Bill Text: VA HB1013 | 2016 | Regular Session | Chaptered
Bill Title: Threat assessment teams; dissemination of certain records and information.
Spectrum: Partisan Bill (Republican 1-0)
Status: (Passed) 2016-03-29 - Governor: Acts of Assembly Chapter text (CHAP0554) [HB1013 Detail]
Download: Virginia-2016-HB1013-Chaptered.html
|
Be it enacted by the General Assembly of Virginia: 1. That §§2.2-3705.2, 2.2-3705.4, 19.2-389, 19.2-389.1, 22.1-79.4, and 32.1-127.1:03 of the Code of Virginia are amended and reenacted as follows: §2.2-3705.2. Exclusions to application of chapter; records relating to public safety. The following records are excluded from the provisions of this chapter but may be disclosed by the custodian in his discretion, except where such disclosure is prohibited by law: 1. Confidential records, including victim identity, provided to or obtained by staff in a rape crisis center or a program for battered spouses. 2. Those portions of engineering and construction drawings and plans submitted for the sole purpose of complying with the Building Code in obtaining a building permit that would identify specific trade secrets or other information, the disclosure of which would be harmful to the competitive position of the owner or lessee. However, such information shall be exempt only until the building is completed. Information relating to the safety or environmental soundness of any building shall not be exempt from disclosure. Those portions of engineering and construction drawings and plans that reveal critical structural components, security equipment and systems, ventilation systems, fire protection equipment, mandatory building emergency equipment or systems, elevators, electrical systems, telecommunications equipment and systems, and other utility equipment and systems submitted for the purpose of complying with the Uniform Statewide Building Code (§36-97 et seq.) or the Statewide Fire Prevention Code (§27-94 et seq.), the disclosure of which would jeopardize the safety or security of any public or private commercial office, multifamily residential or retail building or its occupants in the event of terrorism or other threat to public safety, to the extent that the owner or lessee of such property, equipment or system in writing (i) invokes the protections of this paragraph; (ii) identifies the drawings, plans, or other materials to be protected; and (iii) states the reasons why protection is necessary. Nothing in this subdivision shall prevent the disclosure of information relating to any building in connection with an inquiry into the performance of that building after it has been subjected to fire, explosion, natural disaster or other catastrophic event. 3. Documentation or other information that describes the design, function, operation or access control features of any security system, whether manual or automated, which is used to control access to or use of any automated data processing or telecommunications system. 4. Plans and information to prevent or respond to terrorist activity or cyber attacks, the disclosure of which would jeopardize the safety of any person, including (i) critical infrastructure sector or structural components; (ii) vulnerability assessments, operational, procedural, transportation, and tactical planning or training manuals, and staff meeting minutes or other records; (iii) engineering or architectural records, or records containing information derived from such records, to the extent such records reveal the location or operation of security equipment and systems, elevators, ventilation, fire protection, emergency, electrical, telecommunications or utility equipment and systems of any public building, structure or information storage facility, or telecommunications or utility equipment or systems; and (iv) information not lawfully available to the public regarding specific cybersecurity threats or vulnerabilities or security plans and measures of an entity, facility, building structure, information technology system, or software program. The same categories of records of any person or entity submitted to a public body for the purpose of antiterrorism response planning or cybersecurity planning or protection may be withheld from disclosure if such person or entity in writing (a) invokes the protections of this subdivision, (b) identifies with specificity the records or portions thereof for which protection is sought, and (c) states with reasonable particularity why the protection of such records from public disclosure is necessary to meet the objective of antiterrorism or cybersecurity planning or protection. Such statement shall be a public record and shall be disclosed upon request. Nothing in this subdivision shall be construed to prohibit the disclosure of records relating to the structural or environmental soundness of any building, nor shall it prevent the disclosure of information relating to any building in connection with an inquiry into the performance of that building after it has been subjected to fire, explosion, natural disaster or other catastrophic event. 5. Information that would disclose the security aspects of a system safety program plan adopted pursuant to 49 C.F.R. Part 659 by the Commonwealth's designated Rail Fixed Guideway Systems Safety Oversight agency; and information in the possession of such agency, the release of which would jeopardize the success of an ongoing investigation of a rail accident or other incident threatening railway safety. 6. Engineering and architectural drawings, operational, procedural, tactical planning or training manuals, or staff meeting minutes or other records, the disclosure of which would reveal surveillance techniques, personnel deployments, alarm or security systems or technologies, or operational and transportation plans or protocols, to the extent such disclosure would jeopardize the security of any governmental facility, building or structure or the safety of persons using such facility, building or structure. 7. Security plans and specific assessment components of school safety audits, as provided in §22.1-279.8. Nothing in this subdivision shall be construed to prohibit the disclosure of records relating to the effectiveness of security plans after (i) any school building or property has been subjected to fire, explosion, natural disaster or other catastrophic event, or (ii) any person on school property has suffered or been threatened with any personal injury. 8. [Expired.] 9. Records of the Commitment Review Committee concerning the mental health assessment of an individual subject to commitment as a sexually violent predator under Chapter 9 (§37.2-900 et seq.) of Title 37.2; except that in no case shall records identifying the victims of a sexually violent predator be disclosed. 10. Subscriber data, which for the purposes of this subdivision, means the name, address, telephone number, and any other information identifying a subscriber of a telecommunications carrier, provided directly or indirectly by a telecommunications carrier to a public body that operates a 911 or E-911 emergency dispatch system or an emergency notification or reverse 911 system, if the data is in a form not made available by the telecommunications carrier to the public generally. Nothing in this subdivision shall prevent the release of subscriber data generated in connection with specific calls to a 911 emergency system, where the requester is seeking to obtain public records about the use of the system in response to a specific crime, emergency or other event as to which a citizen has initiated a 911 call. 11. Subscriber data, which for the purposes of this subdivision, means the name, address, telephone number, and any other information identifying a subscriber of a telecommunications carrier, collected by a local governing body in accordance with the Enhanced Public Safety Telephone Services Act (§56-484.12 et seq.), and other identifying information of a personal, medical, or financial nature provided to a local governing body in connection with a 911 or E-911 emergency dispatch system or an emergency notification or reverse 911 system, if such records are not otherwise publicly available. Nothing in this subdivision shall prevent the release of subscriber data generated in connection with specific calls to a 911 emergency system, where the requester is seeking to obtain public records about the use of the system in response to a specific crime, emergency or other event as to which a citizen has initiated a 911 call. 12. Records of the Virginia Military Advisory Council or any commission created by executive order for the purpose of studying and making recommendations regarding preventing closure or realignment of federal military and national security installations and facilities located in Virginia and relocation of such facilities to Virginia, or a local or regional military affairs organization appointed by a local governing body, to the extent such records (i) contain information relating to strategies under consideration or development by the Council or such commission or organizations to prevent the closure or realignment of federal military installations located in Virginia or the relocation of national security facilities located in Virginia, to limit the adverse economic effect of such realignment, closure, or relocation, or to seek additional tenant activity growth from the Department of Defense or federal government or (ii) disclose trade secrets, as defined in the Uniform Trade Secrets Act (§59.1-336 et seq.), provided to the Council or such commission or organizations in connection with their work. In order to invoke the trade secret protection provided by clause (ii), the submitting entity shall, in writing and at the time of submission (a) invoke this exclusion, (b) identify with specificity the information for which such protection is sought, and (c) state the reason why such protection is necessary. Nothing in this subdivision shall be construed to authorize the withholding of all or part of any record, other than a trade secret that has been specifically identified as required by this subdivision, after the Department of Defense or federal agency has issued a final, unappealable decision, or in the event of litigation, a court of competent jurisdiction has entered a final, unappealable order concerning the closure, realignment, or expansion of the military installation or tenant activities, or the relocation of the national security facility, for which records are sought. 13. Documentation or other information as determined by the State Comptroller that describes the design, function, operation, or implementation of internal controls over the Commonwealth's financial processes and systems, and the assessment of risks and vulnerabilities of those controls, including the annual assessment of internal controls mandated by the State Comptroller, the disclosure of which would jeopardize the security of the Commonwealth's financial assets. However, records relating to the investigation of and findings concerning the soundness of any fiscal process shall be disclosed in a form that does not compromise internal controls. Nothing in this subdivision shall be construed to prohibit the Auditor of Public Accounts or the Joint Legislative Audit and Review Commission from reporting internal control deficiencies discovered during the course of an audit. 14. Documentation or other information relating to the Statewide Agencies Radio System (STARS) or any other similar local or regional public safety communications system that (i) describes the design, function, programming, operation, or access control features of the overall system, components, structures, individual networks, and subsystems of the STARS or any other similar local or regional communications system or (ii) relates to radio frequencies assigned to or utilized by STARS or any other similar local or regional communications system, code plugs, circuit routing, addressing schemes, talk groups, fleet maps, encryption, programming maintained by or utilized by STARS or any other similar local or regional public safety communications system; those portions of engineering and construction drawings and plans that reveal critical structural components, interconnectivity, security equipment and systems, network monitoring, network operation center, master sites, ventilation systems, fire protection equipment, mandatory building emergency equipment, electrical systems, and other utility equipment and systems related to STARS or any other similar local or regional public safety communications system; and special event plans, operational plans, storm plans, or other pre-arranged programming, the disclosure of which would reveal surveillance techniques, personnel deployments, alarm or security systems or technologies, or operational and transportation plans or protocols, to the extent such disclosure would jeopardize the security of any governmental facility, building, or structure or the safety of any person. 15. Records of a salaried or volunteer Fire/EMS company or Fire/EMS department, to the extent that the records disclose the telephone numbers for cellular telephones, pagers, or comparable portable communication devices provided to its personnel for use in the performance of their official duties. 16. Records of hospitals and nursing homes regulated by the Board of Health pursuant to Chapter 5 (§32.1-123 et seq.) of Title 32.1 provided to the Department of Health, to the extent such records reveal the disaster recovery plans or the evacuation plans for such facilities in the event of fire, explosion, natural disaster, or other catastrophic event. Nothing in this subdivision shall be construed to prohibit the disclosure of records relating to the effectiveness of executed evacuation plans after the occurrence of fire, explosion, natural disaster, or other catastrophic event. 17. Records received by the Department of Criminal Justice Services pursuant to §§9.1-184, 22.1-79.4, and 22.1-279.8 or for purposes of evaluating threat assessment teams established by a public institution of higher education pursuant to §23-9.2:10 or by a private nonprofit institution of higher education, to the extent such records reveal security plans, walk-through checklists, or vulnerability and threat assessment components. §2.2-3705.4. Exclusions to application of chapter; educational records and certain records of educational institutions. The following records are excluded from the provisions of this chapter but may be disclosed by the custodian in his discretion, except where such disclosure is prohibited by law: 1. Scholastic records containing information concerning identifiable individuals, except that such access shall not be denied to the person who is the subject thereof, or the parent or legal guardian of the student. However, no student shall have access to (i) financial records of a parent or guardian or (ii) records of instructional, supervisory, and administrative personnel and educational personnel ancillary thereto, that are in the sole possession of the maker thereof and that are not accessible or revealed to any other person except a substitute. The parent or legal guardian of a student may prohibit, by written request, the release of any individual information regarding that student until the student reaches the age of 18 years. For scholastic records of students under the age of 18 years, the right of access may be asserted only by his legal guardian or parent, including a noncustodial parent, unless such parent's parental rights have been terminated or a court of competent jurisdiction has restricted or denied such access. For scholastic records of students who are emancipated or attending a state-supported institution of higher education, the right of access may be asserted by the student. Any person who is the subject of any scholastic record and who is 18 years of age or older may waive, in writing, the protections afforded by this subdivision. If the protections are so waived, the public body shall open such records for inspection and copying. 2. Confidential letters and statements of recommendation placed in the records of educational agencies or institutions respecting (i) admission to any educational agency or institution, (ii) an application for employment or promotion, or (iii) receipt of an honor or honorary recognition. 3. Records of the Brown v. Board of Education Scholarship Awards Committee relating to personally identifiable information, including scholarship applications, personal financial information, and confidential correspondence and letters of recommendation. 4. Data, records or information of a proprietary nature produced or collected by or for faculty or staff of public institutions of higher education, other than the institutions' financial or administrative records, in the conduct of or as a result of study or research on medical, scientific, technical or scholarly issues, whether sponsored by the institution alone or in conjunction with a governmental body or a private concern, where such data, records or information has not been publicly released, published, copyrighted or patented. 5. All records of the University of Virginia or the University of Virginia Medical Center or Eastern Virginia Medical School, as the case may be, that contain proprietary, business-related information pertaining to the operations of the University of Virginia Medical Center or Eastern Virginia Medical School, as the case may be, including business development or marketing strategies and activities with existing or future joint venturers, partners, or other parties with whom the University of Virginia Medical Center or Eastern Virginia Medical School, as the case may be, has formed, or forms, any arrangement for the delivery of health care, if disclosure of such information would be harmful to the competitive position of the University of Virginia Medical Center or Eastern Virginia Medical School, as the case may be. 6. Personal information, as defined in §2.2-3801, provided to the Board of the Virginia College Savings Plan or its employees by or on behalf of individuals who have requested information about, applied for, or entered into prepaid tuition contracts or savings trust account agreements pursuant to Chapter 4.9 (§23-38.75 et seq.) of Title 23. Nothing in this subdivision shall be construed to prohibit disclosure or publication of information in a statistical or other form that does not identify individuals or provide personal information. Individuals shall be provided access to their own personal information. 7. Records maintained in connection with fundraising activities by or for a public institution of higher education to the extent that such records reveal (i) personal fundraising strategies relating to identifiable donors or prospective donors or (ii) wealth assessments; estate, financial, or tax planning information; health-related information; employment, familial, or marital status information; electronic mail addresses, facsimile or telephone numbers; birth dates or social security numbers of identifiable donors or prospective donors. Nothing in this subdivision, however, shall be construed to authorize the withholding of records relating to the amount, date, purpose, and terms of the pledge or donation, or the identity of the donor unless the donor has requested anonymity in connection with or as a condition of making a pledge or donation. The exclusion provided by this subdivision shall not apply to protect from disclosure (i) the identities of sponsors providing grants to or contracting with the institution for the performance of research services or other work or (ii) the terms and conditions of such grants or contracts. 8. Records of a threat assessment team established by a local school board pursuant to §22.1-79.4 or by a public institution of higher education pursuant to §23-9.2:10 relating to the assessment or intervention with a specific individual. However, in the event an individual who has been under assessment commits an act, or is prosecuted for the commission of an act that has caused the death of, or caused serious bodily injury, including any felony sexual assault, to another person, the records of such threat assessment team concerning the individual under assessment shall be made available as provided by this chapter, with the exception of any criminal history records obtained pursuant to §19.2-389 or 19.2-389.1, health records obtained pursuant to §32.1-127.1:03, or scholastic records as defined in § 22.1-289. The public body providing such records shall remove information identifying any person who provided information to the threat assessment team under a promise of confidentiality. §19.2-389. Dissemination of criminal history record information. A. Criminal history record information shall be disseminated, whether directly or through an intermediary, only to: 1. Authorized officers or employees of criminal justice agencies, as defined by §9.1-101, for purposes of the administration of criminal justice and the screening of an employment application or review of employment by a criminal justice agency with respect to its own employees or applicants, and dissemination to the Virginia Parole Board, pursuant to this subdivision, of such information on all state-responsible inmates for the purpose of making parole determinations pursuant to subdivisions 1, 2, 3, and 5 of §53.1-136 shall include collective dissemination by electronic means every 30 days. For purposes of this subdivision, criminal history record information includes information sent to the Central Criminal Records Exchange pursuant to §§37.2-819 and 64.2-2014 when disseminated to any full-time or part-time employee of the State Police, a police department or sheriff's office that is a part of or administered by the Commonwealth or any political subdivision thereof, and who is responsible for the prevention and detection of crime and the enforcement of the penal, traffic or highway laws of the Commonwealth for the purposes of the administration of criminal justice; 2. Such other individuals and agencies that require criminal history record information to implement a state or federal statute or executive order of the President of the United States or Governor that expressly refers to criminal conduct and contains requirements or exclusions expressly based upon such conduct, except that information concerning the arrest of an individual may not be disseminated to a noncriminal justice agency or individual if an interval of one year has elapsed from the date of the arrest and no disposition of the charge has been recorded and no active prosecution of the charge is pending; 3. Individuals and agencies pursuant to a specific agreement with a criminal justice agency to provide services required for the administration of criminal justice pursuant to that agreement which shall specifically authorize access to data, limit the use of data to purposes for which given, and ensure the security and confidentiality of the data; 4. Individuals and agencies for the express purpose of research, evaluative, or statistical activities pursuant to an agreement with a criminal justice agency that shall specifically authorize access to data, limit the use of data to research, evaluative, or statistical purposes, and ensure the confidentiality and security of the data; 5. Agencies of state or federal government that are authorized by state or federal statute or executive order of the President of the United States or Governor to conduct investigations determining employment suitability or eligibility for security clearances allowing access to classified information; 6. Individuals and agencies where authorized by court order or court rule; 7. Agencies of any political subdivision of the Commonwealth, public transportation companies owned, operated or controlled by any political subdivision, and any public service corporation that operates a public transit system owned by a local government for the conduct of investigations of applicants for employment, permit, or license whenever, in the interest of public welfare or safety, it is necessary to determine under a duly enacted ordinance if the past criminal conduct of a person with a conviction record would be compatible with the nature of the employment, permit, or license under consideration; 7a. Commissions created pursuant to the Transportation District Act of 1964 (§33.2-1900 et seq.) of Title 33.2 and their contractors, for the conduct of investigations of individuals who have been offered a position of employment whenever, in the interest of public welfare or safety and as authorized in the Transportation District Act of 1964, it is necessary to determine if the past criminal conduct of a person with a conviction record would be compatible with the nature of the employment under consideration; 8. Public or private agencies when authorized or required by federal or state law or interstate compact to investigate (i) applicants for foster or adoptive parenthood or (ii) any individual, and the adult members of that individual's household, with whom the agency is considering placing a child or from whom the agency is considering removing a child due to abuse or neglect, on an emergency, temporary, or permanent basis pursuant to §§ 63.2-901.1 and 63.2-1505, subject to the restriction that the data shall not be further disseminated to any party other than a federal or state authority or court as may be required to comply with an express requirement of law; 9. To the extent permitted by federal law or regulation, public service companies as defined in §56-1, for the conduct of investigations of applicants for employment when such employment involves personal contact with the public or when past criminal conduct of an applicant would be incompatible with the nature of the employment under consideration; 10. The appropriate authority for purposes of granting citizenship and for purposes of international travel, including, but not limited to, issuing visas and passports; 11. A person requesting a copy of his own criminal history record information as defined in §9.1-101 at his cost, except that criminal history record information shall be supplied at no charge to a person who has applied to be a volunteer with (i) a Virginia affiliate of Big Brothers/Big Sisters of America; (ii) a volunteer fire company; (iii) the Volunteer Emergency Families for Children; (iv) any affiliate of Prevent Child Abuse, Virginia; (v) any Virginia affiliate of Compeer; or (vi) any board member or any individual who has been offered membership on the board of a Crime Stoppers, Crime Solvers or Crime Line program as defined in §15.2-1713.1; 12. Administrators and board presidents of and applicants for licensure or registration as a child welfare agency as defined in §63.2-100 for dissemination to the Commissioner of Social Services' representative pursuant to §63.2-1702 for the conduct of investigations with respect to employees of and volunteers at such facilities, caretakers, and other adults living in family day homes or homes approved by family day systems, and foster and adoptive parent applicants of private child-placing agencies, pursuant to §§63.2-1719, 63.2-1720, 63.2-1720.1, 63.2-1721, and 63.2-1721.1, subject to the restriction that the data shall not be further disseminated by the facility or agency to any party other than the data subject, the Commissioner of Social Services' representative or a federal or state authority or court as may be required to comply with an express requirement of law for such further dissemination; 13. The school boards of the Commonwealth for the purpose of screening individuals who are offered or who accept public school employment and those current school board employees for whom a report of arrest has been made pursuant to §19.2-83.1; 14. The Virginia Lottery for the conduct of investigations as set forth in the Virginia Lottery Law (§58.1-4000 et seq.), and the Department of Agriculture and Consumer Services for the conduct of investigations as set forth in Article 1.1:1 (§18.2-340.15 et seq.) of Chapter 8 of Title 18.2; 15. Licensed nursing homes, hospitals and home care organizations for the conduct of investigations of applicants for compensated employment in licensed nursing homes pursuant to §32.1-126.01, hospital pharmacies pursuant to §32.1-126.02, and home care organizations pursuant to § 32.1-162.9:1, subject to the limitations set out in subsection E; 16. Licensed assisted living facilities and licensed adult day care centers for the conduct of investigations of applicants for compensated employment in licensed assisted living facilities and licensed adult day care centers pursuant to §63.2-1720, subject to the limitations set out in subsection F; 17. (Effective until July 1, 2018) The Alcoholic Beverage Control Board for the conduct of investigations as set forth in §4.1-103.1; 17. (Effective July 1, 2018) The Virginia Alcoholic Beverage Control Authority for the conduct of investigations as set forth in § 4.1-103.1; 18. The State Board of Elections and authorized officers and employees thereof and general registrars appointed pursuant to §24.2-110 in the course of conducting necessary investigations with respect to voter registration, limited to any record of felony convictions; 19. The Commissioner of Behavioral Health and Developmental Services for those individuals who are committed to the custody of the Commissioner pursuant to §§19.2-169.2, 19.2-169.6, 19.2-182.2, 19.2-182.3, 19.2-182.8, and 19.2-182.9 for the purpose of placement, evaluation, and treatment planning; 20. Any alcohol safety action program certified by the Commission on the Virginia Alcohol Safety Action Program for (i) assessments of habitual offenders under §46.2-360, (ii) interventions with first offenders under §18.2-251, or (iii) services to offenders under §18.2-51.4, 18.2-266, or 18.2-266.1; 21. Residential facilities for juveniles regulated or operated by the Department of Social Services, the Department of Education, or the Department of Behavioral Health and Developmental Services for the purpose of determining applicants' fitness for employment or for providing volunteer or contractual services; 22. The Department of Behavioral Health and Developmental Services and facilities operated by the Department for the purpose of determining an individual's fitness for employment pursuant to departmental instructions; 23. Pursuant to §22.1-296.3, the governing boards or administrators of private or religious elementary or secondary schools which are accredited by a statewide accrediting organization recognized, prior to January 1, 1996, by the State Board of Education or a private organization coordinating such records information on behalf of such governing boards or administrators pursuant to a written agreement with the Department of State Police; 24. Public and nonprofit private colleges and universities for the purpose of screening individuals who are offered or accept employment; 25. Members of a threat assessment team established by a local school board pursuant to §22.1-79.4, by a public institution of higher education pursuant to §23-9.2:10, or by a private nonprofit institution of higher education, for the purpose of assessing or intervening with an individual whose behavior may present a threat to safety; however, no member of a threat assessment team shall redisclose any criminal history record information obtained pursuant to this section or otherwise use any record of an individual beyond the purpose that such disclosure was made to the threat assessment team; 26. Executive directors of community services boards or the personnel director serving the community services board for the purpose of determining an individual's fitness for employment pursuant to §§37.2-506 and 37.2-607; 27. Executive directors of behavioral health authorities as defined in §37.2-600 for the purpose of determining an individual's fitness for employment pursuant to §§37.2-506 and 37.2-607; 28. The Commissioner of Social Services for the purpose of locating persons who owe child support or who are alleged in a pending paternity proceeding to be a putative father, provided that only the name, address, demographics and social security number of the data subject shall be released; 29. Authorized officers or directors of agencies licensed pursuant to Article 2 (§37.2-403 et seq.) of Chapter 4 of Title 37.2 by the Department of Behavioral Health and Developmental Services for the purpose of determining if any applicant who accepts employment in any direct care position has been convicted of a crime that affects his fitness to have responsibility for the safety and well-being of individuals with mental illness, intellectual disability, or substance abuse pursuant to §§37.2-416, 37.2-506, and 37.2-607; 30. The Commissioner of the Department of Motor Vehicles, for the purpose of evaluating applicants for and holders of a motor carrier certificate or license subject to the provisions of Chapters 20 (§46.2-2000 et seq.) and 21 (§46.2-2100 et seq.) of Title 46.2; 31. The chairmen of the Committees for Courts of Justice of the Senate or the House of Delegates for the purpose of determining if any person being considered for election to any judgeship has been convicted of a crime; 32. Heads of state agencies in which positions have been identified as sensitive for the purpose of determining an individual's fitness for employment in positions designated as sensitive under Department of Human Resource Management policies developed pursuant to §2.2-1201.1. Dissemination of criminal history record information to the agencies shall be limited to those positions generally described as directly responsible for the health, safety and welfare of the general populace or protection of critical infrastructures; 33. The Office of the Attorney General, for all criminal justice activities otherwise permitted under subdivision A 1 and for purposes of performing duties required by the Civil Commitment of Sexually Violent Predators Act (§37.2-900 et seq.); 34. Shipyards, to the extent permitted by federal law or regulation, engaged in the design, construction, overhaul, or repair of nuclear vessels for the United States Navy, including their subsidiary companies, for the conduct of investigations of applications for employment or for access to facilities, by contractors, leased laborers, and other visitors; 35. Any employer of individuals whose employment requires that they enter the homes of others, for the purpose of screening individuals who apply for, are offered, or have accepted such employment; 36. Public agencies when and as required by federal or state law to investigate (i) applicants as providers of adult foster care and home-based services or (ii) any individual with whom the agency is considering placing an adult on an emergency, temporary, or permanent basis pursuant to § 63.2-1601.1, subject to the restriction that the data shall not be further disseminated by the agency to any party other than a federal or state authority or court as may be required to comply with an express requirement of law for such further dissemination, subject to limitations set out in subsection G; 37. The Department of Medical Assistance Services, or its designee, for the purpose of screening individuals who, through contracts, subcontracts, or direct employment, volunteer, apply for, are offered, or have accepted a position related to the provision of transportation services to enrollees in the Medicaid Program or the Family Access to Medical Insurance Security (FAMIS) Program, or any other program administered by the Department of Medical Assistance Services; 38. The State Corporation Commission for the purpose of investigating individuals who are current or proposed members, senior officers, directors, and principals of an applicant or person licensed under Chapter 16 (§6.2-1600 et seq.) or Chapter 19 (§6.2-1900 et seq.) of Title 6.2. Notwithstanding any other provision of law, if an application is denied based in whole or in part on information obtained from the Central Criminal Records Exchange pursuant to Chapter 16 or 19 of Title 6.2, the Commissioner of Financial Institutions or his designee may disclose such information to the applicant or its designee; 39. The Department of Professional and Occupational Regulation for the purpose of investigating individuals for initial licensure pursuant to §54.1-2106.1; 40. The Department for Aging and Rehabilitative Services and the Department for the Blind and Vision Impaired for the purpose of evaluating an individual's fitness for various types of employment and for the purpose of delivering comprehensive vocational rehabilitation services pursuant to Article 11 (§51.5-170 et seq.) of Chapter 14 of Title 51.5 that will assist the individual in obtaining employment; 41. Bail bondsmen, in accordance with the provisions of § 19.2-120; 42. The State Treasurer for the purpose of determining whether a person receiving compensation for wrongful incarceration meets the conditions for continued compensation under §8.01-195.12; 43. The Department of Social Services and directors of local departments of social services for the purpose of screening individuals seeking to enter into a contract with the Department of Social Services or a local department of social services for the provision of child care services for which child care subsidy payments may be provided; 44. The Department of Juvenile Justice to investigate any parent, guardian, or other adult members of a juvenile's household when completing a predispositional or postdispositional report required by § 16.1-273 or a Board of Juvenile Justice regulation promulgated pursuant to § 16.1-233; and 45. Other entities as otherwise provided by law. Upon an ex parte motion of a defendant in a felony case and upon the showing that the records requested may be relevant to such case, the court shall enter an order requiring the Central Criminal Records Exchange to furnish the defendant, as soon as practicable, copies of any records of persons designated in the order on whom a report has been made under the provisions of this chapter. Notwithstanding any other provision of this chapter to the contrary, upon a written request sworn to before an officer authorized to take acknowledgments, the Central Criminal Records Exchange, or the criminal justice agency in cases of offenses not required to be reported to the Exchange, shall furnish a copy of conviction data covering the person named in the request to the person making the request; however, such person on whom the data is being obtained shall consent in writing, under oath, to the making of such request. A person receiving a copy of his own conviction data may utilize or further disseminate that data as he deems appropriate. In the event no conviction data is maintained on the data subject, the person making the request shall be furnished at his cost a certification to that effect. B. Use of criminal history record information disseminated to noncriminal justice agencies under this section shall be limited to the purposes for which it was given and may not be disseminated further. C. No criminal justice agency or person shall confirm the existence or nonexistence of criminal history record information for employment or licensing inquiries except as provided by law. D. Criminal justice agencies shall establish procedures to query the Central Criminal Records Exchange prior to dissemination of any criminal history record information on offenses required to be reported to the Central Criminal Records Exchange to ensure that the most up-to-date disposition data is being used. Inquiries of the Exchange shall be made prior to any dissemination except in those cases where time is of the essence and the normal response time of the Exchange would exceed the necessary time period. A criminal justice agency to whom a request has been made for the dissemination of criminal history record information that is required to be reported to the Central Criminal Records Exchange may direct the inquirer to the Central Criminal Records Exchange for such dissemination. Dissemination of information regarding offenses not required to be reported to the Exchange shall be made by the criminal justice agency maintaining the record as required by §15.2-1722. E. Criminal history information provided to licensed nursing homes, hospitals and to home care organizations pursuant to subdivision A 15 shall be limited to the convictions on file with the Exchange for any offense specified in §§32.1-126.01, 32.1-126.02, and 32.1-162.9:1. F. Criminal history information provided to licensed assisted living facilities and licensed adult day care centers pursuant to subdivision A 16 shall be limited to the convictions on file with the Exchange for any offense specified in §63.2-1720. G. Criminal history information provided to public agencies pursuant to subdivision A 36 shall be limited to the convictions on file with the Exchange for any offense specified in §63.2-1719. H. Upon receipt of a written request from an employer or prospective employer, the Central Criminal Records Exchange, or the criminal justice agency in cases of offenses not required to be reported to the Exchange, shall furnish at the employer's cost a copy of conviction data covering the person named in the request to the employer or prospective employer making the request, provided that the person on whom the data is being obtained has consented in writing to the making of such request and has presented a photo-identification to the employer or prospective employer. In the event no conviction data is maintained on the person named in the request, the requesting employer or prospective employer shall be furnished at his cost a certification to that effect. The criminal history record search shall be conducted on forms provided by the Exchange. §19.2-389.1. Dissemination of juvenile record information. Record information maintained in the Central Criminal Records Exchange pursuant to the provisions of §16.1-299 shall be disseminated only (i) to make the determination as provided in §§18.2-308.2 and 18.2-308.2:2 of eligibility to possess or purchase a firearm; (ii) to aid in the preparation of a pretrial investigation report prepared by a local pretrial services agency established pursuant to Article 5 (§19.2-152.2 et seq.) of Chapter 9, a presentence or post-sentence investigation report pursuant to §19.2-264.5 or 19.2-299 or in the preparation of the discretionary sentencing guidelines worksheets pursuant to subsection C of §19.2-298.01; (iii) to aid local community-based probation services agencies established pursuant to the Comprehensive Community Corrections Act for Local-Responsible Offenders (§9.1-173 et seq.) with investigating or serving adult local-responsible offenders and all court service units serving juvenile delinquent offenders; (iv) for fingerprint comparison utilizing the fingerprints maintained in the Automated Fingerprint Information System (AFIS) computer; (v) to attorneys for the Commonwealth to secure information incidental to sentencing and to attorneys for the Commonwealth and probation officers to prepare the discretionary sentencing guidelines worksheets pursuant to subsection C of §19.2-298.01; (vi) to any full-time or part-time employee of the State Police, a police department or sheriff's office that is a part of or administered by the Commonwealth or any political subdivision thereof, and who is responsible for the prevention and detection of crime and the enforcement of the penal, traffic or highway laws of the Commonwealth, for purposes of the administration of criminal justice as defined in §9.1-101; (vii) to the Department of Forensic Science to verify its authority to maintain the juvenile's sample in the DNA data bank pursuant to § 16.1-299.1; (viii) to the Office of the Attorney General, for all criminal justice activities otherwise permitted and for purposes of performing duties required by the Civil Commitment of Sexually Violent Predators Act (§37.2-900 et seq.); (ix) to the Virginia Criminal Sentencing Commission for research purposes; (x) to members of a threat assessment team established by a school board pursuant to §22.1-79.4, by a public institution of higher education pursuant to §23-9.2:10, or by a private nonprofit institution of higher education, to aid in the assessment or intervention with individuals whose behavior may present a threat to safety; however, no member of a threat assessment team shall redisclose any juvenile record information obtained pursuant to this section or otherwise use any record of an individual beyond the purpose that such disclosure was made to the threat assessment team; and (xi) to any full-time or part-time employee of the State Police or a police department or sheriff's office that is a part of or administered by the Commonwealth or any political subdivision thereof for the purpose of screening any person for full-time or part-time employment with the State Police or a police department or sheriff's office that is a part of or administered by the Commonwealth or any political subdivision thereof. §22.1-79.4. Threat assessment teams and oversight committees. A. Each local school board shall adopt policies for the
establishment of threat assessment teams, including the assessment of and
intervention with B. The superintendent of each school division may establish a committee charged with oversight of the threat assessment teams operating within the division, which may be an existing committee established by the division. The committee shall include individuals with expertise in human resources, education, school administration, mental health, and law enforcement. C. Each division superintendent shall establish, for each school, a threat assessment team that shall include persons with expertise in counseling, instruction, school administration, and law enforcement. Threat assessment teams may be established to serve one or more schools as determined by the division superintendent. Each team shall (i) provide guidance to students, faculty, and staff regarding recognition of threatening or aberrant behavior that may represent a threat to the community, school, or self; (ii) identify members of the school community to whom threatening behavior should be reported; and (iii) implement policies adopted by the local school board pursuant to subsection A. D. Upon a preliminary determination that a student poses a threat of violence or physical harm to self or others, a threat assessment team shall immediately report its determination to the division superintendent or his designee. The division superintendent or his designee shall immediately attempt to notify the student's parent or legal guardian. Nothing in this subsection shall preclude school division personnel from acting immediately to address an imminent threat. E. Each threat assessment team established pursuant to this section shall report quantitative data on its activities according to guidance developed by the Department of Criminal Justice Services. F. Upon a preliminary determination by the threat assessment team that an individual poses a threat of violence to self or others or exhibits significantly disruptive behavior or need for assistance, a threat assessment team may obtain criminal history record information, as provided in §§19.2-389 and 19.2-389.1, and health records, as provided in §32.1-127.1:03. No member of a threat assessment team shall redisclose any criminal history record information or health information obtained pursuant to this section or otherwise use any record of an individual beyond the purpose for which such disclosure was made to the threat assessment team. §32.1-127.1:03. Health records privacy. A. There is hereby recognized an individual's right of privacy in the content of his health records. Health records are the property of the health care entity maintaining them, and, except when permitted or required by this section or by other provisions of state law, no health care entity, or other person working in a health care setting, may disclose an individual's health records. Pursuant to this subsection: 1. Health care entities shall disclose health records to the individual who is the subject of the health record, except as provided in subsections E and F and subsection B of §8.01-413. 2. Health records shall not be removed from the premises where they are maintained without the approval of the health care entity that maintains such health records, except in accordance with a court order or subpoena consistent with subsection C of §8.01-413 or with this section or in accordance with the regulations relating to change of ownership of health records promulgated by a health regulatory board established in Title 54.1. 3. No person to whom health records are disclosed shall redisclose or otherwise reveal the health records of an individual, beyond the purpose for which such disclosure was made, without first obtaining the individual's specific authorization to such redisclosure. This redisclosure prohibition shall not, however, prevent (i) any health care entity that receives health records from another health care entity from making subsequent disclosures as permitted under this section and the federal Department of Health and Human Services regulations relating to privacy of the electronic transmission of data and protected health information promulgated by the United States Department of Health and Human Services as required by the Health Insurance Portability and Accountability Act (HIPAA) (42 U.S.C. §1320d et seq.) or (ii) any health care entity from furnishing health records and aggregate or other data, from which individually identifying prescription information has been removed, encoded or encrypted, to qualified researchers, including, but not limited to, pharmaceutical manufacturers and their agents or contractors, for purposes of clinical, pharmaco-epidemiological, pharmaco-economic, or other health services research. 4. Health care entities shall, upon the request of the individual who is the subject of the health record, disclose health records to other health care entities, in any available format of the requestor's choosing, as provided in subsection E. B. As used in this section: "Agent" means a person who has been appointed as an individual's agent under a power of attorney for health care or an advance directive under the Health Care Decisions Act (§54.1-2981 et seq.). "Certification" means a written representation that is delivered by hand, by first-class mail, by overnight delivery service, or by facsimile if the sender obtains a facsimile-machine-generated confirmation reflecting that all facsimile pages were successfully transmitted. "Guardian" means a court-appointed guardian of the person. "Health care clearinghouse" means, consistent with the definition set out in 45 C.F.R. §160.103, a public or private entity, such as a billing service, repricing company, community health management information system or community health information system, and "value-added" networks and switches, that performs either of the following functions: (i) processes or facilitates the processing of health information received from another entity in a nonstandard format or containing nonstandard data content into standard data elements or a standard transaction; or (ii) receives a standard transaction from another entity and processes or facilitates the processing of health information into nonstandard format or nonstandard data content for the receiving entity. "Health care entity" means any health care provider, health plan or health care clearinghouse. "Health care provider" means those entities listed in the definition of "health care provider" in §8.01-581.1, except that state-operated facilities shall also be considered health care providers for the purposes of this section. Health care provider shall also include all persons who are licensed, certified, registered or permitted or who hold a multistate licensure privilege issued by any of the health regulatory boards within the Department of Health Professions, except persons regulated by the Board of Funeral Directors and Embalmers or the Board of Veterinary Medicine. "Health plan" means an individual or group plan that provides, or pays the cost of, medical care. "Health plan" shall include any entity included in such definition as set out in 45 C.F.R. § 160.103. "Health record" means any written, printed or electronically recorded material maintained by a health care entity in the course of providing health services to an individual concerning the individual and the services provided. "Health record" also includes the substance of any communication made by an individual to a health care entity in confidence during or in connection with the provision of health services or information otherwise acquired by the health care entity about an individual in confidence and in connection with the provision of health services to the individual. "Health services" means, but shall not be limited to, examination, diagnosis, evaluation, treatment, pharmaceuticals, aftercare, habilitation or rehabilitation and mental health therapy of any kind, as well as payment or reimbursement for any such services. "Individual" means a patient who is receiving or has received health services from a health care entity. "Individually identifying prescription information" means all prescriptions, drug orders or any other prescription information that specifically identifies an individual. "Parent" means a biological, adoptive or foster parent. "Psychotherapy notes" means comments, recorded in any medium by a health care provider who is a mental health professional, documenting or analyzing the contents of conversation during a private counseling session with an individual or a group, joint, or family counseling session that are separated from the rest of the individual's health record. "Psychotherapy notes" shall not include annotations relating to medication and prescription monitoring, counseling session start and stop times, treatment modalities and frequencies, clinical test results, or any summary of any symptoms, diagnosis, prognosis, functional status, treatment plan, or the individual's progress to date. C. The provisions of this section shall not apply to any of the following: 1. The status of and release of information governed by §§ 65.2-604 and 65.2-607 of the Virginia Workers' Compensation Act; 2. Except where specifically provided herein, the health records of minors; or 3. The release of juvenile health records to a secure facility or a shelter care facility pursuant to §16.1-248.3. D. Health care entities may, and, when required by other provisions of state law, shall, disclose health records: 1. As set forth in subsection E, pursuant to the written authorization of (i) the individual or (ii) in the case of a minor, (a) his custodial parent, guardian or other person authorized to consent to treatment of minors pursuant to §54.1-2969 or (b) the minor himself, if he has consented to his own treatment pursuant to §54.1-2969, or (iii) in emergency cases or situations where it is impractical to obtain an individual's written authorization, pursuant to the individual's oral authorization for a health care provider or health plan to discuss the individual's health records with a third party specified by the individual; 2. In compliance with a subpoena issued in accord with subsection H, pursuant to a search warrant or a grand jury subpoena, pursuant to court order upon good cause shown or in compliance with a subpoena issued pursuant to subsection C of §8.01-413. Regardless of the manner by which health records relating to an individual are compelled to be disclosed pursuant to this subdivision, nothing in this subdivision shall be construed to prohibit any staff or employee of a health care entity from providing information about such individual to a law-enforcement officer in connection with such subpoena, search warrant, or court order; 3. In accord with subsection F of §8.01-399 including, but not limited to, situations where disclosure is reasonably necessary to establish or collect a fee or to defend a health care entity or the health care entity's employees or staff against any accusation of wrongful conduct; also as required in the course of an investigation, audit, review or proceedings regarding a health care entity's conduct by a duly authorized law-enforcement, licensure, accreditation, or professional review entity; 4. In testimony in accordance with §§8.01-399 and 8.01-400.2; 5. In compliance with the provisions of §8.01-413; 6. As required or authorized by law relating to public health activities, health oversight activities, serious threats to health or safety, or abuse, neglect or domestic violence, relating to contagious disease, public safety, and suspected child or adult abuse reporting requirements, including, but not limited to, those contained in §§32.1-36, 32.1-36.1, 32.1-40, 32.1-41, 32.1-127.1:04, 32.1-276.5, 32.1-283, 32.1-283.1, 32.1-320, 37.2-710, 37.2-839, 53.1-40.10, 54.1-2400.6, 54.1-2400.7, 54.1-2403.3, 54.1-2506, 54.1-2966, 54.1-2966.1, 54.1-2967, 54.1-2968, 54.1-3408.2, 63.2-1509, and 63.2-1606; 7. Where necessary in connection with the care of the individual; 8. In connection with the health care entity's own health care operations or the health care operations of another health care entity, as specified in 45 C.F.R. §164.501, or in the normal course of business in accordance with accepted standards of practice within the health services setting; however, the maintenance, storage, and disclosure of the mass of prescription dispensing records maintained in a pharmacy registered or permitted in Virginia shall only be accomplished in compliance with §§ 54.1-3410, 54.1-3411, and 54.1-3412; 9. When the individual has waived his right to the privacy of the health records; 10. When examination and evaluation of an individual are undertaken pursuant to judicial or administrative law order, but only to the extent as required by such order; 11. To the guardian ad litem and any attorney representing the respondent in the course of a guardianship proceeding of an adult patient who is the respondent in a proceeding under Chapter 20 (§64.2-2000 et seq.) of Title 64.2; 12. To the guardian ad litem and any attorney appointed by the court to represent an individual who is or has been a patient who is the subject of a commitment proceeding under §19.2-169.6, Article 5 (§37.2-814 et seq.) of Chapter 8 of Title 37.2, Article 16 (§16.1-335 et seq.) of Chapter 11 of Title 16.1, or a judicial authorization for treatment proceeding pursuant to Chapter 11 (§37.2-1100 et seq.) of Title 37.2; 13. To a magistrate, the court, the evaluator or examiner required under Article 16 (§16.1-335 et seq.) of Chapter 11 of Title 16.1 or § 37.2-815, a community services board or behavioral health authority or a designee of a community services board or behavioral health authority, or a law-enforcement officer participating in any proceeding under Article 16 (§ 16.1-335 et seq.) of Chapter 11 of Title 16.1, §19.2-169.6, or Chapter 8 (§ 37.2-800 et seq.) of Title 37.2 regarding the subject of the proceeding, and to any health care provider evaluating or providing services to the person who is the subject of the proceeding or monitoring the person's adherence to a treatment plan ordered under those provisions. Health records disclosed to a law-enforcement officer shall be limited to information necessary to protect the officer, the person, or the public from physical injury or to address the health care needs of the person. Information disclosed to a law-enforcement officer shall not be used for any other purpose, disclosed to others, or retained; 14. To the attorney and/or guardian ad litem of a minor who represents such minor in any judicial or administrative proceeding, if the court or administrative hearing officer has entered an order granting the attorney or guardian ad litem this right and such attorney or guardian ad litem presents evidence to the health care entity of such order; 15. With regard to the Court-Appointed Special Advocate (CASA) program, a minor's health records in accord with §9.1-156; 16. To an agent appointed under an individual's power of attorney or to an agent or decision maker designated in an individual's advance directive for health care or for decisions on anatomical gifts and organ, tissue or eye donation or to any other person consistent with the provisions of the Health Care Decisions Act (§54.1-2981 et seq.); 17. To third-party payors and their agents for purposes of reimbursement; 18. As is necessary to support an application for receipt of health care benefits from a governmental agency or as required by an authorized governmental agency reviewing such application or reviewing benefits already provided or as necessary to the coordination of prevention and control of disease, injury, or disability and delivery of such health care benefits pursuant to §32.1-127.1:04; 19. Upon the sale of a medical practice as provided in § 54.1-2405; or upon a change of ownership or closing of a pharmacy pursuant to regulations of the Board of Pharmacy; 20. In accord with subsection B of §54.1-2400.1, to communicate an individual's specific and immediate threat to cause serious bodily injury or death of an identified or readily identifiable person; 21. Where necessary in connection with the implementation of a hospital's routine contact process for organ donation pursuant to subdivision B 4 of §32.1-127; 22. In the case of substance abuse records, when permitted by and in conformity with requirements of federal law found in 42 U.S.C. §290dd-2 and 42 C.F.R. Part 2; 23. In connection with the work of any entity established as set forth in §8.01-581.16 to evaluate the adequacy or quality of professional services or the competency and qualifications for professional staff privileges; 24. If the health records are those of a deceased or mentally incapacitated individual to the personal representative or executor of the deceased individual or the legal guardian or committee of the incompetent or incapacitated individual or if there is no personal representative, executor, legal guardian or committee appointed, to the following persons in the following order of priority: a spouse, an adult son or daughter, either parent, an adult brother or sister, or any other relative of the deceased individual in order of blood relationship; 25. For the purpose of conducting record reviews of inpatient hospital deaths to promote identification of all potential organ, eye, and tissue donors in conformance with the requirements of applicable federal law and regulations, including 42 C.F.R. §482.45, (i) to the health care provider's designated organ procurement organization certified by the United States Health Care Financing Administration and (ii) to any eye bank or tissue bank in Virginia certified by the Eye Bank Association of America or the American Association of Tissue Banks; 26. To the Office of the State Inspector General pursuant to Chapter 3.2 (§2.2-307 et seq.) of Title 2.2; 27. To an entity participating in the activities of a local health partnership authority established pursuant to Article 6.1 (§ 32.1-122.10:001 et seq.) of Chapter 4, pursuant to subdivision 1; 28. To law-enforcement officials by each licensed emergency medical services agency, (i) when the individual is the victim of a crime or (ii) when the individual has been arrested and has received emergency medical services or has refused emergency medical services and the health records consist of the prehospital patient care report required by §32.1-116.1; 29. To law-enforcement officials, in response to their request, for the purpose of identifying or locating a suspect, fugitive, person required to register pursuant to §9.1-901 of the Sex Offender and Crimes Against Minors Registry Act, material witness, or missing person, provided that only the following information may be disclosed: (i) name and address of the person, (ii) date and place of birth of the person, (iii) social security number of the person, (iv) blood type of the person, (v) date and time of treatment received by the person, (vi) date and time of death of the person, where applicable, (vii) description of distinguishing physical characteristics of the person, and (viii) type of injury sustained by the person; 30. To law-enforcement officials regarding the death of an individual for the purpose of alerting law enforcement of the death if the health care entity has a suspicion that such death may have resulted from criminal conduct; 31. To law-enforcement officials if the health care entity believes in good faith that the information disclosed constitutes evidence of a crime that occurred on its premises; 32. To the State Health Commissioner pursuant to §32.1-48.015 when such records are those of a person or persons who are subject to an order of quarantine or an order of isolation pursuant to Article 3.02 (§32.1-48.05 et seq.) of Chapter 2; 33. To the Commissioner of the Department of Labor and Industry or his designee by each licensed emergency medical services agency when the records consist of the prehospital patient care report required by § 32.1-116.1 and the patient has suffered an injury or death on a work site while performing duties or tasks that are within the scope of his employment; 34. To notify a family member or personal representative of an individual who is the subject of a proceeding pursuant to Article 16 (§ 16.1-335 et seq.) of Chapter 11 of Title 16.1 or Chapter 8 (§37.2-800 et seq.) of Title 37.2 of information that is directly relevant to such person's involvement with the individual's health care, which may include the individual's location and general condition, when the individual has the capacity to make health care decisions and (i) the individual has agreed to the notification, (ii) the individual has been provided an opportunity to object to the notification and does not express an objection, or (iii) the health care provider can, on the basis of his professional judgment, reasonably infer from the circumstances that the individual does not object to the notification. If the opportunity to agree or object to the notification cannot practicably be provided because of the individual's incapacity or an emergency circumstance, the health care provider may notify a family member or personal representative of the individual of information that is directly relevant to such person's involvement with the individual's health care, which may include the individual's location and general condition if the health care provider, in the exercise of his professional judgment, determines that the notification is in the best interests of the individual. Such notification shall not be made if the provider has actual knowledge the family member or personal representative is currently prohibited by court order from contacting the individual; 35. To a threat assessment team established by a local
school board pursuant to §22.1-79.4, by a public institution of higher
education pursuant to §23-9.2:10, or by a private nonprofit institution
of higher education 36. To a regional emergency medical services council pursuant to §32.1-116.1, for purposes limited to monitoring and improving the quality of emergency medical services pursuant to §32.1-111.3. Notwithstanding the provisions of subdivisions 1 through 35, a health care entity shall obtain an individual's written authorization for any disclosure of psychotherapy notes, except when disclosure by the health care entity is (i) for its own training programs in which students, trainees, or practitioners in mental health are being taught under supervision to practice or to improve their skills in group, joint, family, or individual counseling; (ii) to defend itself or its employees or staff against any accusation of wrongful conduct; (iii) in the discharge of the duty, in accordance with subsection B of §54.1-2400.1, to take precautions to protect third parties from violent behavior or other serious harm; (iv) required in the course of an investigation, audit, review, or proceeding regarding a health care entity's conduct by a duly authorized law-enforcement, licensure, accreditation, or professional review entity; or (v) otherwise required by law. E. Health care records required to be disclosed pursuant to this section shall be made available electronically only to the extent and in the manner authorized by the federal Health Information Technology for Economic and Clinical Health Act (P.L. 111-5) and implementing regulations and the Health Insurance Portability and Accountability Act (42 U.S.C. §1320d et seq.) and implementing regulations. Notwithstanding any other provision to the contrary, a health care entity shall not be required to provide records in an electronic format requested if (i) the electronic format is not reasonably available without additional cost to the health care entity, (ii) the records would be subject to modification in the format requested, or (iii) the health care entity determines that the integrity of the records could be compromised in the electronic format requested. Requests for copies of or electronic access to health records shall (a) be in writing, dated and signed by the requester; (b) identify the nature of the information requested; and (c) include evidence of the authority of the requester to receive such copies or access such records, and identification of the person to whom the information is to be disclosed; and (d) specify whether the requester would like the records in electronic format, if available, or in paper format. The health care entity shall accept a photocopy, facsimile, or other copy of the original signed by the requestor as if it were an original. Within 15 days of receipt of a request for copies of or electronic access to health records, the health care entity shall do one of the following: (A) furnish such copies of or allow electronic access to the requested health records to any requester authorized to receive them in electronic format if so requested; (B) inform the requester if the information does not exist or cannot be found; (C) if the health care entity does not maintain a record of the information, so inform the requester and provide the name and address, if known, of the health care entity who maintains the record; or (D) deny the request (1) under subsection F, (2) on the grounds that the requester has not established his authority to receive such health records or proof of his identity, or (3) as other provided by law. Procedures set forth in this section shall apply only to requests for health records not specifically governed by other provisions of state law. F. Except as provided in subsection B of §8.01-413, copies of or electronic access to an individual's health records shall not be furnished to such individual or anyone authorized to act on the individual's behalf when the individual's treating physician or the individual's treating clinical psychologist has made a part of the individual's record a written statement that, in the exercise of his professional judgment, the furnishing to or review by the individual of such health records would be reasonably likely to endanger the life or physical safety of the individual or another person, or that such health record makes reference to a person other than a health care provider and the access requested would be reasonably likely to cause substantial harm to such referenced person. If any health care entity denies a request for copies of or electronic access to health records based on such statement, the health care entity shall inform the individual of the individual's right to designate, in writing, at his own expense, another reviewing physician or clinical psychologist, whose licensure, training and experience relative to the individual's condition are at least equivalent to that of the physician or clinical psychologist upon whose opinion the denial is based. The designated reviewing physician or clinical psychologist shall make a judgment as to whether to make the health record available to the individual. The health care entity denying the request shall also inform the individual of the individual's right to request in writing that such health care entity designate, at its own expense, a physician or clinical psychologist, whose licensure, training, and experience relative to the individual's condition are at least equivalent to that of the physician or clinical psychologist upon whose professional judgment the denial is based and who did not participate in the original decision to deny the health records, who shall make a judgment as to whether to make the health record available to the individual. The health care entity shall comply with the judgment of the reviewing physician or clinical psychologist. The health care entity shall permit copying and examination of the health record by such other physician or clinical psychologist designated by either the individual at his own expense or by the health care entity at its expense. Any health record copied for review by any such designated physician or clinical psychologist shall be accompanied by a statement from the custodian of the health record that the individual's treating physician or clinical psychologist determined that the individual's review of his health record would be reasonably likely to endanger the life or physical safety of the individual or would be reasonably likely to cause substantial harm to a person referenced in the health record who is not a health care provider. Further, nothing herein shall be construed as giving, or interpreted to bestow the right to receive copies of, or otherwise obtain access to, psychotherapy notes to any individual or any person authorized to act on his behalf. G. A written authorization to allow release of an individual's health records shall substantially include the following information: AUTHORIZATION TO RELEASE CONFIDENTIAL HEALTH RECORDS Individual's Name ________________________________________ Health Care Entity's Name __________________________________ Person, Agency, or Health Care Entity to whom disclosure is to be made __________________________________________________________________ Information or Health Records to be disclosed __________________________________________________________________ Purpose of Disclosure or at the Request of the Individual __________________________________________________________________ As the person signing this authorization, I understand that I am giving my permission to the above-named health care entity for disclosure of confidential health records. I understand that the health care entity may not condition treatment or payment on my willingness to sign this authorization unless the specific circumstances under which such conditioning is permitted by law are applicable and are set forth in this authorization. I also understand that I have the right to revoke this authorization at any time, but that my revocation is not effective until delivered in writing to the person who is in possession of my health records and is not effective as to health records already disclosed under this authorization. A copy of this authorization and a notation concerning the persons or agencies to whom disclosure was made shall be included with my original health records. I understand that health information disclosed under this authorization might be redisclosed by a recipient and may, as a result of such disclosure, no longer be protected to the same extent as such health information was protected by law while solely in the possession of the health care entity. This authorization expires on (date) or (event) _______________________________ Signature of Individual or Individual's Legal Representative if Individual is Unable to Sign ___________________________________________________________________ Relationship or Authority of Legal Representative ___________________________________________________________________ Date of Signature __________________________ H. Pursuant to this subsection: 1. Unless excepted from these provisions in subdivision 9, no party to a civil, criminal or administrative action or proceeding shall request the issuance of a subpoena duces tecum for another party's health records or cause a subpoena duces tecum to be issued by an attorney unless a copy of the request for the subpoena or a copy of the attorney-issued subpoena is provided to the other party's counsel or to the other party if pro se, simultaneously with filing the request or issuance of the subpoena. No party to an action or proceeding shall request or cause the issuance of a subpoena duces tecum for the health records of a nonparty witness unless a copy of the request for the subpoena or a copy of the attorney-issued subpoena is provided to the nonparty witness simultaneously with filing the request or issuance of the attorney-issued subpoena. No subpoena duces tecum for health records shall set a return date earlier than 15 days from the date of the subpoena except by order of a court or administrative agency for good cause shown. When a court or administrative agency directs that health records be disclosed pursuant to a subpoena duces tecum earlier than 15 days from the date of the subpoena, a copy of the order shall accompany the subpoena. Any party requesting a subpoena duces tecum for health records or on whose behalf the subpoena duces tecum is being issued shall have the duty to determine whether the individual whose health records are being sought is pro se or a nonparty. In instances where health records being subpoenaed are those of a pro se party or nonparty witness, the party requesting or issuing the subpoena shall deliver to the pro se party or nonparty witness together with the copy of the request for subpoena, or a copy of the subpoena in the case of an attorney-issued subpoena, a statement informing them of their rights and remedies. The statement shall include the following language and the heading shall be in boldface capital letters: NOTICE TO INDIVIDUAL The attached document means that (insert name of party requesting or causing issuance of the subpoena) has either asked the court or administrative agency to issue a subpoena or a subpoena has been issued by the other party's attorney to your doctor, other health care providers (names of health care providers inserted here) or other health care entity (name of health care entity to be inserted here) requiring them to produce your health records. Your doctor, other health care provider or other health care entity is required to respond by providing a copy of your health records. If you believe your health records should not be disclosed and object to their disclosure, you have the right to file a motion with the clerk of the court or the administrative agency to quash the subpoena. If you elect to file a motion to quash, such motion must be filed within 15 days of the date of the request or of the attorney-issued subpoena. You may contact the clerk's office or the administrative agency to determine the requirements that must be satisfied when filing a motion to quash and you may elect to contact an attorney to represent your interest. If you elect to file a motion to quash, you must notify your doctor, other health care provider(s), or other health care entity, that you are filing the motion so that the health care provider or health care entity knows to send the health records to the clerk of court or administrative agency in a sealed envelope or package for safekeeping while your motion is decided. 2. Any party filing a request for a subpoena duces tecum or causing such a subpoena to be issued for an individual's health records shall include a Notice in the same part of the request in which the recipient of the subpoena duces tecum is directed where and when to return the health records. Such notice shall be in boldface capital letters and shall include the following language: NOTICE TO HEALTH CARE ENTITIES A COPY OF THIS SUBPOENA DUCES TECUM HAS BEEN PROVIDED TO THE INDIVIDUAL WHOSE HEALTH RECORDS ARE BEING REQUESTED OR HIS COUNSEL. YOU OR THAT INDIVIDUAL HAS THE RIGHT TO FILE A MOTION TO QUASH (OBJECT TO) THE ATTACHED SUBPOENA. IF YOU ELECT TO FILE A MOTION TO QUASH, YOU MUST FILE THE MOTION WITHIN 15 DAYS OF THE DATE OF THIS SUBPOENA. YOU MUST NOT RESPOND TO THIS SUBPOENA UNTIL YOU HAVE RECEIVED WRITTEN CERTIFICATION FROM THE PARTY ON WHOSE BEHALF THE SUBPOENA WAS ISSUED THAT THE TIME FOR FILING A MOTION TO QUASH HAS ELAPSED AND THAT: NO MOTION TO QUASH WAS FILED; OR ANY MOTION TO QUASH HAS BEEN RESOLVED BY THE COURT OR THE ADMINISTRATIVE AGENCY AND THE DISCLOSURES SOUGHT ARE CONSISTENT WITH SUCH RESOLUTION. IF YOU RECEIVE NOTICE THAT THE INDIVIDUAL WHOSE HEALTH RECORDS ARE BEING REQUESTED HAS FILED A MOTION TO QUASH THIS SUBPOENA, OR IF YOU FILE A MOTION TO QUASH THIS SUBPOENA, YOU MUST SEND THE HEALTH RECORDS ONLY TO THE CLERK OF THE COURT OR ADMINISTRATIVE AGENCY THAT ISSUED THE SUBPOENA OR IN WHICH THE ACTION IS PENDING AS SHOWN ON THE SUBPOENA USING THE FOLLOWING PROCEDURE: PLACE THE HEALTH RECORDS IN A SEALED ENVELOPE AND ATTACH TO THE SEALED ENVELOPE A COVER LETTER TO THE CLERK OF COURT OR ADMINISTRATIVE AGENCY WHICH STATES THAT CONFIDENTIAL HEALTH RECORDS ARE ENCLOSED AND ARE TO BE HELD UNDER SEAL PENDING A RULING ON THE MOTION TO QUASH THE SUBPOENA. THE SEALED ENVELOPE AND THE COVER LETTER SHALL BE PLACED IN AN OUTER ENVELOPE OR PACKAGE FOR TRANSMITTAL TO THE COURT OR ADMINISTRATIVE AGENCY. 3. Upon receiving a valid subpoena duces tecum for health records, health care entities shall have the duty to respond to the subpoena in accordance with the provisions of subdivisions 4, 5, 6, 7, and 8. 4. Except to deliver to a clerk of the court or administrative agency subpoenaed health records in a sealed envelope as set forth, health care entities shall not respond to a subpoena duces tecum for such health records until they have received a certification as set forth in subdivision 5 or 8 from the party on whose behalf the subpoena duces tecum was issued. If the health care entity has actual receipt of notice that a motion to quash the subpoena has been filed or if the health care entity files a motion to quash the subpoena for health records, then the health care entity shall produce the health records, in a securely sealed envelope, to the clerk of the court or administrative agency issuing the subpoena or in whose court or administrative agency the action is pending. The court or administrative agency shall place the health records under seal until a determination is made regarding the motion to quash. The securely sealed envelope shall only be opened on order of the judge or administrative agency. In the event the court or administrative agency grants the motion to quash, the health records shall be returned to the health care entity in the same sealed envelope in which they were delivered to the court or administrative agency. In the event that a judge or administrative agency orders the sealed envelope to be opened to review the health records in camera, a copy of the order shall accompany any health records returned to the health care entity. The health records returned to the health care entity shall be in a securely sealed envelope. 5. If no motion to quash is filed within 15 days of the date of the request or of the attorney-issued subpoena, the party on whose behalf the subpoena was issued shall have the duty to certify to the subpoenaed health care entity that the time for filing a motion to quash has elapsed and that no motion to quash was filed. Any health care entity receiving such certification shall have the duty to comply with the subpoena duces tecum by returning the specified health records by either the return date on the subpoena or five days after receipt of the certification, whichever is later. 6. In the event that the individual whose health records are being sought files a motion to quash the subpoena, the court or administrative agency shall decide whether good cause has been shown by the discovering party to compel disclosure of the individual's health records over the individual's objections. In determining whether good cause has been shown, the court or administrative agency shall consider (i) the particular purpose for which the information was collected; (ii) the degree to which the disclosure of the records would embarrass, injure, or invade the privacy of the individual; (iii) the effect of the disclosure on the individual's future health care; (iv) the importance of the information to the lawsuit or proceeding; and (v) any other relevant factor. 7. Concurrent with the court or administrative agency's resolution of a motion to quash, if subpoenaed health records have been submitted by a health care entity to the court or administrative agency in a sealed envelope, the court or administrative agency shall: (i) upon determining that no submitted health records should be disclosed, return all submitted health records to the health care entity in a sealed envelope; (ii) upon determining that all submitted health records should be disclosed, provide all the submitted health records to the party on whose behalf the subpoena was issued; or (iii) upon determining that only a portion of the submitted health records should be disclosed, provide such portion to the party on whose behalf the subpoena was issued and return the remaining health records to the health care entity in a sealed envelope. 8. Following the court or administrative agency's resolution of a motion to quash, the party on whose behalf the subpoena duces tecum was issued shall have the duty to certify in writing to the subpoenaed health care entity a statement of one of the following: a. All filed motions to quash have been resolved by the court or administrative agency and the disclosures sought in the subpoena duces tecum are consistent with such resolution; and, therefore, the health records previously delivered in a sealed envelope to the clerk of the court or administrative agency will not be returned to the health care entity; b. All filed motions to quash have been resolved by the court or administrative agency and the disclosures sought in the subpoena duces tecum are consistent with such resolution and that, since no health records have previously been delivered to the court or administrative agency by the health care entity, the health care entity shall comply with the subpoena duces tecum by returning the health records designated in the subpoena by the return date on the subpoena or five days after receipt of certification, whichever is later; c. All filed motions to quash have been resolved by the court or administrative agency and the disclosures sought in the subpoena duces tecum are not consistent with such resolution; therefore, no health records shall be disclosed and all health records previously delivered in a sealed envelope to the clerk of the court or administrative agency will be returned to the health care entity; d. All filed motions to quash have been resolved by the court or administrative agency and the disclosures sought in the subpoena duces tecum are not consistent with such resolution and that only limited disclosure has been authorized. The certification shall state that only the portion of the health records as set forth in the certification, consistent with the court or administrative agency's ruling, shall be disclosed. The certification shall also state that health records that were previously delivered to the court or administrative agency for which disclosure has been authorized will not be returned to the health care entity; however, all health records for which disclosure has not been authorized will be returned to the health care entity; or e. All filed motions to quash have been resolved by the court or administrative agency and the disclosures sought in the subpoena duces tecum are not consistent with such resolution and, since no health records have previously been delivered to the court or administrative agency by the health care entity, the health care entity shall return only those health records specified in the certification, consistent with the court or administrative agency's ruling, by the return date on the subpoena or five days after receipt of the certification, whichever is later. A copy of the court or administrative agency's ruling shall accompany any certification made pursuant to this subdivision. 9. The provisions of this subsection have no application to subpoenas for health records requested under §8.01-413, or issued by a duly authorized administrative agency conducting an investigation, audit, review or proceedings regarding a health care entity's conduct. The provisions of this subsection shall apply to subpoenas for the health records of both minors and adults. Nothing in this subsection shall have any effect on the existing authority of a court or administrative agency to issue a protective order regarding health records, including, but not limited to, ordering the return of health records to a health care entity, after the period for filing a motion to quash has passed. A subpoena for substance abuse records must conform to the requirements of federal law found in 42 C.F.R. Part 2, Subpart E. I. Health care entities may testify about the health records of an individual in compliance with §§8.01-399 and 8.01-400.2. J. If an individual requests a copy of his health record from a health care entity, the health care entity may impose a reasonable cost-based fee, which shall include only the cost of supplies for and labor of copying the requested information, postage when the individual requests that such information be mailed, and preparation of an explanation or summary of such information as agreed to by the individual. For the purposes of this section, "individual" shall subsume a person with authority to act on behalf of the individual who is the subject of the health record in making decisions related to his health care. K. Nothing in this section shall prohibit a health care provider who prescribes or dispenses a controlled substance required to be reported to the Prescription Monitoring Program established pursuant to Chapter 25.2 (§54.1-2519 et seq.) of Title 54.1 to a patient from disclosing information obtained from the Prescription Monitoring Program and contained in a patient's health care record to another health care provider when such disclosure is related to the care or treatment of the patient who is the subject of the record. |
