Virginia Law

A. Private review agents who have been granted a certificate by the department shall have reasonable access to patient-specific medical records and information.

B. The private review agent's procedures shall specify that specific information exchanged for the purpose of conducting review will be considered confidential, be used by the private review agent solely for the purposes of utilization review, and shared by the private review agent with only those parties who have authority to receive such information, such as the claim administrator. The private review agent's process shall specify that procedures are in place to assure confidentiality and that the private review agent agrees to abide by any federal and state laws governing the issue of confidentiality. Summary data which does not provide sufficient information to allow identification of individual patients or providers need not be considered confidential.

C. When consistent with subsection B of this section and federal and state statutes and regulations, patient-specific data gathered by the private review agent which raises questions of deficiencies in quality may be shared with the hospital's or other facility's Quality Assurance Committee. Prior to the sharing of such information, a private review agent may require the hospital or other facility to assure compliance with confidentiality requirements, to assure the appropriate review and follow-up within that hospital's or other facility's Quality Assurance Committee, and to indemnify the private review agent from inappropriate use of such information.

D. Chapter 6 (§ 38.2-600 et seq.) of Title 38.2 and § 32.1-127.1:03 of the Code of Virginia shall apply to private review agents. Prior to the release of patient-specific information to a private review agent, a patient shall provide written consent for the release of such information. If the patient will not authorize the release of information, or has refused to sign the release of information forms, the private review agent may then follow its own policy or that of the insurer regarding that refusal.

E. Medical records and patient-specific information shall be maintained by the private review agent in a secure area with access limited to essential personnel only.

F. Information generated and obtained by private review agents in the course of utilization review shall be retained for at least five years if the information relates to a case for which an adverse decision was made at any point or if the information relates to a case which may be reopened.