regulations pursuant to 21 C.F.R. Parts 50 and 56, and the federal Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

5.<\/span> The newborn screening program established pursuant to Article 7 (§ 32.1-65<\/a> et seq.) of Chapter 2 of Title 32.1; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

6.<\/span> Tests conducted exclusively to diagnose whether an individual has a specific disease, to the extent that all persons involved in the conduct of the test maintain, use, and disclose genetic data<\/span> in the same manner as protected health information, as described in subdivision 1; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

7.<\/span> Genetic data<\/span> used or maintained by an employer, or disclosed by an employee to an employer, to the extent that the use, maintenance, or disclosure of such data is necessary to comply with a local, state, or federal workplace health and safety ordinance<\/span>, law<\/span>, or regulation. <\/i><\/a><\/p><\/section>","plain_text":" CODE OF VIRGINIA\n\nEXCLUSIONS (\u00a7 59.1-594)\n\nThis chapter shall not apply to any of the following:\n\n1. Protected health information that is collected, maintained, used, or\ndisclosed by a covered entity or business associate governed by the privacy,\nsecurity, and data breach notification rules issued by the U.S. Department of\nHealth and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to\nthe federal Health Insurance Portability and Accountability Act of 1996, P.L.\n104-191, and the federal Health Information Technology for Economic and Clinical\nHealth Act, Title XIII of the federal American Recovery and Reinvestment Act of\n2009, P.L. 111-5;\n\n2. A covered entity governed by the privacy, security, and data breach\nnotification rules issued by the U.S. Department of Health and Human Services,\n45 C.F.R. Parts 160 and 164, established pursuant to the Health Insurance\nPortability and Accountability Act of 1996, P.L. 104-191, and the federal Health\nInformation Technology for Economic and Clinical Health Act, Title XIII of the\nfederal American Recovery and Reinvestment Act of 2009, P.L. 111-5, to the\nextent that the covered entity maintains, uses, and discloses genetic data in\nthe same manner as protected health information, as described in subdivision 1;\n\n3. A business associate of a covered entity governed by the privacy, security,\nand data breach notification rules issued by the U.S. Department of Health and\nHuman Services, 45 C.F.R. Parts 160 and 164, established pursuant to the federal\nHealth Insurance Portability and Accountability Act of 1996, P.L. 104-191, and\nthe federal Health Information Technology for Economic and Clinical Health Act,\nTitle XIII of the federal American Recovery and Reinvestment Act of 2009, P.L.\n111-5, to the extent that the business associate maintains, uses, and discloses\ngenetic data in the same manner as protected health information, as described in\nsubdivision 1;\n\n4. Scientific research or educational activities conducted by a public or\nprivate nonprofit institution of higher education that holds an assurance with\nthe U.S. Department of Health and Human Services pursuant to 45 C.F.R. Part 46,\nto the extent that such scientific research and educational activities comply\nwith all applicable federal and state laws and regulations for the protection of\nhuman subjects in research, including the Common Rule pursuant to 45 C.F.R. Part\n46, U.S. Food and Drug Administration regulations pursuant to 21 C.F.R. Parts 50\nand 56, and the federal Family Educational Rights and Privacy Act, 20 U.S.C.\n§ 1232g;\n\n5. The newborn screening program established pursuant to Article 7 (§\n32.1-65 et seq.) of Chapter 2 of Title 32.1;\n\n6. Tests conducted exclusively to diagnose whether an individual has a specific\ndisease, to the extent that all persons involved in the conduct of the test\nmaintain, use, and disclose genetic data in the same manner as protected health\ninformation, as described in subdivision 1; or\n\n7. Genetic data used or maintained by an employer, or disclosed by an employee\nto an employer, to the extent that the use, maintenance, or disclosure of such\ndata is necessary to comply with a local, state, or federal workplace health and\nsafety ordinance, law, or regulation.\n\nHISTORY: 2023, c. 526.","edition":{"id":1,"name":"2025","slug":"2025","date_created":"2026-06-21 22:39:22","date_modified":"2026-06-21 22:39:22","current":1,"order_by":1,"last_import":null}}