2006 Code of Virginia § 32.1-127.1:03 - Health records privacy

32.1-127.1:03. Health records privacy.

A. There is hereby recognized an individual's right of privacy in the contentof his health records. Health records are the property of the health careentity maintaining them, and, except when permitted or required by thissection or by other provisions of state law, no health care entity, or otherperson working in a health care setting, may disclose an individual's healthrecords.

Pursuant to this subsection:

1. Health care entities shall disclose health records to the individual whois the subject of the health record, except as provided in subsections E andF of this section and subsection B of 8.01-413.

2. Health records shall not be removed from the premises where they aremaintained without the approval of the health care entity that maintains suchhealth records, except in accordance with a court order or subpoenaconsistent with subsection C of 8.01-413 or with this section or inaccordance with the regulations relating to change of ownership of healthrecords promulgated by a health regulatory board established in Title 54.1.

3. No person to whom health records are disclosed shall redisclose orotherwise reveal the health records of an individual, beyond the purpose forwhich such disclosure was made, without first obtaining the individual'sspecific authorization to such redisclosure. This redisclosure prohibitionshall not, however, prevent (i) any health care entity that receives healthrecords from another health care entity from making subsequent disclosures aspermitted under this section and the federal Department of Health and HumanServices regulations relating to privacy of the electronic transmission ofdata and protected health information promulgated by the United StatesDepartment of Health and Human Services as required by the Health InsurancePortability and Accountability Act (HIPAA) (42 U.S.C. 1320d et seq.) or(ii) any health care entity from furnishing health records and aggregate orother data, from which individually identifying prescription information hasbeen removed, encoded or encrypted, to qualified researchers, including, butnot limited to, pharmaceutical manufacturers and their agents or contractors,for purposes of clinical, pharmaco-epidemiological, pharmaco-economic, orother health services research.

B. As used in this section:

"Agent" means a person who has been appointed as an individual's agentunder a power of attorney for health care or an advance directive under theHealth Care Decisions Act ( 54.1-2981 et seq.).

"Certification" means a written representation that is delivered by hand,by first-class mail, by overnight delivery service, or by facsimile if thesender obtains a facsimile-machine-generated confirmation reflecting that allfacsimile pages were successfully transmitted.

"Guardian" means a court-appointed guardian of the person.

"Health care clearinghouse" means, consistent with the definition set outin 45 C.F.R. 160.103, a public or private entity, such as a billingservice, repricing company, community health management information system orcommunity health information system, and "value-added" networks andswitches, that performs either of the following functions: (i) processes orfacilitates the processing of health information received from another entityin a nonstandard format or containing nonstandard data content into standarddata elements or a standard transaction; or (ii) receives a standardtransaction from another entity and processes or facilitates the processingof health information into nonstandard format or nonstandard data content forthe receiving entity.

"Health care entity" means any health care provider, health plan or healthcare clearinghouse.

"Health care provider" means those entities listed in the definition of"health care provider" in 8.01-581.1, except that state-operatedfacilities shall also be considered health care providers for the purposes ofthis section. Health care provider shall also include all persons who arelicensed, certified, registered or permitted or who hold a multistatelicensure privilege issued by any of the health regulatory boards within theDepartment of Health Professions, except persons regulated by the Board ofFuneral Directors and Embalmers or the Board of Veterinary Medicine.

"Health plan" means an individual or group plan that provides, or pays thecost of, medical care. "Health plan" shall include any entity included insuch definition as set out in 45 C.F.R. 160.103.

"Health record" means any written, printed or electronically recordedmaterial maintained by a health care entity in the course of providing healthservices to an individual concerning the individual and the servicesprovided. "Health record" also includes the substance of any communicationmade by an individual to a health care entity in confidence during or inconnection with the provision of health services or information otherwiseacquired by the health care entity about an individual in confidence and inconnection with the provision of health services to the individual.

"Health services" means, but shall not be limited to, examination,diagnosis, evaluation, treatment, pharmaceuticals, aftercare, habilitation orrehabilitation and mental health therapy of any kind, as well as payment orreimbursement for any such services.

"Individual" means a patient who is receiving or has received healthservices from a health care entity.

"Individually identifying prescription information" means allprescriptions, drug orders or any other prescription information thatspecifically identifies an individual.

"Parent" means a biological, adoptive or foster parent.

"Psychotherapy notes" means comments, recorded in any medium by a healthcare provider who is a mental health professional, documenting or analyzingthe contents of conversation during a private counseling session with anindividual or a group, joint, or family counseling session that are separatedfrom the rest of the individual's health record. "Psychotherapy notes"shall not include annotations relating to medication and prescriptionmonitoring, counseling session start and stop times, treatment modalities andfrequencies, clinical test results, or any summary of any symptoms,diagnosis, prognosis, functional status, treatment plan, or the individual'sprogress to date.

C. The provisions of this section shall not apply to any of the following:

1. The status of and release of information governed by 65.2-604 and65.2-607 of the Virginia Workers' Compensation Act;

2. Except where specifically provided herein, the health records of minors; or

3. The release of juvenile health records to a secure facility or a sheltercare facility pursuant to 16.1-248.3.

D. Health care entities may, and, when required by other provisions of statelaw, shall, disclose health records:

1. As set forth in subsection E, pursuant to the written authorization of (i)the individual or (ii) in the case of a minor, (a) his custodial parent,guardian or other person authorized to consent to treatment of minorspursuant to 54.1-2969 or (b) the minor himself, if he has consented to hisown treatment pursuant to 54.1-2969, or (iii) in emergency cases orsituations where it is impractical to obtain an individual's writtenauthorization, pursuant to the individual's oral authorization for a healthcare provider or health plan to discuss the individual's health records witha third party specified by the individual;

2. In compliance with a subpoena issued in accord with subsection H, pursuantto court order upon good cause shown or in compliance with a subpoena issuedpursuant to subsection C of 8.01-413;

3. In accord with subsection F of 8.01-399 including, but not limited to,situations where disclosure is reasonably necessary to establish or collect afee or to defend a health care entity or the health care entity's employeesor staff against any accusation of wrongful conduct; also as required in thecourse of an investigation, audit, review or proceedings regarding a healthcare entity's conduct by a duly authorized law-enforcement, licensure,accreditation, or professional review entity;

4. In testimony in accordance with 8.01-399 and 8.01-400.2;

5. In compliance with the provisions of 8.01-413;

6. As required or authorized by law relating to public health activities,health oversight activities, serious threats to health or safety, or abuse,neglect or domestic violence, relating to contagious disease, public safety,and suspected child or adult abuse reporting requirements, including, but notlimited to, those contained in 32.1-36, 32.1-36.1, 32.1-40, 32.1-41,32.1-127.1:04, 32.1-276.5, 32.1-283, 32.1-283.1, 37.2-710, 37.2-839,53.1-40.10, 54.1-2400.6, 54.1-2400.7, 54.1-2403.3, 54.1-2506, 54.1-2966,54.1-2966.1, 54.1-2967, 54.1-2968, 63.2-1509 and 63.2-1606;

7. Where necessary in connection with the care of the individual;

8. In connection with the health care entity's own health care operations orthe health care operations of another health care entity, as specified in 45C.F.R. 164.501, or in the normal course of business in accordance withaccepted standards of practice within the health services setting; however,the maintenance, storage, and disclosure of the mass of prescriptiondispensing records maintained in a pharmacy registered or permitted inVirginia shall only be accomplished in compliance with 54.1-3410,54.1-3411 and 54.1-3412;

9. When the individual has waived his right to the privacy of the healthrecords;

10. When examination and evaluation of an individual are undertaken pursuantto judicial or administrative law order, but only to the extent as requiredby such order;

11. To the guardian ad litem and any attorney representing the respondent inthe course of a guardianship proceeding of an adult patient who is therespondent in a proceeding under Chapter 10 ( 37.2-1000 et seq.) of Title37.2;

12. To the attorney appointed by the court to represent an individual who isor has been a patient who is the subject of a civil commitment proceedingunder Article 5 ( 37.2-814 et seq.) of Chapter 8 of Title 37.2 or a judicialauthorization for treatment proceeding pursuant to Chapter 11 ( 37.2-1100 etseq.) of Title 37.2;

13. To the attorney and/or guardian ad litem of a minor who represents suchminor in any judicial or administrative proceeding, if the court oradministrative hearing officer has entered an order granting the attorney orguardian ad litem this right and such attorney or guardian ad litem presentsevidence to the health care entity of such order;

14. With regard to the Court-Appointed Special Advocate (CASA) program, aminor's health records in accord with 9.1-156;

15. To an agent appointed under an individual's power of attorney or to anagent or decision maker designated in an individual's advance directive forhealth care or for decisions on anatomical gifts and organ, tissue or eyedonation or to any other person consistent with the provisions of the HealthCare Decisions Act ( 54.1-2981 et seq.);

16. To third-party payors and their agents for purposes of reimbursement;

17. As is necessary to support an application for receipt of health carebenefits from a governmental agency or as required by an authorizedgovernmental agency reviewing such application or reviewing benefits alreadyprovided or as necessary to the coordination of prevention and control ofdisease, injury, or disability and delivery of such health care benefitspursuant to 32.1-127.1:04;

18. Upon the sale of a medical practice as provided in 54.1-2405; or upon achange of ownership or closing of a pharmacy pursuant to regulations of theBoard of Pharmacy;

19. In accord with subsection B of 54.1-2400.1, to communicate anindividual's specific and immediate threat to cause serious bodily injury ordeath of an identified or readily identifiable person;

20. Where necessary in connection with the implementation of a hospital'sroutine contact process for organ donation pursuant to subdivision B 4 of 32.1-127;

21. In the case of substance abuse records, when permitted by and inconformity with requirements of federal law found in 42 U.S.C. 290dd-2 and42 C.F.R. Part 2;

22. In connection with the work of any entity established as set forth in 8.01-581.16 to evaluate the adequacy or quality of professional services orthe competency and qualifications for professional staff privileges;

23. If the health records are those of a deceased or mentally incapacitatedindividual to the personal representative or executor of the deceasedindividual or the legal guardian or committee of the incompetent orincapacitated individual or if there is no personal representative, executor,legal guardian or committee appointed, to the following persons in thefollowing order of priority: a spouse, an adult son or daughter, eitherparent, an adult brother or sister, or any other relative of the deceasedindividual in order of blood relationship;

24. For the purpose of conducting record reviews of inpatient hospital deathsto promote identification of all potential organ, eye, and tissue donors inconformance with the requirements of applicable federal law and regulations,including 42 C.F.R. 482.45, (i) to the health care provider's designatedorgan procurement organization certified by the United States Health CareFinancing Administration and (ii) to any eye bank or tissue bank in Virginiacertified by the Eye Bank Association of America or the American Associationof Tissue Banks;

25. To the Office of the Inspector General for Mental Health, MentalRetardation and Substance Abuse Services pursuant to Article 3 ( 37.2-423 etseq.) of Chapter 4 of Title 37.2;

26. To an entity participating in the activities of a local healthpartnership authority established pursuant to Article 6.1 ( 32.1-122.10:001et seq.) of Chapter 4 of this title, pursuant to subdivision 1 of thissubsection;

27. To law-enforcement officials by each licensed emergency medical servicesagency, (i) when the individual is the victim of a crime or (ii) when theindividual has been arrested and has received emergency medical services orhas refused emergency medical services and the health records consist of theprehospital patient care report required by 32.1-116.1;

28. To the State Health Commissioner pursuant to 32.1-48.015 when suchrecords are those of a person or persons who are subject to an order ofquarantine or an order of isolation pursuant to Article 3.02 ( 32.1-48.05 etseq.) of Chapter 2 of this title; and

29. To the Commissioner of the Department of Labor and Industry or hisdesignee by each licensed emergency medical services agency when the recordsconsist of the prehospital patient care report required by 32.1-116.1 andthe patient has suffered an injury or death on a work site while performingduties or tasks that are within the scope of his employment.

Notwithstanding the provisions of subdivisions 1 through 29 of thissubsection, a health care entity shall obtain an individual's writtenauthorization for any disclosure of psychotherapy notes, except whendisclosure by the health care entity is (i) for its own training programs inwhich students, trainees, or practitioners in mental health are being taughtunder supervision to practice or to improve their skills in group, joint,family, or individual counseling; (ii) to defend itself or its employees orstaff against any accusation of wrongful conduct; (iii) in the discharge ofthe duty, in accordance with subsection B of 54.1-2400.1, to takeprecautions to protect third parties from violent behavior or other seriousharm; (iv) required in the course of an investigation, audit, review, orproceeding regarding a health care entity's conduct by a duly authorizedlaw-enforcement, licensure, accreditation, or professional review entity; or(v) otherwise required by law.

E. Requests for copies of health records shall (i) be in writing, dated andsigned by the requester; (ii) identify the nature of the informationrequested; and (iii) include evidence of the authority of the requester toreceive such copies and identification of the person to whom the informationis to be disclosed. The health care entity shall accept a photocopy,facsimile, or other copy of the original signed by the requestor as if itwere an original. Within 15 days of receipt of a request for copies of healthrecords, the health care entity shall do one of the following: (i) furnishsuch copies to any requester authorized to receive them; (ii) inform therequester if the information does not exist or cannot be found; (iii) if thehealth care entity does not maintain a record of the information, so informthe requester and provide the name and address, if known, of the health careentity who maintains the record; or (iv) deny the request (a) undersubsection F, (b) on the grounds that the requester has not established hisauthority to receive such health records or proof of his identity, or (c) asotherwise provided by law. Procedures set forth in this section shall applyonly to requests for health records not specifically governed by otherprovisions of state law.

F. Except as provided in subsection B of 8.01-413, copies of anindividual's health records shall not be furnished to such individual oranyone authorized to act on the individual's behalf when the individual'streating physician or the individual's treating clinical psychologist hasmade a part of the individual's record a written statement that, in theexercise of his professional judgment, the furnishing to or review by theindividual of such health records would be reasonably likely to endanger thelife or physical safety of the individual or another person, or that suchhealth record makes reference to a person other than a health care providerand the access requested would be reasonably likely to cause substantial harmto such referenced person. If any health care entity denies a request forcopies of health records based on such statement, the health care entityshall inform the individual of the individual's right to designate, inwriting, at his own expense, another reviewing physician or clinicalpsychologist, whose licensure, training and experience relative to theindividual's condition are at least equivalent to that of the physician orclinical psychologist upon whose opinion the denial is based. The designatedreviewing physician or clinical psychologist shall make a judgment as towhether to make the health record available to the individual.

The health care entity denying the request shall also inform the individualof the individual's right to request in writing that such health care entitydesignate, at its own expense, a physician or clinical psychologist, whoselicensure, training, and experience relative to the individual's conditionare at least equivalent to that of the physician or clinical psychologistupon whose professional judgment the denial is based and who did notparticipate in the original decision to deny the health records, who shallmake a judgment as to whether to make the health record available to theindividual. The health care entity shall comply with the judgment of thereviewing physician or clinical psychologist. The health care entity shallpermit copying and examination of the health record by such other physicianor clinical psychologist designated by either the individual at his ownexpense or by the health care entity at its expense.

Any health record copied for review by any such designated physician orclinical psychologist shall be accompanied by a statement from the custodianof the health record that the individual's treating physician or clinicalpsychologist determined that the individual's review of his health recordwould be reasonably likely to endanger the life or physical safety of theindividual or would be reasonably likely to cause substantial harm to aperson referenced in the health record who is not a health care provider.

Further, nothing herein shall be construed as giving, or interpreted tobestow the right to receive copies of, or otherwise obtain access to,psychotherapy notes to any individual or any person authorized to act on hisbehalf.

G. A written authorization to allow release of an individual's health recordsshall substantially include the following information:

AUTHORIZATIONTORELEASECONFIDENTIALHEALTHRECORDS
Individual'sName............................................................
HealthCareEntity'sName....................................................
Person,Agency,orHealthCareEntitytowhomdisclosureisto
bemade......................................................................
InformationorHealthRecordstobedisclosed................................
PurposeofDisclosureorattheRequestoftheIndividual....................
Asthepersonsigningthisauthorization,IunderstandthatIamgivingmy
permissiontotheabove-namedhealthcareentityfordisclosureof
confidentialhealthrecords.Iunderstandthatthehealthcareentitymaynot
conditiontreatmentorpaymentonmywillingnesstosignthisauthorization
unlessthespecificcircumstancesunderwhichsuchconditioningispermitted
bylawareapplicableandaresetforthinthisauthorization.Ialso
understandthatIhavetherighttorevokethisauthorizationatanytime,but
thatmyrevocationisnoteffectiveuntildeliveredinwritingtotheperson
whoisinpossessionofmyhealthrecordsandisnoteffectiveastohealth
recordsalreadydisclosedunderthisauthorization.Acopyofthis
authorizationandanotationconcerningthepersonsoragenciestowhom
disclosurewasmadeshallbeincludedwithmyoriginalhealthrecords.I
understandthathealthinformationdisclosedunderthisauthorizationmightbe
redisclosedbyarecipientandmay,asaresultofsuchdisclosure,nolonger
beprotectedtothesameextentassuchhealthinformationwasprotectedby
lawwhilesolelyinthepossessionofthehealthcareentity.
Thisauthorizationexpireson(date)or(event)..............................
SignatureofIndividualorIndividual'sLegalRepresentativeifIndividualis
UnabletoSign...............................................................
RelationshiporAuthorityofLegalRepresentative............................
DateofSignature............................................................
H.Pursuanttothissubsection:
1.Unlessexceptedfromtheseprovisionsinsubdivision9ofthissubsection,
nopartytoacivil,criminaloradministrativeactionorproceedingshall
requesttheissuanceofasubpoenaducestecumforanotherparty'shealth
recordsorcauseasubpoenaducestecumtobeissuedbyanattorneyunlessa
copyoftherequestforthesubpoenaoracopyoftheattorney-issuedsubpoena
isprovidedtotheotherparty'scounselortotheotherpartyifprose,
simultaneouslywithfilingtherequestorissuanceofthesubpoena.Noparty
toanactionorproceedingshallrequestorcausetheissuanceofasubpoena
ducestecumforthehealthrecordsofanonpartywitnessunlessacopyofthe
requestforthesubpoenaoracopyoftheattorney-issuedsubpoenaisprovided
tothenonpartywitnesssimultaneouslywithfilingtherequestorissuanceof
theattorney-issuedsubpoena.
Nosubpoenaducestecumforhealthrecordsshallsetareturndateearlier
than15daysfromthedateofthesubpoenaexceptbyorderofacourtor
administrativeagencyforgoodcauseshown.Whenacourtoradministrative
agencydirectsthathealthrecordsbedisclosedpursuanttoasubpoenaduces
tecumearlierthan15daysfromthedateofthesubpoena,acopyoftheorder
shallaccompanythesubpoena.
Anypartyrequestingasubpoenaducestecumforhealthrecordsoronwhose
behalfthesubpoenaducestecumisbeingissuedshallhavethedutyto
determinewhethertheindividualwhosehealthrecordsarebeingsoughtispro
seoranonparty.
Ininstanceswherehealthrecordsbeingsubpoenaedarethoseofaproseparty
ornonpartywitness,thepartyrequestingorissuingthesubpoenashall
delivertotheprosepartyornonpartywitnesstogetherwiththecopyofthe
requestforsubpoena,oracopyofthesubpoenainthecaseofan
attorney-issuedsubpoena,astatementinformingthemoftheirrightsand
remedies.Thestatementshallincludethefollowinglanguageandtheheading
shallbeinboldfacecapitalletters:
NOTICETOINDIVIDUAL
Theattacheddocumentmeansthat(insertnameofpartyrequestingorcausing
issuanceofthesubpoena)haseitheraskedthecourtoradministrativeagency
toissueasubpoenaorasubpoenahasbeenissuedbytheotherparty's
attorneytoyourdoctor,otherhealthcareproviders(namesofhealthcare
providersinsertedhere)orotherhealthcareentity(nameofhealthcare
entitytobeinsertedhere)requiringthemtoproduceyourhealthrecords.
Yourdoctor,otherhealthcareproviderorotherhealthcareentityis
requiredtorespondbyprovidingacopyofyourhealthrecords.Ifyoubelieve
yourhealthrecordsshouldnotbedisclosedandobjecttotheirdisclosure,
youhavetherighttofileamotionwiththeclerkofthecourtorthe
administrativeagencytoquashthesubpoena.Ifyouelecttofileamotionto
quash,suchmotionmustbefiledwithin15daysofthedateoftherequestor
oftheattorney-issuedsubpoena.Youmaycontacttheclerk'sofficeorthe
administrativeagencytodeterminetherequirementsthatmustbesatisfied
whenfilingamotiontoquashandyoumayelecttocontactanattorneyto
representyourinterest.Ifyouelecttofileamotiontoquash,youmust
notifyyourdoctor,otherhealthcareprovider(s),orotherhealthcare
entity,thatyouarefilingthemotionsothatthehealthcareprovideror
healthcareentityknowstosendthehealthrecordstotheclerkofcourtor
administrativeagencyinasealedenvelopeorpackageforsafekeepingwhile
yourmotionisdecided.
2.Anypartyfilingarequestforasubpoenaducestecumorcausingsucha
subpoenatobeissuedforanindividual'shealthrecordsshallincludea
Noticeinthesamepartoftherequestinwhichtherecipientofthesubpoena
ducestecumisdirectedwhereandwhentoreturnthehealthrecords.Such
noticeshallbeinboldfacecapitallettersandshallincludethefollowing
language:
NOTICETOHEALTHCAREENTITIES
ACOPYOFTHISSUBPOENADUCESTECUMHASBEENPROVIDEDTOTHEINDIVIDUALWHOSE
HEALTHRECORDSAREBEINGREQUESTEDORHISCOUNSEL.YOUORTHATINDIVIDUALHAS
THERIGHTTOFILEAMOTIONTOQUASH(OBJECTTO)THEATTACHEDSUBPOENA.IFYOU
ELECTTOFILEAMOTIONTOQUASH,YOUMUSTFILETHEMOTIONWITHIN15DAYSOF
THEDATEOFTHISSUBPOENA.
YOUMUSTNOTRESPONDTOTHISSUBPOENAUNTILYOUHAVERECEIVEDWRITTEN
CERTIFICATIONFROMTHEPARTYONWHOSEBEHALFTHESUBPOENAWASISSUEDTHATTHE
TIMEFORFILINGAMOTIONTOQUASHHASELAPSEDANDTHAT:
NOMOTIONTOQUASHWASFILED;OR
ANYMOTIONTOQUASHHASBEENRESOLVEDBYTHECOURTORTHEADMINISTRATIVE
AGENCYANDTHEDISCLOSURESSOUGHTARECONSISTENTWITHSUCHRESOLUTION.
IFYOURECEIVENOTICETHATTHEINDIVIDUALWHOSEHEALTHRECORDSAREBEING
REQUESTEDHASFILEDAMOTIONTOQUASHTHISSUBPOENA,ORIFYOUFILEAMOTION
TOQUASHTHISSUBPOENA,YOUMUSTSENDTHEHEALTHRECORDSONLYTOTHECLERKOF
THECOURTORADMINISTRATIVEAGENCYTHATISSUEDTHESUBPOENAORINWHICHTHE
ACTIONISPENDINGASSHOWNONTHESUBPOENAUSINGTHEFOLLOWINGPROCEDURE:
PLACETHEHEALTHRECORDSINASEALEDENVELOPEANDATTACHTOTHESEALED
ENVELOPEACOVERLETTERTOTHECLERKOFCOURTORADMINISTRATIVEAGENCYWHICH
STATESTHATCONFIDENTIALHEALTHRECORDSAREENCLOSEDANDARETOBEHELDUNDER
SEALPENDINGARULINGONTHEMOTIONTOQUASHTHESUBPOENA.THESEALEDENVELOPE
ANDTHECOVERLETTERSHALLBEPLACEDINANOUTERENVELOPEORPACKAGEFOR
TRANSMITTALTOTHECOURTORADMINISTRATIVEAGENCY.

3. Upon receiving a valid subpoena duces tecum for health records, healthcare entities shall have the duty to respond to the subpoena in accordancewith the provisions of subdivisions 4, 5, 6, 7, and 8 of this subsection.

4. Except to deliver to a clerk of the court or administrative agencysubpoenaed health records in a sealed envelope as set forth, health careentities shall not respond to a subpoena duces tecum for such health recordsuntil they have received a certification as set forth in subdivision 5 or 8of this subsection from the party on whose behalf the subpoena duces tecumwas issued.

If the health care entity has actual receipt of notice that a motion to quashthe subpoena has been filed or if the health care entity files a motion toquash the subpoena for health records, then the health care entity shallproduce the health records, in a securely sealed envelope, to the clerk ofthe court or administrative agency issuing the subpoena or in whose court oradministrative agency the action is pending. The court or administrativeagency shall place the health records under seal until a determination ismade regarding the motion to quash. The securely sealed envelope shall onlybe opened on order of the judge or administrative agency. In the event thecourt or administrative agency grants the motion to quash, the health recordsshall be returned to the health care entity in the same sealed envelope inwhich they were delivered to the court or administrative agency. In the eventthat a judge or administrative agency orders the sealed envelope to be openedto review the health records in camera, a copy of the order shall accompanyany health records returned to the health care entity. The health recordsreturned to the health care entity shall be in a securely sealed envelope.

5. If no motion to quash is filed within 15 days of the date of the requestor of the attorney-issued subpoena, the party on whose behalf the subpoenawas issued shall have the duty to certify to the subpoenaed health careentity that the time for filing a motion to quash has elapsed and that nomotion to quash was filed. Any health care entity receiving suchcertification shall have the duty to comply with the subpoena duces tecum byreturning the specified health records by either the return date on thesubpoena or five days after receipt of the certification, whichever is later.

6. In the event that the individual whose health records are being soughtfiles a motion to quash the subpoena, the court or administrative agencyshall decide whether good cause has been shown by the discovering party tocompel disclosure of the individual's health records over the individual'sobjections. In determining whether good cause has been shown, the court oradministrative agency shall consider (i) the particular purpose for which theinformation was collected; (ii) the degree to which the disclosure of therecords would embarrass, injure, or invade the privacy of the individual;(iii) the effect of the disclosure on the individual's future health care;(iv) the importance of the information to the lawsuit or proceeding; and (v)any other relevant factor.

7. Concurrent with the court or administrative agency's resolution of amotion to quash, if subpoenaed health records have been submitted by a healthcare entity to the court or administrative agency in a sealed envelope, thecourt or administrative agency shall: (i) upon determining that no submittedhealth records should be disclosed, return all submitted health records tothe health care entity in a sealed envelope; (ii) upon determining that allsubmitted health records should be disclosed, provide all the submittedhealth records to the party on whose behalf the subpoena was issued; or (iii)upon determining that only a portion of the submitted health records shouldbe disclosed, provide such portion to the party on whose behalf the subpoenawas issued and return the remaining health records to the health care entityin a sealed envelope.

8. Following the court or administrative agency's resolution of a motion toquash, the party on whose behalf the subpoena duces tecum was issued shallhave the duty to certify in writing to the subpoenaed health care entity astatement of one of the following:

a. All filed motions to quash have been resolved by the court oradministrative agency and the disclosures sought in the subpoena duces tecumare consistent with such resolution; and, therefore, the health recordspreviously delivered in a sealed envelope to the clerk of the court oradministrative agency will not be returned to the health care entity;

b. All filed motions to quash have been resolved by the court oradministrative agency and the disclosures sought in the subpoena duces tecumare consistent with such resolution and that, since no health records havepreviously been delivered to the court or administrative agency by the healthcare entity, the health care entity shall comply with the subpoena ducestecum by returning the health records designated in the subpoena by thereturn date on the subpoena or five days after receipt of certification,whichever is later;

c. All filed motions to quash have been resolved by the court oradministrative agency and the disclosures sought in the subpoena duces tecumare not consistent with such resolution; therefore, no health records shallbe disclosed and all health records previously delivered in a sealed envelopeto the clerk of the court or administrative agency will be returned to thehealth care entity;

d. All filed motions to quash have been resolved by the court oradministrative agency and the disclosures sought in the subpoena duces tecumare not consistent with such resolution and that only limited disclosure hasbeen authorized. The certification shall state that only the portion of thehealth records as set forth in the certification, consistent with the courtor administrative agency's ruling, shall be disclosed. The certificationshall also state that health records that were previously delivered to thecourt or administrative agency for which disclosure has been authorized willnot be returned to the health care entity; however, all health records forwhich disclosure has not been authorized will be returned to the health careentity; or

e. All filed motions to quash have been resolved by the court oradministrative agency and the disclosures sought in the subpoena duces tecumare not consistent with such resolution and, since no health records havepreviously been delivered to the court or administrative agency by the healthcare entity, the health care entity shall return only those health recordsspecified in the certification, consistent with the court or administrativeagency's ruling, by the return date on the subpoena or five days afterreceipt of the certification, whichever is later.

A copy of the court or administrative agency's ruling shall accompany anycertification made pursuant to this subdivision.

9. The provisions of this subsection have no application to subpoenas forhealth records requested under 8.01-413, or issued by a duly authorizedadministrative agency conducting an investigation, audit, review orproceedings regarding a health care entity's conduct.

The provisions of this subsection shall apply to subpoenas for the healthrecords of both minors and adults.

Nothing in this subsection shall have any effect on the existing authority ofa court or administrative agency to issue a protective order regarding healthrecords, including, but not limited to, ordering the return of health recordsto a health care entity, after the period for filing a motion to quash haspassed.

A subpoena for substance abuse records must conform to the requirements offederal law found in 42 C.F.R. Part 2, Subpart E.

I. Health care entities may testify about the health records of an individualin compliance with 8.01-399 and 8.01-400.2.

J. If an individual requests a copy of his health record from a health careentity, the health care entity may impose a reasonable cost-based fee, whichshall include only the cost of supplies for and labor of copying therequested information, postage when the individual requests that suchinformation be mailed, and preparation of an explanation or summary of suchinformation as agreed to by the individual. For the purposes of this section,"individual" shall subsume a person with authority to act on behalf of theindividual who is the subject of the health record in making decisionsrelated to his health care.

(1997, c. 682; 1998, c. 470; 1999, cc. 812, 956, 1010; 2000, cc. 810, 813,923, 927; 2001, c. 671; 2002, cc. 568, 658, 835, 860; 2003, cc. 471, 907,983; 2004, cc. 49, 64, 65, 66, 67, 163, 773, 1014, 1021; 2005, cc. 39, 101,642, 697; 2006, c. 433.)