                                 CODE OF VIRGINIA

DISCLOSURE LIMITATIONS AND CONDITIONS (§ 38.2-613)

A. An insurance institution, agent, or insurance-support organization shall not
disclose any medical-record information or privileged information about an
individual collected or received in connection with an insurance transaction
unless the disclosure is with the written authorization of the individual,
provided:

   1. If the authorization is submitted by another insurance institution, agent,
   or insurance-support organization, the authorization meets the requirements of
   &#xA7; 38.2-606; or

   2. If the authorization is submitted by a person other than an insurance
   institution, agent, or insurance-support organization, the authorization is:
   				a. Dated,
   				b. Signed by the individual, and
   				c. Obtained two years or less prior to the date a disclosure is sought
   pursuant to this subdivision.

B. Notwithstanding the provisions of subsection A, an insurance institution,
agent, or insurance-support organization may disclose personal or privileged
information about an individual collected or received in connection with an
insurance transaction, without written authorization, if the disclosure is:

   1. To a person other than an insurance institution, agent, or
   insurance-support organization, provided the disclosure is reasonably
   necessary:
   				a. To enable that person to perform a business, professional or insurance
   function for the disclosing insurance institution, agent, or insurance-support
   organization and that person agrees not to disclose the information further
   without the individual&#8217;s written authorization unless the further
   disclosure:

      1. Would otherwise be permitted by this section if made by an insurance
      institution, agent, or insurance-support organization; or

      2. Is reasonably necessary for that person to perform its function for the
      disclosing insurance institution, agent, or insurance-support organization;
      or
      					b. To enable that person to provide information to the disclosing
      insurance institution, agent, or insurance-support organization for the
      purpose of:

      1. Determining an individual&#8217;s eligibility for an insurance benefit or
      payment; or

      2. Detecting or preventing criminal activity, fraud, material
      misrepresentation, or material nondisclosure in connection with an insurance
      transaction; or

   2. To an insurance institution, agent, or insurance-support organization, or
   self-insurer, provided the information disclosed is limited to that which is
   reasonably necessary:
   				a. To detect or prevent criminal activity, fraud, material
   misrepresentation, or material nondisclosure in connection with insurance
   transactions; or
   				b. For either the disclosing or receiving insurance institution, agent or
   insurance-support organization to perform its function in connection with an
   insurance transaction involving the individual; or

   3. To a medical-care institution or medical professional for the purpose of
   (i) verifying insurance coverage or benefits, (ii) informing an individual of
   a medical problem of which the individual may not be aware or (iii) conducting
   an operations or services audit, provided only that information is disclosed
   as is reasonably necessary to accomplish the foregoing purposes; or

   4. To an insurance regulatory authority; or

   5. To a law-enforcement or other government authority:
   				a. To protect the interests of the insurance institution, agent or
   insurance-support organization in preventing or prosecuting the perpetration
   of fraud upon it; or
   				b. If the insurance institution, agent, or insurance-support organization
   reasonably believes that illegal activities have been conducted by the
   individual; or
   				c. Upon written request of any law-enforcement agency, for all insured or
   claimant information in the possession of an insurance institution, agent, or
   insurance-support organization which relates an ongoing criminal
   investigation. Such insurance institution, agent, or insurance-support
   organization shall release such information, including, but not limited to,
   policy information, premium payment records, record of prior claims by the
   insured or by another claimant, and information collected in connection with
   an insurance company&#8217;s investigation of an application or claim. Any
   information released to a law-enforcement agency pursuant to such request
   shall be treated as confidential criminal investigation information and not be
   disclosed further except as provided by law. Notwithstanding any provision in
   this article, no insurance institution, agent, or insurance-support
   organization shall notify any insured or claimant that information has been
   requested or supplied pursuant to this section prior to notification from the
   requesting law-enforcement agency that its criminal investigation is
   completed. Within ninety days following the completion of any such criminal
   investigation, the law-enforcement agency making such a request for
   information shall notify any insurance institution, agent, or
   insurance-support organization from whom information was requested that the
   criminal investigation has been completed; or

   6. Otherwise permitted or required by law; or

   7. In response to a facially valid administrative or judicial order, including
   a search warrant or subpoena; or

   8. Made for the purpose of conducting actuarial or research studies, provided:
   				a. No individual may be identified in any actuarial or research report,
   and
   				b. Materials allowing the individual to be identified are returned or
   destroyed as soon as they are no longer needed, and
   				c. The actuarial or research organization agrees not to disclose the
   information unless the disclosure would otherwise be permitted by this section
   if made by an insurance institution, agent, or insurance-support organization;
   or

   9. To a party or a representative of a party to a proposed or consummated
   sale, transfer, merger, or consolidation of all or part of the business of the
   insurance institution, agent, or insurance-support organization, provided:
   				a. Prior to the consummation of the sale, transfer, merger, or
   consolidation only such information is disclosed as is reasonably necessary to
   enable the recipient to make business decisions about the purchase, transfer,
   merger, or consolidation, and
   				b. The recipient agrees not to disclose the information unless the
   disclosure would otherwise be permitted by this section if made by an
   insurance institution, agent, or insurance-support organization; or

   10. To a nonaffiliated third party whose only use of such information will be
   in connection with the marketing of a nonfinancial product or service,
   provided:
   				a. No medical-record information, privileged information, or personal
   information relating to an individual&#8217;s character, personal habits, mode
   of living, or general reputation is disclosed, and no classification derived
   from the information is disclosed,
   				b. The individual has been given an opportunity, in accordance with the
   provisions of subsection A of &#xA7; 38.2-612.1, to indicate that he does not
   want financial information disclosed for marketing purposes and has given no
   indication that he does not want the information disclosed, and
   				c. The nonaffiliated third party receiving such information agrees not to
   use it except in connection with the marketing of the product or service; or

   11. (i) To a consumer reporting agency in accordance with the Fair Credit
   Reporting Act (15 U.S.C. &#xA7; 1681 et seq.) or (ii) from a consumer report
   reported by a consumer reporting agency; or

   12. To a group policyholder for the purpose of reporting claims experience or
   conducting an audit of the insurance institution&#8217;s or agent&#8217;s
   operations or services, provided the information disclosed is reasonably
   necessary for the group policyholder to conduct the review or audit; or

   13. To a professional peer review organization for the purpose of reviewing
   the service or conduct of a medical-care institution or medical professional;
   or

   14. To a governmental authority for the purpose of determining the
   individual&#8217;s eligibility for health benefits for which the governmental
   authority may be liable; or

   15. To a certificate holder or policyholder for the purpose of providing
   information regarding the status of an insurance transaction; or

   16. To a lienholder, mortgagee, assignee, lessor or other person shown on the
   records of an insurance institution or agent as having a legal or beneficial
   interest in a policy of insurance, or to persons acting in a fiduciary or
   representative capacity on behalf of the individual, provided that:
   				a. No medical record information is disclosed unless the disclosure would
   be permitted by this section; and
   				b. The information disclosed is limited to that which is reasonably
   necessary to permit such person to protect his interest in the policy; or

   17. Necessary to effect, administer, or enforce a transaction requested or
   authorized by the individual, or in connection with servicing or processing an
   insurance product or service requested or authorized by the individual, or
   necessary for reinsurance purposes, or for stop loss or excess loss agreements
   provided for in subsection B of &#xA7; 38.2-109; or

   18. Pursuant to any federal Health Insurance Portability and Accountability
   Act privacy rules promulgated by the United States Department of Health and
   Human Services.

C. An insurance institution, agent, or insurance-support organization may
disclose information about an individual collected or received in connection
with an insurance transaction, without written authorization, if the disclosure
is:

   1. To a nonaffiliated third party whose only use of such information will be
   to perform services for or functions on behalf of the insurance institution in
   connection with the marketing of the insurance institution&#8217;s product or
   service or the marketing of products or services offered pursuant to a joint
   marketing agreement, provided:
   				a. No medical-record information or privileged information is disclosed
   without the individual&#8217;s written authorization unless such disclosure is
   otherwise permitted by subsection B,
   				b. With respect to financial information, the individual has been given
   the notice required by subsection B of &#xA7; 38.2-604.1, and
   				c. The person receiving such financial information agrees, by contract,
   (i) not to use it except to perform services for or functions on behalf of the
   insurance institution in connection with the marketing of the insurance
   institution&#8217;s product or service or the marketing of products or
   services offered pursuant to a joint marketing agreement, or as permitted
   under subsection B and (ii) to maintain the confidentiality of such
   information and not disclose it to any other nonaffiliated third party unless
   such disclosure would otherwise be permitted by this section if made by the
   insurance institution, agent, or insurance-support organization;

   2. To an affiliate, provided:
   				a. No medical-record information or privileged information is disclosed
   without the individual&#8217;s written authorization unless such disclosure is
   otherwise permitted by subsection B, and
   				b. The affiliate receiving the information does not disclose the
   information except as would otherwise be permitted by this section if such
   disclosure were made by the insurance institution, agent, or insurance-support
   organization.

D. 1. No person proposing to issue, re-issue, or renew any policy, contract, or
plan of accident and sickness insurance defined in § 38.2-109, but excluding
disability income insurance, issued by any (i) insurer providing hospital,
medical and surgical or major medical coverage on an expense incurred basis,
(ii) corporation providing a health services plan, or (iii) health maintenance
organization providing a health care plan for health care services shall
disclose any genetic information about an individual or a member of such
individual&#8217;s family collected or received in connection with any insurance
transaction unless the disclosure is made with the written authorization of the
individual.

   2. For the purpose of this subsection, &#8220;genetic information&#8221; means
   information about genes, gene products, or inherited characteristics that may
   derive from an individual or a family member.

   3. Agents and insurance support organizations shall be subject to the
   provisions of this subsection to the extent of their participation in the
   issue, re-issue, or renewal of any policy, contract, or plan of accident and
   sickness insurance defined in &#xA7; 38.2-109, but excluding disability income
   insurance.

E. Any notices, disclosures, or authorizations required by this section may be
provided electronically if the individual agrees.

F. Any privileged information about an individual that is disclosed in violation
of this section shall be available to that individual in accordance with the
provisions of &#xA7;&#xA7; 38.2-608 and 38.2-609.

G. Except in the case of disclosures made pursuant to subdivision B 10, the
requirements of subsection A of &#xA7; 38.2-612.1 shall not apply when
information is disclosed pursuant to this section.

HISTORY: 1981, c. 389, § 38.1-57.16; 1986, c. 562; 1987, c. 325; 1996, c. 704;
2001, c. 371; 2020, c. 264.