Virginia CDPA for Medical Practices: Where It Stacks on HIPAA

Virginia's Consumer Data Protection Act (Va. Code § 59.1-575 et seq.) took effect January 1, 2023. The single biggest divergence from HIPAA is structural: CDPA is a consumer-rights and processing-purpose statute, where HIPAA is a covered-entity safeguarding statute. CDPA includes a HIPAA carve-out for PHI but still applies to a medical practice's non-PHI data — intake forms for marketing, employee data, website analytics — whenever the practice meets CDPA's volume threshold.

What Virginia CDPA actually requires

CDPA applies to a "controller" or "processor" that conducts business in Virginia or produces products or services targeted to Virginia residents and that, during a calendar year, either controls or processes personal data of at least 100,000 Virginia consumers, or controls or processes personal data of at least 25,000 Virginia consumers and derives over 50 percent of gross revenue from the sale of personal data. Below those thresholds, CDPA does not apply.

When CDPA applies, Va. Code § 59.1-578 imposes core obligations: limit collection to what is adequate, relevant, and reasonably necessary; provide a privacy notice; obtain opt-in consent before processing sensitive data; perform data protection assessments for high-risk processing; honor consumer rights to access, correct, delete, port, and opt out of sale or targeted advertising; and execute written contracts with processors.

The HIPAA carve-out at Va. Code § 59.1-576(C) exempts:

• Protected health information under HIPAA
• Patient information held by a HIPAA-covered entity or business associate in the same manner as PHI
• Information used for public health activities
• Information processed under specified clinical trial regulations

What is not exempted: the entity itself, marketing data not derived from PHI, website analytics tied to non-employee visitors, and any data collected from non-patients in a consumer capacity (prospects, family members searching the website, wellness program participants who are not patients). Employee and applicant data and persons acting in a commercial or B2B capacity fall outside CDPA's "consumer" definition at Va. Code § 59.1-575 and are not pulled in by the CDPA framework — even though they may be regulated under other workforce-privacy regimes.

Where Virginia CDPA is stricter than HIPAA

Where CDPA bites a healthcare practice is the non-PHI data layer. HIPAA does not regulate the marketing list a practice builds from waiting-room sign-in sheets when the data is not yet linked to treatment. HIPAA does not regulate a website's analytics tracking when the visitor is not a patient. HIPAA's marketing authorization rule at 45 CFR 164.508(a)(3) applies only to marketing communications using PHI. CDPA reaches further.

| Topic | HIPAA | Virginia CDPA | Stricter | |---|---|---|---| | Data scope | PHI held by covered entity or BA | All personal data of Virginia consumers, with HIPAA carve-out | Different scope, not strictly comparable | | Right to delete | None — only access and amendment | Yes for non-PHI data (§ 59.1-577) | Virginia | | Right to data portability | Limited (electronic PHI access) | Yes for all non-PHI personal data | Virginia | | Opt-in for sensitive data | Authorization for non-TPO uses | Opt-in consent required before processing | Virginia | | Data minimization | Minimum necessary rule (164.502(b)) | Data collection adequate and relevant only (§ 59.1-578) | Comparable | | Data protection assessment | Risk analysis required (164.308(a)(1)) | DPA required for high-risk processing (§ 59.1-580) | CDPA specific to processing risk | | Private right of action | None | None — AG only | Tie | | Penalty per violation | Up to $73,011 per violation, $2,190,294 annual cap per identical violation (2026 HHS-adjusted HIPAA; 45 CFR Part 102) | Up to $7,500 per violation | HIPAA per-violation | | Right to cure | None | 30 days before AG can sue (§ 59.1-585) | CDPA more lenient |

The two statutes are designed for different objectives. HIPAA protects health information across all of its forms; CDPA gives consumers rights over their personal data. A medical practice has to comply with both — HIPAA on the PHI track, CDPA on the non-PHI consumer track — and the two rarely overlap in practice.

Where HIPAA is stricter than Virginia CDPA

HIPAA is materially broader on the PHI track. The Security Rule's administrative, physical, and technical safeguards at 45 CFR Part 164, Subpart C have no CDPA equivalent — Virginia does not impose a federal-grade SRA requirement, an encryption standard, or audit logs by statute for medical practices. HIPAA's breach notification rule at 45 CFR 164.400-414 is more prescriptive on form and content than Virginia's general breach statute at § 18.2-186.6.

HIPAA's per-violation penalty ceiling under 45 CFR 160.404 — adjusted annually for inflation — is substantially higher than CDPA's $7,500. And HIPAA has no right-to-cure provision; CDPA's 30-day cure window at § 59.1-585 gives controllers a structural defense CDPA enforcement actions that HIPAA respondents do not enjoy.

Breach notification timeline

CDPA itself is not a breach notification statute. Virginia breach notification lives at Va. Code § 18.2-186.6 and requires notice to affected Virginia residents without unreasonable delay where unencrypted personal information has been accessed and acquired by an unauthorized person. Where the breach affects more than 1,000 Virginia residents, the entity must also notify the Virginia Attorney General and consumer reporting agencies.

For HIPAA-covered breaches, the 60-day individual notification deadline under 45 CFR 164.404(b) controls for PHI. Practices run both tracks in parallel: HIPAA for PHI, Virginia § 18.2-186.6 for non-PHI personal information of Virginia residents.

Penalties + private right of action

Va. Code § 59.1-584 makes the Virginia Attorney General the exclusive enforcer of CDPA. Civil penalties under § 59.1-584(B) run up to $7,500 per violation. The AG can also seek restitution, injunctive relief, and reasonable expenses.

Va. Code § 59.1-585 requires the AG to send a written notice identifying the specific provisions allegedly violated, giving the controller 30 days to cure. Only if the violation continues, or the controller breaches an express written statement provided to the AG, can the AG bring an action. This 30-day cure window is a meaningful structural protection — it converts most CDPA enforcement actions into compliance negotiations rather than litigation.

The lack of a private right of action makes CDPA less plaintiff-friendly than BIPA, GIPA, or Washington's My Health My Data Act. Plaintiffs' firms have not built CDPA class action practices comparable to the Illinois BIPA bar. But the AG's office has been active and has published enforcement actions; assume the AG will examine practices that fail to honor consumer access requests, that miss the 30-day cure, or that lack a published privacy notice.

HIPAA enforcement under 45 CFR Part 160, Subpart D runs concurrently. HHS OCR remains the federal enforcer, with state AGs able to bring parallel HIPAA actions under HITECH § 13410(e). The Virginia AG has used HITECH authority in past matters.

Compliance checklist for in-state practices

For Virginia practices that meet the CDPA volume thresholds:

• Determine whether CDPA applies by counting Virginia consumers whose personal data the practice controls or processes — not just patients, but all consumers (website visitors, prospects, marketing leads).
• Map PHI vs non-PHI clearly. PHI under HIPAA is exempt from CDPA consumer rights. Non-PHI data — analytics, marketing lists, prospect intake — is fully covered.
• Publish a privacy notice that meets Va. Code § 59.1-578(C) requirements: categories of personal data processed, purposes, categories of third parties, how to exercise consumer rights.
• Stand up a consumer-rights intake mechanism. Virginia consumers have rights to access, correct, delete, port, and opt out of sale or targeted advertising. The response window is 45 days from receipt of a verified request.
• For any processing of sensitive data — geolocation, genetic, biometric, health diagnosis not under HIPAA, racial or ethnic origin — obtain opt-in consent before processing.
• Perform a data protection assessment for any high-risk processing (targeted advertising, sale of personal data, profiling, processing of sensitive data) under § 59.1-580. Retain the DPA in writing.
• Execute written processor contracts under § 59.1-579 with vendors that process Virginia consumer data outside the HIPAA business associate framework. BAAs cover PHI vendors; CDPA processor contracts cover non-PHI vendors.
• Maintain a 30-day cure response process: when the Virginia AG sends a § 59.1-585 notice, the practice has 30 days to cure the alleged violation. Document the cure thoroughly.

Cross-references: Washington's My Health My Data Act takes the opposite design choice — broad consumer health data coverage with a private right of action — and is far more aggressive than Virginia CDPA. Illinois BIPA and GIPA also runs class actions that CDPA does not allow. The compliance binder covers the HIPAA backbone; Virginia practices layer CDPA's non-PHI consumer rights track on top.