Virginia Privacy Laws for Blood Bank Software Vendors: A Compliance Guide

Blood bank software may handle donor records, test results, health records, and information that identifies Virginia residents. Which rules apply depends on what information the system handles, who the vendor serves, and whether the vendor acts as a HIPAA business associate, a Virginia Consumer Data Protection Act (VCDPA) processor, or both.

This guide summarizes the main Virginia and federal requirements vendors should evaluate. It is general information, not legal advice; assess your specific services, data flows, and customer arrangements with qualified counsel.

Which Virginia privacy laws apply to blood bank software vendors?

Several laws may be relevant, but they do not apply identically to every vendor or every data set:

• The Virginia Consumer Data Protection Act: The VCDPA generally covers a person doing business in Virginia or targeting its residents if, in a calendar year, the person controls or processes personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data. It excludes certain entities and information, including HIPAA-covered entities and business associates and specified health information. Review the Act’s scope and exemptions.
• Virginia health-records privacy law: Virginia recognizes privacy in health records and restricts disclosure and further disclosure, subject to statutory permissions and exceptions. Check whether the records and the vendor’s role fall within Virginia Code § 32.1-127.1:03.
• The Virginia breach notification statute: Virginia Code § 18.2-186.6 addresses certain breaches of narrowly defined personal information, not every exposure of health data. Its trigger and response duties are discussed below. See the Virginia breach notification statute.
• HIV-test confidentiality: Virginia law makes HIV test results confidential and limits release to persons or entities permitted or authorized under applicable federal or state law. See Virginia Code § 32.1-36.1.
• Genetic data privacy: Virginia’s Genetic Data Privacy Act focuses on direct-to-consumer genetic testing companies and certain service providers. It does not automatically apply to every blood bank software vendor merely because the system contains blood-related information. Review the Act’s definitions, exclusions, and requirements.

A vendor may face different requirements for different activities. For example, hosting protected health information (PHI) for a covered blood bank can create HIPAA business-associate duties, while the vendor’s separate consumer-facing service or other non-exempt processing may require a distinct VCDPA analysis.

How does the Virginia Consumer Data Protection Act apply to health data?

The VCDPA defines sensitive data to include personal data revealing a physical or mental health diagnosis, as well as genetic or biometric data processed for the purpose of uniquely identifying a person. A controller generally may not process sensitive data without the consumer’s consent, subject to statutory exceptions. The Act also requires controllers to limit collection to what is reasonably necessary for disclosed purposes and maintain reasonable administrative, technical, and physical data-security practices. See Virginia’s Consumer Data Protection Act.

The phrase “consumer health data” is sometimes used broadly, but it is not a blanket label that makes every health-related datum subject to the same VCDPA treatment. The statutory definition matters. For example, a blood type or donor record may be personal data and may be protected as a health record or PHI in context; whether it is VCDPA sensitive data depends on the facts and statutory definitions. Genetic or biometric data falls into the VCDPA sensitive-data category when it is processed to uniquely identify a person.

Covered businesses must also consider whether they are controllers or processors for each activity. A vendor processing data only on a customer’s documented instructions may be a processor; a vendor deciding its own purposes for data use may be a controller for that activity. A processor must follow controller instructions and assist with matters such as consumer requests, security, breach response, and data protection assessments. The VCDPA’s role-based requirements address these duties.

When a controller processes sensitive data or engages in certain other higher-risk activities, it must conduct and document a data protection assessment. The assessment must weigh benefits against risks to consumers and consider available safeguards. A vendor acting only as a processor should provide information and assistance that lets its customer meet the customer’s assessment duties; a vendor may have its own controller obligations when it determines the purposes and means of separate processing. See Virginia’s data protection assessment provision.

When does HIPAA govern blood bank software and business associates?

HIPAA applies to covered entities—health plans, health care clearinghouses, and health care providers that conduct certain standard electronic transactions—and to their business associates. A blood bank or collection organization must assess whether it meets a covered-entity definition; the fact that an organization handles blood or health information alone does not settle that question.

A software vendor generally becomes a business associate when it performs a service for a covered entity that involves creating, receiving, maintaining, or transmitting PHI on the entity’s behalf. Hosting PHI, maintaining a database, or accessing records to troubleshoot a system can qualify. By contrast, merely selling software without access to the customer’s PHI does not, by itself, make the vendor a business associate. HHS explains these distinctions in its guidance on whether a software vendor is a business associate and HIPAA and cloud computing.

PHI is individually identifiable health information created, received, maintained, or transmitted by a covered entity or business associate in the regulated context. HIPAA is not a general federal privacy law for every organization or every health-related data set. A vendor should identify which services involve PHI, which customers are covered entities or business associates, and whether any subcontractors handle PHI on the vendor’s behalf.

Where the vendor is a business associate, it must enter into a HIPAA business associate agreement (BAA) before handling PHI on the customer’s behalf. A subcontractor that creates, receives, maintains, or transmits PHI for a business associate may also be a business associate and needs the required downstream agreement. HHS provides the required elements in its guidance on business associate contract provisions.

What security safeguards and breach notification duties apply?

For electronic PHI (ePHI), HIPAA’s Security Rule requires administrative, physical, and technical safeguards. Business associates must address security risks, control appropriate access, protect systems and data, and respond to security incidents. The Rule calls for a risk analysis and reasonable, appropriate measures based on the organization and its environment; it does not prescribe a single security setup for every vendor. HHS describes the Security Rule risk-analysis requirement.

Under HIPAA’s Breach Notification Rule, a business associate that discovers a breach of unsecured PHI must notify the covered entity without unreasonable delay and no later than 60 days after discovery. The business associate’s notice should include available details needed by the covered entity, including the identities of affected individuals when known. The covered entity generally carries the duty to notify affected individuals, HHS, and, in some circumstances, the media, though the parties may arrange for the business associate to perform notification tasks on the covered entity’s behalf. See HHS breach notification guidance.

Virginia’s breach notification statute has a different and narrower trigger. It generally concerns unauthorized access and acquisition of unencrypted and unredacted computerized data that compromises defined personal information and causes, or is reasonably believed to cause, identity theft or other fraud. The statute’s definition of personal information includes a person’s name together with specified identifiers, such as a Social Security number, driver’s license number, or certain financial-account details. Health information alone is not listed as one of those identifiers. Review the precise statutory breach definition and notice duties.

An entity that maintains computerized data it does not own or license must notify the owner or licensee of a qualifying breach without unreasonable delay. The owner or licensee may have to notify affected Virginia residents and the Attorney General, also without unreasonable delay. If notice is provided to more than 1,000 people at one time, the statute requires notice to the Attorney General and nationwide consumer reporting agencies about the timing, distribution, and content of the notice. Virginia’s statute states no universal 60-day deadline; that number is HIPAA’s outside deadline for a business associate’s HIPAA breach notice to its covered-entity customer, not a general Virginia deadline.

In practice, vendors should promptly contain and investigate incidents, preserve relevant evidence, determine what data and residents may be involved, and notify customers under the applicable contract and law. Contractual reporting deadlines are often shorter than HIPAA’s outside limit so customers have time to assess and meet their own duties.

How should vendors handle genetic, HIV, and other sensitive health information?

Start by classifying the data and the activity rather than assuming that all blood-related information is legally identical. A blood type, an infectious-disease screening result, an HIV test result, and a genomic result may trigger different protections depending on how the information was obtained, who holds it, and why it is being used.

Virginia law makes the results of every HIV test confidential and permits release only to persons or entities authorized under applicable federal or state law. Vendors supporting a blood collection agency should use access controls and customer instructions that prevent unauthorized disclosure and should not independently release results simply because they operate the software. Virginia law separately states that a blood collection agency need not provide the individual face-to-face disclosure opportunity otherwise described for confirmed positive results, but must notify the Board of Health of positive tests. See § 32.1-36.1 and § 32.1-37.2.

Virginia’s Genetic Data Privacy Act defines genetic data in relation to analysis of a biological sample or another element that enables equivalent genetic information to be obtained. The law focuses on direct-to-consumer genetic testing companies and provides exclusions, including specified HIPAA-regulated data and certain disease-diagnostic tests where those involved maintain, use, and disclose genetic data in the same manner as PHI. A blood bank software vendor should not assume it is covered—or exempt—without checking its role, service, and the applicable exclusion. See Virginia’s Genetic Data Privacy Act.

When a vendor contracts with a direct-to-consumer genetic testing company as a covered service provider under that Act, the contract must limit use, retention, and disclosure of samples and genetic data to the specified services and prohibit certain commercial uses and combinations with other information. Those requirements apply to the covered relationships described by the statute, not automatically to every software contract involving blood data.

For all sensitive records, vendors should limit workforce access to assigned duties, keep data separated by customer and purpose where appropriate, log access and changes, and prohibit secondary use unless authorized by the customer and permitted by law. These are practical safeguards; the specific legal obligations depend on the law governing the data and the vendor’s role.

What should blood banks include in vendor contracts and data processing agreements?

Use contracts that identify the data, the parties’ legal roles, and the permitted processing. A HIPAA BAA and a VCDPA processor contract serve related but distinct functions; where both laws apply, one agreement may address both if it includes all required terms.

• Define services and instructions: Specify the service, processing purpose, data types, duration, allowed uses and disclosures, and the parties’ responsibilities. Prohibit using PHI or other customer data for unrelated purposes unless legally permitted and contractually authorized.
• Set security and confidentiality obligations: Require appropriate safeguards, workforce confidentiality, access controls, incident response, and documentation. Make clear how the vendor will report suspected incidents and confirmed breaches.
• Set incident timelines and cooperation duties: Choose a prompt contractual reporting deadline that gives the blood bank time to investigate and meet applicable notification duties. Require cooperation with impact analysis, affected-person identification, remediation, and notices.
• Control subcontractors: Require prior authorization or another agreed process for subcontractors that handle regulated data, and require written flow-down terms. HIPAA requires applicable protections to extend to business-associate subcontractors; the VCDPA processor contract also requires written subcontractor obligations.
• Address consumer and patient requests: Set procedures for access, correction, deletion, portability, and other requests as applicable, while recognizing that the controller or covered entity remains responsible for determining the proper response.
• Plan for termination and retention: Specify how data will be returned or deleted at the end of service, how backups are handled, and which records must be retained by law. HIPAA BAA provisions require return or destruction of PHI when feasible at termination.
• Provide compliance information: Describe reasonable cooperation with customer assessments and inquiries. The VCDPA processor contract requires the processor to provide information needed to demonstrate compliance and to permit or cooperate with reasonable assessments. HIPAA does not itself mandate that every cloud vendor provide customer audits, but customers may request appropriate assurances based on their risk analysis.

For VCDPA processing, Virginia law requires the controller-processor contract to address processing instructions, the nature and purpose of processing, data types, duration, and each party’s rights and obligations. It also requires confidentiality, return or deletion at the controller’s direction subject to legal retention, compliance information, reasonable assessments, and written subcontractor terms. See Virginia Code § 59.1-579. For HIPAA, compare the contract against HHS’s BAA requirements.

What exemptions and compliance limitations should vendors assess?

Exemptions are specific; they do not mean every vendor or all of its data is outside privacy law.

• VCDPA entity and data exemptions: The Act excludes certain entities, including a HIPAA-governed covered entity or business associate, and separately exempts specified categories of information such as PHI under HIPAA and Virginia health records. Identify the vendor’s status and assess each data set instead of assuming all information it handles is exempt.
• Scope thresholds: A vendor should test the VCDPA’s consumer and revenue thresholds, including when it processes data on behalf of customers. If the vendor determines purposes of a separate use, analyze whether it acts as a controller for that activity.
• Genetic-law exclusions: Virginia’s Genetic Data Privacy Act excludes certain HIPAA-regulated information and specified research, newborn-screening, and disease-diagnostic activities. The exclusion is limited to the circumstances described by the statute.
• Separate statutory duties: HIPAA status does not automatically erase obligations under Virginia HIV confidentiality law or other laws. Likewise, a VCDPA exemption does not automatically remove duties that apply under HIPAA, Virginia health-records law, or a contract.
• Data covered by the breach statute: A breach of health information may require action under HIPAA or other rules even when the information does not meet Virginia’s narrower definition of personal information for its breach notification statute.

Bottom line: Map each data flow, determine the vendor’s role, and match each record type to the law that actually governs it. Then document the analysis in security procedures and contracts that make incident response, permitted use, and customer cooperation clear.

FAQs

Does Virginia’s Consumer Data Protection Act apply to blood bank software vendors?

It may. The VCDPA’s thresholds and entity exemptions matter, as do the vendor’s role and the data involved. A HIPAA-governed business associate is among the entities excluded by the Act, and specified categories such as HIPAA PHI and Virginia health records are exempt data. A vendor should separately assess non-exempt activities and data rather than assume that all its processing is covered or exempt.

When is a blood bank software provider a HIPAA business associate?

Generally, when it provides a service to a HIPAA covered entity that involves creating, receiving, maintaining, or transmitting PHI on the entity’s behalf—for example, hosting patient records or accessing them to troubleshoot the service. Simply selling software without access to PHI does not, by itself, create a business-associate relationship. A business associate must have the appropriate BAA and ensure applicable subcontractors are covered by required agreements.

What must a vendor do after a breach of Virginia residents’ personal information?

First determine whether the incident meets Virginia’s statutory definition, including whether the specified unencrypted or unredacted identifiers were accessed and acquired and whether the statute’s identity-theft-or-fraud condition is met. A vendor maintaining data it does not own or license must notify the owner or licensee without unreasonable delay after discovering a qualifying breach. The owner or licensee may have to notify affected residents and the Attorney General. If HIPAA also applies, a business associate must notify its covered-entity customer without unreasonable delay and no later than 60 days after discovery of a breach of unsecured PHI.

Are blood type and genetic data subject to additional privacy protections?

They can be, depending on context. A blood type may be personal information or part of a health record or PHI, but that does not automatically make it genetic data. Virginia’s VCDPA treats genetic data as sensitive when processed to uniquely identify a person, and Virginia’s Genetic Data Privacy Act applies to specified direct-to-consumer genetic testing relationships with defined exclusions. HIV test results have a separate Virginia confidentiality protection.