LIS Logo

Virginia Law

Administrative Code

Creating a Report: Check the sections you'd like to appear in the report, then use the "Create Report" button at the bottom of the page to generate your report. Once the report is generated you'll then have the option to download it as a pdf, print or email the report.

Virginia Administrative Code
Title 12. Health
Agency 5. Department of Health
Chapter 115. Virginia Immunization Information System
8/24/2026

12VAC5-115-40. Patient confidentiality.

A. A participant may only access individual immunization information within VIIS that is required to perform the participant's job function.

B. No participant may conduct any activity that jeopardizes the proper function or security of VIIS, including sharing of sign-on information, allowing unauthorized view of VIIS screens, or failing to log off VIIS when leaving a workstation. A participant may only use VIIS patient-level data for a purpose listed in § 32.1-46.01 A of the Code of Virginia and must immediately notify the patient and VDH of any breach of personal privacy or confidentiality.

C. No employer may access an employee's patient-level data in VIIS for the purpose of determining if the employee is in compliance with the employer's immunization policies.

D. A patient may opt out of VIIS by completing the electronic VDH Opt-Out Form specifying the patient's opt-out preferences.

E. Patient immunization records may not be copied except for authorized use. The copies may not be left where they are visible by unauthorized personnel and shall be shredded, pulped, or incinerated before disposal.

F. VIIS records shall be treated with the same confidentiality and privacy as any other health record. VDH shall immediately suspend a participant's system access privileges for inappropriate use of VIIS records and shall conduct an investigation. VDH may take additional actions pursuant to § 32.1-27 of the Code of Virginia. The VIIS program manager may reinstate privileges.

G. Nothing in this chapter alters the provision in 45 CFR Part 164 that permits covered health care entities to disclose protected health information to a public health authority without individual authorization.

Statutory Authority

§ 32.1-46.01 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 31, Issue 22, eff. July 31, 2015; amended, Virginia Register Volume 42, Issue 22, eff. August 13, 2026.

Website addresses provided in the Virginia Administrative Code to documents incorporated by reference are for the reader's convenience only, may not necessarily be active or current, and should not be relied upon. To ensure the information incorporated by reference is accurate, the reader is encouraged to use the source document described in the regulation.

As a service to the public, the Virginia Administrative Code is provided online by the Virginia General Assembly. We are unable to answer legal questions or respond to requests for legal advice, including application of law to specific fact. To understand and protect your legal rights, you should consult an attorney.