78341738.2-613Virginia Decodedhttps://vacode.org2016InsuranceInsurance Information And Privacy ProtectionDisclosure limitations and conditions1981, c. 389, § 38.1-57.16; 1986, c. 562; 1987, c. 325; 1996, c. 704; 2001, c. 371.http://law.lis.virginia.gov/vacode/38.2-613/38.2-608Access to recorded personal information/38.2-608/38.2-609Correction, amendment, or deletion of recorded personal information/38.2-609/38.2-612.1Special requirements for providing financial information to nonaffiliated third parties/38.2-612.1//38.2-613/38.2/6/38.2-61338.2-60438.2-604.138.2-612.138.2-61738.2-62052-41An insurance institution, agent, or insurance-support organization shall not disclose any medical-record information or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is with the written authorization of the individual, provided:sectionAA1 If the authorization is submitted by another insurance institution, agent, or insurance-support organization, the authorization meets the requirements of § 38.2-606; orsectionA1A12 If the authorization is submitted by a person other than an insurance institution, agent, or insurance-support organization, the authorization is:
sectionA2A22 Signed by the individual, andsectionA2bA2b3 Obtained two years or less prior to the date a disclosure is sought pursuant to this subdivision.sectionA2cA2c3Notwithstanding the provisions of subsection A of this section, an insurance institution, agent, or insurance-support organization may disclose personal or privileged information about an individual collected or received in connection with an insurance transaction, without written authorization, if the disclosure is:sectionBB1 To a person other than an insurance institution, agent, or insurance-support organization, provided the disclosure is reasonably necessary:
sectionB1B12 Would otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization; orsectionB1a(1B1a(14 Is reasonably necessary for that person to perform its function for the disclosing insurance institution, agent, or insurance-support organization; orsectionB1a(2B1a(24 To enable that person to provide information to the disclosing insurance institution, agent, or insurance-support organization for the purpose of:
sectionB1bB1b3 Detecting or preventing criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with an insurance transaction; orsectionB1b(2B1b(24 To an insurance institution, agent, or insurance-support organization, or self-insurer, provided the information disclosed is limited to that which is reasonably necessary:
sectionB2B22 To detect or prevent criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with insurance transactions; orsectionB2aB2a3 For either the disclosing or receiving insurance institution, agent or insurance-support organization to perform its function in connection with an insurance transaction involving the individual; orsectionB2bB2b3 To a medical-care institution or medical professional for the purpose of (i) verifying insurance coverage or benefits, (ii) informing an individual of a medical problem of which the individual may not be aware or (iii) conducting an operations or services audit, provided only that information is disclosed as is reasonably necessary to accomplish the foregoing purposes; orsectionB3B32 To an insurance regulatory authority; orsectionB4B42 To a law-enforcement or other government authority:
sectionB5B52 To protect the interests of the insurance institution, agent or insurance-support organization in preventing or prosecuting the perpetration of fraud upon it; orsectionB5aB5a3 If the insurance institution, agent, or insurance-support organization reasonably believes that illegal activities have been conducted by the individual; orsectionB5bB5b3 Otherwise permitted or required by law; orsectionB6B62 In response to a facially valid administrative or judicial order, including a search warrant or subpoena; orsectionB7B72 Made for the purpose of conducting actuarial or research studies, provided:
sectionB8B82 No individual may be identified in any actuarial or research report, andsectionB8aB8a3 Materials allowing the individual to be identified are returned or destroyed as soon as they are no longer needed, andsectionB8bB8b3 The actuarial or research organization agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization; orsectionB8cB8c3 To a party or a representative of a party to a proposed or consummated sale, transfer, merger, or consolidation of all or part of the business of the insurance institution, agent, or insurance-support organization, provided:
sectionB9B92 Prior to the consummation of the sale, transfer, merger, or consolidation only such information is disclosed as is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger, or consolidation, andsectionB9aB9a3 The recipient agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization; orsectionB9bB9b3 To a nonaffiliated third party whose only use of such information will be in connection with the marketing of a nonfinancial product or service, provided:
sectionB10B102 The individual has been given an opportunity, in accordance with the provisions of subsection A of § 38.2-612.1, to indicate that he does not want financial information disclosed for marketing purposes and has given no indication that he does not want the information disclosed, andsectionB10bB10b3 The nonaffiliated third party receiving such information agrees not to use it except in connection with the marketing of the product or service; orsectionB10cB10c3 (i) To a consumer reporting agency in accordance with the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) or (ii) from a consumer report reported by a consumer reporting agency; orsectionB11B112 To a professional peer review organization for the purpose of reviewing the service or conduct of a medical-care institution or medical professional; orsectionB13B132 To a certificate holder or policyholder for the purpose of providing information regarding the status of an insurance transaction; orsectionB15B152 To a lienholder, mortgagee, assignee, lessor or other person shown on the records of an insurance institution or agent as having a legal or beneficial interest in a policy of insurance, or to persons acting in a fiduciary or representative capacity on behalf of the individual, provided that:
sectionB16B162 No medical record information is disclosed unless the disclosure would be permitted by this section; andsectionB16aB16a3 The information disclosed is limited to that which is reasonably necessary to permit such person to protect his interest in the policy; orsectionB16bB16b3 Necessary to effect, administer, or enforce a transaction requested or authorized by the individual, or in connection with servicing or processing an insurance product or service requested or authorized by the individual, or necessary for reinsurance purposes, or for stop loss or excess loss agreements provided for in subsection B of § 38.2-109; orsectionB17B172 Pursuant to any federal Health Insurance Portability and Accountability Act privacy rules promulgated by the United States Department of Health and Human Services.sectionB18B182An insurance institution, agent, or insurance-support organization may disclose information about an individual collected or received in connection with an insurance transaction, without written authorization, if the disclosure is:sectionCC1 With respect to financial information, the individual has been given the notice required by subsection B of § 38.2-604.1, andsectionC1bC1b3 To an affiliate, provided:
sectionC2C22 The affiliate receiving the information does not disclose the information except as would otherwise be permitted by this section if such disclosure were made by the insurance institution, agent, or insurance-support organization.sectionC2bC2b3 Agents and insurance support organizations shall be subject to the provisions of this subsection to the extent of their participation in the issue, re-issue, or renewal of any policy, contract, or plan of accident and sickness insurance defined in § 38.2-109, but excluding disability income insurance.sectionD3D32Any notices, disclosures, or authorizations required by this section may be provided electronically if the individual agrees.sectionEE1Any privileged information about an individual that is disclosed in violation of this section shall be available to that individual in accordance with the provisions of §§ 38.2-608 and 38.2-609.sectionFF1Except in the case of disclosures made pursuant to subdivision B 10 of this section, the requirements of subsection A of § 38.2-612.1 shall not apply when information is disclosed pursuant to this section.sectionGG1