Privacy Law Library

Breach of medical information notification

VA medical breach notification

Breach notification · Health · Government records

Requires publicly funded entities that own or license computerized medical or health insurance information of Virginia residents to notify the Attorney General, the Commissioner of Health, and affected residents without unreasonable delay after a breach. HIPAA-regulated entities and those under the FTC Health Breach Notification Rule are excluded.

Where
Virginia
Citation
Va. Code § 32.1-127.1:05
Status
In force
Enforced by
No express enforcement provision; notices go to the Attorney General and the Commissioner of Health
People can sue
No
Penalties
The section sets no specific penalty.
Applies to
  • 'Entities' defined as state and local government bodies, public school boards and colleges, and other organizations, corporations, or agencies in Virginia supported wholly or principally by public funds (32.1-127.1:05(A))
  • Not applicable to HIPAA covered entities or business associates subject to HITECH breach rules, or to entities subject to the FTC Health Breach Notification Rule (32.1-127.1:05(F))

Breach duties

  • Notify the Attorney General, the Commissioner of Health, the subject of the information, and affected residents without unreasonable delay after unauthorized access and acquisition of unencrypted medical information.Va. Code § 32.1-127.1:05(B)
  • Notice must describe the incident, the type of medical information involved, protective steps taken, and a contact number if one exists.Va. Code § 32.1-127.1:05(A) ('Notice')
  • Vendors maintaining medical information they do not own must notify the owner or licensee without unreasonable delay.Va. Code § 32.1-127.1:05(D)
  • When notifying more than 1,000 persons at once, notify the Attorney General and the Commissioner of Health of timing, distribution, and content.Va. Code § 32.1-127.1:05(E) · Only if: >1,000 persons notified

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Effective date of the enacting act (2010, c. 852) not confirmed, so effective_date is left null. Enforcement mechanism not stated in the section.

Research reference, not legal advice.