After underwriting an individual health application, an insurer holds the applicant's HIV test result. The employer that led the applicant to seek the coverage demands a copy of the result to explain a benefit decision. What is the insurer's correct position under Virginia law?

Why B is correct

Under Va. Code § 38.2-613.01 and 14 VAC 5-180-50, HIV test information obtained in insurance underwriting is confidential, and disclosure requires the subject's authorization. An employer's involvement in arranging or sponsoring coverage does not create a right to see the result — the confidentiality belongs to the applicant, not to the party who prompted the application. The insurer should refuse the request, and improper disclosure would itself be a violation enforceable by the Virginia Bureau of Insurance.

Why the other options are wrong

• A) The employer's initiating role gives it no access; only the applicant's authorization unlocks the result.
• C) Being named somewhere in an application is not the statutory standard; disclosure requires the applicant's specific authorization.
• D) Redaction does not convert a prohibited disclosure into a permitted one — the underlying result still may not be shared without authorization.

Memory hook

The HIV result belongs to the applicant — no authorization, no disclosure, not even to the boss.