Authority for Study

HJR 134 directed JCHC to “study the use and disclosure of health records relative to Virginia law and the Health Insurance Portability and Accountability Act (HIPAA)" in order to “consider the need for amendments to Virginia laws and recommend ways to assist health care providers and other relevant parties to understand and comply with state and federal health record privacy laws."

Background on the HIPAA Privacy Rule

The Privacy Rule, promulgated under the federal Health Insurance Portability and Accountability Act of 1996, imposed new requirements for HIPAA-covered entities to ensure the privacy of health records including the use and disclosure of health records. As a general principle, HIPAA supervenes state health privacy laws which make it (a) more difficult for an individual to access his own records than would HIPAA or (b) easier for a third party to access an individual’s health records than would HIPAA. There are a number of instances in which it is unclear whether HIPAA privacy provisions or Virginia law take precedence.

JCHC Study

A study effort was undertaken on behalf of JCHC and led by representatives of the Health Law Section of the Virginia Bar Association (VBA). Workgroups including members of VBA and representatives of the Administration, the Attorney General’s Office, and various interest groups deliberated and made recommendations regarding legislation to address conflict between HIPAA and State statute. The workgroups’ recommendations are described in the Executive Summary of the final report.