Virginia Administrative Code › Title 12 - HEALTH › Agency 35 - DEPARTMENT OF BEHAVIORAL HEALTH AND DEVELOPMENTAL SERVICES › Chapter 115 - REGULATIONS TO ASSURE THE RIGHTS OF INDIVIDUALS RECEIVING SERVICES FROM PROVIDERS LICENSED, FUNDED, OR OPERATED BY THE DEPARTMENT OF BEHAVIORAL › Part III - Explanation of Individual Rights and Provider Duties › Section 12VAC35-115-80 - Confidentiality

Current through Register Vol. 40, No. 24, July 15, 2024
A. Each individual
				  is entitled to have all identifying information that a provider maintains or
				  knows about him remain confidential. Each individual has a right to give his
				  authorization before the provider shares identifying information about him or
				  his care unless another state law or regulation, or these regulations
				  specifically require or permit the provider to disclose certain specific
				  information.
B. The provider's
				  duties.
1. Providers shall maintain the
				  confidentiality of any information that identifies an individual. If an
				  individual's services record pertains in whole or in part to referral,
				  diagnosis or treatment of substance use disorders, providers shall disclose
				  information only according to applicable federal regulations (see 42 CFR Part
				  2, Confidentiality of Alcohol and Drug Abuse Patient Records).
2. Providers shall obtain and document in the
				  individual's services record the individual's authorization or that of the
				  authorized representative prior to disclosing any identifying information about
				  him. The authorization must contain the following elements:
a. The name of the organization and the name
				  or other specific identification of the person or persons or class of persons
				  to whom disclosure is made;
b. A
				  description of the nature of the information to be disclosed, the purpose of
				  the disclosure, and an indication whether the authorization extends to the
				  information placed in the individual's record after the authorization was given
				  but before it expires;
c. An
				  indication of the effective date of the authorization and the date the
				  authorization will expire, or the event or condition upon which it will expire;
				  and
d. The signature of the
				  individual and the date. If the authorization is signed by an authorized
				  representative, a description of the authorized representative's authority to
				  act.
3. Providers shall
				  tell each individual and his authorized representative about the individual's
				  confidentiality rights. This shall include how information can be disclosed and
				  how others might get information about the individual without his
				  authorization. If a disclosure is not required by law, the provider shall give
				  strong consideration to any objections from the individual or his authorized
				  representative in making the decision to disclose information.
4. Providers shall prevent unauthorized
				  disclosures of information from services records and shall maintain and
				  disclose information in a secure manner.
5. In the case of a minor, the authorization
				  of the custodial parent or other person authorized to consent to the minor's
				  treatment under § 54.1-2969 is required, except as provided below:
a. Section 54.1-2969E of the Code of Virginia
				  permits a minor to authorize the disclosure of information related to medical
				  or health services for a sexually transmitted or contagious disease, family
				  planning or pregnancy, and outpatient care, treatment or rehabilitation for
				  substance use disorders, mental illness, or emotional disturbance.
b. The concurrent authorization of the minor
				  and custodial parent is required to disclose inpatient substance abuse
				  records.
c. The minor and the
				  custodial parent shall authorize the disclosure of identifying information
				  related to the minor's inpatient psychiatric hospitalization when the minor is
				  14 years of age or older and has consented to the admission.
6. When providers disclose
				  identifying information, they shall attach a statement that informs the person
				  receiving the information that it must not be disclosed to anyone else unless
				  the individual authorizes the disclosure or unless state law or regulation
				  allows or requires further disclosure without authorization.
7. Providers may encourage individuals to
				  name family members, friends, and others who may be told of their presence in
				  the program and general condition or well-being. Except for information
				  governed by 42 CFR Part 2, providers may disclose to a family member, other
				  relative, a close personal friend, or any other person identified by the
				  individual, information that is directly relevant to that persons involvement
				  with the individual's care or payment for his health care, if (i) the provider
				  obtains the individual's agreement, (ii) the provider provides the individual
				  with the opportunity to object to the disclosure, and (iii) the individual does
				  not object or the provider reasonably infers for the circumstances, based or
				  the exercise of professional judgment, that the individual does not object to
				  the disclosure. If the opportunity to agree or object cannot be provided
				  because of the individual's incapacity or an emergency circumstance, the
				  provider may, in the exercise of professional judgment, determine whether the
				  disclosure is in the best interest of the individual and, if so, disclose only
				  the information that is directly relevant to the person's involvement with the
				  individual's health care.
8.
				  Providers may disclose the following identifying information without
				  authorization or violation of the individual's confidentiality, but only under
				  the conditions specified in the following subdivisions of this subsection.
				  Providers should always consult 42 CFR Part 2, Confidentiality of Alcohol and
				  Drug Abuse Patient Records, if applicable, because these federal regulations
				  may prohibit some of the disclosures addressed in this section.
a. Emergencies: Providers may disclose
				  information in an emergency to any person who needs that particular information
				  for the purpose of preventing injury to or death of an individual or other
				  person. The provider shall not disclose any information that is not needed for
				  this specific purpose.
b. Providers
				  or health plans: Providers may permit any full-time or part-time employee,
				  consultant, agent, or contractor of the provider to use identifying information
				  or disclose to another provider, a health plan, the department, or a CSB,
				  information required to give services to the individual or to get payment for
				  the services.
c. Court proceedings:
				  If the individual or someone acting for him introduces any aspect of his mental
				  condition or services as an issue before a court, administrative agency, or
				  medical malpractice review panel, the provider may disclose any information
				  relevant to that issue. The provider may also disclose any records if they are
				  properly subpoenaed, if a court orders them to be produced, or if involuntary
				  admission or certification for admission is being proposed.
d. Legal counsel: Providers may disclose
				  information to their own legal counsel or to anyone working on behalf of their
				  legal counsel in providing representation to the provider. Providers of
				  state-operated services may disclose information to the Office of the Attorney
				  General or to anyone appointed by or working on behalf of that office in
				  providing representation to the Commonwealth of Virginia.
e. Human rights committees: Providers may
				  disclose to the LHRC and the SHRC any information necessary for the conduct of
				  their responsibilities under these regulations.
f. Others authorized or required by the
				  commissioner, CSB, or private program director: Providers may disclose
				  information to other persons if authorized or required for the following
				  activities:
(1) Licensing, human rights, or
				  certification or accreditation reviews;
(2) Hearings, reviews, appeals, or
				  investigations under these regulations;
(3) Evaluation of provider performance and
				  individual outcomes (see §§ 37.2-508 and 37.2-608 of the Code of
				  Virginia);
(4) Statistical
				  reporting;
(5) Preauthorization,
				  utilization reviews, financial and related administrative services reviews, and
				  audits; or
(6) Similar oversight
				  and review activities.
g. Preadmission screening, services, and
				  discharge planning: Providers may disclose to the department, the CSB, or to
				  other providers information necessary to screen individuals for admission or to
				  prepare and carry out a comprehensive individualized services or discharge plan
				  (see § 37.2-505 of the Code of Virginia).
h. Protection and advocacy agency: Providers
				  may disclose information to the protection and advocacy agency in accordance
				  with that agency's legal authority under federal and state law.
i. Historical research: Providers may
				  disclose information to persons engaging in bona fide historical research if
				  all of the following conditions are met:
(1)
				  The request for historical research shall include, at a minimum, a summary of
				  the scope and purpose of the research, a description of the product to result
				  from the research and its expected date of completion, a rationale explaining
				  the need to access otherwise private information, and the specific
				  identification of the type and location of the records sought.
(2) The commissioner, CSB executive director,
				  or private program director has authorized the research;
(3) The individual or individuals who are the
				  subject of the disclosure are deceased;
(4) There are no known living persons
				  permitted by law to authorize the disclosure; and
(5) The disclosure would in no way reveal the
				  identity of any person who is not the subject of the historical
				  research.
j. Protection
				  of public safety: If an individual receiving services makes a specific threat
				  to cause serious bodily injury or death to an identified or readily
				  identifiable person and the provider reasonably believes that the individual
				  has the intent and the ability to carry out the threat immediately or
				  imminently, the provider may disclose those facts necessary to alleviate the
				  potential threat.
k. Inspector
				  General: Providers may disclose to the Office of the State Inspector General
				  (§ 2.2-308 of the Code of Virginia) any individual services records and
				  other information relevant to the provider's delivery of services.
l. Virginia Patient Level Data System:
				  Providers may disclose financial and services information to Virginia Health
				  Information as required by law (see Chapter 7.2 (§ 32.1-276.2 et seq.) of
				  Title 32.1 of the Code of Virginia).
m. Psychotherapy notes: Providers shall
				  obtain an individual's authorization for any disclosure of psychotherapy notes,
				  except when disclosure is made:
(1) For the
				  provider's own training programs in which students, trainees, or practitioners
				  in mental health are being taught under supervision to practice or improve
				  their skills in group, joint, family or individual counseling;
(2) To defend the provider or its employees
				  or staff against any accusation or wrongful conduct;
(3) In discharge of the provider's duty, in
				  accordance with § 54.1-2400.1B of the Code of Virginia, to take
				  precautions to protect third parties from violent behavior or other serious
				  harm;
(4) As required in the course
				  of an investigation, audit, review, or proceeding regarding a provider's
				  conduct by a duly authorized law enforcement, licensure, accreditation, or
				  professional review entity; or
(5)
				  When otherwise required by law.
n. A law-enforcement official:
(1) Pursuant to a search warrant or grand
				  jury subpoena;
(2) In response to
				  their request, for the purpose of identifying or locating a suspect, fugitive,
				  an individual required to register pursuant to § 9.1-901 of the Sex
				  Offender and Crimes Against Minors Registry Act, material witness, or missing
				  person, provided that only the following information is disclosed:
(a) Name and address of the
				  individual;
(b) Date and place of
				  birth of the individual;
(c) Social
				  security number of the individual;
(d) Blood type of the individual;
(e) Date and time of treatment received by
				  the individual;
(f) Date and time
				  of death of the individual;
(g)
				  Description of distinguishing physical characteristics of the individual;
				  and
(h) Type of injury sustained by
				  the individual.
(3)
				  Regarding the death of an individual for the purpose of alerting law
				  enforcement of the death if the health care entity has a suspicion that such
				  death may have resulted from criminal conduct; or
(4) If the health care entity believes in
				  good faith that the information disclosed constitutes evidence of a crime that
				  occurred on its premises.
o. Other statutes or regulations: Providers
				  may disclose information to the extent required or permitted by any other state
				  or law or regulation. See also § 32.1-127.1:03 of the Code of Virginia for
				  a list of circumstances in which records may be disclosed without
				  authorization.
9. Upon
				  request, the provider shall tell the individual or his authorized
				  representative the sources of information contained in his services records and
				  provide a written listing of disclosures of information made without
				  authorization, except for disclosures:
a. To
				  employees of the department, CSB, the provider, or other providers;
b. To carry out treatment, payment, or health
				  care operations;
c. That are
				  incidental or unintentional disclosures that occur as a by-product of engaging
				  in health care communications and practices that are already permitted or
				  required;
d. To an individual or
				  his authorized representative;
e.
				  Pursuant to an authorization;
f.
				  For national security or intelligence purposes;
g. To correctional institutions or
				  law-enforcement officials; or
h.
				  That were made more than six years prior to the request.
10. The provider shall include the following
				  information in the listing of disclosures of information provided to the
				  individual or his authorized representative under subdivision 9 of this
				  subsection:
a. The name of the person or
				  organization that received the information and the address if known;
b. A brief description of the information
				  disclosed; and
c. A brief statement
				  of the purpose of the disclosure or, in lieu of such a statement, a copy of the
				  written request for disclosure.
11. If the provider makes multiple
				  disclosures of information to the same person or entity for a single purpose,
				  the provider shall include the following:
a.
				  The information required in subdivision 10 of this subsection for the first
				  disclosure made during the requested period;
b. The frequency, periodicity, or number of
				  disclosures made during the period for which the individual is requesting
				  information; and
c. The date of the
				  last disclosure during the time period.
12. If the provider makes a disclosure to a
				  social service or protective services agency about an individual who the
				  provider reasonably believes to be a victim of abuse or neglect, the provider
				  is not required to inform the individual or his authorized representative of
				  the disclosure if:
a. The provider, in the
				  exercise of professional judgment, believes that informing the individual would
				  place the individual at risk of serious harm; or
b. The provider would be informing the
				  authorized representative, and the provider reasonably believes that the
				  authorized representative is responsible for the abuse or neglect, and that
				  informing such person would not be in the best interests of the
				  individual.