Virginia Provider-Based Hospital Outpatient Clinic Privacy Laws: A Guide

Virginia law protects health records kept by hospital outpatient clinics, while federal HIPAA rules and, in some cases, additional substance-use-disorder protections may also apply. The details can depend on the record, who is requesting or receiving it, and whether the clinic is part of a licensed hospital or an outpatient surgical hospital.

What Virginia privacy laws protect in outpatient clinic health records

Virginia Code § 32.1-127.1:03 recognizes a patient’s privacy in health records. The definition covers written, printed, or electronic information maintained while providing health services, as well as confidential communications and information acquired in connection with care. That can include clinical notes, test results, diagnoses, treatment information, and billing-related records.

The record is the property of the health care entity that maintains it, but the entity generally may not disclose it unless Virginia law or another applicable law permits or requires disclosure. Virginia law also requires specific written authorization for most disclosures of separately maintained psychotherapy notes, subject to listed exceptions.

HIPAA applies to covered entities and their business associates. It sets federal privacy protections and individual rights; Virginia law may provide additional protections or rights. When both laws apply, a clinic generally must follow the applicable requirements of both. See HHS guidance on HIPAA and state laws.

When may a hospital outpatient clinic disclose patient records?

A clinic may disclose records when the patient or an authorized representative gives the required authorization, or when a specific legal exception applies. Virginia law permits certain disclosures, for example, when necessary for a patient’s care, for health care operations, to third-party payors for reimbursement, and for specified public-health, safety, or reporting purposes. The statute also addresses certain subpoenas, warrants, and court orders; legal process must meet the applicable requirements.

Do not assume that every request from an insurer, employer, family member, or attorney allows unrestricted access. The clinic should confirm the requester’s authority, the purpose, and the scope of any permitted disclosure. For the full list of Virginia exceptions, consult Virginia Code § 32.1-127.1:03 and the applicable HIPAA Privacy Rule guidance.

How can patients request records and audit trails?

Submit a written, dated, and signed request to the clinic’s health information management or medical-records department. Under Virginia law, identify the information you want, show that you have authority to receive it, identify any person to whom it should be disclosed, and specify whether you want paper or electronic records. The clinic generally must respond within 30 days by providing the records or explaining that they do not exist, cannot be found, are maintained elsewhere, or cannot be disclosed.

You can specifically request a health record audit trail. Virginia law requires a health care entity, on the patient’s request, to provide an audit trail of additions, deletions, or revisions to the health record, subject to the law’s exceptions. Be precise: this right concerns changes to the record; it does not necessarily mean that you will receive a log of every person who viewed the record.

HIPAA separately provides a right to access information in a designated record set and, in defined circumstances, a right to receive an accounting of certain disclosures. An accounting is not the same as an electronic system access log, and HIPAA excludes some disclosures—such as many disclosures for treatment, payment, or health care operations. See HHS guidance on the right of access and HHS guidance on accountings of disclosures.

Virginia permits a reasonable, cost-based fee for copies in circumstances allowed by law. A clinic may deny or limit access in specified situations, including when a treating professional has documented that access would be reasonably likely to endanger someone’s life or physical safety or cause substantial harm to another person. Virginia law also excludes access to psychotherapy notes from this right. See Virginia’s access and fee provisions.

What limits apply to redisclosure of health records?

Virginia’s redisclosure authorization rule generally prohibits a recipient from revealing a patient’s records beyond the purpose for which they were disclosed unless the patient first gives specific authorization. A clinic that receives records from another health care entity may make further disclosures when those disclosures are permitted by Virginia law and HIPAA. Other statutory exceptions may also apply.

When you sign a release, check who may receive the records, what information may be shared, and the stated purpose. Virginia’s authorization provisions warn that information disclosed to a recipient may be redisclosed and may no longer receive the same protection it had while held by the original health care entity. Additional federal restrictions can apply to certain records, including records protected by 42 CFR Part 2.

How long must hospitals retain patient records?

Virginia’s hospital-licensure regulation requires a hospital to preserve medical records, or accurate reproductions, for at least five years after the patient’s discharge. For a minor, the record must be kept for at least five years after the minor reaches age 18. The regulation also specifies a 10-year retention period for birth and death information. See 12VAC5-410-1260.

HIPAA does not set a general retention period for patients’ medical records. It does require protection of the information for as long as it is maintained, and separate HIPAA documentation requirements may have their own retention rules. See HHS guidance on HIPAA and medical-record retention. Other laws, record types, or circumstances may require a longer period than the hospital’s general minimum.

What special rules apply to minors’ records and portal access?

Virginia law allows a minor to consent to certain services and to access or authorize disclosure of records related to those services. The categories include specified sexually transmitted or reportable infectious-disease care, birth control, pregnancy or family planning, outpatient substance-use-disorder care, and outpatient mental-health care. A parent or guardian may generally access a minor’s other health records, but a treating professional may withhold records when disclosure is reasonably likely to cause substantial harm to the minor or another person. See Virginia Code § 54.1-2969.

Portal access should reflect these distinctions. Virginia’s specific secure-website rule applies to an outpatient surgical hospital that makes minors’ records available online: it must make records available to a parent or guardian through the site unless it cannot do so in a way that prevents disclosure of information withheld under Virginia law or the required minor consent has not been provided. This is not a blanket portal rule for every provider-based outpatient department. See 12VAC5-410-1260(D).

How do HIPAA and substance-use-disorder confidentiality rules apply?

HIPAA governs protected health information held by covered entities and their business associates. It generally permits certain uses and disclosures without a separate patient authorization, including for treatment, payment, and health care operations, while also giving patients rights to access and seek amendment of information in a designated record set. Virginia law independently identifies permitted disclosures and may provide additional protections. A clinic should assess both laws rather than treating HIPAA as the only applicable rule.

42 CFR Part 2 provides additional federal confidentiality protections for qualifying substance-use-disorder records created or held by federally assisted programs that provide services such as diagnosis, treatment, or referral for treatment. The rules do not automatically cover every record that mentions substance use. Under the updated rule, a patient may give a single consent for future treatment, payment, and health care operations disclosures; a recipient subject to HIPAA may then redisclose the records as HIPAA permits, except for use in legal proceedings against the patient. Part 2 imposes additional restrictions and contains limited exceptions, so clinics should confirm whether the particular record is covered. The updated requirements took effect on April 16, 2024, with compliance required by February 16, 2026. See HHS’s current overview of 42 CFR Part 2.

In summary, Virginia law protects outpatient health records, gives patients a specific right to request a record-change audit trail, limits redisclosure, and sets hospital retention minimums. HIPAA and Part 2 may add separate rights or restrictions, while minor consent and portal rules depend on the service and facility type.

FAQs

Can patients request an audit trail of changes to their health records?

Yes. Virginia law requires a health care entity to provide the patient, upon specific request, an audit trail of additions, deletions, or revisions to the health record, subject to legal exceptions. This is distinct from a log showing every person who accessed the record.

How long must a Virginia hospital retain outpatient records?

Under Virginia’s hospital-licensure regulation, a hospital must preserve medical records for at least five years after discharge. For a minor, the minimum is at least five years after the minor reaches age 18. Other requirements or circumstances may call for longer retention.

Can a clinic redisclose records it received from another provider?

Sometimes. A health care entity may make further disclosures when they are permitted by Virginia law and HIPAA. Other recipients generally may not disclose the records beyond the original purpose without the patient’s specific authorization, unless an exception applies. Records protected by 42 CFR Part 2 may have additional restrictions.

Do special confidentiality rules apply to substance-use-disorder records?

Yes, when the records qualify for protection under 42 CFR Part 2. These rules restrict disclosure and use, including use in legal proceedings against a patient. A single patient consent may authorize future treatment, payment, and health care operations disclosures, but the scope and limits of Part 2 still matter.