Free Virginia HIPAA Practice Test Online

Correct answer: A. Va. Code § 32.1-127.1:03

Correct: Va. Code § 32.1-127.1:03, part of Virginia's Health Records Privacy Act within Title 32.1, Chapter 5.1, expressly recognizes an individual's right of privacy in the content of their health records and governs disclosure by Virginia health care entities.

• B: Incorrect: Va. Code § 18.2-186.6 is Virginia's general personal-information data breach notification statute, not the state health records privacy statute.
• C: Incorrect: Va. Code § 59.1-578 is a provision of the Virginia Consumer Data Protection Act governing consent for processing sensitive data, not the health records privacy statute.
• D: Incorrect: Va. Code § 8.01-413 addresses procedures for obtaining copies of medical records through civil subpoenas, not the general right of privacy in health record content.

Correct answer: B. The health care entity that created and maintains the records

Correct: Va. Code § 32.1-127.1:03 expressly provides that health records are the property of the health care entity that maintains them, even though the individual retains a recognized privacy interest in their content.

• A: Incorrect: the statute grants patients a recognized right of privacy in and access to the content of their records, but it does not make the patient the legal owner of the physical or electronic record itself.
• C: Incorrect: the Virginia Department of Health has regulatory oversight functions but is not designated as the owner of records maintained by individual health care entities.
• D: Incorrect: ownership under the statute turns on who maintains the record, not on who paid for the underlying services.

Correct answer: C. The patient's treating physician or treating clinical psychologist has documented that access would reasonably be expected to endanger the life or safety of the patient or another person, or cause substantial harm

Correct: § 32.1-127.1:03 permits denial of access only when a treating physician or treating clinical psychologist has made a written finding that access would reasonably be likely to endanger life or safety, or cause substantial harm to the patient or a referenced third person, and the statute provides a process to have that determination reviewed.

• A: Incorrect: an unpaid bill is not a statutory ground for denying a patient access to their own health record under § 32.1-127.1:03.
• B: Incorrect: the statute does not permit a health care entity to withhold a patient's own record on a general claim of proprietary interest.
• D: Incorrect: the age of a record is not itself a basis under the statute for denying patient access.

Correct answer: D. 30 days

Correct: § 32.1-127.1:03 generally requires a Virginia health care entity to respond to a patient's health record request within 30 days.

• A: Incorrect: 10 days is shorter than the response window the statute actually allows.
• B: Incorrect: 15 days is not the statutory response period under § 32.1-127.1:03.
• C: Incorrect: 45 days exceeds the statutory response period under § 32.1-127.1:03.

Correct answer: A. No, redisclosure beyond the purpose of the original disclosure requires the individual's specific authorization, subject to limited statutory exceptions

Correct: § 32.1-127.1:03 prohibits a recipient from redisclosing or otherwise revealing health records beyond the purpose for which the original disclosure was made, without first obtaining the individual's specific authorization, apart from a narrow set of statutory exceptions.

• B: Incorrect: the statute does not grant recipients unrestricted redisclosure rights merely because the initial disclosure to them was lawful.
• C: Incorrect: the redisclosure restriction is not limited to disclosures to non-licensed recipients; it applies regardless of whether the further recipient is itself a licensed health care entity.
• D: Incorrect: the statute's redisclosure limits are not confined to disclosures outside government; the general authorization requirement applies broadly to any unrelated further disclosure.