Section 80. Confidentiality

A. Each individual is entitled to have all identifying information that a provider maintains or knows about him remain confidential. Each individual has a right to give his authorization before the provider shares identifying information about him or his care unless another state law or regulation, or these regulations specifically require or permit the provider to disclose certain specific information.

B. The provider's duties.

1. Providers shall maintain the confidentiality of any information that identifies an individual. If an individual's services record pertains in whole or in part to referral, diagnosis or treatment of substance use disorders, providers shall disclose information only according to applicable federal regulations (see 42 CFR Part 2, Confidentiality of Alcohol and Drug Abuse Patient Records).

2. Providers shall obtain and document in the individual's services record the individual's authorization or that of the authorized representative prior to disclosing any identifying information about him. The authorization must contain the following elements:

a. The name of the organization and the name or other specific identification of the person or persons or class of persons to whom disclosure is made;

b. A description of the nature of the information to be disclosed, the purpose of the disclosure, and an indication whether the authorization extends to the information placed in the individual's record after the authorization was given but before it expires;

c. An indication of the effective date of the authorization and the date the authorization will expire, or the event or condition upon which it will expire; and

d. The signature of the individual and the date. If the authorization is signed by an authorized representative, a description of the authorized representative's authority to act.

3. Providers shall tell each individual and his authorized representative about the individual's confidentiality rights. This shall include how information can be disclosed and how others might get information about the individual without his authorization. If a disclosure is not required by law, the provider shall give strong consideration to any objections from the individual or his authorized representative in making the decision to disclose information.

4. Providers shall prevent unauthorized disclosures of information from services records and shall maintain and disclose information in a secure manner.

5. In the case of a minor, the authorization of the custodial parent or other person authorized to consent to the minor's treatment under § 54.1-2969 is required, except as provided below:

a. Section 54.1-2969 E of the Code of Virginia permits a minor to authorize the disclosure of information related to medical or health services for a sexually transmitted or contagious disease, family planning or pregnancy, and outpatient care, treatment or rehabilitation for substance use disorders, mental illness, or emotional disturbance.

b. The concurrent authorization of the minor and custodial parent is required to disclose inpatient substance abuse records.

c. The minor and the custodial parent shall authorize the disclosure of identifying information related to the minor's inpatient psychiatric hospitalization when the minor is 14 years of age or older and has consented to the admission.

6. When providers disclose identifying information, they shall attach a statement that informs the person receiving the information that it must not be disclosed to anyone else unless the individual authorizes the disclosure or unless state law or regulation allows or requires further disclosure without authorization.

7. Providers may encourage individuals to name family members, friends, and others who may be told of their presence in the program and general condition or well-being. Except for information governed by 42 CFR Part 2, providers may disclose to a family member, other relative, a close personal friend, or any other person identified by the individual, information that is directly relevant to that persons involvement with the individual's care or payment for his health care, if (i) the provider obtains the individual's agreement, (ii) the provider provides the individual with the opportunity to object to the disclosure, and (iii) the individual does not object or the provider reasonably infers for the circumstances, based or the exercise of professional judgment, that the individual does not object to the disclosure. If the opportunity to agree or object cannot be provided because of the individual's incapacity or an emergency circumstance, the provider may, in the exercise of professional judgment, determine whether the disclosure is in the best interest of the individual and, if so, disclose only the information that is directly relevant to the person's involvement with the individual's health care.

8. Providers may disclose the following identifying information without authorization or violation of the individual's confidentiality, but only under the conditions specified in the following subdivisions of this subsection. Providers should always consult 42 CFR Part 2, Confidentiality of Alcohol and Drug Abuse Patient Records, if applicable, because these federal regulations may prohibit some of the disclosures addressed in this section.

a. Emergencies: Providers may disclose information in an emergency to any person who needs that particular information for the purpose of preventing injury to or death of an individual or other person. The provider shall not disclose any information that is not needed for this specific purpose.

b. Providers or health plans: Providers may permit any full-time or part-time employee, consultant, agent, or contractor of the provider to use identifying information or disclose to another provider, a health plan, the department, or a CSB, information required to give services to the individual or to get payment for the services.

c. Court proceedings: If the individual or someone acting for him introduces any aspect of his mental condition or services as an issue before a court, administrative agency, or medical malpractice review panel, the provider may disclose any information relevant to that issue. The provider may also disclose any records if they are properly subpoenaed, if a court orders them to be produced, or if involuntary admission or certification for admission is being proposed.

d. Legal counsel: Providers may disclose information to their own legal counsel or to anyone working on behalf of their legal counsel in providing representation to the provider. Providers of state-operated services may disclose information to the Office of the Attorney General or to anyone appointed by or working on behalf of that office in providing representation to the Commonwealth of Virginia.

e. Human rights committees: Providers may disclose to the LHRC and the SHRC any information necessary for the conduct of their responsibilities under these regulations.

f. Others authorized or required by the commissioner, CSB, or private program director: Providers may disclose information to other persons if authorized or required for the following activities:

(1) Licensing, human rights, or certification or accreditation reviews;

(2) Hearings, reviews, appeals, or investigations under these regulations;

(3) Evaluation of provider performance and individual outcomes (see §§ 37.2-508 and 37.2-608 of the Code of Virginia);

(4) Statistical reporting;

(5) Preauthorization, utilization reviews, financial and related administrative services reviews, and audits; or

(6) Similar oversight and review activities.

g. Preadmission screening, services, and discharge planning: Providers may disclose to the department, the CSB, or to other providers information necessary to screen individuals for admission or to prepare and carry out a comprehensive individualized services or discharge plan (see § 37.2-505 of the Code of Virginia).

h. Protection and advocacy agency: Providers may disclose information to the protection and advocacy agency in accordance with that agency's legal authority under federal and state law.

i. Historical research: Providers may disclose information to persons engaging in bona fide historical research if all of the following conditions are met:

(1) The request for historical research shall include, at a minimum, a summary of the scope and purpose of the research, a description of the product to result from the research and its expected date of completion, a rationale explaining the need to access otherwise private information, and the specific identification of the type and location of the records sought;

(2) The commissioner, CSB executive director, or private program director has authorized the research;

(3) The individual or individuals who are the subject of the disclosure are deceased;

(4) There are no known living persons permitted by law to authorize the disclosure; and

(5) The disclosure would in no way reveal the identity of any person who is not the subject of the historical research.

j. Protection of public safety: If an individual receiving services makes a specific threat to cause serious bodily injury or death to an identified or readily identifiable person and the provider reasonably believes that the individual has the intent and the ability to carry out the threat immediately or imminently, the provider may disclose those facts necessary to alleviate the potential threat.

k. Inspector General: Providers may disclose to the Office of the State Inspector General (§ 2.2-308 of the Code of Virginia) any individual services records and other information relevant to the provider's delivery of services.

l. Virginia Patient Level Data System: Providers may disclose financial and services information to Virginia Health Information as required by law (see Chapter 7.2 (§ 32.1-276.2 et seq.) of Title 32.1 of the Code of Virginia).

m. Psychotherapy notes: Providers shall obtain an individual's authorization for any disclosure of psychotherapy notes, except when disclosure is made:

(1) For the provider's own training programs in which students, trainees, or practitioners in mental health are being taught under supervision to practice or improve their skills in group, joint, family or individual counseling;

(2) To defend the provider or its employees or staff against any accusation or wrongful conduct;

(3) In discharge of the provider's duty, in accordance with § 54.1-2400.1 B of the Code of Virginia, to take precautions to protect third parties from violent behavior or other serious harm;

(4) As required in the course of an investigation, audit, review, or proceeding regarding a provider's conduct by a duly authorized law enforcement, licensure, accreditation, or professional review entity; or

(5) When otherwise required by law.

n. A law-enforcement official:

(1) Pursuant to a search warrant or grand jury subpoena;

(2) In response to their request, for the purpose of identifying or locating a suspect, fugitive, an individual required to register pursuant to § 9.1-901 of the Sex Offender and Crimes Against Minors Registry Act, material witness, or missing person, provided that only the following information is disclosed:

(a) Name and address of the individual;

(b) Date and place of birth of the individual;

(c) Social security number of the individual;

(d) Blood type of the individual;

(e) Date and time of treatment received by the individual;

(f) Date and time of death of the individual;

(g) Description of distinguishing physical characteristics of the individual; and

(h) Type of injury sustained by the individual;

(3) Regarding the death of an individual for the purpose of alerting law enforcement of the death if the health care entity has a suspicion that such death may have resulted from criminal conduct; or

(4) If the health care entity believes in good faith that the information disclosed constitutes evidence of a crime that occurred on its premises.

o. Other statutes or regulations: Providers may disclose information to the extent required or permitted by any other state or law or regulation. See also § 32.1-127.1:03 of the Code of Virginia for a list of circumstances in which records may be disclosed without authorization.

9. Upon request, the provider shall tell the individual or his authorized representative the sources of information contained in his services records and provide a written listing of disclosures of information made without authorization, except for disclosures:

a. To employees of the department, CSB, the provider, or other providers;

b. To carry out treatment, payment, or health care operations;

c. That are incidental or unintentional disclosures that occur as a by-product of engaging in health care communications and practices that are already permitted or required;

d. To an individual or his authorized representative;

e. Pursuant to an authorization;

f. For national security or intelligence purposes;

g. To correctional institutions or law-enforcement officials; or

h. That were made more than six years prior to the request.

10. The provider shall include the following information in the listing of disclosures of information provided to the individual or his authorized representative under subdivision 9 of this subsection:

a. The name of the person or organization that received the information and the address if known;

b. A brief description of the information disclosed; and

c. A brief statement of the purpose of the disclosure or, in lieu of such a statement, a copy of the written request for disclosure.

11. If the provider makes multiple disclosures of information to the same person or entity for a single purpose, the provider shall include the following:

a. The information required in subdivision 10 of this subsection for the first disclosure made during the requested period;

b. The frequency, periodicity, or number of disclosures made during the period for which the individual is requesting information; and

c. The date of the last disclosure during the time period.

12. If the provider makes a disclosure to a social service or protective services agency about an individual who the provider reasonably believes to be a victim of abuse or neglect, the provider is not required to inform the individual or his authorized representative of the disclosure if:

a. The provider, in the exercise of professional judgment, believes that informing the individual would place the individual at risk of serious harm; or

b. The provider would be informing the authorized representative, and the provider reasonably believes that the authorized representative is responsible for the abuse or neglect, and that informing such person would not be in the best interests of the individual.

Historical Notes

Derived from Volume 18, Issue 03, eff. November 21, 2001; amended, Virginia Register Volume 23, Issue 25, eff. September 19, 2007; Volume 29, Issue 04, eff. November 21, 2012; Volume 31, Issue 01, eff. October 8, 2014.

Statutory Authority

§§ 37.2-203 and 37.2-400 of the Code of Virginia.