Virginia Health Privacy Rights

No major state PHI law beyond HIPAA. Virginia's recently enacted Consumer Data Protection Act (CDPA) excludes PHI under HIPAA, so its opt-out and access rights don't apply to HIPAA data. Virginia's health privacy provisions are scattered: e.g., there's a statute requiring consent to release medical records (with exceptions) which affirms your HIPAA rights. Virginia law specifically requires consent for release of medical records for workers' compensation claims beyond what's necessary, giving patients some control in that context. Generally, VA defers to HIPAA on timelines and content of rights. (Virginia's new mental health records law allows some sharing with family/caregivers in crisis unless patient objects, but patients can still object – a slight limitation on privacy in emergencies, though intended to help care.)