5.3 Patient Confidentiality, HIPAA & Virginia Health Records Privacy

Patient Confidentiality, HIPAA & Virginia Health Records Privacy

Quick Answer: Patient medical and pharmacy records are protected under the federal HIPAA Privacy Rule (45 CFR Part 164) and the Virginia Health Records Privacy Act (Code of Virginia § 32.1-127.1:03). Pharmacies may disclose Protected Health Information (PHI) without prior patient consent for Treatment, Payment, and Health Care Operations (TPO). For non-treatment disclosures, the Minimum Necessary standard strictly applies. While Virginia Board of Pharmacy inspectors and DHP investigators possess statutory authority to inspect records without a warrant, disclosures to law enforcement officers strictly require a valid search warrant, court order, or formal subpoena. Under federal HITECH regulations and Virginia law, an unauthorized breach of unsecured PHI mandates written individual notification within 60 calendar days; breaches compromising 500 or more individuals require concurrent notification to the HHS Office for Civil Rights (OCR), major media outlets, and the Virginia Attorney General.

---

1. Federal HIPAA Privacy Rule Standards (45 CFR Part 164)

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), enacted federally and enforced by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), establishes baseline national privacy safeguards for health data.

Covered Entities & Protected Health Information (PHI)

Pharmacies, pharmacists, hospitals, and health plans are designated Covered Entities. Any information created, received, maintained, or transmitted by a covered entity that relates to the past, present, or future physical or mental health of an individual, the provision of healthcare, or payment for healthcare is Protected Health Information (PHI).

PHI encompasses any data element that can identify an individual, including the 18 HIPAA Direct Identifiers:

• Names and postal addresses (all geographic subdivisions smaller than a state)
• All dates directly related to an individual (birth, admission, discharge, death, dispensing dates)
• Telephone numbers, fax numbers, and email addresses
• Social Security numbers, Medical Record Numbers (MRNs), and Health Plan Beneficiary numbers
• Prescription numbers and account numbers
• Certificate/license numbers and vehicle identifiers
• Device identifiers and serial numbers
• URLs and Internet Protocol (IP) addresses
• Biometric identifiers (fingerprints, voiceprints)
• Full-face photographic images and comparable images
• Any other unique identifying number, characteristic, or code

The TPO Framework: Permitted Disclosures Without Authorization

Under 45 CFR § 164.506, covered entities may use and disclose PHI without individual patient consent or written authorization for three core operational categories known as TPO:

1. Treatment: Provision, coordination, or management of healthcare services. Examples include: dispensing a prescription, conducting prospective drug utilization reviews (DUR), consulting with the patient's prescriber regarding dosage adjustments, conferring with a covering clinical specialist, and transferring prescription records between pharmacies.
2. Payment: Activities undertaken by the pharmacy to obtain reimbursement or determine coverage. Examples include: adjudicating prescription claims with third-party payers or Pharmacy Benefit Managers (PBMs), obtaining prior authorizations, coordinating benefits with Medicare Part D, and participating in routine commercial insurance audits.
3. Health Care Operations: Essential administrative, legal, and quality assurance functions. Examples include: conducting internal medication error reviews, clinical quality improvement audits, pharmacy staff training, supervising pharmacy student interns, and undergoing Board of Pharmacy accreditation reviews.

The Minimum Necessary Standard & Key Exemptions

Under 45 CFR § 164.502(b), covered entities must make reasonable efforts to limit the request, use, or disclosure of PHI to the minimum necessary required to accomplish the intended purpose.

Critical Exam Point — Exemptions from Minimum Necessary: The minimum necessary standard does NOT apply to:

• Disclosures to or requests by a healthcare provider for treatment purposes (clinicians must have access to complete clinical records without artificial redaction);
• Disclosures made directly to the patient;
• Disclosures made pursuant to a valid, signed patient authorization;
• Disclosures required by law (e.g., mandatory reporting to the Prescription Monitoring Program, child abuse reports);
• Disclosures required for compliance investigations conducted by HHS OCR.

Notice of Privacy Practices (NPP)

Pharmacies must formulate and distribute a comprehensive Notice of Privacy Practices (NPP) outlining patient rights and pharmacy disclosure duties:

• The NPP must be provided to the patient no later than the first day of service delivery.
• The pharmacy must make a documented good-faith effort to obtain a signed written acknowledgment of receipt from the patient.
• If the patient refuses to sign the acknowledgment, the pharmacist must document the good-faith effort and the reason for refusal in the pharmacy record.
• Record Retention Mandate: All signed NPP acknowledgments, privacy policies, written authorizations, and compliance logs must be retained for a minimum of six (6) years from the date of creation.

---

2. Virginia Health Records Privacy Act & Prescription Record Confidentiality

In addition to federal HIPAA mandates, the Commonwealth of Virginia enforces rigorous state privacy protections under the Virginia Health Records Privacy Act (Code of Virginia § 32.1-127.1:03) and the Virginia Drug Control Act (Code of Virginia § 54.1-3408.01).

Patient Property and Privacy Rights

Under Code of Virginia § 32.1-127.1:03(A), the General Assembly explicitly recognizes that "patients have a property right in the information contained in their health records" and guarantees a statutory right of privacy. Health records—including prescription files, medication histories, and clinical dispensing notes—are privileged and confidential.

Statutory Confidentiality of Prescription Records (§ 54.1-3408.01 & 18VAC110-20-400)

Under Code of Virginia § 54.1-3408.01 and Board regulations:

• Prescription records, patient medication profiles, and order slips are strictly confidential documents.
• Criminal Sanctions: Any person who unlawfully accesses, discloses, or disseminates prescription records in violation of Virginia law is guilty of a Class 2 misdemeanor.
• Administrative Discipline: Permittees and licensed pharmacists face formal disciplinary proceedings before the Board of Pharmacy, including license suspension, revocation, and civil monetary penalties up to $5,000 per violation under Code of Virginia § 54.1-2401.

---

3. Authorized Disclosures Without Patient Consent: State & Federal Standards

A central objective tested on the MPJE is identifying exactly who is legally entitled to inspect or obtain pharmacy records without patient consent.

High-Yield MPJE Distinction — Board Inspectors vs. Police Officers:

• Board of Pharmacy / DHP Investigators: Under Virginia Code § 54.1-3308, Board inspectors have statutory authority to enter any permitted pharmacy during regular business hours and inspect all prescription records, vaults, computers, and inventories WITHOUT a search warrant, court order, or subpoena. Refusing entry to a Board inspector constitutes grounds for immediate license revocation.
• Law Enforcement Officers (Local Police, State Police, Sheriff): A police officer investigating a suspect CANNOT simply show a police badge and verbally demand to see a customer's prescription history. Disclosing pharmacy records to law enforcement without a valid search warrant, court order, or formal subpoena duces tecum is an illegal breach of confidentiality under Virginia and federal law.

---

4. Breach Notification Framework (HITECH Act & Virginia Law)

Under the Health Information Technology for Economic and Clinical Health (HITECH) Act, codified at 45 CFR Part 164 Subpart D, and Virginia personal data breach statutes (Code of Virginia § 32.1-127.1:05 and § 18.2-186.6), covered entities must adhere to strict breach evaluation and reporting protocols.

Definition of a Breach

A breach is defined as the unauthorized acquisition, access, use, or disclosure of unencrypted protected health information that compromises the security or privacy of the PHI.

• The Presumption of Breach: Any impermissible use or disclosure of unsecured PHI is legally presumed to be a breach unless the covered entity demonstrates, through a documented four-factor risk assessment, that there is a low probability the data was compromised.
• Four-Factor Risk Assessment:
  1. The nature and extent of the PHI involved (including types of identifiers and clinical sensitivity);
  2. The unauthorized person who used the PHI or to whom the disclosure was made;
  3. Whether the PHI was actually viewed, acquired, or accessed; and
  4. The extent to which the risk has been mitigated (e.g., immediate secure return or certified destruction).

Mandatory Notification Timelines & Thresholds

                     HIPAA / Virginia Breach Notification Timelines
  ┌────────────────────────────────────────────────────────────────────────┐
  │                       Breach of Unsecured PHI Discovered                │
  └───────────────────────────────────┬────────────────────────────────────┘
                                      │
  ┌───────────────────────────────────▼────────────────────────────────────┐
  │                      Notice to ALL Affected Individuals                │
  │  • Must be sent in writing via first-class mail (or consented email)    │
  │  • Without unreasonable delay and NO LATER THAN 60 CALENDAR DAYS       │
  └───────────────────────────────────┬────────────────────────────────────┘
                                      │
                     ┌────────────────┴────────────────┐
                     │                                 │
       ┌─────────────▼───────────────┐   ┌─────────────▼───────────────┐
       │ Breaches Affecting >= 500   │   │ Breaches Affecting < 500    │
       │        Individuals          │   │        Individuals          │
       ├─────────────────────────────┤   ├─────────────────────────────┤
       │ • Notify HHS OCR within     │   │ • Maintain internal breach  │
       │   60 calendar days          │   │   documentation log         │
       │ • Notify Prominent Media    │   │ • Submit electronically to  │
       │   within 60 calendar days   │   │   HHS OCR within 60 days of │
       │ • Notify Virginia AG under  │   │   calendar year end         │
       │   Va. Code § 18.2-186.6     │   │   (no media notice required)│
       └─────────────────────────────┘   └─────────────────────────────┘

Detailed Reporting Thresholds

1. Notice to Affected Individuals (All Breaches): Written notice must be dispatched via first-class mail without unreasonable delay and in no case later than sixty (60) calendar days after discovery of the breach. If contact information is outdated for 10 or more individuals, a substitute notice must be posted on the pharmacy website home page or in prominent major broadcast/print media for 90 days with a toll-free phone number.
2. Large Breaches (500 or More Individuals):
   • HHS Secretary (via OCR): The pharmacy must submit electronic notification to HHS OCR without unreasonable delay and within 60 calendar days of discovery.
   • Prominent Media Outlets: The pharmacy must issue a formal press release to prominent media outlets serving the state or jurisdiction within 60 calendar days.
   • Virginia Attorney General: Notice must be provided to the Office of the Attorney General of Virginia pursuant to state data privacy breach requirements.
3. Small Breaches (Fewer Than 500 Individuals):
   • The pharmacy logs the breach internally.
   • Electronic submission to HHS OCR is completed within 60 calendar days after the end of the calendar year in which the breach occurred.