The following information contained in a public record is excluded from the mandatory disclosure provisions of this chapter but may be disclosed by the custodian in his discretion, except where such disclosure is prohibited by law. Redaction of information excluded under this section from a public record shall be conducted in accordance with § 2.2-3704.01.
Where the person who is the subject of health records is confined in a state or local correctional facility, the administrator or chief medical officer of such facility may assert such confined person's right of access to the health records if the administrator or chief medical officer has reasonable cause to believe that such confined person has an infectious disease or other medical condition from which other persons so confined need to be protected. Health records shall only be reviewed and shall not be copied by such administrator or chief medical officer. The information in the health records of a person so confined shall continue to be confidential and shall not be disclosed by the administrator or chief medical officer of the facility to any person except the subject or except as provided by law.
Where the person who is the subject of health records is under the age of 18, his right of access may be asserted only by his guardian or his parent, including a noncustodial parent, unless such parent's parental rights have been terminated, a court of competent jurisdiction has restricted or denied such access, or a parent has been denied access to the health record in accordance with § 20-124.6. In instances where the person who is the subject thereof is an emancipated minor, a student in a public institution of higher education, or is a minor who has consented to his own treatment as authorized by § 16.1-338 or 54.1-2969, the right of access may be asserted by the subject person.
For the purposes of this chapter, statistical summaries of incidents and statistical data concerning abuse of individuals receiving services compiled by the Commissioner of Behavioral Health and Developmental Services shall be disclosed. No such summaries or data shall include any information that identifies specific individuals receiving services.
Va. Code § 2.2-3705.5