Virginia Administrative Code
Title 12 - HEALTH
Agency 35 - DEPARTMENT OF BEHAVIORAL HEALTH AND DEVELOPMENTAL SERVICES
Chapter 115 - REGULATIONS TO ASSURE THE RIGHTS OF INDIVIDUALS RECEIVING SERVICES FROM PROVIDERS LICENSED, FUNDED, OR OPERATED BY THE DEPARTMENT OF BEHAVIORAL
Part III - Explanation of Individual Rights and Provider Duties
Section 12VAC35-115-80 - Confidentiality
Universal Citation: 2 VA Admin Code 35-115-80
Current through Register Vol. 41, No. 3, September 23, 2024
A. Each individual is entitled to have all identifying information that a provider maintains or knows about him remain confidential. Each individual has a right to give his authorization before the provider shares identifying information about him or his care unless another state law or regulation, or these regulations specifically require or permit the provider to disclose certain specific information.
B. The provider's duties.
1. Providers shall maintain the
confidentiality of any information that identifies an individual. If an
individual's services record pertains in whole or in part to referral,
diagnosis or treatment of substance use disorders, providers shall disclose
information only according to applicable federal regulations (see 42 CFR Part
2, Confidentiality of Alcohol and Drug Abuse Patient Records).
2. Providers shall obtain and document in the
individual's services record the individual's authorization or that of the
authorized representative prior to disclosing any identifying information about
him. The authorization must contain the following elements:
a. The name of the organization and the name
or other specific identification of the person or persons or class of persons
to whom disclosure is made;
b. A
description of the nature of the information to be disclosed, the purpose of
the disclosure, and an indication whether the authorization extends to the
information placed in the individual's record after the authorization was given
but before it expires;
c. An
indication of the effective date of the authorization and the date the
authorization will expire, or the event or condition upon which it will expire;
and
d. The signature of the
individual and the date. If the authorization is signed by an authorized
representative, a description of the authorized representative's authority to
act.
3. Providers shall
tell each individual and his authorized representative about the individual's
confidentiality rights. This shall include how information can be disclosed and
how others might get information about the individual without his
authorization. If a disclosure is not required by law, the provider shall give
strong consideration to any objections from the individual or his authorized
representative in making the decision to disclose information.
4. Providers shall prevent unauthorized
disclosures of information from services records and shall maintain and
disclose information in a secure manner.
5. In the case of a minor, the authorization
of the custodial parent or other person authorized to consent to the minor's
treatment under § 54.1-2969 is required, except as provided below:
a. Section 54.1-2969E of the Code of Virginia
permits a minor to authorize the disclosure of information related to medical
or health services for a sexually transmitted or contagious disease, family
planning or pregnancy, and outpatient care, treatment or rehabilitation for
substance use disorders, mental illness, or emotional disturbance.
b. The concurrent authorization of the minor
and custodial parent is required to disclose inpatient substance abuse
records.
c. The minor and the
custodial parent shall authorize the disclosure of identifying information
related to the minor's inpatient psychiatric hospitalization when the minor is
14 years of age or older and has consented to the admission.
6. When providers disclose
identifying information, they shall attach a statement that informs the person
receiving the information that it must not be disclosed to anyone else unless
the individual authorizes the disclosure or unless state law or regulation
allows or requires further disclosure without authorization.
7. Providers may encourage individuals to
name family members, friends, and others who may be told of their presence in
the program and general condition or well-being. Except for information
governed by 42 CFR Part 2, providers may disclose to a family member, other
relative, a close personal friend, or any other person identified by the
individual, information that is directly relevant to that persons involvement
with the individual's care or payment for his health care, if (i) the provider
obtains the individual's agreement, (ii) the provider provides the individual
with the opportunity to object to the disclosure, and (iii) the individual does
not object or the provider reasonably infers for the circumstances, based or
the exercise of professional judgment, that the individual does not object to
the disclosure. If the opportunity to agree or object cannot be provided
because of the individual's incapacity or an emergency circumstance, the
provider may, in the exercise of professional judgment, determine whether the
disclosure is in the best interest of the individual and, if so, disclose only
the information that is directly relevant to the person's involvement with the
individual's health care.
8.
Providers may disclose the following identifying information without
authorization or violation of the individual's confidentiality, but only under
the conditions specified in the following subdivisions of this subsection.
Providers should always consult 42 CFR Part 2, Confidentiality of Alcohol and
Drug Abuse Patient Records, if applicable, because these federal regulations
may prohibit some of the disclosures addressed in this section.
a. Emergencies: Providers may disclose
information in an emergency to any person who needs that particular information
for the purpose of preventing injury to or death of an individual or other
person. The provider shall not disclose any information that is not needed for
this specific purpose.
b. Providers
or health plans: Providers may permit any full-time or part-time employee,
consultant, agent, or contractor of the provider to use identifying information
or disclose to another provider, a health plan, the department, or a CSB,
information required to give services to the individual or to get payment for
the services.
c. Court proceedings:
If the individual or someone acting for him introduces any aspect of his mental
condition or services as an issue before a court, administrative agency, or
medical malpractice review panel, the provider may disclose any information
relevant to that issue. The provider may also disclose any records if they are
properly subpoenaed, if a court orders them to be produced, or if involuntary
admission or certification for admission is being proposed.
d. Legal counsel: Providers may disclose
information to their own legal counsel or to anyone working on behalf of their
legal counsel in providing representation to the provider. Providers of
state-operated services may disclose information to the Office of the Attorney
General or to anyone appointed by or working on behalf of that office in
providing representation to the Commonwealth of Virginia.
e. Human rights committees: Providers may
disclose to the LHRC and the SHRC any information necessary for the conduct of
their responsibilities under these regulations.
f. Others authorized or required by the
commissioner, CSB, or private program director: Providers may disclose
information to other persons if authorized or required for the following
activities:
(1) Licensing, human rights, or
certification or accreditation reviews;
(2) Hearings, reviews, appeals, or
investigations under these regulations;
(3) Evaluation of provider performance and
individual outcomes (see §§ 37.2-508 and 37.2-608 of the Code of
Virginia);
(4) Statistical
reporting;
(5) Preauthorization,
utilization reviews, financial and related administrative services reviews, and
audits; or
(6) Similar oversight
and review activities.
g. Preadmission screening, services, and
discharge planning: Providers may disclose to the department, the CSB, or to
other providers information necessary to screen individuals for admission or to
prepare and carry out a comprehensive individualized services or discharge plan
(see § 37.2-505 of the Code of Virginia).
h. Protection and advocacy agency: Providers
may disclose information to the protection and advocacy agency in accordance
with that agency's legal authority under federal and state law.
i. Historical research: Providers may
disclose information to persons engaging in bona fide historical research if
all of the following conditions are met:
(1)
The request for historical research shall include, at a minimum, a summary of
the scope and purpose of the research, a description of the product to result
from the research and its expected date of completion, a rationale explaining
the need to access otherwise private information, and the specific
identification of the type and location of the records sought.
(2) The commissioner, CSB executive director,
or private program director has authorized the research;
(3) The individual or individuals who are the
subject of the disclosure are deceased;
(4) There are no known living persons
permitted by law to authorize the disclosure; and
(5) The disclosure would in no way reveal the
identity of any person who is not the subject of the historical
research.
j. Protection
of public safety: If an individual receiving services makes a specific threat
to cause serious bodily injury or death to an identified or readily
identifiable person and the provider reasonably believes that the individual
has the intent and the ability to carry out the threat immediately or
imminently, the provider may disclose those facts necessary to alleviate the
potential threat.
k. Inspector
General: Providers may disclose to the Office of the State Inspector General
(§ 2.2-308 of the Code of Virginia) any individual services records and
other information relevant to the provider's delivery of services.
l. Virginia Patient Level Data System:
Providers may disclose financial and services information to Virginia Health
Information as required by law (see Chapter 7.2 (§ 32.1-276.2 et seq.) of
Title 32.1 of the Code of Virginia).
m. Psychotherapy notes: Providers shall
obtain an individual's authorization for any disclosure of psychotherapy notes,
except when disclosure is made:
(1) For the
provider's own training programs in which students, trainees, or practitioners
in mental health are being taught under supervision to practice or improve
their skills in group, joint, family or individual counseling;
(2) To defend the provider or its employees
or staff against any accusation or wrongful conduct;
(3) In discharge of the provider's duty, in
accordance with § 54.1-2400.1B of the Code of Virginia, to take
precautions to protect third parties from violent behavior or other serious
harm;
(4) As required in the course
of an investigation, audit, review, or proceeding regarding a provider's
conduct by a duly authorized law enforcement, licensure, accreditation, or
professional review entity; or
(5)
When otherwise required by law.
n. A law-enforcement official:
(1) Pursuant to a search warrant or grand
jury subpoena;
(2) In response to
their request, for the purpose of identifying or locating a suspect, fugitive,
an individual required to register pursuant to § 9.1-901 of the Sex
Offender and Crimes Against Minors Registry Act, material witness, or missing
person, provided that only the following information is disclosed:
(a) Name and address of the
individual;
(b) Date and place of
birth of the individual;
(c) Social
security number of the individual;
(d) Blood type of the individual;
(e) Date and time of treatment received by
the individual;
(f) Date and time
of death of the individual;
(g)
Description of distinguishing physical characteristics of the individual;
and
(h) Type of injury sustained by
the individual.
(3)
Regarding the death of an individual for the purpose of alerting law
enforcement of the death if the health care entity has a suspicion that such
death may have resulted from criminal conduct; or
(4) If the health care entity believes in
good faith that the information disclosed constitutes evidence of a crime that
occurred on its premises.
o. Other statutes or regulations: Providers
may disclose information to the extent required or permitted by any other state
or law or regulation. See also § 32.1-127.1:03 of the Code of Virginia for
a list of circumstances in which records may be disclosed without
authorization.
9. Upon
request, the provider shall tell the individual or his authorized
representative the sources of information contained in his services records and
provide a written listing of disclosures of information made without
authorization, except for disclosures:
a. To
employees of the department, CSB, the provider, or other providers;
b. To carry out treatment, payment, or health
care operations;
c. That are
incidental or unintentional disclosures that occur as a by-product of engaging
in health care communications and practices that are already permitted or
required;
d. To an individual or
his authorized representative;
e.
Pursuant to an authorization;
f.
For national security or intelligence purposes;
g. To correctional institutions or
law-enforcement officials; or
h.
That were made more than six years prior to the request.
10. The provider shall include the following
information in the listing of disclosures of information provided to the
individual or his authorized representative under subdivision 9 of this
subsection:
a. The name of the person or
organization that received the information and the address if known;
b. A brief description of the information
disclosed; and
c. A brief statement
of the purpose of the disclosure or, in lieu of such a statement, a copy of the
written request for disclosure.
11. If the provider makes multiple
disclosures of information to the same person or entity for a single purpose,
the provider shall include the following:
a.
The information required in subdivision 10 of this subsection for the first
disclosure made during the requested period;
b. The frequency, periodicity, or number of
disclosures made during the period for which the individual is requesting
information; and
c. The date of the
last disclosure during the time period.
12. If the provider makes a disclosure to a
social service or protective services agency about an individual who the
provider reasonably believes to be a victim of abuse or neglect, the provider
is not required to inform the individual or his authorized representative of
the disclosure if:
a. The provider, in the
exercise of professional judgment, believes that informing the individual would
place the individual at risk of serious harm; or
b. The provider would be informing the
authorized representative, and the provider reasonably believes that the
authorized representative is responsible for the abuse or neglect, and that
informing such person would not be in the best interests of the
individual.
Statutory Authority: §§ 37.2-203 and 37.2-400 of the Code of Virginia.
Disclaimer: These regulations may not be the most recent version. Virginia may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
