Health record rights in Virginia: what state law adds
In Virginia, as of October 3, 2026, your OK is needed before at least some businesses outside HIPAA share your health data; you get a free copy of your record in some cases; the health information exchange offers no general choice; reproductive health, mental health, HIV and genetic records each have a specific confidentiality rule; you can sue only in a narrow case; breach notices must cover medical and health insurance information; and we found no law on AI in care. Each answer below quotes, dates and links the law. There is no state total and no state rank.
Laws read · page updated
Not legal advice. This records what the law said on the date we read it. Laws and court orders change. Read the law itself, or ask a lawyer, before you rely on it. State laws add to the federal floor. The national score rates federal law and national infrastructure and does not change with these state profiles.
Can you sue if your records are misused?Only in a narrow case, such as a data breach or one kind of record. The laws below say which. Same answer in 31 of the 50 states, counting this one.
Federal law, mainly HIPAA, applies in every state; our US page explains it in plain English. Each answer below says what this state adds on top, with the law's name, citation, effective date, the words that matter and a link to the official page.
Do apps and wearables need your OK before sharing health data?
Federal floor: HIPAA does not cover most apps, wearables, websites or data brokers.
Yes, at least for some businesses. A law in force requires your OK before they use or share your health data (opt-in).
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
VCDPA requires opt-in consent for sensitive data, including health diagnosis. The VCPA requires consent for reproductive or sexual health data. No dedicated general consumer health data law with a separate sale authorization found. Effective dates use Va. Const. art. IV, § 13 July 1 default.
Consumer Data Protection Act, data controller responsibilities. Va. Code § 59.1-578(A)(5)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Not process sensitive data concerning a consumer without obtaining the consumer's consent
Who it binds, in our words: control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data (§ 59.1-576(A))
Consumer Data Protection Act, definition of sensitive data. Va. Code § 59.1-575
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status
Who it binds, in our words: Same thresholds as § 59.1-576(A).
Consumer Protection Act, prohibited practices, reproductive or sexual health information. Va. Code § 59.1-200(A)(85)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer.
Who it binds, in our words: Acts committed by a supplier in connection with a consumer transaction. Does not apply to nonpublic personal information subject to the federal Gramm-Leach-Bliley Act.
Genetic Data Privacy, express consent required. Va. Code § 59.1-596(B)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Every direct-to-consumer genetic testing company shall obtain a consumer's express consent for the collection, use, and disclosure of the consumer's genetic data
Who it binds, in our words: Direct-to-consumer genetic testing companies only.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Do you get a copy faster or free in some cases?
Federal floor: HIPAA gives the provider 30 days, plus one 30-day extension, and allows a cost-based fee. We also count the federal information blocking rule (45 CFR Part 171).
In one way: a free copy in at least one case.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Deadline is 30 days, equal to HIPAA. A free yearly EHR copy for Social Security and benefit claims goes beyond the federal floor, since federal law allows a cost-based fee for such copies.
Deadline in the law: 30 days (not shorter than HIPAA's 30).
Free copy: One free copy of EHR records per calendar year for a patient or the patient's attorney supporting a claim or appeal under Social Security Act Titles II, XVI, XVIII or XIX, 38 U.S.C. § 101 et seq., or a federal or state needs-based benefit program (§ 8.01-413(B7))
Fee rule: Patient's own request: reasonable cost-based fee limited to supplies and labor of copying, postage, and an agreed summary (§ 32.1-127.1:03(J))
Fee rule: Other requesters, paper: $0.25 per page after the first pages, $1 per page from microfilm, search and handling fee up to $20, plus postage (§ 8.01-413(B2))
Fee rule: Other requesters, electronic: $0.18 per page after the first pages, search and handling up to $20, total capped at $160 per request (§ 8.01-413(B3))
Fee rule: Imaging produced electronically: up to $25 per study plus up to $10 search and handling (§ 8.01-413)
Fee rule: Account balance or itemized charges supplied at no cost up to three times every 12 months (§ 8.01-413)
Goes beyond the federal floor: yes.
Free copy for benefits claims. Va. Code § 8.01-413(B7)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
A health care provider shall provide one free copy of a patient's medical records stored or maintained in an electronic health record (EHR) per calendar year if requested by a patient or his attorney for the purpose of supporting a claim or appeal under Title II, XVI, XVIII, or XIX
Who it binds, in our words: Health care providers; records stored or maintained in an EHR; request supported by documentation of the claim or appeal.
Health records privacy, response deadline. Va. Code § 32.1-127.1:03(E)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Within 30 days of receipt of a request for copies of or electronic access to health records, the health care entity shall do one of the following
Who it binds, in our words: Health care entities.
Health records privacy, patient fee rule. Va. Code § 32.1-127.1:03(J)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
if an individual requests a copy of his health record from a health care entity, the health care entity may impose a reasonable cost-based fee, which shall include only the cost of supplies for and labor of copying the requested information
Who it binds, in our words: Health care entities; individual includes a person with authority to act on the individual's behalf.
Second check by a separate agent: confirmed.
Can you say no to sharing through a health information exchange (a network that passes records between doctors)?
Federal floor: HIPAA lets providers share records for treatment without asking you.
No general choice. Sharing through the exchange follows HIPAA's rules, and no state rule or exchange policy offers a general choice.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Statute lets entities disclose to an HIE without authorization. No state rule or published VHI policy offering a general choice found. Some providers offer their own HIE opt-out forms. Sensitive-category rule not determined.
Set by state law.
Designated exchange: Virginia Health Information (statewide HIE, formerly ConnectVirginia).
Health records privacy, disclosure to health information exchange. Va. Code § 32.1-127.1:03(D)(37)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
To an electronic health information exchange or network for the purpose of meeting the requirements of the federal 21st Century Cures Act, P.L. 114-255, and its related federal regulations.
Who it binds, in our words: Health care entities.
Second check by a separate agent: confirmed.
Are some sensitive records, like mental health or HIV, given extra rules?
These answers record whether a rule exists and what it says. They say nothing about whether any care is legal or available.
Reproductive health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
The Consumer Protection Act requires consumer consent to obtain or disclose reproductive or sexual health information. The 2026 Health Care Protection Act covers all lawful health care and was not scored here.
Consumer Protection Act, prohibited practices, reproductive or sexual health information. Va. Code § 59.1-200(A)(85)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer.
Who it binds, in our words: Suppliers in connection with a consumer transaction; excludes data subject to the Gramm-Leach-Bliley Act.
Second check by a separate agent: confirmed.
Mental health records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
State statute requires written authorization to disclose psychotherapy notes, with listed exceptions.
Health records privacy, psychotherapy notes. Va. Code § 32.1-127.1:03(D)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
a health care entity shall obtain an individual's written authorization for any disclosure of psychotherapy notes
Who it binds, in our words: Health care entities, with listed exceptions such as supervised mental health training programs.
Second check by a separate agent: confirmed.
HIV records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
HIV test results are confidential by statute. Release only to persons permitted to obtain protected health information under law.
Confidentiality of test for human immunodeficiency virus. Va. Code § 32.1-36.1(A)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
The results of every test to determine infection with human immunodeficiency virus shall be confidential. Such information may be released only to persons or entities permitted or authorized to obtain protected health information under any applicable federal or state law.
Who it binds, in our words: Results of every HIV test.
Second check by a separate agent: confirmed.
Genetic records
Yes. A law in force has a specific rule on keeping these records confidential or on who may see them.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Two statutes: express consent for direct-to-consumer genetic testing disclosures (2023), and a health insurance genetic information confidentiality rule (1996).
Genetic Data Privacy, certain disclosures of genetic data prohibited. Va. Code § 59.1-599
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
No direct-to-consumer genetic testing company shall disclose a consumer's genetic data to any entity that is responsible for administering or making decisions regarding health insurance, life insurance, long-term care insurance, disability insurance, or employment
Who it binds, in our words: Direct-to-consumer genetic testing companies; disclosure allowed with the consumer's express consent.
Genetic information privacy (health insurance). Va. Code § 38.2-508.4(C)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
all information obtained from genetic screening or testing conducted prior to the repeal of this section shall be confidential and shall not be made public
Who it binds, in our words: Insurers, health services plans and HMOs issuing accident and sickness coverage, excluding disability income insurance.
Second check by a separate agent: confirmed.
Can you sue if your records are misused?
Only in a narrow case, such as a data breach or one kind of record. The laws below say which.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Private actions exist only for narrow categories: reproductive or sexual health data via the VCPA, and HIV test results. VCDPA and Genetic Data Privacy are Attorney General only.
Damages a court may award: VCPA: actual damages or $500, whichever is greater; if willful, up to three times actual damages or $1,000. HIV test results: actual damages or $100, whichever is greater, plus possible attorney's fees.
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Any person who suffers loss as the result of a violation of this chapter shall be entitled to initiate an action to recover actual damages, or $500, whichever is greater.
Who it binds, in our words: Violations of the Consumer Protection Act, including § 59.1-200(A)(85) on reproductive or sexual health information.
Consumer Protection Act, reproductive or sexual health information. Va. Code § 59.1-200(A)(85)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer.
Who it binds, in our words: Suppliers in connection with a consumer transaction.
HIV test confidentiality, individual action. Va. Code § 32.1-36.1(C)
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Any person who is the subject of an unauthorized disclosure pursuant to this section shall be entitled to initiate an action to recover actual damages, if any, or $100, whichever is greater.
Who it binds, in our words: Unauthorized disclosure of HIV test results.
Consumer Data Protection Act, enforcement. Va. Code § 59.1-584
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations of this chapter or under any other law
Who it binds, in our words: Consumer Data Protection Act; Attorney General has exclusive authority.
Second check by a separate agent: disputed, then settled by a ruling drafted by an agent against the law's text and approved by the authors on October 3, 2026.
Must you be told if health data leaks in a breach?
Yes. The breach notice law covers both medical information and health insurance information.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
Medical breach law covers both elements but binds only public bodies and publicly funded entities. Notice goes to the Attorney General and Commissioner of Health. HIPAA entities are excluded. Effective date from Acts 2010, c. 852, cl. 2.
Deadline to tell people: without unreasonable delay.
The attorney general or a regulator must also be told.
A business that follows HIPAA's breach rules is treated as following this law.
Breach of medical information notification. Va. Code § 32.1-127.1:05
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Any information regarding an individual's medical or mental health history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or 2. An individual's health insurance policy number or subscriber identification number
Who it binds, in our words: "Entity" means public bodies of the Commonwealth and its political subdivisions and "other organizations, corporations, or agencies in the Commonwealth supported wholly or principally by public funds." Does not apply to HIPAA covered entities or business associates subject to federal breach notification.
Breach of personal information notification. Va. Code § 18.2-186.6
In force · effective · read October 3, 2026 · source(law.lis.virginia.gov)
Social security number; 2. Driver's license number or state identification card number issued in lieu of a driver's license number; 3. Financial account number, or credit card or debit card number
Who it binds, in our words: General breach law; its personal information definition does not list medical or health insurance information.
Second check by a separate agent: confirmed.
Are there rules for AI used in your care?
The three rules we look for: you must be told when AI is used in your care; a licensed clinician decides, not AI alone; you can reach a human, or have a human review the decision. Each counts only if the law names health care or health coverage.
No law found We searched the official code and found none.
The researcher's note
Written by the research agent for our records, in the rulebook's shorthand. The answer above is the plain version.
AI code sections found cover criminal justice and education only. HB 2094 (2025) was vetoed. SB 586 and SB 269 (2026) were continued to 2027.
These public figures describe conditions that can affect whether people are able to use the rights above, such as health insurance and internet at home. They are not scored, not part of any answer, and not a reason for any answer. Each is the latest the source publishes for the state, checked against the publisher (the Census Bureau or the Bureau of Labor Statistics); grouped under the Healthy People 2030 social determinants of health.
Source and period on every row. Figures from DataSpine, each checked against its publisher. Not scored.
Figure
Value
Source and period
People under 65 without health insuranceHealth care access and quality
8.1%
Small Area Health Insurance Estimates, SAHIE 2024 (single-year model estimate)
Households with a computerHealth care access and quality
94.0%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a broadband internet subscriptionHealth care access and quality
88.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households with a smartphone and no other computerHealth care access and quality
7.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Median household incomeEconomic stability
$87,249 (2022 dollars)
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Unemployment rateEconomic stability
3.6%
Local Area Unemployment Statistics, December 2025, monthly, seasonally adjusted
Households without a vehicleNeighborhood and built environment
6.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
People who speak a language other than English at homeSocial and community context
16.7%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Households of one person aged 65 or overSocial and community context
11.1%
American Community Survey 5-year, ACS 5-year, 2018 to 2022
Not shown: the number of people below the poverty line and the number with a bachelor's degree, which are available only as counts, and counts do not compare across states of different size.
Not shown yet, with no checked state figure: Medicare members who also have Medicaid; Medicaid enrollment; primary care supply; social vulnerability, income and jobs; people in nonmetro counties; social vulnerability, housing and transport; social vulnerability, household and minority themes.
Also recorded: a data broker registry
A fact, not part of any answer above. No law found We found no data broker registry law.
Another state
This study covers the 50 states and Washington, DC. It does not cover the US territories (Puerto Rico, Guam, the US Virgin Islands, the Northern Mariana Islands and American Samoa).
Built by SuperTruth, which checks whether a record can be trusted before an AI acts on it. About SuperTruth · How we used AI
Health Record Rights Index by SuperTruth. Research by AI agents built on Anthropic's Claude, checked by a second agent and ruled by the authors; how we did it. Research tool, not legal advice. Text CC BY 4.0.
