<?xml version="1.0"?>
<law><site_title>Virginia Decoded</site_title><site_url>https://vacode.org</site_url><law_id>81752</law_id><section_number>38.2-608</section_number><catch_line>Access to recorded personal information</catch_line><edition url="https://vacode.org/2025/" slug="2025" current="TRUE" last_updated="">2025</edition><referred_to_by><reference>38.2-2114</reference><reference>38.2-2212</reference><reference>38.2-604</reference><reference>38.2-607</reference><reference>38.2-610</reference><reference>38.2-613</reference><reference>38.2-617</reference></referred_to_by><structure><unit label="title" level="1" order_by="1" identifier="38.2">Insurance</unit><unit label="chapter" level="2" order_by="1" identifier="6">Insurance Information and Privacy Protection</unit><unit label="article" level="3" order_by="1" identifier="1">Collection, Use, and Dissemination of Information</unit></structure><text>
						<section id="A"><p><span class="prefix-number">A.</span> If any <span class="dictionary">individual</span>, after proper identification, submits a written request to an <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span>, or <span class="dictionary">insurance-support organization</span> for access to recorded <span class="dictionary">personal information</span> about the <span class="dictionary">individual</span> that is reasonably described by the <span class="dictionary">individual</span> and reasonably able to be located and retrieved by the <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span>, or <span class="dictionary">insurance-support organization</span>, the <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span>, or <span class="dictionary">insurance-support organization</span> shall within 30 business days from the date the request is received: <a id="paragraph-292865" class="section-permalink" href="https://vacode.org/38.2-608/#A"><i class="fa fa-link"/></a></p></section>
						<section id="A1" class="indent-1"><p><span class="prefix-number">1.</span> Inform the <span class="dictionary">individual</span> of the nature and substance of the recorded <span class="dictionary">personal information</span> in writing, by telephone, or by other oral communication, whichever the <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span>, or <span class="dictionary">insurance-support organization</span> prefers; <a id="paragraph-292866" class="section-permalink" href="https://vacode.org/38.2-608/#A1"><i class="fa fa-link"/></a></p></section>
						<section id="A2" class="indent-1"><p><span class="prefix-number">2.</span> Permit the <span class="dictionary">individual</span> to see and copy, in <span class="dictionary">person</span>, the recorded <span class="dictionary">personal information</span> pertaining to him or to obtain a copy of the recorded <span class="dictionary">personal information</span> by mail, whichever the <span class="dictionary">individual</span> prefers, unless the recorded <span class="dictionary">personal information</span> is in coded form, in which case an accurate translation in plain language shall be provided in writing; <a id="paragraph-292867" class="section-permalink" href="https://vacode.org/38.2-608/#A2"><i class="fa fa-link"/></a></p></section>
						<section id="A3" class="indent-1"><p><span class="prefix-number">3.</span> Disclose to the <span class="dictionary">individual</span> the identity, if recorded, of those <span class="dictionary">persons</span> to whom the <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span>, or <span class="dictionary">insurance-support organization</span> has disclosed the <span class="dictionary">personal information</span> within two years prior to such request, and if the identity is not recorded, the names of those <span class="dictionary">insurance institutions</span>, <span class="dictionary">agents</span>, <span class="dictionary"><span class="dictionary">insurance-support organizations</span></span> or other <span class="dictionary">persons</span> to whom such information is normally disclosed; and <a id="paragraph-292868" class="section-permalink" href="https://vacode.org/38.2-608/#A3"><i class="fa fa-link"/></a></p></section>
						<section id="A4" class="indent-1"><p><span class="prefix-number">4.</span> Provide the <span class="dictionary">individual</span> with a summary of the procedures by which he may request correction, amendment, or deletion of recorded <span class="dictionary">personal information</span>. <a id="paragraph-292869" class="section-permalink" href="https://vacode.org/38.2-608/#A4"><i class="fa fa-link"/></a></p></section>
						<section id="B"><p><span class="prefix-number">B.</span> Any <span class="dictionary">personal information</span> provided pursuant to subsection A of this section shall identify the source of the information if it is an <span class="dictionary">institutional source</span>. <a id="paragraph-292870" class="section-permalink" href="https://vacode.org/38.2-608/#B"><i class="fa fa-link"/></a></p></section>
						<section id="C"><p><span class="prefix-number">C.</span> <span class="dictionary">Medical-record information</span> supplied by a <span class="dictionary">medical-care institution</span> or <span class="dictionary">medical professional</span> and requested under subsection A of this section, together with the identity of the <span class="dictionary">medical professional</span> or medical care institution that provided the information, shall be supplied either directly to the <span class="dictionary">individual</span> or to a <span class="dictionary">medical professional</span> designated by the <span class="dictionary">individual</span> and licensed to provide medical care with respect to the condition to which the information relates, whichever the <span class="dictionary">individual</span> prefers. If the <span class="dictionary">individual</span> elects to have the information disclosed to a <span class="dictionary">medical professional</span> designated by him, the <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span> or <span class="dictionary">insurance-support organization</span> shall notify the <span class="dictionary">individual</span>, at the time of the disclosure, that it has provided the information to the <span class="dictionary">medical professional</span>.
			However, disclosure directly to the <span class="dictionary">individual</span> may be denied if a treating physician, clinical psychologist, clinical social worker, or licensed professional counselor has determined, in the exercise of professional <span class="dictionary">judgment</span>, that the disclosure requested would be reasonably likely to endanger the life or physical safety of the <span class="dictionary">individual</span> or another <span class="dictionary">person</span> or that the information requested makes reference to a <span class="dictionary">person</span> other than a health care provider and disclosure of such information would be reasonably likely to cause substantial harm to the referenced <span class="dictionary">person</span>.
			If disclosure to the <span class="dictionary">individual</span> is denied, upon the <span class="dictionary">individual</span>&#x2019;s request, the <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span> or insurance support organization shall either (i) designate a physician, clinical psychologist, clinical social worker, or licensed professional counselor acceptable to the <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span> or insurance support organization, who was not directly involved in the denial, and whose licensure, training, and experience relative to the <span class="dictionary">individual</span>&#x2019;s condition are at least equivalent to that of the physician, clinical psychologist, clinical social worker, or licensed professional counselor who made the original determination, who shall, at the expense of the <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span> or insurance support organization, make a <span class="dictionary">judgment</span> as to whether to make the information available to the <span class="dictionary">individual</span>; or (ii) if the <span class="dictionary">individual</span> so requests, make the information available, at the <span class="dictionary">individual</span>&#x2019;s expense to a physician, clinical psychologist, clinical social worker, or licensed professional counselor selected by the <span class="dictionary">individual</span>, whose licensure, training and experience relative to the <span class="dictionary">individual</span>&#x2019;s condition are at least equivalent to that of the physician, clinical psychologist, clinical social worker, or licensed professional counselor who made the original determination, who shall make a <span class="dictionary">judgment</span> as to whether to make the information available to the <span class="dictionary">individual</span>. The <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span>, or insurance support organization shall comply with the <span class="dictionary">judgment</span> of the reviewing physician, clinical psychologist, clinical social worker, or licensed professional counselor made in accordance with the foregoing procedures. <a id="paragraph-292871" class="section-permalink" href="https://vacode.org/38.2-608/#C"><i class="fa fa-link"/></a></p></section>
						<section id="D"><p><span class="prefix-number">D.</span> Except for <span class="dictionary">personal information</span> provided under &#xA7; <a class="law" title="Notice of adverse underwriting decision; furnishing reasons for decisions and sources of information" href="/38.2-610/">38.2-610</a>, an <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span>, or <span class="dictionary">insurance-support organization</span> may charge a reasonable fee to cover the costs incurred in providing a copy of recorded <span class="dictionary">personal information</span> to <span class="dictionary">individuals</span>. <a id="paragraph-292872" class="section-permalink" href="https://vacode.org/38.2-608/#D"><i class="fa fa-link"/></a></p></section>
						<section id="E"><p><span class="prefix-number">E.</span> The obligations imposed by this section upon an <span class="dictionary">insurance institution</span> or <span class="dictionary">agent</span> may be satisfied by another <span class="dictionary">insurance institution</span> or <span class="dictionary">agent</span> authorized to act on its behalf. With respect to the copying and disclosure of recorded <span class="dictionary">personal information</span> pursuant to a request under subsection A of this section, an <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span>, or <span class="dictionary">insurance-support organization</span> may make arrangements with an <span class="dictionary">insurance-support organization</span> or a <span class="dictionary">consumer reporting agency</span> to copy and disclose recorded <span class="dictionary">personal information</span> on its behalf. <a id="paragraph-292873" class="section-permalink" href="https://vacode.org/38.2-608/#E"><i class="fa fa-link"/></a></p></section>
						<section id="F"><p><span class="prefix-number">F.</span> The rights granted to <span class="dictionary">individuals</span> in this section shall extend to all natural <span class="dictionary">persons</span> to the extent information about them is collected and maintained by an <span class="dictionary">insurance institution</span>, <span class="dictionary">agent</span> or <span class="dictionary">insurance-support organization</span> in connection with an <span class="dictionary">insurance transaction</span>. The rights granted to all natural <span class="dictionary">persons</span> by this subsection shall not extend to information about them that relates to and is collected in connection with or in reasonable anticipation of a claim or civil or criminal proceeding involving them. <a id="paragraph-292874" class="section-permalink" href="https://vacode.org/38.2-608/#F"><i class="fa fa-link"/></a></p></section>
						<section id="G"><p><span class="prefix-number">G.</span> For purposes of this section, the term &#x201C;<span class="dictionary">insurance-support organization</span>&#x201D; does not include &#x201C;<span class="dictionary">consumer reporting agency</span>.&#x201D; <a id="paragraph-292875" class="section-permalink" href="https://vacode.org/38.2-608/#G"><i class="fa fa-link"/></a></p></section></text><history>1981, c. 389, &#xA7; 38.1-57.11; 1986, c. 562; 2004, cc. 65, 1014; 2020, c. 945; 2022, c. 509.</history><metadata></metadata></law>
