12 Va. Admin. Code § 5-405-100 - Access to and confidentiality of medical records and information
Current through Register Vol.. 38, No. 17, April 11, 2022
A. Private review
agents who have been granted a certificate by the department shall have
reasonable access to patient-specific medical records and
information.
B. The private review
agent's procedures shall specify that specific information exchanged for the
purpose of conducting review will be considered confidential, be used by the
private review agent solely for the purposes of utilization review, and shared
by the private review agent with only those parties who have authority to
receive such information, such as the claim administrator. The private review
agent's process shall specify that procedures are in place to assure
confidentiality and that the private review agent agrees to abide by any
federal and state laws governing the issue of confidentiality. Summary data
which does not provide sufficient information to allow identification of
individual patients or providers need not be considered confidential.
C. When consistent with subsection B of this
section and federal and state statutes and regulations, patient-specific data
gathered by the private review agent which raises questions of deficiencies in
quality may be shared with the hospital's or other facility's Quality Assurance
Committee. Prior to the sharing of such information, a private review agent may
require the hospital or other facility to assure compliance with
confidentiality requirements, to assure the appropriate review and follow-up
within that hospital's or other facility's Quality Assurance Committee, and to
indemnify the private review agent from inappropriate use of such
information.
D. Chapter 6 (§
38.2-600 et seq.) of Title 38.2 and § 32.1-127.1:03 of the Code of
Virginia shall apply to private review agents. Prior to the release of
patient-specific information to a private review agent, a patient shall provide
written consent for the release of such information. If the patient will not
authorize the release of information, or has refused to sign the release of
information forms, the private review agent may then follow its own policy or
that of the insurer regarding that refusal.
E. Medical records and patient-specific
information shall be maintained by the private review agent in a secure area
with access limited to essential personnel only.
F. Information generated and obtained by
private review agents in the course of utilization review shall be retained for
at least five years if the information relates to a case for which an adverse
decision was made at any point or if the information relates to a case which
may be reopened.
Notes
Statutory Authority
§§ 32.1-138.7 and 32.1-138.15 of the Code of Virginia.
The following state regulations pages link to this page.
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.