HIPAA compliance for urgent care centers in Virginia

Virginia keeps obligations of its own alongside HIPAA, with different recipients and triggers from the federal rules. Beyond that, Virginia has 7 recorded rules that apply to urgent care centers differently from other businesses in the state — set out below with their conditions and sources.

Virginia jurisdiction record verified against primary state authority August 2026. General reference, not legal advice.

Does this reach your practice?

Two questions have to be settled before any state rule matters: whether HIPAA reaches a practice like yours, and whether Virginia's own law reaches a practice that HIPAA already covers.

Federal — is this practice a covered entity

Urgent care centers that electronically conduct claims, eligibility, authorization, or other adopted transactions are HIPAA covered entities. Once covered, the duties below are required across every shared workstation, rotating clinician, laboratory workflow, and care handoff.

State — how Virginia law interacts with HIPAA

Virginia's breach-notification statute contains no HIPAA-specific provision. Urgent care centers must satisfy the state regime on its own terms, independently of anything HIPAA requires.

Virginia's § 18.2-186.6 does not contain an explicit HIPAA-substitution clause. Subsections F and H provide exemptions for entities that comply with an alternative statutory or regulatory notification requirement of a primary/functional state or federal regulator — HIPAA-regulated entities may qualify under this general regulator-compliance provision, but the exemption is not automatic and should be evaluated against the specific alternative regime being complied with. Virginia also maintains the Virginia Consumer Data Protection Act (VCDPA, Va. Code §§ 59.1-575 et seq., effective January 1, 2023) which imposes independent controller-level obligations.

What Virginia adds for urgent care centers specifically

Rules that exist because of the combination — not federal HIPAA, which applies the same way everywhere, and not Virginia's general breach law, which applies the same way to every business in the state.

Minor consent to treatment

Minor may consent

A minor is deemed an adult for the purpose of consenting to medical or health services needed to determine the presence of or to treat venereal disease or any reportable infectious or contagious disease; medical or health services required in case of birth control, pregnancy or family planning except for sexual sterilization; medical or health services needed for outpatient care, treatment or rehabilitation for substance abuse; and medical or health services needed for outpatient care, treatment or rehabilitation for mental illness or emotional disturbance.

Service: reportable venereal, infectious or contagious disease; birth control, pregnancy or family planning; outpatient care for substance abuse; outpatient care for mental illness or emotional disturbance
Patient population: minors

What this means operationally

Virginia deems the minor an adult for these four purposes rather than granting a narrower consent, which changes who the patient is for that episode rather than merely who signs. The mental-illness limb is outpatient only, so an episode that escalates to inpatient care leaves the section behind and the consent basis has to be re-established.

Applies when

The service falls within one of the four enumerated categories

Exceptions

Family planning consent does not extend to sexual sterilization

State statuteVa. Code § 54.1-2969(E)Minors receiving one of the four enumerated servicesVerified 2026-08-29

Limit on liability

Emergency medical services personnel, health care professionals and hospitals incur no liability for the lack of consent when treating a minor in an emergency. In the case of a minor 14 years of age or older who is physically capable of giving consent, such consent shall be obtained first.

Provider class: emergency medical services personnel, health care professionals and hospitals
Service: emergency treatment

What this means operationally

The proviso is the whole of it. Virginia does not treat an emergency as dispensing with consent where the patient can give it — a conscious 14-year-old is asked first, and the protection for proceeding without consent does not cover skipping that step. That makes physical capacity, not urgency, the question at the bedside, and it is the opposite of the instinct most emergency workflows encode.

Applies when

A minor requires emergency treatment

Exceptions

Consent must first be obtained from a minor 14 or older who is physically capable of giving it

State statuteVa. Code § 54.1-2969(C)Minors requiring emergency treatmentVerified 2026-08-29

Minor may consent

A pregnant minor shall be deemed an adult for the sole purpose of giving consent for herself and her child to surgical and medical treatment relating to the delivery of her child, where that treatment is provided during the delivery or the duration of the hospital admission for the delivery. Thereafter, the minor mother shall also be deemed an adult for the purpose of giving consent to surgical and medical treatment for her child. Nothing in the subsection permits a minor to consent to an abortion without complying with § 16.1-241.

Service: surgical and medical treatment relating to the delivery of the child
Setting: during the delivery or the duration of the hospital admission for it
Patient population: pregnant minors and minor mothers

What this means operationally

The authority is bounded by an ADMISSION, which is unusual — for herself, it lasts as long as the delivery hospitalisation and no longer, so the same patient loses the capacity at discharge. For her child it does not lapse. A practice seeing a minor mother post-partum is therefore dealing with someone who can consent for the baby but not necessarily for herself, and that asymmetry is easy to get backwards.

Applies when

The minor is pregnant and the treatment relates to the delivery, during the delivery or that hospital admission
Or the minor is a mother consenting for her child

Exceptions

Does not permit consent to an abortion without complying with § 16.1-241

State statuteVa. Code § 54.1-2969(G), (J)Pregnant minors and minor mothers, and their childrenVerified 2026-08-29

Parental access to records

Parental right of access

A minor shall also be deemed an adult for the purpose of accessing or authorizing the disclosure of medical records related to subdivisions 1 through 4 of subsection E.

Service: records of reportable venereal, infectious or contagious disease care; birth control, pregnancy or family planning; outpatient substance abuse care; and outpatient care for mental illness or emotional disturbance

What this means operationally

Virginia says the quiet part out loud: the consent capacity carries the records capacity with it. For these four service categories the minor is the person who may see the record and the person who may release it, which is what the HIPAA personal-representative rule at 45 CFR 164.502(g)(3) defers to. It is recorded apart from the consent grant because it answers a different question at a different moment — consent is asked at the visit, records authority is exercised weeks later by staff who were not in the room.

Applies when

The records relate to care within one of the four categories in subsection E

Exceptions

Subsection K still allows a parent to obtain the minor's other health records, subject to the substantial-harm determination

State statuteVa. Code § 54.1-2969(E), records limbMinors who received care within subsection EVerified 2026-08-29

How long records must be kept

How long the record must be kept

Patient records shall be maintained for a minimum of six years following the LAST PATIENT ENCOUNTER. Records of a minor child, including immunizations, shall be maintained until the child reaches 18 years of age or becomes emancipated, with a minimum time for record retention of six years. The requirement does not apply to records that have previously been transferred to another practitioner or health care provider or provided to the patient, or to records required by contractual obligation or federal law to be maintained for a longer period.

Provider class: practitioners regulated by the Virginia Board of Medicine under 18VAC85-20
Record class: patient records, including immunization records for minors

What this means operationally

Six years from the last ENCOUNTER rather than from each date of service, so the clock restarts on every visit and an active patient's file cannot age out. The minor rule has two limbs that interact: for a young child the age-18 endpoint governs, but for a sixteen-year-old the six-year floor is longer and runs past majority. The transfer exception is the practically useful one — records already transferred to another provider or given to the patient fall out of the duty entirely, which makes a documented transfer a way of discharging it.

Applies when

A Board of Medicine practitioner holds patient records

Exceptions

Records previously transferred to another practitioner or provider, or provided to the patient
Records required by contractual obligation or federal law to be kept longer

State regulation18VAC85-20-26, retention provisionPatients, adult and minorVerified 2026-08-29

Provider must disclose

Practitioners shall post information, or in some manner inform all patients, concerning the timeframe for record retention and destruction.

Provider class: practitioners regulated by the Virginia Board of Medicine under 18VAC85-20

What this means operationally

A standing proactive disclosure with no triggering event, which is why it is easy to omit — nothing in the workflow prompts it. Two things make it demanding in practice: it must reach ALL patients rather than those who ask, and its content is the practice's own retention and destruction timeframe, so a practice cannot post it without having decided and written down what that timeframe is. Posting satisfies it, but so does informing in some other manner, which leaves the channel to the practice.

Applies when

A Board of Medicine practitioner holds patient records

State regulation18VAC85-20-26, patient notification provisionAll patients of the practiceVerified 2026-08-29

Destruction and disposition

Destruction or disposition requirement

Patient records shall only be destroyed in a manner that protects patient confidentiality, such as by incineration or shredding.

Provider class: practitioners regulated by the Virginia Board of Medicine under 18VAC85-20

What this means operationally

A method constraint that reaches disposal contractors as much as the practice itself: incineration and shredding are given as examples rather than as the only permitted methods, so the test is whether confidentiality is protected. It says nothing about WHEN destruction is permitted — that is governed by the retention rule and by any longer contractual or federal obligation, and this provision must not be read as authorizing destruction once six years have passed.

Applies when

Patient records are to be destroyed

State regulation18VAC85-20-26, destruction provisionPatients whose records are destroyedVerified 2026-08-29

Each rule above was read against the cited source on the date shown. General reference for compliance planning, not legal advice — confirm current text before relying on it.

Virginia breach obligations

These apply to businesses generally rather than to urgent care centers in particular, and they are shown after applicability because whether they reach you depends on the answer above.

Virginiabreach data →

Individual notice deadline

Without unreasonable delay following discovery or notification of the breach of the security of the system, subject to reasonable delays for scope determination, restoration of system integrity, and law-enforcement requests.

The statute does not fix a numeric outer bound. Unreasonable delay is itself a violation and may result in state enforcement action, so treat the operative timeframe as the shortest window your incident circumstances reasonably support.

State regulator notice

Required

The Office of the Attorney General must be notified without unreasonable delay when notice is provided to Virginia residents. Additionally, when notifying more than 1,000 persons at one time, the entity must also notify (without unreasonable delay) the Attorney General and all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis.

Source: Va. Code § 18.2-186.6(B)

Statewide rules that also reach urgent care centers

Minor may consent

Except for the purposes of sexual sterilization, any minor who is or has been married shall be deemed an adult for the purpose of giving consent to surgical and medical treatment.

What this means operationally

A status route with no age floor and no service limit beyond sterilization, and it survives the marriage — 'is or has been'. Because it is framed as adult status for surgical and medical treatment generally, it is the Virginia route that reaches a practice outside the four subsection E categories.

Applies when

The minor is or has been married

Exceptions

Does not extend to sexual sterilization

StatewideVa. Code § 54.1-2969(F)Minors who are or have been marriedVerified 2026-08-29

Provider must disclose

Any judge, local director of social services, Director of the Department of Corrections, Director of the Department of Juvenile Justice, or principal executive officer who consents to treatment for a minor under this section shall make a reasonable effort to notify the minor's parent or guardian.

What this means operationally

The duty binds the substitute consenter, not the treating practice — which is worth stating plainly, because a practice that assumes the notification has happened, or assumes it is its own job, gets the allocation wrong in opposite directions. What the practice can usefully record is which office consented, since that is who owes the notice.

Applies when

One of the named office-holders consented to treatment for a minor

StatewideVa. Code § 54.1-2969(I)Minors treated on substitute consent under § 54.1-2969Verified 2026-08-29

Minor may consent

Where a minor who has been separated from the custody of a parent or guardian is in need of surgical or medical treatment, authority commensurate with that of a parent in like cases is conferred on: a judge, for minors within the custody control of their court; a local director of social services or designee, for committed minors, minors in emergency custody under § 63.2-1517 and entrusted minors where parental consent is unavailable; the Director of the Department of Corrections or of Juvenile Justice or a designee, for minors sentenced or committed to their custody; the principal executive officer of a state institution, for its wards; the principal executive officer of any other qualified institution or agency, for minors in its custody; and a person standing in loco parentis, or a conservator or custodian, for their charge. Separately, a judge of a juvenile and domestic relations district court may consent where the parent or guardian's consent is unobtainable because they are not a resident of the Commonwealth, their whereabouts is unknown, or they cannot be consulted with promptness reasonable under the circumstances.

What this means operationally

Virginia's substitute-consent scheme is built around CUSTODY rather than around kinship. Where Texas and Florida list relatives in order, Virginia lists office-holders — and the only private-capacity entry is a person standing in loco parentis, a conservator or a custodian. A grandparent presenting without one of those roles is not on this list. The gate is that the minor has been separated from parental custody, which is a status a practice must establish rather than assume from the parent's absence.

Applies when

The minor has been separated from the custody of a parent or guardian and needs surgical or medical treatment

StatewideVa. Code § 54.1-2969(A), (B)Minors separated from parental custodyVerified 2026-08-29

Duty to keep an accurate record

HEALTH RECORDS SHALL NOT BE REMOVED FROM THE PREMISES WHERE THEY ARE MAINTAINED WITHOUT THE APPROVAL OF THE HEALTH CARE ENTITY that maintains them, EXCEPT in accordance with a COURT ORDER OR SUBPOENA consistent with § 8.01-413(C), or with this section, or IN ACCORDANCE WITH THE REGULATIONS RELATING TO CHANGE OF OWNERSHIP OF HEALTH RECORDS promulgated by a health regulatory board established in Title 54.1. No person to whom health records are disclosed SHALL REDISCLOSE OR OTHERWISE REVEAL the health records of an individual BEYOND THE PURPOSE FOR WHICH SUCH DISCLOSURE WAS MADE, without first obtaining the individual's specific authorization.

What this means operationally

A physical custody rule that constrains ordinary practice arrangements: records may not leave the premises without the maintaining entity's approval, which reaches a departing clinician taking files, off-site storage moves and vendor collection alike, and the permitted routes are narrow — legal process, this section, or the change-of-ownership regulations a Title 54.1 board has promulgated. The redisclosure limb binds the RECIPIENT rather than the practice, and is purpose-limited rather than time-limited: an insurer or attorney who receives records for one purpose may not repurpose them without fresh specific authorization.

Applies when

Health records are to be removed from the premises where they are maintained, or a recipient proposes to redisclose records beyond the purpose of the original disclosure

Exceptions

Court order or subpoena consistent with Va. Code § 8.01-413(C)
Change-of-ownership regulations promulgated by a health regulatory board under Title 54.1

StatewideVa. Code § 32.1-127.1:03(A)(2), (A)(3)Individuals who are the subject of a health recordVerified 2026-08-30

Parental right of access

There is hereby recognized AN INDIVIDUAL'S RIGHT OF PRIVACY IN THE CONTENT OF HIS HEALTH RECORDS. HEALTH RECORDS ARE THE PROPERTY OF THE HEALTH CARE ENTITY MAINTAINING THEM, and except when permitted or required by this section or other state law, no health care entity or other person working in a health care setting may disclose an individual's health records. HEALTH CARE ENTITIES SHALL DISCLOSE HEALTH RECORDS TO THE INDIVIDUAL WHO IS THE SUBJECT OF THE HEALTH RECORD, INCLUDING AN AUDIT TRAIL OF ANY ADDITIONS, DELETIONS OR REVISIONS TO THE HEALTH RECORD, IF SPECIFICALLY REQUESTED, except as provided in subsections E and F and subsection B of § 8.01-413.

What this means operationally

The audit-trail limb is the one worth building for. On specific request the patient is entitled not merely to the record but to a trail of ADDITIONS, DELETIONS AND REVISIONS — which is an EHR capability question rather than a policy one, and a system that cannot produce a per-record change history cannot be made compliant by procedure. Note the ownership premise sitting alongside it: the record is the ENTITY'S PROPERTY and the patient's right is one of access and privacy in its content, not of ownership, which is why the disclosure duty is expressed as an exception to a general prohibition rather than as a proprietary claim.

Applies when

An individual who is the subject of a health record requests it, and specifically requests the audit trail

Exceptions

Subject to the exceptions in § 32.1-127.1:03(E) and (F) and Va. Code § 8.01-413(B)

StatewideVa. Code § 32.1-127.1:03(A)(1)Individuals who are the subject of a health recordVerified 2026-08-30

Custody on closure or transfer

Before transferring records on the closure, sale or relocation of a practice, the practitioner shall have attempted to notify the patient of the pending transfer, EITHER ELECTRONICALLY OR BY MAIL at the patient's last known address, AND by publishing prior notice in a newspaper. The notice must specify that records will be sent to a provider of the patient's choice or provided to the patient, and must disclose whether any charges will be billed, which are limited to the ACTUAL COSTS of copying and mailing. On written request the records must be sent within a reasonable time. A current patient is one who has had a patient encounter with the provider or the practice during the TWO-YEAR period immediately preceding the date of the record transfer. Relocation means moving the practice more than 30 MILES away, or to a practice site in another state or the District of Columbia.

What this means operationally

Virginia requires BOTH individual notice and newspaper publication — not a choice between them, which is where practices most often fall short. The definitions do a lot of work: 'current patient' is a two-year encounter window, so the notice population is bounded rather than the whole historical file, and 'relocation' is defined by distance, so moving thirty-one miles triggers the same duties as closing. Charges are capped at actual costs of copying and mailing, which is narrower than any fee schedule elsewhere in the corpus.

Applies when

A practice is closing, being sold, or relocating more than 30 miles or out of state

StatewideVa. Code § 54.1-2405Current patients, meaning those seen in the preceding two yearsVerified 2026-08-29

What applies to urgent care centers everywhere

Urgent care combines high patient volume, walk-in identity verification, rotating personnel, shared workstations, labs, imaging, prescribing, occupational medicine, and rapid care coordination. The SRA must account for the speed and turnover built into the operating model.

Shared workstations, unique user access, automatic locking, unattended sessions, and physical screen visibility

The EHR, registration, intake, claims, eligibility, patient portal, e-prescribing, laboratory, and imaging systems

Access granted to physicians, advanced-practice clinicians, nurses, technicians, front-desk staff, contractors, and temporary personnel

Walk-in identity verification and the handling of minors, guardians, family members, and representatives

Primary-care, hospital, specialist, referral, and care-coordination disclosures

Occupational-medicine, employer, workers' compensation, drug-testing, and return-to-work workflows

Full urgent carecompliance guide →

Knowing the Virginia rule is not the same as meeting it.

The risk assessment asks what your practice actually does — which systems hold records, who reaches them, which vendors touch them — and reports against the obligations that apply to you, including the Virginia rules on this page.

Start the risk assessment