12VAC5-115-70: Release of VIIS data

A. Individual patient data may not be disclosed except to the extent required or permitted by state and federal law or regulations.

B. Patient data shall be erased when no longer needed, when IT equipment is being terminated, or in accordance with a data sharing agreement or a participant registration agreement with VDH.

C. Aggregate data from which personal identifying data has been removed or redacted may be released for the purposes of statistical analysis, research, or reporting only after approval by VDH.

D. VDH shall immediately suspend a participant's system access privileges for inappropriate use of VIIS data and shall conduct an investigation. VDH may take additional actions in accordance with § 32.1-27 of the Code of Virginia. The VIIS program manager may reinstate privileges upon satisfactory completion of required remedial actions and guarantee of proper use of VIIS in the future.