Administrative Code

Creating a Report: Check the sections you'd like to appear in the report, then use the "Create Report" button at the bottom of the page to generate your report. Once the report is generated you'll then have the option to download it as a pdf, print or email the report.

Virginia Administrative Code
Title 12. Health
Agency 5. Department of Health
Chapter 405. Rules Governing Private Review Agents

12VAC5-405-100. Access to and confidentiality of medical records and information.

A. Private review agents who have been granted a certificate by the department shall have reasonable access to patient-specific medical records and information.

B. The private review agent's procedures shall specify that specific information exchanged for the purpose of conducting review will be considered confidential, be used by the private review agent solely for the purposes of utilization review, and shared by the private review agent with only those parties who have authority to receive such information, such as the claim administrator. The private review agent's process shall specify that procedures are in place to assure confidentiality and that the private review agent agrees to abide by any federal and state laws governing the issue of confidentiality. Summary data which does not provide sufficient information to allow identification of individual patients or providers need not be considered confidential.

C. When consistent with subsection B of this section and federal and state statutes and regulations, patient-specific data gathered by the private review agent which raises questions of deficiencies in quality may be shared with the hospital's or other facility's Quality Assurance Committee. Prior to the sharing of such information, a private review agent may require the hospital or other facility to assure compliance with confidentiality requirements, to assure the appropriate review and follow-up within that hospital's or other facility's Quality Assurance Committee, and to indemnify the private review agent from inappropriate use of such information.

D. Chapter 6 (§ 38.2-600 et seq.) of Title 38.2 and § 32.1-127.1:03 of the Code of Virginia shall apply to private review agents. Prior to the release of patient-specific information to a private review agent, a patient shall provide written consent for the release of such information. If the patient will not authorize the release of information, or has refused to sign the release of information forms, the private review agent may then follow its own policy or that of the insurer regarding that refusal.

E. Medical records and patient-specific information shall be maintained by the private review agent in a secure area with access limited to essential personnel only.

F. Information generated and obtained by private review agents in the course of utilization review shall be retained for at least five years if the information relates to a case for which an adverse decision was made at any point or if the information relates to a case which may be reopened.

Statutory Authority

§§ 32.1-138.7 and 32.1-138.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 15, Issue 20, eff. July 21, 1999.

Website addresses provided in the Virginia Administrative Code to documents incorporated by reference are for the reader's convenience only, may not necessarily be active or current, and should not be relied upon. To ensure the information incorporated by reference is accurate, the reader is encouraged to use the source document described in the regulation.

As a service to the public, the Virginia Administrative Code is provided online by the Virginia General Assembly. We are unable to answer legal questions or respond to requests for legal advice, including application of law to specific fact. To understand and protect your legal rights, you should consult an attorney.