Title of Regulation: 1VAC20-70. Absentee Voting (amending 1VAC20-70-20).

Statutory Authority: § 24.2-103 of the Code of Virginia.

Effective Date: June 4, 2021.

Agency Contact: Ashley Coles, Agency Regulatory Coordinator, Department of Elections, Washington Building, 1100 Bank Street, First Floor, Richmond, VA 23219, telephone (804) 864-8901, FAX (804) 371-0194, or email ashley.coles@elections.virginia.gov.

Summary:

The amendments apply to mail absentee ballots with missing or illegible postmarks received by the General Registrar's office by noon on the third day after Election Day and include (i) allowing that the General Registrar may use data from a ballot's Intelligent Mail barcode (IMb) to count the ballot if the IMb data shows the ballot was mailed on or before the date of the relevant election; (ii) providing that if the data does not meet the requirement of clause (i) or shows the ballot was mailed after the election, the General Registrar will refer to the date on which the Envelope B oath was signed to determine whether the ballot was cast on or before the date of the relevant election; (iii) allowing that a ballot with no IMb data and a missing postmark will not be counted; and (iv) providing that any ballot with a missing or illegible postmark with IMb data showing it was mailed after Election Day will not be counted.

1VAC20-70-20. Material omissions from absentee ballots.

A. Pursuant to the requirements of § 24.2-706 of the Code of Virginia, a timely received absentee ballot contained in an Envelope B shall not be rendered invalid if it contains an error or omission not material to its proper processing.

B. The following omissions are always material and any Envelope B containing such omissions shall be rendered invalid if any of the following exists:

1. Except as provided in subdivisions C 2 and 3 of this section, the voter did not include his full first name;

2. The voter did not provide his last name;

3. The voter omitted his generational suffix when one or more individuals with the same name are registered at the same address, and it is impossible to determine the identity of the voter;

4. The voter did not provide his house number and street name or his rural route address;

5. The voter did not provide either his city or zip code;

6. The voter did not sign Envelope B; or

7. The voter's witness did not sign Envelope B.

C. The ballot shall not be rendered invalid if on the Envelope B:

1. The voter included his full name in an order other than "last, first, middle";

2. The voter used his first initial instead of his first full name, so long as the voter provided his full middle name;

3. The voter provided a derivative of his legal name as his first or middle name (e.g., "Bob" instead of "Robert");

4. If the voter provided his first name and last name, the voter did not provide a middle name or a middle initial;

5. The voter did not provide his residential street identifier (Street, Drive, etc.);

6. The voter did not provide a zip code, so long as the voter provided his city;

7. The voter did not provide his city, so long as the voter provided his zip code;

8. The voter omitted the date, or provided an incorrect or incomplete date on which he signed Envelope B; or

9. The ballot is imperfectly sealed within Envelope B, provided that the outer envelope with Envelope B and the ballot arrived sealed.

10. The illegibility of a voter's or witness' signature on an Envelope B shall not be considered an omission or error.

D. For the purposes of this regulation, "city" may include the voter's locality, town, or any acceptable mailing name for the five-digit zip code of the voter's residence.

E. Whether an error or omission on an Envelope B not specifically addressed by this regulation is material and shall render the absentee ballot invalid shall be determined by a majority of the officers of the election present.

F. If a ballot is received by the general registrar's office by noon on the third day after the election pursuant to § 24.2-709 of the Code of Virginia but the return envelope has a missing or illegible postmark, the General Registrar shall refer to the Intelligent Mail barcode on the return envelope to determine whether the ballot was mailed on or before the date of the relevant election.

1. If there is evidence from the Intelligent Mail barcode that the ballot was mailed after the close of polls for the relevant election, the ballot shall be rendered invalid.

2. If there is no evidence from the Intelligent Mail barcode that the ballot was mailed after the close of polls for the relevant election, including if the Intelligent Mail barcode was not scanned but the return envelope has an illegible postmark, the General Registrar shall refer to the date on which the oath on Envelope B was signed to determine whether the ballot was cast on or before the date of the relevant election.

a. 3. If the oath on Envelope B was signed on or before the date of the relevant election, there is no evidence from the Intelligent Mail barcode that the ballot shall not be rendered invalid due to receipt was mailed after the close of polls by the General Registrar. b. If the oath on Envelope B was signed after the date of for the relevant election and if the return envelope has a missing postmark, the ballot shall be rendered invalid.

Title of Regulation: 4VAC20-620. Pertaining to Summer Flounder (amending 4VAC20-620-40).

Statutory Authority: § 28.2-201 of the Code of Virginia.

Effective Date: June 1, 2021.

Agency Contact: Jennifer Farmer, Marine Resources Commission, 380 Fenwick Road, Fort Monroe, VA 23551, telephone (757) 247-2248, or email jennifer.farmer@mrc.virginia.gov.

Summary:

The amendments change the landing dates, possession limits, and landing limits for summer flounder commercially harvested offshore in federal waters and landed in Virginia.

4VAC20-620-40. Commercial vessel possession and landing limitations.

A. It shall be unlawful for any person harvesting summer flounder outside of Virginia's waters to do any of the following, except as described in subsections B, C, D, E, F, and F G of this section:

1. Possess aboard any vessel in Virginia waters any amount of summer flounder in excess of 10% by weight of Atlantic croaker or the combined landings, on board a vessel, of black sea bass, scup, squid, scallops, and Atlantic mackerel.

2. Possess aboard any vessel in Virginia waters any amount of summer flounder in excess of 1,500 pounds landed in combination with Atlantic croaker.

3. Fail to sell the vessel's entire harvest of all species at the point of landing.

B. Nothing in this chapter shall preclude a vessel from possessing any North Carolina or New Jersey vessel possession limit of summer flounder in Virginia; however, no vessel that possesses the North Carolina or New Jersey vessel possession limit of summer flounder shall offload any amount of that possession limit, except as described in subsection K L of this section.

C. From February 25 through April 7, it shall be unlawful for any person harvesting summer flounder outside of Virginia waters to do any of the following:

1. Possess aboard any vessel in Virginia waters any amount of summer flounder in excess of the combined total of the Virginia landing limit described in subdivision 2 of this subsection and the amount of the legal North Carolina or New Jersey landing limit or trip limit.

2. Land in Virginia more than a total of 15,000 pounds of summer flounder.

3. Land in Virginia any amount of summer flounder more than once in any consecutive five-day period.

D. From June 15 through August 15, it shall be unlawful for any person harvesting summer flounder outside of Virginia waters to do any of the following:

1. Possess aboard any vessel in Virginia waters any amount of summer flounder in excess of the combined total of the Virginia landing limit described in subdivision 2 of this subsection and the amount of the legal North Carolina or New Jersey landing limit or trip limit.

2. Land in Virginia more than a total of 12,500 pounds of summer flounder.

3. Land in Virginia any amount of summer flounder more than once in any consecutive five-day period.

D. E. From September 8 through October 31, it shall be unlawful for any person harvesting summer flounder outside of Virginia waters to do any of the following:

1. Possess aboard any vessel in Virginia waters any amount of summer flounder in excess of the combined total of the Virginia landing limit described in subdivision 2 of this subsection and the amount of the legal North Carolina or New Jersey landing limit or trip limit.

2. Land in Virginia more than a total of 12,000 pounds of summer flounder.

3. Land in Virginia any amount of summer flounder more than once in any consecutive five-day period.

E. F. From November 1 through December 31, it shall be unlawful for any person harvesting summer flounder outside of Virginia waters to do any of the following:

1. Possess aboard any vessel in Virginia waters any amount of summer flounder in excess of the total of the Virginia landing limit described in subdivision 2 of this subsection and the amount of the legal North Carolina or New Jersey landing limit or trip limit.

2. Land in Virginia more than a total of 12,000 pounds of summer flounder.

3. Land in Virginia any amount of summer flounder more than once in any consecutive five-day period.

F. G. From January 1 through December 31, any boat or vessel issued a valid federal summer flounder moratorium permit and owned and operated by a legal Virginia Commercial Hook-and-Line Licensee that possesses a Restricted Summer Flounder Endorsement shall be restricted to a possession and landing limit of 200 pounds of summer flounder, except as described in 4VAC20-620-30 F.

G. H. Upon request by a marine police officer, the seafood buyer or processor shall offload and accurately determine the total weight of all summer flounder aboard any vessel landing summer flounder in Virginia.

H. I. Any possession limit described in this section shall be determined by the weight in pounds of summer flounder as customarily packed, boxed, and weighed by the seafood buyer or processor. The weight of any summer flounder in pounds found in excess of any possession limit described in this section shall be prima facie evidence of violation of this chapter. Persons in possession of summer flounder aboard any vessel in excess of the possession limit shall be in violation of this chapter unless that vessel has requested and been granted safe harbor. Any buyer or processor offloading or accepting any quantity of summer flounder from any vessel in excess of the possession limit shall be in violation of this chapter, except as described by subsection K of this section. A buyer or processor may accept or buy summer flounder from a vessel that has secured safe harbor, provided that vessel has satisfied the requirements described in subsection K of this section.

I. J. If a person violates the possession limits described in this section, the entire amount of summer flounder in that person's possession shall be confiscated. Any confiscated summer flounder shall be considered as a removal from the appropriate commercial harvest or landings quota. Upon confiscation, the marine police officer shall inventory the confiscated summer flounder and, at a minimum, secure two bids for purchase of the confiscated summer flounder from approved and licensed seafood buyers. The confiscated fish will be sold to the highest bidder, and all funds derived from such sale shall be deposited for the Commonwealth pending court resolution of the charge of violating the possession limits established by this chapter. All of the collected funds will be returned to the accused upon a finding of innocence or forfeited to the Commonwealth upon a finding of guilty.

J. K. It shall be unlawful for a licensed seafood buyer or federally permitted seafood buyer to fail to contact the Marine Resources Commission Operation Station prior to a vessel offloading summer flounder harvested outside of Virginia. The buyer shall provide to the Marine Resources Commission the name of the vessel, its captain, an estimate of the amount in pounds of summer flounder on board that vessel, and the anticipated or approximate offloading time. Once offloading of any vessel is complete and the weight of the landed summer flounder has been determined, the buyer shall contact the Marine Resources Commission Operations Station and report the vessel name and corresponding weight of summer flounder landed. It shall be unlawful for any person to offload from a boat or vessel for commercial purposes any summer flounder during the period of 9 p.m. to 7 a.m.

K. L. Any boat or vessel that has entered Virginia waters for safe harbor shall only offload summer flounder when the state that licenses that vessel requests to transfer quota to Virginia, in the amount that corresponds to that vessel's possession limit, and the commissioner agrees to accept that transfer of quota.

L. M. After any commercial harvest or landing quota as described in 4VAC20-620-30 has been attained and announced as such, any boat or vessel possessing summer flounder on board may enter Virginia waters for safe harbor but shall contact the Marine Resources Commission Operation Center in advance of such entry into Virginia waters.

M. N. It shall be unlawful for any person harvesting summer flounder outside of Virginia waters to possess aboard any vessel, in Virginia, any amount of summer flounder, once it has been projected and announced that 100% of the quota described in 4VAC20-620-30 A has been taken.

Title of Regulation: 9VAC25-260. Water Quality Standards (amending 9VAC25-260-400, 9VAC25-260-420, 9VAC25-260-440, 9VAC25-260-510).

Statutory Authority: § 62.1-44.15 of the Code of Virginia; Clean Water Act (33 USC § 1251 et seq.); 40 CFR Part 131.

Public Hearing Information: No public hearing is currently scheduled.

Public Comment Deadline: July 7, 2021.

Effective Date: July 4, 2076.

Agency Contact: David Whitehurst, Department of Environmental Quality, 1111 East Main Street, Suite 1400, P.O. Box 1105, Richmond, VA 23218, telephone (804) 698-4121, or email david.whitehurst@deq.virginia.gov.

Basis: The corresponding federal water quality standards regulation at 40 CFR 131.6 describes the minimum requirements for water quality standards. The minimum requirements are use designations, water quality criteria to protect the designated uses, and an antidegradation policy. All of the citations mentioned describe mandates for water quality standards. The Environmental Protection Agency (EPA) Water Quality Standards regulation (40 CFR 131.11) is the regulatory basis for EPA requiring the states to establish water quality criteria to protect designated uses and the criteria are used to assess whether or not a waterbody is meeting those uses.

The State Water Control Law authorizes protection and restoration of the quality of state waters, safeguarding the clean waters from pollution, prevention and reduction of pollution, and promotion of water conservation. The State Water Control Law at § 62.1-44.15 of the Code of Virginia requires the State Water Control Board to establish standards of quality and to modify, amend, or cancel any such standards or policies. It also requires the board to hold public hearings from time to time for the purpose of reviewing the water quality standards, and adopting, modifying, or canceling such standards as appropriate.

The correlation between the proposed regulatory action and the identified legal authority is that the amendments being considered are modifications of criteria that will protect designated uses, which are requirements of the Water Quality Standards. The authority to adopt standards as provided by the cited provisions is mandated, although the specific standards to be adopted or modified are discretionary to EPA and the state.

Purpose: The department has concluded that the proposed amendments to the regulation are essential to protecting the health, safety, and welfare of the citizens of the Commonwealth by protecting the water quality of source water for public water supplies.

Rationale for Using Fast-Track Rulemaking Process: Section 62.1-44.15 of the Code of Virginia mandates and authorizes the State Water Control Board to establish water quality standards and policies for any state waters consistent with the purpose and general policy of the State Water Control Law and to modify, amend, or cancel any such standards or policies established. Section 303(c) of the federal Clean Water Act mandates the State Water Control Board to review and modify and adopt water quality standards as appropriate.

A public water supply (PWS) designation may require more stringent effluent limits for discharges from permitted facilities within a five-mile distance beyond the locality that controls the PWS intake. However, department staff have determined there are no permitted facilities within that vie-mile distance for any of the four facility intakes for which a PWS designation is proposed. Also, a PWS designation protects source water that is used for human consumption. Given these factors, the rulemaking is assumed to be noncontroversial.

Substance: The proposed substantive amendments to 9VAC25-260-400, 9VAC25-260-420, 9VAC25-260-440, and 9VAC25-260-510 of the state water quality standards create a new subdivision in the respective river basins and place a PWS notation in the Special Standards column next to that subdivision of the river basin where the water supply intake is located. A PWS notation indicates that criteria under the column heading Public Water Supply in the table located at 9VAC25-260-140 apply in waters designated as such.

Issues: There are no primary advantages or disadvantages to the public. The primary advantage to the agency and the Commonwealth is having improved protection for waters used as source water for public water supply. There is no disadvantage to the agency or the Commonwealth that will result from the adoption of this amendment.

Department of Planning and Budget's Economic Impact Analysis:

Summary of the Proposed Amendments to Regulation. The State Water Control Board (Board) proposes to designate four additional bodies of water as public water supply (PWS) sources.

Background. A PWS is a water source whereby a city, town, or other community draws source water into their drinking water intake facilities, which in turn is eventually piped to area businesses, schools, and homes. According to the Board, more stringent criteria are typically applied to numerous pollutant parameters in order to protect the designated use of a PWS for human consumption. The Commonwealth's surface waters are currently divided into 10 river basins; in addition, 220 bodies of water are designated as a PWS.

The Board evaluates water bodies for the PWS designation on an ongoing basis. This action would grant PWS designation to four additional water sources. These water sources are located within the Counties of Cumberland, Greene, Rockingham, and Washington; they are also located within four basins: James, Potomac, Rappahannock, and the Tennessee and Big Sandy.¹ Three of the four water intake facilities are under development, and withdrawal structures are either currently under construction or are planned to be in the immediate future. One intake facility located in Potomac River Basin is active, and all withdrawal structures and appurtenances have been constructed and are currently in use.

Estimated Benefits and Costs. The most immediate implication for designating a body of water as a PWS is that it may require more stringent effluent limits for discharges from permitted facilities within a five-mile distance from the intake. However, according to DEQ, no permitted facilities are currently operating within five miles upstream from any of the proposed PWS, and DEQ is not aware of any future planned facilities that may require a permit. In addition, more stringent effluent limits do not apply to non-point pollution sources such as farms. Since no permitted facilities are within the five-mile distance for any of the four facility intakes for which a PWS designation is proposed, no significant economic impact is expected upon promulgation of the proposed changes.

Although the proposed PWS designations may theoretically make some potential industrial uses more expensive (such as for businesses that may consider locating within the segments in question) because of the more stringent PWS discharge standards, it would be highly speculative to project any such economic impact at this time. Should an effluent discharging firm consider locating within the segments in question, however, the proposed changes would ensure that the water quality is maintained at a level appropriate for human consumption.

Businesses and Other Entities Affected. There is no known existing or planned facilities that may be subject to more stringent water quality criteria due to the proposed four PWS designations. Thus, no adverse economic impact² or disproportional impact is expected on businesses or other entities.

Small Businesses³ Affected. The proposed amendments do not appear to adversely affect small businesses.

Localities⁴ Affected.⁵ The four additional water sources being proposed to be designated as PWS are located in Counties of Cumberland, Greene, Rockingham, and Washington. However, these PWS designations are not expected to impose costs on the localities. Consequently, no adverse economic impact on these counties is indicated.

Projected Impact on Employment. The proposed amendments do not appear to affect employment.

Effects on the Use and Value of Private Property. A PWS designation could potentially affect the value of properties within the designated segments, but given that there are no current or planned permitted discharges into the affected water bodies, projection of any such impact would be highly speculative at this time. Thus, the proposed amendments are unlikely to significantly affect the current use and value of private property upon promulgation of the proposed changes.

___________________________________________

¹Potomac River Basin: South Fork Shenandoah River and its tributaries from the City of Harrisonburg water supply intake near the confluence of Big Run to points five miles upstream;

James River Basin: Cobbs Creek (Cumberland County) and its tributaries from the public water supply intake on Cobbs Creek Reservoir to their headwaters;

Rappahannock River Basin: from the dam of Whit Run pumped storage reservoir on an unnamed tributary to White Run upstream to its tributaries;

Tennessee and Big Sandy Basins: South Fork Holston River and its tributaries from Washington County Service authority intake near the confluence of the Middle and South Fork Holston River to points five miles upstream.

²Adverse impact is indicated if there is any increase in net cost or reduction in net revenue for any entity, even if the benefits exceed the costs for all entities combined.

³Pursuant to § 2.2-4007.04 of the Code of Virginia, small business is defined as "a business entity, including its affiliates, that (i) is independently owned and operated and (ii) employs fewer than 500 full-time employees or has gross annual sales of less than $6 million."

⁴"Locality" can refer to either local governments or the locations in the Commonwealth where the activities relevant to the regulatory change are most likely to occur.

⁵§ 2.2-4007.04 defines "particularly affected" as bearing disproportionate material impact.

Agency's Response to Economic Impact Analysis: The Department of Environmental Quality has reviewed the economic impact analysis prepared by the Department of Planning and Budget and has no comment.

Summary:

The amendments designate as a public water supply one river basin section where a water supply intake is located in each of four Virginia water basins. The designation is shown with the notation "PWS" in the Special Standards column. Typically, more stringent criteria apply to numerous pollutant parameters to protect the designated use of public water supply for human consumption. Three of the four water supplies are proposed and withdrawal structures are either currently in construction or are planned to be in the immediate future. One of the water supplies is active with all withdrawal structures and appurtenances having been constructed and currently in use.

9VAC25-260-400. Potomac River Basin (Shenandoah River Subbasin).

Shenandoah River Subbasin

9VAC25-260-420. James River Basin (Middle).

9VAC25-260-440. Rappahannock River Basin.

9VAC25-260-510. Tennessee and Big Sandy River Basins (Holston River Subbasin).

Title of Regulation: 14VAC5-430. Insurance Data Security Risk Assessment and Reporting (adding 14VAC5-430-10 through 14VAC5-430-70).

Statutory Authority: §§ 12.1-13 and 38.2-223 of the Code of Virginia.

Effective Date: June 1, 2021.

Agency Contact: Katie Johnson, Insurance Policy Advisor, Bureau of Insurance, State Corporation Commission, P.O. Box 1157, Richmond, VA 23218, telephone (804) 371-9688, FAX (804) 371-9873, or email katie.johnson@scc.virginia.gov.

Summary:

The regulatory action implements the provisions of the Insurance Data Security Act (§ 38.2-621 et seq. of the Code of Virginia), Chapter 264 of the 2020 Acts of Assembly, and establishes cybersecurity initiatives and notification procedures for insurers, insurance agencies, and licensees or third-party providers. Changes to the proposed regulation include (i) removing the distinction between Level One and Level Two licensees in favor of a standard of measures appropriate to the size and complexity of the licensee; (ii) permitting licensees to use National Institute of Standards and Technology or any other substantially similar standard as a safe harbor for compliance with the chapter; (iii) removing the requirement that licensees that do not plan to notify consumers of a cybersecurity event must provide a detailed explanation of this decision to the Commissioner and that the Commissioner has the ability to review that explanation and override it; (iv) adding a provision that a decision not to notify consumers of a cybersecurity event requires an explanation to the Commissioner supporting the licensee's decision without unreasonable delay; and (v) making all compliance dates in the chapter July 1, 2022, for consistency.

AT RICHMOND, MAY 24, 2021

COMMONWEALTH OF VIRGINIA, ex rel.

STATE CORPORATION COMMISSION

CASE NO. INS-2020-00168

Ex Parte In the matter of Adopting

Rules to Implement the Requirements

of the Insurance Data Security Act

ORDER ADOPTING REGULATIONS

On August 13, 2020, the State Corporation Commission ("Commission") entered an Order to Take Notice of a proposal by the Bureau of Insurance ("Bureau") to adopt new rules at Title 14, Chapter 430 of the Virginia Administrative Code (14VAC5-430-10 et seq.), entitled Insurance Data Security Risk Assessment and Reporting ("Rules").

The Bureau's proposed Rules were drafted to comply with the requirements of the Insurance Data Security Act, §§ 38.2-621 et seq. of the Code of Virginia ("IDSA"). The IDSA was enacted by the 2020 Virginia General Assembly and establishes standards that Bureau licensees must meet regarding data security, cybersecurity investigations, and notification to the Commissioner of Insurance and consumers of cybersecurity events. The IDSA also directed the Commission to adopt regulations to implement the requirements of the IDSA.¹ A detailed summary of these proposed amendments was set forth in the Order to Take Notice.

The Order to Take Notice and proposed regulations were published in the Virginia Register of Regulations on September 14, 2020, posted on the Commission's website, and sent to all to all insurers, burial societies, fraternal benefit societies, health services plans, risk retention groups, joint underwriting associations, group self-insurance pools, and group self-insurance associations licensed by the Commission, qualified reinsurers in Virginia (collectively, potential "Licensees"), the Virginia Attorney General's Division of Consumer Counsel ("Consumer Counsel") and to all interested persons. Licensees, Consumer Counsel and other interested parties were afforded the opportunity to file written comments or request a hearing on or before October 26, 2020.

Comments to the Rules were filed by Wesley Bissett, Independent Agents and Brokers of America ("IIABA"); Robert Bradshaw, on behalf of Independent Insurance Agents of Virginia, as well as on behalf of Christine E. Miller,, Kevin Kowar, Professional Insurance Agents of Virginia/DC, Kathie Naylor, Virginia Association of Health Underwriters; Nancy Egan, American Property Casualty Insurance Association; Marc Follmer, Virginia Farm Bureau Mutual Insurance Company ("VFB"); Michelle Caroll Foster, American Council of Life Insurers; Leigh Hubbard, Virginia Land Title Association; Andrew Kirkner, National Association of Mutual Insurance Companies; and John Morris, UnitedHealthcare ("UHC").²

The Bureau considered the comments filed and responded to them in its Response to Comments ("Response"),³ which the Bureau filed with the Clerk of the Commission on April 5, 2021. In its Response, the Bureau addressed the comments and either recommended that various sections of the proposed Rules be amended or indicated why it did not believe other suggested revisions were authorized or warranted.

NOW THE COMMISSION, having considered the proposed regulations, the comments filed, the Bureau's Statement of Position, the record herein, and applicable law, concludes that the proposed regulations should be adopted by the Commission, as recommended and modified and attached hereto. The Commission further concludes that the proposed regulations, as modified, should be adopted with an effective date of June 1, 2021.

Accordingly, IT IS ORDERED THAT:

(1) The proposed regulations, as modified herein and attached hereto, are adopted effective June 1, 2021.

(2) This Order and the attached regulations shall be made available on the Commission's website: scc.virginia.gov/pages/Case-Information.

(3) The Commission's Division of Information Resources shall provide a copy of this Order and the regulations to the Virginia Registrar of Regulations for publication in the Virginia Register of Regulations.

(4) This case is dismissed, and the papers filed herein shall be placed in the Commission's file for ended causes.

A COPY of this Order and the attached regulations shall be sent by the Clerk of the Commission to the Commission's Office of General Counsel, to the Attorney General's Division of Consumer Counsel and to the Commissioner of the Bureau of Insurance, who shall email an electronic link to this Order and attached regulations to all insurers, burial societies, fraternal benefit societies, health services plans, risk retention groups, joint underwriting associations, group self-insurance pools, and group self-insurance associations licensed by the Commission, qualified reinsurers in Virginia and such other interested persons as he may designate.

_____________________________

¹See § 38.2-627 D of the IDSA.

²Comments submitted by NAIMIC, IIABA and UHC were filed on October 27, 2020, after the deadline imposed by the Order to Take Notice. However, as the Bureau indicated it considered and responded to all comments received, the Commission has considered all comments filed as well.

³The only commenter requesting a hearing, withdrew the request based upon the Bureau’s proposed modifications to the Rules as outlined in the Response.

Chapter 430

Insurance Data Security Risk Assessment and Reporting

14VAC5-430-10. Applicability and scope.

This chapter sets forth rules to carry out the provisions of the Insurance Data Security Act, Article 2 (§ 38.2-621, et seq.) of Chapter 6 of Title 38.2 of the Code of Virginia, and sets minimum standards for risk assessment and security standards required of all licensees. However, as outlined, the specific requirements for licensees may differ in certain circumstances, depending on the size and complexity of the licensee. This chapter applies to and protects physical and electronic data, including nonpublic information, stored, transmitted, and processed across various information systems or any other media used by licensees.

14VAC5-430-20. Severability.

If any provision of this chapter or its application to any person or circumstance is for any reason held to be invalid by a court or the commission, the remainder of this chapter and the application of the provisions to other persons or circumstances shall not be affected.

14VAC5-430-30. Definitions.

The following word and terms when used in this chapter shall have the following meanings, unless context clearly indicates otherwise:

"Authorized person" means a person known to and authorized by the licensee and determined to be necessary and appropriate to have access to the nonpublic information held by the licensee and its information systems.

"Bureau" means the Bureau of Insurance.

"Commissioner" means the Commissioner of Insurance.

"Consumer" means an individual, including any applicant, policyholder, former policyholder, insured, beneficiary, claimant, and certificate holder, who is a resident of Virginia and whose nonpublic information is in the possession, custody, or control of a licensee or an authorized person.

"Cybersecurity event" means an event resulting in unauthorized access to, disruption of, or misuse of an information system or nonpublic information in the possession, custody, or control of a licensee or an authorized person. "Cybersecurity event" does not include (i) the unauthorized acquisition of encrypted nonpublic information if the encryption, process, or key is not also acquired, released, or used without authorization or (ii) an event in which the licensee has determined that the nonpublic information accessed by an unauthorized person has not been used or released and has been returned or destroyed.

"Encrypted" or "encryption" means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key.

"Home state" means the jurisdiction in which the producer maintains its principal place of residence or principal place of business and is licensed by that jurisdiction to act as a resident insurance producer.

"Information security program" means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information.

"Information system" means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic information, as well as any specialized system, such as industrial or process control systems, telephone switching and private branch exchange systems, and environmental control systems.

[ "Level one licensee" means any licensee with more than 10 employees and authorized persons.

"Level two licensee" means any licensee with 10 or fewer employees and authorized persons. A level two licensee may choose to comply with the requirements for a level one licensee. If a licensee ceases to qualify as a level two licensee, the licensee shall have 180 days from the date it ceases to qualify to comply with the requirements of a level one licensee. ]

"Licensee" means any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered pursuant to the insurance laws of Virginia. "Licensee" does not include a purchasing group or a risk retention group chartered and licensed in a state other than Virginia or a person that is acting as an assuming insurer that is domiciled in another state or jurisdiction.

"Multi-factor authentication" means authentication through verification of at least two of the following types of authentication factors:

1. Knowledge factors, such as a password;

2. Possession factors, such as a token or text message on a mobile device; or

3. Inherence factors, such as a biometric characteristic.

"Nonpublic information" means information that is not publicly available information and is:

1. Business-related information of a licensee the tampering with which, or the unauthorized disclosure, access, or use of which, would cause a material adverse impact to the business, operations, or security of the licensee;

2. Any information concerning a consumer that because of name, number, personal mark, or other identifier can be used to identify such consumer, in any combination with a consumer's (i) social security number; (ii) driver's license number or nondriver identification card number; (iii) financial account, credit card, or debit card number; (iv) security code, access code, or password that would permit access to a consumer's financial account; (v) passport number; (vi) military identification number; or (vii) biometric records; or

3. Any information or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify a particular consumer, and that relates to (i) the past, present, or future physical, mental, or behavioral health or condition of any consumer or a member of the consumer's family; (ii) the provision of health care to any consumer; or (iii) payment for the provision of health care to any consumer.

[ "Nonpublic information" does not include a consumer's personally identifiable information that has been anonymized using a method no less secure than the safe harbor method under HIPAA.

"Publicly available information" means any information that a licensee has a reasonable basis to believe is lawfully made available to the general public from federal, state, or local government records; widely distributed media; or disclosures to the general public that are required to be made by federal, state, or local law. A licensee has a reasonable basis to believe that information is lawfully made available to the general public if the licensee has taken steps to determine (i) that the information is of the type that is available to the general public and (ii) whether a consumer can direct that the information not be made available to the general public and, if so, that such consumer has not done so. ]

"Third-party service provider" means a person, not otherwise defined as a licensee, that contracts with a licensee to maintain, process, or store nonpublic information or otherwise is permitted access to nonpublic information through its provision of services to the licensee, or an insurance-support organization.

14VAC5-430-40. Information security program risk assessment.

A. [ In addition to the information security program requirements of § 38.2-623 of the Code of Virginia, each level one licensee shall conduct periodic risk assessments consistent with the objectives of the most current revision of NIST SP 800-30, NIST SP 800-39, or other substantially similar standard, taking into consideration the level one licensee's size and complexity.

1. Each level one licensee shall consider cybersecurity risks in its enterprise risk management process.

2. Compliance with the provisions of this subsection is required for all level one licensees on or before (insert date one year from the effective date of this chapter).

B. ] In addition to the information security program requirements of § 38.2-623 of the Code of Virginia, taking into consideration the [ level two ] licensee's size and complexity, each [ level two ] licensee shall conduct a periodic risk assessment consistent with the following [ elements processes ]:

1. Identify reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration, or destruction of nonpublic information held by a [ level two ] licensee [ , including the security of information systems and nonpublic information that are accessible to or held by third-party service providers ];

2. Assess the likelihood and potential damage of these threats taking into consideration the sensitivity of nonpublic information in the possession, custody, or control of the licensee [ and its authorized persons ];

3. Assess the sufficiency of policies, procedures, information systems, and other safeguards in place to manage these threats, including consideration of threats in each relevant area of the licensee's operations, such as employee training [ and management ]; information classification that includes the processing, storage, transmission, and disposal of information; and the detection, prevention, and response to attacks and intrusions; and

4. Implement information safeguards to manage the threats identified in the licensee's ongoing assessment and, no less than annually, assess the effectiveness of the key controls, systems, and procedures.

[ B. An assessment conducted in accordance with the objectives of the most current revision of NIST SP 800-30, NIST SP 800-39, or other substantially similar standard shall meet the requirements for a periodic assessment in subsection A of this section.

C. ] Compliance with the provisions of this subsection is required of all [ level two ] licensees on or before July 1, 2022.

14VAC5-430-50. Information security program security measures.

A. [ As part of its information security program and based on its risk assessments, each level one licensee shall implement the appropriate measures consistent with NIST SP 800-53, NIST SP 800-171, or any substantially similar framework based on these standards, taking into consideration its size and complexity. Compliance with the provisions of this subsection is required for all level one licensees on or before (insert date one year from the effective date of this chapter).

B. ] As part of its information security program and based on its risk assessments, each [ level two ] licensee shall implement appropriate security measures as follows:

1. Manage the data, personnel, devices, systems, and facilities of the licensee in accordance with its identified risk;

2. Protect, by encryption or other appropriate means, all nonpublic information while being transmitted over an external network;

3. Protect, by encryption or other appropriate means, all nonpublic information stored on portable computing, storage devices, or media;

4. Adopt secure development practices for applications developed in-house and used by the licensee;

5. Adopt procedures for evaluating and assessing the security of externally developed applications utilized by the licensee;

6. Implement effective controls, [ including which may include ] multi-factor authentication, for authorized [ individuals persons ] to access nonpublic information; and

7. Use audit trails or audit logs designed to detect and respond to cybersecurity events and to reconstruct material financial transactions.

[ B. ] Compliance with the provisions of this [ subsection section ] is required of all [ level two ] licensees on or before July 1, 2022.

C. [ Security measures implemented in accordance with the objectives of the most current revision of NIST SP 800-30, NIST SP 800-39, or other substantially similar standard shall meet the requirements for security measures in subsection A of this section.

D. ] Effective July 1, 2022, each licensee that utilizes a third-party service provider shall:

1. Exercise due diligence in selecting a third-party service provider; and

2. Require the third-party service provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the third-party service provider.

14VAC5-430-60. Reporting cybersecurity events to the commissioner.

A. Reporting cybersecurity events to the commissioner.

1. Once a licensee has determined [ both ] that a cybersecurity event has occurred and [ that ] the licensee has a duty to report it to the commissioner pursuant to § 38.2-625 of the Code of Virginia, the licensee shall notify the commissioner within three business days that it has information to report, using the email address designated by the bureau. This notification should include the name, telephone number, and email address of the individual who is the licensee's designated contact for the cybersecurity event.

2. Instructions for communicating the information required by § 38.2-625 of the Code of Virginia to the commissioner through a secure portal will be provided by the bureau in response to the email.

3. The licensee shall update the commissioner on the progress of its investigation as information becomes known to the licensee until the licensee has provided [ all as much of ] the information set forth in § 38.2-625 of the Code of Virginia [ as possible ].

4. If also required to notify consumers [ under § 38.2-626 of the Code of Virginia and 14VAC5-430-70 ], licensees shall (i) provide the commissioner with a copy of the notice template and any documentation provided to consumers and (ii) maintain a list of consumers notified and retain the list for [ the longer of five years or ] the timeframe established by § 38.2-624 D of the Code of Virginia.

B. Except where nonpublic information has been accessed, once a domestic insurance company has notified the commissioner of the date, nature, and scope of the cybersecurity event, the [ insurance ] company may report [ all any ] remaining information required by § 38.2-625 of the Code of Virginia [ discovered by the licensee pursuant to its investigation ] (i) annually in a separate report, (ii) in the certification described in § 38.2-623 H of the Code of Virginia, or (iii) on a continuing basis through the portal established for [ the company by reporting cybersecurity events to ] the bureau [ for this purpose ].

C. Unless exempted by § 38.2-629 A 2 of the Code of Virginia, producers whose home state is Virginia shall report cybersecurity events to the commissioner in accordance with subsection A of this section.

D. If required to report to the commissioner, nondomestic insurance companies, and, unless exempted under § 38.2-629 A 2 of the Code of Virginia, producers whose home state is not Virginia shall notify the commissioner of the cybersecurity event pursuant to § 38.2-625 A 2 of the Code of Virginia as set forth in subsection A of this section.

14VAC5-430-70. Consumer notification provisions.

A. Licensees, except those exempted under [ subsection A 1 or A 2 of ] § 38.2-629 [ A 2 ] of the Code of Virginia, that determine a cybersecurity event has occurred and has caused or has a reasonable likelihood of causing identity theft or other fraud to consumers whose information was accessed or acquired shall notify those consumers in accordance with § 38.2-626 of the Code of Virginia, subject to any applicable numerical threshold.

B. Each licensee required to notify consumers of a cybersecurity event that does not intend to notify consumers based on a belief that the cybersecurity event does not have a reasonable likelihood of causing identity theft or other fraud to the consumers shall notify the commissioner [ , without unreasonable delay, ] of its position and provide [ a detailed an ] explanation supporting the licensee's position.

[ C. If, upon review of the report, the cybersecurity event does have a reasonable likelihood of causing identity theft or other fraud to the consumer, the commissioner may require the licensee to notify the affected consumers in accordance with § 38.2-626 of the Code of Virginia. ]

DOCUMENTS INCORPORATED BY REFERENCE (14VAC5-430)

National Institute of Standards and Technology, Computer Security Division, Information Technology Laboratory, 100 Bureau Drive (Mail Stop 8930), Gaithersburg, MD 20899-8930, sec-cert@nist.gov

NIST, Special Publication, Guide for Conducting Risk Assessments, 800-30 (rev. 1, 9/2012)

NIST, Special Publication, Managing Information Security Risk Organization, Mission, and Information System View, 800-39 (eff. 3/2011)

[ NIST, Special Publication, Security and Privacy Controls for Federal Information Systems and Organizations, 800-53 (rev. 4, 4/2013)

NIST, Special Publication, Protecting Controlled Unclassified Information, 800-171 (rev. 2, 2/2020) ]

Title of Regulation: 18VAC125-30. Regulations Governing the Certification of Sex Offender Treatment Providers (amending 18VAC125-30-10, 18VAC125-30-30, 18VAC125-30-40, 18VAC125-30-50, 18VAC125-30-70, 18VAC125-30-80, 18VAC125-30-90, 18VAC125-30-110; adding 18VAC125-30-25, 18VAC125-30-81, 18VAC125-30-91, 18VAC125-30-101; repealing 18VAC125-30-100, 18VAC125-30-120).

Statutory Authority: §§ 54.1-2400 and 54.1-3605 of the Code of Virginia.

Public Hearing Information: No public hearing is currently scheduled.

Public Comment Deadline: July 7, 2021.

Effective Date: July 22, 2021.

Agency Contact: Jaime Hoyle, Executive Director, Board of Psychology, 9960 Mayland Drive, Suite 300, Richmond, VA 23233, telephone (804) 367-4406, FAX (804) 327-4435, or email jaime.hoyle@dhp.virginia.gov.

Basis: Regulations of the Board of Psychology are promulgated under the general authority of § 54.1-2400 of the Code of Virginia, which establishes the general powers and duties of health regulatory boards including the responsibility to promulgate regulations that are reasonable and necessary. Specific authority to regulate sex offender treatment provider certification is found in § 54.1-3611 of the Code of Virginia.

Purpose: Treatment of sex offenders requires special training and expertise. The goal is to treat the offender to avoid recidivism and to also protect the public. The board determined that additional standards of practice were necessary to ensure a certified provider could be held accountable for unprofessional conduct similar to any other mental health provider. Therefore, the regulation is absolutely necessary for public health, safety, and welfare.

Rationale for Using Fast-Track Rulemaking Process: This action is the result of a comprehensive periodic review of 18VAC125-30. No public comment was received. The amended regulation was developed by persons with expertise as sex offender treatment providers; the amendments are not expected to be controversial.

Substance: The amendments (i) clarify and update requirements and language consistent with current practice; (ii) eliminate the need for reference letters with an application and substituting a report from the National Practitioner Data Bank and verification of a license from another board; (iii) provide for acceptance of supervised experience obtained in another state; (iv) add an allowance for exceptions or exemptions for continuing education requirement; and (v) expand the standards of practice and grounds for disciplinary action for consistency with other boards and professions.

Issues: The primary advantage of the amendments is greater protection for the public and for the clients who receive treatment with thorough enhanced and clarified standards of practice and grounds for disciplinary action. There are no disadvantages to the public. There are no advantages or disadvantages to the Commonwealth.

Department of Planning and Budget's Economic Impact Analysis:

Summary of the Proposed Amendments to Regulation. The Board of Psychology (Board) proposes to amend 18VAC125-30 Regulations Governing the Certification of Sex Offender Treatment Providers (regulation) in order to implement a number of changes following a periodic review.¹ The proposed amendments would (i) clarify and update requirements to be consistent with current practice, (ii) remove the requirement for three reference letters and instead require a report from the National Practitioner Data Bank (NPDB) and a verification of any other license held as a health professional, (iii) allow supervised experience obtained in another state to count towards certification requirements, (iv) add allowable exceptions or exemptions to the continued education requirements, and (v) expand the standards of practice and grounds for disciplinary action to be consistent with those found in the regulations for other health professions.

Background. Pursuant to a periodic review, the Board proposes to make a number of changes. The most significant changes are summarized as follows:

1. Clarify and update requirements and language consistent with current practice: For example, the definition of "ancillary services" is updated by replacing "substance abuse avoidance" with "substance misuse," and replacing "sex education" with "human sexuality." Also, the definition of "face-to-face" contact is amended to include interaction between therapy trainees and supervisors via technology. In addition, while the total hours for face-to face supervision would not change (a minimum of 100 hours of face-to-face supervision out of 2,000 hours of experience), the requirement for six hours per month of face-to-face supervision is repealed and replaced with "one hour of face-to-face supervision for every 20 hours of experience." The Department of Health Professions (DHP) reports that this change would allow greater flexibility for the supervisor and supervisee.

2. Remove the requirement for three reference letters to accompany a certification application: Instead, applicants would submit a report from the NPDB and verification of any licenses from another board.² According to DHP, the applicant would request a report from the NPDB which, in turn, would be submitted to DHP along with other required documentation. The NPDB charges healthcare professionals $4 for each "self-query" of their own report, of which they may choose to receive hard copies by mail.³ DHP reports that most sex offender treatment providers are also licensed as social workers, counselors, or other mental health professionals. Thus, verification of that license also serves as an effective method to ensure the applicant's professional standing.

3. Acceptance of supervised experience obtained in another state: Section 50 would permit the board to accept supervised experience hours completed in another jurisdiction for individuals with less than five years of documented work experience. New language would prohibit candidates from beginning their supervised experience until after completing the required degree as set forth in 18VAC125-30-40. This follows the direction taken by the Board of Social Work in 2020.⁴

4. Add an allowance for exceptions or exemptions for the continuing education (CE) requirement: A new section (81) would set out requirements for CE. While there is no change to the hourly requirements, the Virginia Sex Offender Treatment Association would be added as an approved CE provider. Other proposed amendments would: (i) exempt providers from CE for their first renewal after initial certification; (ii) grant the Board authority to grant extensions or exemptions at their discretion;⁵(iii) require maintenance of documentation for three years to allow for possible audits, eliminating the need to keep records indefinitely; and(iv) clarify that CE required by a disciplinary order may not be used to satisfy the renewal requirement for CE.

5. Expand the standards of practice and grounds for disciplinary action to be consistent with other boards and professions: Additional grounds would be added in Section 110 for consistency with the regulations of related boards such as counseling, social work, and psychology.⁶ These expanded grounds for action include engaging in intentional or negligent conduct that causes or is likely to cause harm to a client, performing functions outside the areas of competency, performing acts of fraud or deceiving the public, and failing to cooperate with DHP staff in the conduct of an investigation.

Lastly, one of the proposed amendments would prohibit treatment providers from entering into an intimate or romantic relationship with a current or former sex offender client until five years after the cessation of treatment. In contrast, 18VAC125-30-100 of the regulation currently prohibits treatment providers from entering into such relationships altogether, regardless of how much time has passed since cessation of treatment. Although the proposed language is intended to align the standards of practice with those adopted by the Board of Social Work and Board of Counseling, which extended the prohibition on entering such relationships from three years to five years, sex offender treatment providers had previously not been allowed to enter such relationships at all. In response to questions from the Department of Planning and Budget as to whether the Board intended for its requirements to be more permissive than before, DHP reported, "We do not believe the standard should be different for this type of practitioner than for other behavioral health professions; most who hold this certification are also licensees as counselors, social workers, etc. There is mitigating language in that subdivision in which the practitioner bears the burden of assuring that there has been no exploitation of the client both during and following treatment."⁷

Estimated Benefits and Costs. By clarifying the requirements to obtain and maintain certification, the proposed amendments would benefit current and prospective sex offender treatment providers as well as the organizations that employ them. Some providers may incur lower costs to maintain their certification due to the new exemptions and exceptions for CE requirements. Applicants who have completed a portion of their training in another state would benefit by being able to use supervised experience hours acquired elsewhere to meet the certification requirements.

Although applicants would have to pay a $4 fee to obtain a report from the NPDB, they would benefit from not having to expend the time and effort to obtain three letters of reference from currently licensed professionals. Utilizing a national database promotes greater transparency since applicants cannot select their letter writers and previous disciplinary actions in other states are less likely to be accidentally overlooked. Thus, prospective employers of certified sex offender treatment providers and the public at large would benefit from using the NPDB.

In addition, aligning the grounds for disciplinary action with the regulations that govern other mental health treatment providers would benefit the public by ensuring that a provider facing disciplinary charges under one board is not permitted to continue providing sex offender treatment simply due to discrepancies in the standards of practice.

Businesses and Other Entities Affected. DHP reports that there are currently 437 certified sex offender treatment providers. It is unknown how many of these providers are also licensed social workers, counselors, or other mental health providers. DHP reports that most sex offender treatment providers are employed by government agencies or are contracted by court systems, but some may be in private practice, especially if they are also licensed as other mental health providers.

Small Businesses⁸ Affected. Private practices that are either (i) owned and operated by or (ii) employ certified sex offender treatment providers would be affected by the proposed amendments. Although the number of such businesses is unknown, the proposed amendments do not appear to create any new costs for them.

Localities⁹ Affected.¹⁰ The proposed amendments do not introduce new costs for local governments and are unlikely to affect any locality in particular.

Projected Impact on Employment. The proposed amendments are unlikely to affect the employment of certified sex offender treatment providers. The number of certified providers may increase since some of the proposed amendments would make it easier for providers from other states to obtain certification in Virginia and provide greater flexibility for supervisors and supervisees to meet the "face to face" supervised experience requirements.

Effects on the Use and Value of Private Property. The proposed amendments are unlikely to affect the use and value of private property. Real estate development costs are not affected.

______________________________________

¹See https://townhall.virginia.gov/l/ViewPReview.cfm?PRid=1900.

²The National Practitioner Data Bank is a web-based repository of reports containing information on medical malpractice payments and certain adverse actions related to health care practitioners, providers, and suppliers. See https://www.npdb.hrsa.gov/topNavigation/aboutUs.jsp. In Virginia, the Board of Physical Therapy, Board of Dentistry, Board of Medicine, and Board of Social Work also currently use the NPDB.

³See https://www.npdb.hrsa.gov/pract/selfQueryBasics.jsp for detailed instructions on how individual professionals should use the service to obtain reports.

⁴See https://townhall.virginia.gov/L/ViewStage.cfm?stageid=9103.

⁵According to DHP, "Such provisions are allowed for all other professions for this and other boards but were missing in the current regulations."

⁶As per pages 11-12 of the Agency Background Document: "Without consistency in the grounds, it is possible for a licensee to have disciplinary action taken against his license but avoid discipline for this certification as a sex offender treatment provider." See https://townhall.virginia.gov/l/GetFile.cfm?File=31\5660\9149\AgencyStatement_DHP_9149_v1.pdf

⁷While this protects individuals seeking treatment, it does not address the possibility that sex offenders who have received treatment may wrongfully manipulate their providers into signing off on parole applications or similar actions that would reduce legal penalties and/or enable recidivist behavior.

⁸Pursuant to § 2.2-4007.04 of the Code of Virginia, small business is defined as "a business entity, including its affiliates, that (i) is independently owned and operated and (ii) employs fewer than 500 full-time employees or has gross annual sales of less than $6 million."

⁹"Locality" can refer to either local governments or the locations in the Commonwealth where the activities relevant to the regulatory change are most likely to occur.

¹⁰§ 2.2-4007.04 defines "particularly affected" as bearing disproportionate material impact.

Agency's Response to Economic Impact Analysis: The Board of Psychology concurs with the economic impact analysis of the Department of Planning and Budget.

Summary:

As a result of a periodic review, the amendments (i) clarify and update requirements and language consistent with current practice, (ii) eliminate the need for reference letters with an application and substitute a report from the National Practitioner Data Bank and verification of a license from another board, (iii) provide for acceptance of supervised experience obtained in another state, (iv) add an allowance for exceptions or exemptions for continuing education requirement, and (v) expand the standards of practice and grounds for disciplinary action for consistency with other boards and professions.

18VAC125-30-10. Definitions.

The following words and terms when used in this chapter shall have the following meanings, unless the context clearly indicates otherwise:

"Ancillary services" means training in that includes anger management, stress management, assertiveness, social skills, substance abuse avoidance misuse, victim empathy, and sex education human sexuality as part of an identified sex offender treatment provider program.

"Applicant" means an individual who has submitted a completed application with documentation and the appropriate fees to be examined for certification as a sex offender treatment provider.

"Assessment" means using specific techniques of evaluation and measurement to collect facts related to sexually abusive thoughts and behaviors contributing to sexual offense.

"Board" means the Virginia Board of Psychology.

"Certified sex offender treatment provider" means a person who is certified to provide treatment to sex offenders and who provides such services in accordance with the provisions of §§ 54.1-2924.1, 54.1-3005, 54.1-3505, 54.1-3609, 54.1-3610, 54.1-3611, and 54.1-3705 of the Code of Virginia and the regulations promulgated pursuant to these provisions.

"Competency area" means an area in which a person possesses knowledge and skills and the ability to apply them in the clinical setting.

"Face-to-face" means in-person or real-time interactive in which there is visual and audio contact and an opportunity for interaction.

"Sex offender" means (i) any person who has been adjudicated or convicted of a sex offense or has a founded child sexual abuse status by the Department of Social Services; (ii) any person for whom any court has found sufficient evidence without specific finding of guilt of committing a felony or misdemeanor which may be reasonably inferred to be sexually motivated; or (iii) any person who admits to or acknowledges behavior which would result in adjudication, conviction, or a founded child sexual abuse status.

"Sex offense" means behavior in violation of any of the following statutes in the Code of Virginia: § 18.2-48 in part (abduction of any person with intent to defile such person), § 18.2-60.3 in part (includes only those instances in which sexual motivation can be reasonably inferred), § 18.2-61, § 18.2-63, § 18.2-64.1, § 18.2-67.1, § 18.2-67.2, § 18.2-67.2:1, § 18.2-67.3, § 18.2-67.4, § 18.2-67.5, § 18.2-130 in part (includes only those instances in which sexual motivation can be reasonable inferred), subsection A of § 18.2-361 in part "If any person carnally knows in any manner any brute animal" and subsection B § 18.2-361 in its entirety, § 18.2-366, § 18.2-370, § 18.2-370.1, § 18.2-374.1 (not to include plethysmographic testing materials in the possession of qualified mental health professionals or technicians), § 18.2-387.

"Supervision" means the ongoing process performed by a supervisor who monitors the performance of the person supervised and provides regular documented individual consultation, guidance, and instruction with respect to the skills and competencies of the person providing sex offender treatment services.

"Supervisor" means an individual who assumes full responsibility for the education and training activities of a person as it relates to sex offender treatment and provides the supervision required by such a person. The supervisor shall be a certified sex offender treatment provider and licensed by the Board of Medicine, Nursing, Counseling, Psychology or Social Work.

"Supervisory contract" means an agreement that outlines the expectations and responsibilities of the supervisor and the trainee in accordance with this chapter.

"Treatment" means therapeutic intervention to promote change in sexually abusive thoughts and behaviors which specifically addresses the occurrence and dynamics of sexual behavior and utilizes specific strategies to promote change and to reduce the risk of recidivism.

18VAC125-30-25. Current name and address.

Certificate holders shall notify the board in writing within 60 days of a change in name or a change of the address of record or of the public address if different from the address of record.

18VAC125-30-30. Prerequisites to certification.

A. Every applicant for certification by the board shall:

1. Meet the educational requirements prescribed in 18VAC125-30-40;

2. Meet the experience requirements prescribed in 18VAC125-30-50;

3. Submit to the board:

a. A completed application form;

b. Documented evidence of having fulfilled the education, experience, and supervision set forth in 18VAC125-30-40 and 18VAC125-30-50; and

c. Reference letters from three licensed health care professionals familiar with and attesting to the applicant's skills and experience A current report from the National Practitioner Data Bank; and

d. Verification of any other health or mental health license, certificate, or registration ever held in Virginia or in another jurisdiction. In order to qualify for certification, the applicant shall have no unresolved action against a license, certificate, or registration. The board will consider history of disciplinary action on a case-by-case basis.

B. The board may certify by endorsement an individual who can document current certification as a sex offender treatment provider in good standing obtained by standards substantially equivalent to those outlined in this chapter as verified by an out-of-state certifying agency on a board-approved form.

18VAC125-30-40. Educational requirements.

An applicant for certification as a sex offender treatment provider shall:

1. Document completion of one of the following degrees:

a. A master's or doctoral degree in social work, psychology, counseling, or nursing from a regionally accredited university; or

b. The degree of Doctor of Medicine or Doctor of Osteopathic Medicine from an institution that is approved by an accrediting agency recognized by the Virginia Board of Medicine

Graduates of institutions that are not accredited by an acceptable accrediting agency shall establish the equivalency of their education to the educational requirements of the Virginia Board of Social Work, Psychology, Counseling, Nursing or Medicine.

2. Provide documentation of certificates of completion documenting 50 clock hours of training education acceptable to the board in the following areas, with 15 clock hours in each area identified in subdivisions 2 a and 2 b of this section, 10 clock hours in each the area identified in subdivision 2 c of this section, and five clock hours in each area identified in subdivisions 2 d and 2 e of this section:

a. Sex offender assessment;

b. Sex offender treatment interventions;

c. Etiology/developmental issues of sex offense behavior;

d. Criminal justice and legal issues related to sexual offending; and

e. Program evaluation, treatment efficacy, Treatment effectiveness and issues related to relapse prevention or recidivism of sex offenders.

18VAC125-30-50. Experience requirements; supervision.

A. Registration of supervision. Supervised experience obtained in Virginia without prior written board approval shall not be accepted toward certification. Candidates shall not begin the experience until after completion of the required degree as set forth in 18VAC125-30-40.

1. In order to register supervision with the board, individuals shall submit Prior to beginning supervised postdegree experience in Virginia, an individual shall submit:

a. A completed supervisory contract;

b. The application and the registration fee prescribed in 18VAC125-30-20; and

c. Official graduate transcript documenting the degree requirement of 18VAC125-30-40.

2. The board may waive the registration requirement for individuals who have obtained at least five years of documented work experience in sex offender treatment in another jurisdiction. For individuals with less than five years of documented work experience, the board may accept supervised experience hours completed in another jurisdiction, provided the experience meets the requirements of this section, except it is not required that a supervisor in the other jurisdiction hold certification as a sex offender treatment provider or a license issued by a health regulatory board in Virginia.

B. An applicant for certification as a sex offender treatment provider shall provide documentation of having 2,000 hours of postdegree clinical experience in the delivery of clinical assessment/treatment services. At least 200 hours of this experience must be face-to-face treatment and assessment with sex offender clients.

1. The experience shall include a minimum of 100 hours of face-to-face supervision within the 2,000 hours experience with a minimum of six hours per month one hour of face-to-face supervision for every 20 hours of experience. A minimum of 50 hours shall be in individual face-to-face supervision. Face-to-face supervision obtained in a group setting shall include no more than six trainees in a group.

2. If the applicant has obtained the required postdegree clinical experience for a mental health license within the past 10 years, he the applicant can receive credit for those hours that were in the delivery of clinical assessment/treatment services with sex offender clients provided:

a. The applicant can document that the hours were in the treatment and assessment with sex offender clients; and

b. The supervisor for those hours can attest that he was licensed and qualified to render services to sex offender clients at the time of the supervision.

C. Supervised experience obtained in Virginia without prior written board approval shall not be accepted toward certification. Candidates shall not begin the experience until after completion of the required degree as set forth in 18VAC125-30-40. An individual who proposes to obtain supervised postdegree experience in Virginia shall, prior to the onset of such supervision, submit a supervisory contract along with the application package and pay the registration of supervision fee set forth in 18VAC125-30-20.

D. The supervisor.

1. The supervisor shall assume responsibility for the professional activities of the applicant.

2. The supervisor shall not provide supervision for activities for which the prospective applicant has not had appropriate education.

3. The supervisor shall be a certified sex offender treatment provider and hold a current and unrestricted Virginia license as a clinical nurse specialist, doctor of medicine or osteopathic medicine, professional counselor, marriage and family therapist, clinical social worker, or clinical psychologist and.

4. The supervisor shall provide supervision only for those sex offender treatment services which he is qualified to render.

4. 5. At the time of formal application for certification, the board approved supervisor shall document for the board the applicant's total hours of supervision, length of work experience, competence in sex offender treatment, and needs for additional supervision or training.

18VAC125-30-70. Supervision of unlicensed persons.

Those A certified sex offender treatment provider shall provide supervision for unlicensed persons providing ancillary services as part of an identified sex offender treatment program in an exempt practice situation and not meeting the educational and experience requirements to become an applicant shall provide such services under the supervision of a certified sex offender treatment provider.

18VAC125-30-80. Annual renewal of certificate.

A. Every certificate issued by the board shall expire on June 30 of each year.

B. Along with the renewal application, the certified sex offender treatment provider shall:

1. Submit the renewal fee prescribed in 18VAC125-30-20; and

2. Attest to having obtained six hours of continuing education in topics related to the provision of sex offender treatment within the renewal period. Continuing education shall be offered by a sponsor or provider approved by the Virginia Board of Social Work, Psychology, Counseling, Nursing, or Medicine or by the Association for the Treatment of Sexual Abusers or one of its state chapters. Hours of continuing education used to satisfy the renewal requirements for another license may be used to satisfy the six-hour requirement for sex offender treatment provider certification, provided it was related to the provision of sex offender treatment as specified in 18VAC125-30-81.

C. Certificate holders shall notify the board in writing of a change of address of record or of the public address, if different from the address of record, within 60 days. Failure to receive a renewal notice and application form or forms shall not excuse the certified sex offender treatment provider from the renewal requirement.

18VAC125-30-81. Continuing education requirements.

A. Certified sex offender treatment providers shall complete a minimum of six contact hours of continuing education in topics related to the provision of sex offender treatment for each annual renewal period.

B. Continuing education shall be offered by a sponsor or provider approved by the Virginia Board of Social Work, Psychology, Counseling, Nursing, or Medicine or by the Association for the Treatment of Sexual Abusers or one of its state chapters, or the Virginia Sex Offender Treatment Association. Hours of continuing education used to satisfy the renewal requirements for another license may be used to satisfy the six-hour requirement for sex offender treatment provider certification, provided it was related to the provision of sex offender treatment.

C. Attestation of completion of continuing education is not required for the first renewal following initial certification in Virginia.

D. The board may grant an extension for good cause of up to one year for the completion of continuing education requirements upon written request from a certificate holder prior to the renewal date. Such extension shall not relieve the certificate holder of the continuing education requirement.

E. The board may grant an exemption for all or part of the continuing education requirements due to circumstances beyond the control of a certificate holder, such as temporary disability, mandatory military service, or officially declared disasters, upon written request from the certificate holder prior to the renewal date.

F. All certificate holders shall maintain original documentation of official transcripts showing credit hours earned or certificates of participation for a period of three years following renewal.

G. Continuing education hours required by a disciplinary order may not be used to satisfy the requirement for renewal.

18VAC125-30-90. Reinstatement.

A. A person whose certificate has expired may renew it within one year after its expiration date by paying the renewal fee and the late renewal fee prescribed in 18VAC125-30-20.

B. A person whose certificate has expired beyond one year and who wishes to resume practice shall:

1. Submit a reinstatement application along with the reinstatement fee.

2. Provide evidence satisfactory to the board of current ability to practice of completion of six hours of continuing education for each year in which the certification has been expired, with a maximum of 24 hours.

3. Submit verification of any professional health or mental health registration, certification or licensure obtained ever held in Virginia or in any other jurisdiction subsequent to the initial application for certification.

18VAC125-30-91. Reinstatement following disciplinary action.

A. Any person whose certificate has been revoked or suspended by the board under the provisions of 18VAC125-30-110 shall, in order to be eligible for reinstatement, (i) submit an application to the board for a license, (ii) pay the appropriate reinstatement fee, and (iii) submit any other evidence of competency as prescribed by the board. After a hearing, the board may at its discretion grant the reinstatement.

B. Any person whose certificate has been revoked shall not apply for reinstatement until three years after such board action.

18VAC125-30-100. Standards of practice. (Repealed.).

A. The protection of the public health, safety, and welfare and the best interest of the public shall be the primary guide in determining the appropriate professional conduct of all certified practitioners who provide services to sex offenders.

B. Persons certified by the board and applicants under supervision shall:

1. Practice in a manner that ensures community protection and safety.

2. Treat all sex offender clients with dignity and respect, regardless of the nature of their crimes or offenses.

3. Provide only services and use only techniques for which they are qualified by training and experience.

4. Inform sex offender clients of (i) the purposes of an interview, testing, or evaluation session; (ii) the ways in which information obtained in such sessions will be used before asking the sex offender client to reveal personal information or allowing such information to be divulged; (iii) the methods of interventions, including any experimental methods of treatment; and (iv) the risks and benefits of any treatment.

5. Inform sex offender clients of the limits of confidentiality and any circumstances which may allow an exception to the agreed upon confidentiality, including (i) as obligated under dual-client situations, especially in criminal justice or related settings; (ii) when the client is a danger to self or others; (iii) when under court order to disclose information; (iv) in cases of suspected child abuse; and (v) as otherwise required by law.

6. Not require or seek waivers of privacy or confidentiality beyond the requirements of treatment, training, or community safety.

7. Explain to juvenile sex offender clients the rights of their parents or legal guardians, or both, to obtain information relating to the sex offender client.

8. Maintain sex offender client records securely, inform all employees of the rules applicable to the appropriate level of confidentiality, and provide for the destruction of records which are no longer useful.

9. Retain sex offender client records for a minimum of five years from the date of termination of services.

10. Stay abreast of new developments, concepts, and practices which are important to providing appropriate professional services.

11. Never engage in dual relationships with sex offender clients or former clients, or current trainees that could impair professional judgment or compromise the sex offender client's or trainee's well-being, impair the trainee's judgment, or increase the risk of sex offender client or trainee exploitation. Engaging in sexual intimacies or romantic relationships with sex offender clients or former clients, or with current trainees is strictly prohibited.

12. Report to the board known or suspected violations of the laws and regulations governing the practice of sex offender treatment providers, as well as any information that a sex offender treatment provider is unable to practice with reasonable skill and safety because of illness or substance abuse or otherwise poses a danger to himself, the public, or clients.

13. Provide clients with accurate information concerning tests, reports, billing, payment responsibilities, therapeutic regime, and schedules before rendering services.

14. Maintain cooperative and collaborative relationships with corrections/probation/parole officers or any responsible agency for purposes of the effective supervision and monitoring of a sex offender client's behavior in order to assure public safety.

15. Consider the validity, reliability, and appropriateness of assessments selected for use with sex offender clients. Where questions exist about the appropriateness of utilizing a particular assessment with a sex offender client, expert guidance from a knowledgeable, certified sex offender treatment provider shall be sought.

16. Recognize the sensitivity of sexual arousal assessment testing and treatment materials, safeguard the use of such materials in compliance with § 18.2-374.1:1 of the Code of Virginia, and use them only for the purpose for which they are intended in a controlled penile plethysmographic laboratory assessment.

17. Be aware of the limitations of plethysmograph and that plethysmographic data is only meaningful within the context of a comprehensive evaluation or treatment process or both.

18. Be knowledgeable of the limitations of the polygraph and take into account its appropriateness with each individual client and special client population.

19. Comply with all laws of the Code of Virginia applicable to the practice of sex offender treatment providers.

18VAC125-30-101. Standards of practice.

A. The protection of the public health, safety, and welfare and the best interest of the public shall be the primary guide in determining the appropriate professional conduct of all certified practitioners who provide services to sex offenders. Sex offender treatment providers respect the rights, dignity, and worth of all people, regardless of the nature of one's crimes or offenses, and are mindful of individual differences. Regardless of the delivery method, whether in-person or by use of technology, these standards shall apply to the practice of sex offender treatment.

B. Persons certified by the board and applicants under supervision shall:

1. Practice in a manner that ensures community protection and safety;

2. Provide or supervise only services and use only techniques for which they are qualified by education, training, and experience;

3. Accurately represent their areas of competence, education, training, experience, professional affiliations, credentials, and published findings to ensure that such statements are neither fraudulent nor misleading;

4. Accurately inform sex offender clients of (i) the purposes of an interview, testing, or evaluation session; (ii) the ways in which information obtained in such sessions will be used before asking the sex offender client to reveal personal information or allowing such information to be divulged; (iii) the methods of interventions, including any experimental methods of treatment; and (iv) the risks and benefits of any treatment;

5. Clearly document at the outset of service delivery what party the sex offender treatment provider considers to be the client and what, if any, responsibilities the provider has to all related parties. Explain to juvenile sex offender clients the rights of their parents, legal guardians, or both to obtain information relating to the sex offender client;

6. Maintain current competency in the areas of practice through continuing education, consultation, or other procedures consistent with current standards of scientific and professional knowledge;

7. Be able to justify all services rendered to clients as necessary for diagnostic or therapeutic purposes;

8. Avoid harming, exploiting, misusing influence, or misleading patients or clients, research participants, students, and others for whom they provide professional services and minimize harm when it is foreseeable and unavoidable;

9. Maintain cooperative and collaborative relationships with corrections, probation, or parole officers or any responsible agency for purposes of the effective supervision and monitoring of a sex offender client's behavior in order to assure public safety;

10. Construct, maintain, administer, interpret, and report testing and diagnostic services in a manner and for purposes that are current and appropriate. Sex offender treatment providers shall consider the validity, reliability, appropriateness, and limitations of assessments and data selected for use with sex offender clients, including to the plethysmograph and polygraph. Where questions exist about the appropriateness of utilizing a particular assessment with a sex offender client, expert guidance from a knowledgeable, certified sex offender treatment provider shall be sought;

11. Safeguard the use of sexual arousal assessment testing and treatment materials, due to the sensitivity of such materials in compliance with § 18.2-374.1:1 of the Code of Virginia and use them only for the purpose for which they are intended in a controlled penile plethysmographic laboratory assessment;

12. Not engage in conversion therapy with any person younger than 18 years of age;

13. Withdraw from, avoid, adjust, or clarify conflicting roles with due regard for the best interest of the affected party and maximal compliance with these standards;

14. Neither accept nor give commissions, rebates, or other forms of remuneration for referral of clients for professional services. Make appropriate consultations and referrals consistent with the law based on the interest of the patients or clients;

15. Make arrangements for another professional to deal with emergency needs of clients during periods of foreseeable absences from professional availability and provide for continuity of care when services must be terminated;

16. Conduct financial responsibilities to clients in an ethical and honest manner by:

a. Informing clients of fees for professional services and billing arrangements as soon as is feasible;

b. Informing clients prior to the use of collection agencies or legal measures to collect fees and provide opportunity for prompt payment;

c. Obtaining written consent for fees that deviate from the practitioner's usual and customary fees for services; and

d. Not obtaining, attempting to obtain, or cooperating with others in obtaining payment for services by misrepresenting services provided, dates of services, or status of treatment;

17. Design, conduct, and report research in accordance with recognized standards of scientific competence and research ethics. Practitioners shall adhere to requirements of § 32.1-162.18 of the Code of Virginia for obtaining informed consent from patients prior to involving them as participants in human research, with the exception of retrospective chart reviews;

18. Report to the board known or suspected violations of the laws and regulations governing the practice of sex offender treatment providers, as well as any information that a sex offender treatment provider is unable to practice with reasonable skill and safety because of physical or mental impairment or substance misuse or otherwise poses a danger to the provider, the public, or clients;

19. Document the reasons for and steps taken if it becomes necessary to terminate a therapeutic relationship (e.g., when it becomes clear that the client is not benefiting from the relationship or when the sex offender treatment provider feels endangered). Document assistance provided in making arrangements for the continuation of treatment for clients, if necessary, following termination of a therapeutic relationship; and

20. Comply with laws of the Code of Virginia and regulations of the board applicable to the practice of sex offender treatment providers.

C. In regard to confidentiality, persons regulated by the board shall:

1. Inform sex offender clients of the limits of confidentiality and any circumstances which may allow an exception to the agreed upon confidentiality, including (i) as obligated under dual-client situations, especially in criminal justice or related settings; (ii) when the client is a danger to self or others; (iii) when under court order to disclose information; (iv) in cases of suspected child or elder abuse; and (v) as otherwise required by law or regulation;

2. Not require or seek waivers of privacy or confidentiality beyond the requirements of treatment, training, or community safety;

3. Keep confidential their professional relationships with patients or clients and disclose client information to others only with written consent except as required or permitted by law;

4. Protect the confidentiality in the usage of client information and clinical materials by obtaining informed consent from the client or the client's legally authorized representative before (i) videotaping, (ii) audio recording, (iii) permitting third party observation, or (iv) using identifiable client information in teaching, writing, or public presentations; and

5. Not willfully or negligently breach the confidentiality between a practitioner and a client. A disclosure that is required or permitted by applicable law or beyond the control of the practitioner shall not be considered negligent or willful.

D. In regard to client records, persons regulated by the board shall:

1. Maintain timely, accurate, legible, and complete written or electronic records for each client. For a sex offender treatment provider practicing in an institutional setting, the recordkeeping shall follow the policies of the institution or public facility. For a sex offender treatment provider practicing in a noninstitutional setting, the record shall include:

a. The name of the client and other identifying information;

b. The presenting problem, purpose, or diagnosis;

c. Documentation of the fee arrangement;

d. The date and clinical summary of each service provided;

e. Any test results, including raw data, or other evaluative results obtained;

f. Notation and results of formal consults with other providers; and

g. Any releases by the client;

2. Maintain client records securely, inform all employees of the requirements of confidentiality, and dispose of written, electronic, and other records in such a manner as to ensure their confidentiality; and

3. Maintain client records for a minimum of five years or as otherwise required by law from the last date of service, with the following exceptions:

a. At minimum, records of a minor child shall be maintained for five years after attaining 18 years of age;

b. Records that are required by contractual obligation or federal law to be maintained for a longer period of time; or

c. Records that have been transferred pursuant to § 54.1-2405 of the Code of Virginia pertaining to closure, sale, or change of location of one's practice.

E. In regard to dual relationships, persons regulated by the board shall:

1. Not engage in a dual relationship with a person under supervision that could impair professional judgment or increase the risk of exploitation or harm. Sex offender treatment providers shall take appropriate professional precautions when a dual relationship cannot be avoided, such as informed consent, consultation, supervision, and documentation to ensure that judgment is not impaired and no exploitation occurs;

2. Not engage in sexual intimacies or a romantic relationship with a student, supervisee, resident, intern, therapy patient, client, or those included in collateral therapeutic services, such as a parent, spouse, or significant other of the client, while providing professional services. For at least five years after cessation or termination of professional services, not engage in sexual intimacies or a romantic relationship with a therapy patient, client, or those included in collateral therapeutic services. Consent to, initiation of, or participation in sexual behavior or romantic involvement with a sex offender treatment provider does not change the exploitative nature of the conduct nor lift the prohibition. Because sexual or romantic relationships are potentially exploitative, sex offender treatment providers shall bear the burden of demonstrating that there has been no exploitation, based on factors such as duration of therapy, amount of time since therapy, termination circumstances, client's personal history and mental status, and adverse impact on the client;

3. Not engage in a personal relationship with a former client in which there is a risk of exploitation or potential harm or if the former client continues to relate to the sex offender treatment provider in the provider's professional capacity; and

4. Recognize conflicts of interest and inform all parties of the nature and directions of loyalties and responsibilities involved.

F. Upon learning of evidence that indicates a reasonable probability that another mental health provider is or may be guilty of a violation of standards of conduct as defined in statute or regulation, persons licensed by the board shall advise their clients of their right to report such misconduct to the Department of Health Professions in accordance with § 54.1-2400.4 of the Code of Virginia.

18VAC125-30-110. Grounds for disciplinary action.

The board may revoke, suspend, restrict or refuse to issue a certificate, or reprimand or fine a practitioner in accord with the following:

1. Violation of provisions of this chapter, including the standards of practice set forth in 18VAC125-30-101.

2. Conviction of a felony or a misdemeanor involving moral turpitude (i.e., relating to lying, stealing, or cheating).

3. Misuse of drugs or alcohol which interferes with professional functioning Demonstrating an inability to practice as a sex offender treatment provider with reasonable skill and safety as a result of any mental, emotional, or physical condition or substance misuse.

4. Mental or physical illness which interferes with professional functioning Conducting one's practice in such a manner so as to make it a danger to the health and welfare of a client or to the public.

5. The denial, revocation, suspension, or restriction of a health or mental health registration, license, or certificate to practice in Virginia or in another state, or a United States possession, or territory of the United States or the surrender of any such registration, license, or certificate while an active investigation is pending or in lieu of disciplinary action.

6. Engaging in intentional or negligent conduct that causes or is likely to cause injury to a client.

7. Knowingly allowing persons under supervision to jeopardize client safety or provide care to clients outside of such person's scope of practice or area of responsibility.

8. Performing functions outside areas of competency.

9. Failing to comply with the continuing education requirements set forth in this chapter.

10. Performing an act or making statements that are likely to deceive, defraud, or harm the public.

11. Failing to cooperate with an employee of the Department of Health Professions in the conduct of an investigation.

12. Procuring, attempting to procure, or maintaining a certificate or registration by fraud or misrepresentation.

13. Violating or aiding and abetting another to violate any statute applicable to the practice of the profession, including § 32.1-127.1:03 of the Code of Virginia relating to health records.

14. Failing to report evidence of child abuse or neglect as required in § 63.2-1509 of the Code of Virginia or abuse of aged and incapacitated adults as required in § 63.2-1606 of the Code of Virginia.

18VAC125-30-120. Reinstatement following disciplinary action. (Repealed.).

A. Any person whose certificate has been revoked by the board under the provisions of 18VAC125-30-110 may, three years subsequent to such board action, submit a new application to the board for certification to the board. Any person whose certificate has been denied renewal by the board under the provisions of 18VAC125-30-110 may, two years subsequent to such board action, submit a new application to the board for certification to the board.

B. The board in its discretion may, after a hearing, grant reinstatement.

C. The applicant for reinstatement, if approved, shall be certified upon payment of the appropriate fees applicable at the time of reinstatement.