                                 CODE OF VIRGINIA

HEALTH RECORDS PRIVACY (§ 32.1-127.1:03)

A. There is hereby recognized an individual&#8217;s right of privacy in the
content of his health records. Health records are the property of the health
care entity maintaining them, and, except when permitted or required by this
section or by other provisions of state law, no health care entity, or other
person working in a health care setting, may disclose an individual&#8217;s
health records.
			Pursuant to this subsection:

   1. Health care entities shall disclose health records to the individual who is
   the subject of the health record, including an audit trail of any additions,
   deletions, or revisions to the health record, if specifically requested,
   except as provided in subsections E and F and subsection B of &#xA7; 8.01-413.

   2. Health records shall not be removed from the premises where they are
   maintained without the approval of the health care entity that maintains such
   health records, except in accordance with a court order or subpoena consistent
   with subsection C of &#xA7; 8.01-413 or with this section or in accordance
   with the regulations relating to change of ownership of health records
   promulgated by a health regulatory board established in Title 54.1.

   3. No person to whom health records are disclosed shall redisclose or
   otherwise reveal the health records of an individual, beyond the purpose for
   which such disclosure was made, without first obtaining the individual&#8217;s
   specific authorization to such redisclosure. This redisclosure prohibition
   shall not, however, prevent (i) any health care entity that receives health
   records from another health care entity from making subsequent disclosures as
   permitted under this section and the federal Department of Health and Human
   Services regulations relating to privacy of the electronic transmission of
   data and protected health information promulgated by the United States
   Department of Health and Human Services as required by the Health Insurance
   Portability and Accountability Act (HIPAA) (42 U.S.C. &#xA7; 1320d et seq.) or
   (ii) any health care entity from furnishing health records and aggregate or
   other data, from which individually identifying prescription information has
   been removed, encoded or encrypted, to qualified researchers, including, but
   not limited to, pharmaceutical manufacturers and their agents or contractors,
   for purposes of clinical, pharmaco-epidemiological, pharmaco-economic, or
   other health services research.

   4. Health care entities shall, upon the request of the individual who is the
   subject of the health record, disclose health records to other health care
   entities, in any available format of the requester&#8217;s choosing, as
   provided in subsection E.

B. As used in this section:
			&#8220;Agent&#8221; means a person who has been appointed as an
individual&#8217;s agent under a power of attorney for health care or an advance
directive under the Health Care Decisions Act (&#xA7; 54.1-2981 et seq.).
			&#8220;Certification&#8221; means a written representation that is delivered
by hand, by first-class mail, by overnight delivery service, or by facsimile if
the sender obtains a facsimile-machine-generated confirmation reflecting that
all facsimile pages were successfully transmitted.
			&#8220;Guardian&#8221; means a court-appointed guardian of the person.
			&#8220;Health care clearinghouse&#8221; means, consistent with the definition
set out in 45 C.F.R. &#xA7; 160.103, a public or private entity, such as a
billing service, repricing company, community health management information
system or community health information system, and &#8220;value-added&#8221;
networks and switches, that performs either of the following functions: (i)
processes or facilitates the processing of health information received from
another entity in a nonstandard format or containing nonstandard data content
into standard data elements or a standard transaction; or (ii) receives a
standard transaction from another entity and processes or facilitates the
processing of health information into nonstandard format or nonstandard data
content for the receiving entity.
			&#8220;Health care entity&#8221; means any health care provider, health plan
or health care clearinghouse.
			&#8220;Health care provider&#8221; means those entities listed in the
definition of &#8220;health care provider&#8221; in &#xA7; 8.01-581.1, except
that state-operated facilities shall also be considered health care providers
for the purposes of this section. Health care provider shall also include all
persons who are licensed, certified, registered or permitted or who hold a
multistate licensure privilege issued by any of the health regulatory boards
within the Department of Health Professions, except persons regulated by the
Board of Funeral Directors and Embalmers or the Board of Veterinary Medicine.
			&#8220;Health plan&#8221; means an individual or group plan that provides, or
pays the cost of, medical care. &#8220;Health plan&#8221; includes any entity
included in such definition as set out in 45 C.F.R. &#xA7; 160.103.
			&#8220;Health record&#8221; means any written, printed or electronically
recorded material maintained by a health care entity in the course of providing
health services to an individual concerning the individual and the services
provided. &#8220;Health record&#8221; also includes the substance of any
communication made by an individual to a health care entity in confidence during
or in connection with the provision of health services or information otherwise
acquired by the health care entity about an individual in confidence and in
connection with the provision of health services to the individual.
			&#8220;Health services&#8221; means, but shall not be limited to,
examination, diagnosis, evaluation, treatment, pharmaceuticals, aftercare,
habilitation or rehabilitation and mental health therapy of any kind, as well as
payment or reimbursement for any such services.
			&#8220;Individual&#8221; means a patient who is receiving or has received
health services from a health care entity.
			&#8220;Individually identifying prescription information&#8221; means all
prescriptions, drug orders or any other prescription information that
specifically identifies an individual.
			&#8220;Parent&#8221; means a biological, adoptive or foster parent.
			&#8220;Psychotherapy notes&#8221; means comments, recorded in any medium by a
health care provider who is a mental health professional, documenting or
analyzing the contents of conversation during a private counseling session with
an individual or a group, joint, or family counseling session that are separated
from the rest of the individual&#8217;s health record. &#8220;Psychotherapy
notes&#8221; does not include annotations relating to medication and
prescription monitoring, counseling session start and stop times, treatment
modalities and frequencies, clinical test results, or any summary of any
symptoms, diagnosis, prognosis, functional status, treatment plan, or the
individual&#8217;s progress to date.

C. The provisions of this section shall not apply to any of the following:

   1. The status of and release of information governed by &#xA7;&#xA7; 65.2-604
   and 65.2-607 of the Virginia Workers&#8217; Compensation Act;

   2. Except where specifically provided herein, the health records of minors;

   3. The release of juvenile health records to a secure facility or a shelter
   care facility pursuant to &#xA7; 16.1-248.3; or

   4. The release of health records to a state correctional facility pursuant to
   &#xA7; 53.1-40.10 or a local or regional correctional facility pursuant to
   &#xA7; 53.1-133.03.

D. Health care entities may, and, when required by other provisions of state
law, shall, disclose health records:

   1. As set forth in subsection E, pursuant to the written authorization of (i)
   the individual or (ii) in the case of a minor, (a) his custodial parent,
   guardian or other person authorized to consent to treatment of minors pursuant
   to &#xA7; 54.1-2969 or (b) the minor himself, if he has consented to his own
   treatment pursuant to &#xA7; 54.1-2969, or (iii) in emergency cases or
   situations where it is impractical to obtain an individual&#8217;s written
   authorization, pursuant to the individual&#8217;s oral authorization for a
   health care provider or health plan to discuss the individual&#8217;s health
   records with a third party specified by the individual;

   2. In compliance with a subpoena issued in accord with subsection H, pursuant
   to a search warrant or a grand jury subpoena, pursuant to court order upon
   good cause shown or in compliance with a subpoena issued pursuant to
   subsection C of &#xA7; 8.01-413. Regardless of the manner by which health
   records relating to an individual are compelled to be disclosed pursuant to
   this subdivision, nothing in this subdivision shall be construed to prohibit
   any staff or employee of a health care entity from providing information about
   such individual to a law-enforcement officer in connection with such subpoena,
   search warrant, or court order;

   3. In accord with subsection F of &#xA7; 8.01-399 including, but not limited
   to, situations where disclosure is reasonably necessary to establish or
   collect a fee or to defend a health care entity or the health care
   entity&#8217;s employees or staff against any accusation of wrongful conduct;
   also as required in the course of an investigation, audit, review or
   proceedings regarding a health care entity&#8217;s conduct by a duly
   authorized law-enforcement, licensure, accreditation, or professional review
   entity;

   4. In testimony in accordance with &#xA7;&#xA7; 8.01-399 and 8.01-400.2;

   5. In compliance with the provisions of &#xA7; 8.01-413;

   6. As required or authorized by law relating to public health activities,
   health oversight activities, serious threats to health or safety, or abuse,
   neglect or domestic violence, relating to contagious disease, public safety,
   and suspected child or adult abuse reporting requirements, including, but not
   limited to, those contained in &#xA7;&#xA7; 16.1-248.3, 32.1-36, 32.1-36.1,
   32.1-40, 32.1-41, 32.1-127.1:04, 32.1-276.5, 32.1-283, 32.1-283.1, 32.1-320,
   37.2-710, 37.2-839, 53.1-40.10, 53.1-133.03, 54.1-2400.6, 54.1-2400.7,
   54.1-2400.9, 54.1-2403.3, 54.1-2506, 54.1-2966, 54.1-2967, 54.1-2968,
   54.1-3408.2, 63.2-1509, and 63.2-1606;

   7. Where necessary in connection with the care of the individual;

   8. In connection with the health care entity&#8217;s own health care
   operations or the health care operations of another health care entity, as
   specified in 45 C.F.R. &#xA7; 164.501, or in the normal course of business in
   accordance with accepted standards of practice within the health services
   setting; however, the maintenance, storage, and disclosure of the mass of
   prescription dispensing records maintained in a pharmacy registered or
   permitted in Virginia shall only be accomplished in compliance with
   &#xA7;&#xA7; 54.1-3410, 54.1-3411, and 54.1-3412;

   9. When the individual has waived his right to the privacy of the health
   records;

   10. When examination and evaluation of an individual are undertaken pursuant
   to judicial or administrative law order, but only to the extent as required by
   such order;

   11. To the guardian ad litem and any attorney representing the respondent in
   the course of a guardianship proceeding of an adult patient who is the
   respondent in a proceeding under Chapter 20 (&#xA7; 64.2-2000 et seq.) of
   Title 64.2;

   12. To the guardian ad litem and any attorney appointed by the court to
   represent an individual who is or has been a patient who is the subject of a
   commitment proceeding under &#xA7; 19.2-169.6, Article 5 (&#xA7; 37.2-814 et
   seq.) of Chapter 8 of Title 37.2, Article 16 (&#xA7; 16.1-335 et seq.) of
   Chapter 11 of Title 16.1, or a judicial authorization for treatment proceeding
   pursuant to Chapter 11 (&#xA7; 37.2-1100 et seq.) of Title 37.2;

   13. To a magistrate, the court, the evaluator or examiner required under
   Article 16 (&#xA7; 16.1-335 et seq.) of Chapter 11 of Title 16.1 or &#xA7;
   37.2-815, a community services board or behavioral health authority or a
   designee of a community services board or behavioral health authority, or a
   law-enforcement officer participating in any proceeding under Article 16
   (&#xA7; 16.1-335 et seq.) of Chapter 11 of Title 16.1, &#xA7; 19.2-169.6, or
   Chapter 8 (&#xA7; 37.2-800 et seq.) of Title 37.2 regarding the subject of the
   proceeding, and to any health care provider evaluating or providing services
   to the person who is the subject of the proceeding or monitoring the
   person&#8217;s adherence to a treatment plan ordered under those provisions.
   Health records disclosed to a law-enforcement officer shall be limited to
   information necessary to protect the officer, the person, or the public from
   physical injury or to address the health care needs of the person. Information
   disclosed to a law-enforcement officer shall not be used for any other
   purpose, disclosed to others, or retained;

   14. To the attorney and/or guardian ad litem of a minor who represents such
   minor in any judicial or administrative proceeding, if the court or
   administrative hearing officer has entered an order granting the attorney or
   guardian ad litem this right and such attorney or guardian ad litem presents
   evidence to the health care entity of such order;

   15. With regard to the Court-Appointed Special Advocate (CASA) program, a
   minor&#8217;s health records in accord with &#xA7; 9.1-156;

   16. To an agent appointed under an individual&#8217;s power of attorney or to
   an agent or decision maker designated in an individual&#8217;s advance
   directive for health care or for decisions on anatomical gifts and organ,
   tissue or eye donation or to any other person consistent with the provisions
   of the Health Care Decisions Act (&#xA7; 54.1-2981 et seq.);

   17. To third-party payors and their agents for purposes of reimbursement;

   18. As is necessary to support an application for receipt of health care
   benefits from a governmental agency or as required by an authorized
   governmental agency reviewing such application or reviewing benefits already
   provided or as necessary to the coordination of prevention and control of
   disease, injury, or disability and delivery of such health care benefits
   pursuant to &#xA7; 32.1-127.1:04;

   19. Upon the sale of a medical practice as provided in &#xA7; 54.1-2405; or
   upon a change of ownership or closing of a pharmacy pursuant to regulations of
   the Board of Pharmacy;

   20. In accord with subsection B of &#xA7; 54.1-2400.1, to communicate an
   individual&#8217;s specific and immediate threat to cause serious bodily
   injury or death of an identified or readily identifiable person;

   21. Where necessary in connection with the implementation of a
   hospital&#8217;s routine contact process for organ donation pursuant to
   subdivision B 4 of &#xA7; 32.1-127;

   22. In the case of substance abuse records, when permitted by and in
   conformity with requirements of federal law found in 42 U.S.C. &#xA7; 290dd-2
   and 42 C.F.R. Part 2;

   23. In connection with the work of any entity established as set forth in
   &#xA7; 8.01-581.16 to evaluate the adequacy or quality of professional
   services or the competency and qualifications for professional staff
   privileges;

   24. If the health records are those of a deceased or mentally incapacitated
   individual to the personal representative or executor of the deceased
   individual or the legal guardian or committee of the incompetent or
   incapacitated individual or if there is no personal representative, executor,
   legal guardian or committee appointed, to the following persons in the
   following order of priority: a spouse, an adult son or daughter, either
   parent, an adult brother or sister, or any other relative of the deceased
   individual in order of blood relationship;

   25. For the purpose of conducting record reviews of inpatient hospital deaths
   to promote identification of all potential organ, eye, and tissue donors in
   conformance with the requirements of applicable federal law and regulations,
   including 42 C.F.R. &#xA7; 482.45, (i) to the health care provider&#8217;s
   designated organ procurement organization certified by the United States
   Health Care Financing Administration and (ii) to any eye bank or tissue bank
   in Virginia certified by the Eye Bank Association of America or the American
   Association of Tissue Banks;

   26. To the Office of the State Inspector General pursuant to Chapter 3.2
   (&#xA7; 2.2-307 et seq.) of Title 2.2;

   27. To an entity participating in the activities of a local health partnership
   authority established pursuant to Article 6.1 (&#xA7; 32.1-122.10:001 et seq.)
   of Chapter 4, pursuant to subdivision 1;

   28. To law-enforcement officials by each licensed emergency medical services
   agency, (i) when the individual is the victim of a crime or (ii) when the
   individual has been arrested and has received emergency medical services or
   has refused emergency medical services and the health records consist of the
   prehospital patient care report required by &#xA7; 32.1-116.1;

   29. To law-enforcement officials, in response to their request, for the
   purpose of identifying or locating a suspect, fugitive, person required to
   register pursuant to &#xA7; 9.1-901 of the Sex Offender and Crimes Against
   Minors Registry Act, material witness, or missing person, provided that only
   the following information may be disclosed: (i) name and address of the
   person, (ii) date and place of birth of the person, (iii) social security
   number of the person, (iv) blood type of the person, (v) date and time of
   treatment received by the person, (vi) date and time of death of the person,
   where applicable, (vii) description of distinguishing physical characteristics
   of the person, and (viii) type of injury sustained by the person;

   30. To law-enforcement officials regarding the death of an individual for the
   purpose of alerting law enforcement of the death if the health care entity has
   a suspicion that such death may have resulted from criminal conduct;

   31. To law-enforcement officials if the health care entity believes in good
   faith that the information disclosed constitutes evidence of a crime that
   occurred on its premises;

   32. To the State Health Commissioner pursuant to &#xA7; 32.1-48.015 when such
   records are those of a person or persons who are subject to an order of
   quarantine or an order of isolation pursuant to Article 3.02 (&#xA7;
   32.1-48.05 et seq.) of Chapter 2;

   33. To the Commissioner of the Department of Labor and Industry or his
   designee by each licensed emergency medical services agency when the records
   consist of the prehospital patient care report required by &#xA7; 32.1-116.1
   and the patient has suffered an injury or death on a work site while
   performing duties or tasks that are within the scope of his employment;

   34. To notify a family member or personal representative of an individual who
   is the subject of a proceeding pursuant to Article 16 (&#xA7; 16.1-335 et
   seq.) of Chapter 11 of Title 16.1 or Chapter 8 (&#xA7; 37.2-800 et seq.) of
   Title 37.2 of information that is directly relevant to such person&#8217;s
   involvement with the individual&#8217;s health care, which may include the
   individual&#8217;s location and general condition, when the individual has the
   capacity to make health care decisions and (i) the individual has agreed to
   the notification, (ii) the individual has been provided an opportunity to
   object to the notification and does not express an objection, or (iii) the
   health care provider can, on the basis of his professional judgment,
   reasonably infer from the circumstances that the individual does not object to
   the notification. If the opportunity to agree or object to the notification
   cannot practicably be provided because of the individual&#8217;s incapacity or
   an emergency circumstance, the health care provider may notify a family member
   or personal representative of the individual of information that is directly
   relevant to such person&#8217;s involvement with the individual&#8217;s health
   care, which may include the individual&#8217;s location and general condition
   if the health care provider, in the exercise of his professional judgment,
   determines that the notification is in the best interests of the individual.
   Such notification shall not be made if the provider has actual knowledge the
   family member or personal representative is currently prohibited by court
   order from contacting the individual;

   35. To a threat assessment team established by a local school board pursuant
   to &#xA7; 22.1-79.4, by a public institution of higher education pursuant to
   &#xA7; 23.1-805, or by a private nonprofit institution of higher education;
   and

   36. To a regional emergency medical services council pursuant to &#xA7;
   32.1-116.1, for purposes limited to monitoring and improving the quality of
   emergency medical services pursuant to &#xA7; 32.1-111.3.
   				Notwithstanding the provisions of subdivisions 1 through 35, a health care
   entity shall obtain an individual&#8217;s written authorization for any
   disclosure of psychotherapy notes, except when disclosure by the health care
   entity is (i) for its own training programs in which students, trainees, or
   practitioners in mental health are being taught under supervision to practice
   or to improve their skills in group, joint, family, or individual counseling;
   (ii) to defend itself or its employees or staff against any accusation of
   wrongful conduct; (iii) in the discharge of the duty, in accordance with
   subsection B of &#xA7; 54.1-2400.1, to take precautions to protect third
   parties from violent behavior or other serious harm; (iv) required in the
   course of an investigation, audit, review, or proceeding regarding a health
   care entity&#8217;s conduct by a duly authorized law-enforcement, licensure,
   accreditation, or professional review entity; or (v) otherwise required by
   law.

E. Health care records required to be disclosed pursuant to this section shall
be made available electronically only to the extent and in the manner authorized
by the federal Health Information Technology for Economic and Clinical Health
Act (P.L. 111-5) and implementing regulations and the Health Insurance
Portability and Accountability Act (42 U.S.C. &#xA7; 1320d et seq.) and
implementing regulations. Notwithstanding any other provision to the contrary, a
health care entity shall not be required to provide records in an electronic
format requested if (i) the electronic format is not reasonably available
without additional cost to the health care entity, (ii) the records would be
subject to modification in the format requested, or (iii) the health care entity
determines that the integrity of the records could be compromised in the
electronic format requested. Requests for copies of or electronic access to
health records shall (a) be in writing, dated and signed by the requester; (b)
identify the nature of the information requested; and (c) include evidence of
the authority of the requester to receive such copies or access such records,
and identification of the person to whom the information is to be disclosed; and
(d) specify whether the requester would like the records in electronic format,
if available, or in paper format. The health care entity shall accept a
photocopy, facsimile, or other copy of the original signed by the requester as
if it were an original. Within 30 days of receipt of a request for copies of or
electronic access to health records, the health care entity shall do one of the
following: (1) furnish such copies of or allow electronic access to the
requested health records to any requester authorized to receive them in
electronic format if so requested; (2) inform the requester if the information
does not exist or cannot be found; (3) if the health care entity does not
maintain a record of the information, so inform the requester and provide the
name and address, if known, of the health care entity who maintains the record;
or (4) deny the request (A) under subsection F, (B) on the grounds that the
requester has not established his authority to receive such health records or
proof of his identity, or (C) as otherwise provided by law. Procedures set forth
in this section shall apply only to requests for health records not specifically
governed by other provisions of state law.

F. Except as provided in subsection B of &#xA7; 8.01-413, copies of or
electronic access to an individual&#8217;s health records shall not be furnished
to such individual or anyone authorized to act on the individual&#8217;s behalf
when the individual&#8217;s treating physician, clinical psychologist, clinical
social worker, or licensed professional counselor has made a part of the
individual&#8217;s record a written statement that, in the exercise of his
professional judgment, the furnishing to or review by the individual of such
health records would be reasonably likely to endanger the life or physical
safety of the individual or another person, or that such health record makes
reference to a person other than a health care provider and the access requested
would be reasonably likely to cause substantial harm to such referenced person.
If any health care entity denies a request for copies of or electronic access to
health records based on such statement, the health care entity shall inform the
individual of the individual&#8217;s right to designate, in writing, at his own
expense, another reviewing physician, clinical psychologist, clinical social
worker, or licensed professional counselor whose licensure, training and
experience relative to the individual&#8217;s condition are at least equivalent
to that of the physician, clinical psychologist, clinical social worker, or
licensed professional counselor upon whose opinion the denial is based. The
designated reviewing physician, clinical psychologist, clinical social worker,
or licensed professional counselor shall make a judgment as to whether to make
the health record available to the individual.
			The health care entity denying the request shall also inform the individual
of the individual&#8217;s right to request in writing that such health care
entity designate, at its own expense, a physician, clinical psychologist,
clinical social worker, or licensed professional counselor, whose licensure,
training, and experience relative to the individual&#8217;s condition are at
least equivalent to that of the physician, clinical psychologist, clinical
social worker, or licensed professional counselor upon whose professional
judgment the denial is based and who did not participate in the original
decision to deny the health records, who shall make a judgment as to whether to
make the health record available to the individual. The health care entity shall
comply with the judgment of the reviewing physician, clinical psychologist,
clinical social worker, or licensed professional counselor. The health care
entity shall permit copying and examination of the health record by such other
physician, clinical psychologist, clinical social worker, or licensed
professional counselor designated by either the individual at his own expense or
by the health care entity at its expense.
			Any health record copied for review by any such designated physician,
clinical psychologist, clinical social worker, or licensed professional
counselor shall be accompanied by a statement from the custodian of the health
record that the individual&#8217;s treating physician, clinical psychologist,
clinical social worker, or licensed professional counselor determined that the
individual&#8217;s review of his health record would be reasonably likely to
endanger the life or physical safety of the individual or would be reasonably
likely to cause substantial harm to a person referenced in the health record who
is not a health care provider.
			Further, nothing herein shall be construed as giving, or interpreted to
bestow the right to receive copies of, or otherwise obtain access to,
psychotherapy notes to any individual or any person authorized to act on his
behalf.

G. A written authorization to allow release of an individual&#8217;s health
records shall substantially include the following information:
			AUTHORIZATION TO RELEASE CONFIDENTIAL HEALTH RECORDS
			Individual&#8217;s Name ________
			Health Care Entity&#8217;s Name ________
			Person, Agency, or Health Care Entity to whom disclosure is to be made
			____
			Information or Health Records to be disclosed
			____
			Purpose of Disclosure or at the Request of the Individual
			____
			As the person signing this authorization, I understand that I am giving my
permission to the above-named health care entity for disclosure of confidential
health records. I understand that the health care entity may not condition
treatment or payment on my willingness to sign this authorization unless the
specific circumstances under which such conditioning is permitted by law are
applicable and are set forth in this authorization. I also understand that I
have the right to revoke this authorization at any time, but that my revocation
is not effective until delivered in writing to the person who is in possession
of my health records and is not effective as to health records already disclosed
under this authorization. A copy of this authorization and a notation concerning
the persons or agencies to whom disclosure was made shall be included with my
original health records. I understand that health information disclosed under
this authorization might be redisclosed by a recipient and may, as a result of
such disclosure, no longer be protected to the same extent as such health
information was protected by law while solely in the possession of the health
care entity.
			This authorization expires on (date) or (event) ____
			Signature of Individual or Individual&#8217;s Legal Representative if
Individual is Unable to Sign
			____
			Relationship or Authority of Legal Representative
			____
			Date of Signature ____

H. Pursuant to this subsection:

   1. Unless excepted from these provisions in subdivision 9, no party to a
   civil, criminal or administrative action or proceeding shall request the
   issuance of a subpoena duces tecum for another party&#8217;s health records or
   cause a subpoena duces tecum to be issued by an attorney unless a copy of the
   request for the subpoena or a copy of the attorney-issued subpoena is provided
   to the other party&#8217;s counsel or to the other party if pro se,
   simultaneously with filing the request or issuance of the subpoena. No party
   to an action or proceeding shall request or cause the issuance of a subpoena
   duces tecum for the health records of a nonparty witness unless a copy of the
   request for the subpoena or a copy of the attorney-issued subpoena is provided
   to the nonparty witness simultaneously with filing the request or issuance of
   the attorney-issued subpoena.
   				No subpoena duces tecum for health records shall set a return date earlier
   than 15 days from the date of the subpoena except by order of a court or
   administrative agency for good cause shown. When a court or administrative
   agency directs that health records be disclosed pursuant to a subpoena duces
   tecum earlier than 15 days from the date of the subpoena, a copy of the order
   shall accompany the subpoena.
   				Any party requesting a subpoena duces tecum for health records or on whose
   behalf the subpoena duces tecum is being issued shall have the duty to
   determine whether the individual whose health records are being sought is pro
   se or a nonparty.
   				In instances where health records being subpoenaed are those of a pro se
   party or nonparty witness, the party requesting or issuing the subpoena shall
   deliver to the pro se party or nonparty witness together with the copy of the
   request for subpoena, or a copy of the subpoena in the case of an
   attorney-issued subpoena, a statement informing them of their rights and
   remedies. The statement shall include the following language and the heading
   shall be in boldface capital letters:
   				NOTICE TO INDIVIDUAL
   				The attached document means that ________(insert name of party requesting
   or causing issuance of the subpoena) has either asked the court or
   administrative agency to issue a subpoena or a subpoena has been issued by the
   other party&#8217;s attorney to your doctor, other health care providers
   ________(names of health care providers inserted here) or other health care
   entity ________(name of health care entity to be inserted here) requiring them
   to produce your health records. Your doctor, other health care provider or
   other health care entity is required to respond by providing a copy of your
   health records. If you believe your health records should not be disclosed and
   object to their disclosure, you have the right to file a motion with the clerk
   of the court or the administrative agency to quash the subpoena. If you elect
   to file a motion to quash, such motion must be filed within 15 days of the
   date of the request or of the attorney-issued subpoena. You may contact the
   clerk&#8217;s office or the administrative agency to determine the
   requirements that must be satisfied when filing a motion to quash and you may
   elect to contact an attorney to represent your interest. If you elect to file
   a motion to quash, you must notify your doctor, other health care provider(s),
   or other health care entity, that you are filing the motion so that the health
   care provider or health care entity knows to send the health records to the
   clerk of court or administrative agency in a sealed envelope or package for
   safekeeping while your motion is decided.

   2. Any party filing a request for a subpoena duces tecum or causing such a
   subpoena to be issued for an individual&#8217;s health records shall include a
   Notice in the same part of the request in which the recipient of the subpoena
   duces tecum is directed where and when to return the health records. Such
   notice shall be in boldface capital letters and shall include the following
   language:
   				NOTICE TO HEALTH CARE ENTITIES
   				A COPY OF THIS SUBPOENA DUCES TECUM HAS BEEN PROVIDED TO THE INDIVIDUAL
   WHOSE HEALTH RECORDS ARE BEING REQUESTED OR HIS COUNSEL. YOU OR THAT
   INDIVIDUAL HAS THE RIGHT TO FILE A MOTION TO QUASH (OBJECT TO) THE ATTACHED
   SUBPOENA. IF YOU ELECT TO FILE A MOTION TO QUASH, YOU MUST FILE THE MOTION
   WITHIN 15 DAYS OF THE DATE OF THIS SUBPOENA.
   				YOU MUST NOT RESPOND TO THIS SUBPOENA UNTIL YOU HAVE RECEIVED WRITTEN
   CERTIFICATION FROM THE PARTY ON WHOSE BEHALF THE SUBPOENA WAS ISSUED THAT THE
   TIME FOR FILING A MOTION TO QUASH HAS ELAPSED AND THAT:
   				NO MOTION TO QUASH WAS FILED; OR
   				ANY MOTION TO QUASH HAS BEEN RESOLVED BY THE COURT OR THE ADMINISTRATIVE
   AGENCY AND THE DISCLOSURES SOUGHT ARE CONSISTENT WITH SUCH RESOLUTION.
   				IF YOU RECEIVE NOTICE THAT THE INDIVIDUAL WHOSE HEALTH RECORDS ARE BEING
   REQUESTED HAS FILED A MOTION TO QUASH THIS SUBPOENA, OR IF YOU FILE A MOTION
   TO QUASH THIS SUBPOENA, YOU MUST SEND THE HEALTH RECORDS ONLY TO THE CLERK OF
   THE COURT OR ADMINISTRATIVE AGENCY THAT ISSUED THE SUBPOENA OR IN WHICH THE
   ACTION IS PENDING AS SHOWN ON THE SUBPOENA USING THE FOLLOWING PROCEDURE:
   				PLACE THE HEALTH RECORDS IN A SEALED ENVELOPE AND ATTACH TO THE SEALED
   ENVELOPE A COVER LETTER TO THE CLERK OF COURT OR ADMINISTRATIVE AGENCY WHICH
   STATES THAT CONFIDENTIAL HEALTH RECORDS ARE ENCLOSED AND ARE TO BE HELD UNDER
   SEAL PENDING A RULING ON THE MOTION TO QUASH THE SUBPOENA. THE SEALED ENVELOPE
   AND THE COVER LETTER SHALL BE PLACED IN AN OUTER ENVELOPE OR PACKAGE FOR
   TRANSMITTAL TO THE COURT OR ADMINISTRATIVE AGENCY.

   3. Upon receiving a valid subpoena duces tecum for health records, health care
   entities shall have the duty to respond to the subpoena in accordance with the
   provisions of subdivisions 4, 5, 6, 7, and 8.

   4. Except to deliver to a clerk of the court or administrative agency
   subpoenaed health records in a sealed envelope as set forth, health care
   entities shall not respond to a subpoena duces tecum for such health records
   until they have received a certification as set forth in subdivision 5 or 8
   from the party on whose behalf the subpoena duces tecum was issued.
   				If the health care entity has actual receipt of notice that a motion to
   quash the subpoena has been filed or if the health care entity files a motion
   to quash the subpoena for health records, then the health care entity shall
   produce the health records, in a securely sealed envelope, to the clerk of the
   court or administrative agency issuing the subpoena or in whose court or
   administrative agency the action is pending. The court or administrative
   agency shall place the health records under seal until a determination is made
   regarding the motion to quash. The securely sealed envelope shall only be
   opened on order of the judge or administrative agency. In the event the court
   or administrative agency grants the motion to quash, the health records shall
   be returned to the health care entity in the same sealed envelope in which
   they were delivered to the court or administrative agency. In the event that a
   judge or administrative agency orders the sealed envelope to be opened to
   review the health records in camera, a copy of the order shall accompany any
   health records returned to the health care entity. The health records returned
   to the health care entity shall be in a securely sealed envelope.

   5. If no motion to quash is filed within 15 days of the date of the request or
   of the attorney-issued subpoena, the party on whose behalf the subpoena was
   issued shall have the duty to certify to the subpoenaed health care entity
   that the time for filing a motion to quash has elapsed and that no motion to
   quash was filed. Any health care entity receiving such certification shall
   have the duty to comply with the subpoena duces tecum by returning the
   specified health records by either the return date on the subpoena or five
   days after receipt of the certification, whichever is later.

   6. In the event that the individual whose health records are being sought
   files a motion to quash the subpoena, the court or administrative agency shall
   decide whether good cause has been shown by the discovering party to compel
   disclosure of the individual&#8217;s health records over the
   individual&#8217;s objections. In determining whether good cause has been
   shown, the court or administrative agency shall consider (i) the particular
   purpose for which the information was collected; (ii) the degree to which the
   disclosure of the records would embarrass, injure, or invade the privacy of
   the individual; (iii) the effect of the disclosure on the individual&#8217;s
   future health care; (iv) the importance of the information to the lawsuit or
   proceeding; and (v) any other relevant factor.

   7. Concurrent with the court or administrative agency&#8217;s resolution of a
   motion to quash, if subpoenaed health records have been submitted by a health
   care entity to the court or administrative agency in a sealed envelope, the
   court or administrative agency shall: (i) upon determining that no submitted
   health records should be disclosed, return all submitted health records to the
   health care entity in a sealed envelope; (ii) upon determining that all
   submitted health records should be disclosed, provide all the submitted health
   records to the party on whose behalf the subpoena was issued; or (iii) upon
   determining that only a portion of the submitted health records should be
   disclosed, provide such portion to the party on whose behalf the subpoena was
   issued and return the remaining health records to the health care entity in a
   sealed envelope.

   8. Following the court or administrative agency&#8217;s resolution of a motion
   to quash, the party on whose behalf the subpoena duces tecum was issued shall
   have the duty to certify in writing to the subpoenaed health care entity a
   statement of one of the following:
   				a. All filed motions to quash have been resolved by the court or
   administrative agency and the disclosures sought in the subpoena duces tecum
   are consistent with such resolution; and, therefore, the health records
   previously delivered in a sealed envelope to the clerk of the court or
   administrative agency will not be returned to the health care entity;
   				b. All filed motions to quash have been resolved by the court or
   administrative agency and the disclosures sought in the subpoena duces tecum
   are consistent with such resolution and that, since no health records have
   previously been delivered to the court or administrative agency by the health
   care entity, the health care entity shall comply with the subpoena duces tecum
   by returning the health records designated in the subpoena by the return date
   on the subpoena or five days after receipt of certification, whichever is
   later;
   				c. All filed motions to quash have been resolved by the court or
   administrative agency and the disclosures sought in the subpoena duces tecum
   are not consistent with such resolution; therefore, no health records shall be
   disclosed and all health records previously delivered in a sealed envelope to
   the clerk of the court or administrative agency will be returned to the health
   care entity;
   				d. All filed motions to quash have been resolved by the court or
   administrative agency and the disclosures sought in the subpoena duces tecum
   are not consistent with such resolution and that only limited disclosure has
   been authorized. The certification shall state that only the portion of the
   health records as set forth in the certification, consistent with the court or
   administrative agency&#8217;s ruling, shall be disclosed. The certification
   shall also state that health records that were previously delivered to the
   court or administrative agency for which disclosure has been authorized will
   not be returned to the health care entity; however, all health records for
   which disclosure has not been authorized will be returned to the health care
   entity; or
   				e. All filed motions to quash have been resolved by the court or
   administrative agency and the disclosures sought in the subpoena duces tecum
   are not consistent with such resolution and, since no health records have
   previously been delivered to the court or administrative agency by the health
   care entity, the health care entity shall return only those health records
   specified in the certification, consistent with the court or administrative
   agency&#8217;s ruling, by the return date on the subpoena or five days after
   receipt of the certification, whichever is later.
   				A copy of the court or administrative agency&#8217;s ruling shall
   accompany any certification made pursuant to this subdivision.

   9. The provisions of this subsection have no application to subpoenas for
   health records requested under &#xA7; 8.01-413, or issued by a duly authorized
   administrative agency conducting an investigation, audit, review or
   proceedings regarding a health care entity&#8217;s conduct.
   				The provisions of this subsection shall apply to subpoenas for the health
   records of both minors and adults.
   				Nothing in this subsection shall have any effect on the existing authority
   of a court or administrative agency to issue a protective order regarding
   health records, including, but not limited to, ordering the return of health
   records to a health care entity, after the period for filing a motion to quash
   has passed.
   				A subpoena for substance abuse records must conform to the requirements of
   federal law found in 42 C.F.R. Part 2, Subpart E.

I. Health care entities may testify about the health records of an individual in
compliance with &#xA7;&#xA7; 8.01-399 and 8.01-400.2.

J. Except as provided by subsection B7 of &#xA7; 8.01-413, if an individual
requests a copy of his health record from a health care entity, the health care
entity may impose a reasonable cost-based fee, which shall include only the cost
of supplies for and labor of copying the requested information, postage when the
individual requests that such information be mailed, and preparation of an
explanation or summary of such information as agreed to by the individual. For
the purposes of this section, &#8220;individual&#8221; shall subsume a person
with authority to act on behalf of the individual who is the subject of the
health record in making decisions related to his health care.

K. Nothing in this section shall prohibit a health care provider who prescribes
or dispenses a controlled substance required to be reported to the Prescription
Monitoring Program established pursuant to Chapter 25.2 (&#xA7; 54.1-2519 et
seq.) of Title 54.1 to a patient from disclosing information obtained from the
Prescription Monitoring Program and contained in a patient&#8217;s health care
record to another health care provider when such disclosure is related to the
care or treatment of the patient who is the subject of the record.

L. An authorization for the disclosure of health records executed pursuant to
this section shall remain in effect until (i) the authorization is revoked in
writing and delivered to the health care entity maintaining the record that is
subject to the authorization by the person who executed the authorization, (ii)
any expiration date set forth in the authorization, or (iii) the health care
entity maintaining the record becomes aware of any expiration event described in
the authorization, whichever occurs first. However, any revocation of an
authorization for the disclosure of health records executed pursuant to this
section shall not be effective to the extent that the health care entity
maintaining the record has disclosed health records prior to delivery of such
revocation in reliance upon the authorization or as otherwise provided pursuant
to 45 C.F.R. &#xA7; 164.508. A statement in an authorization for the disclosure
of health records pursuant to this section that the information to be used or
disclosed is &#8220;all health records&#8221; is a sufficient description for
the disclosure of all health records of the person maintained by the health care
provider to whom the authorization was granted. If a health care provider
receives a written revocation of an authorization for the disclosure of health
records in accordance with this subsection, a copy of such written revocation
shall be included in the person&#8217;s original health record maintained by the
health care provider.
			An authorization for the disclosure of health records executed pursuant to
this section shall, unless otherwise expressly limited in the authorization, be
deemed to include authorization for the person named in the authorization to
assist the person who is the subject of the health record in accessing health
care services, including scheduling appointments for the person who is the
subject of the health record and attending appointments together with the person
who is the subject of the health record.

HISTORY: 1997, c. 682; 1998, c. 470; 1999, cc. 812, 956, 1010; 2000, cc. 810,
813, 923, 927; 2001, c. 671; 2002, cc. 568, 658, 835, 860; 2003, cc. 471, 907,
983; 2004, cc. 49, 64, 65, 66, 67, 163, 773, 1014, 1021; 2005, cc. 39, 101, 642,
697; 2006, c. 433; 2007, c. 497; 2008, cc. 315, 782, 850, 870; 2009, cc. 606,
651, 813, 840; 2010, cc. 185, 340, 406, 456, 524, 778, 825; 2011, cc. 499, 668,
798, 812, 844, 871; 2012, cc. 386, 402, 479; 2016, c. 554; 2017, cc. 457, 712,
720; 2018, c. 165; 2020, c. 945; 2022, cc. 509, 534, 784; 2025, c. 182.