Va. Code § 32.1-137.16
Every entity subject to Article 1.1 (§ 32.1-137.1 et seq.) of Chapter 5 and this article shall maintain or cause to be maintained, in writing and at a location accessible to employees of the Department, records of review procedures; the health care qualifications of the entity's staff; the criteria used by the entity to make its determinations; records of complaints received, including the manner in which the complaints were resolved; the number and type of adverse determinations and reconsiderations; the number and outcome of final adverse determinations and appeals thereof, including a separate record for expedited appeals; and procedures to ensure confidentiality of medical records and personal information. Records of complaints under Article 1.1 (§ 32.1-137.1 et seq.) shall be maintained from the date of the entity's last examination and for no less than six years.
Every entity subject to utilization review under this article shall provide, upon request of the Commissioner, data and records pertaining to utilization review from which patient and provider identifiers have been removed. Records shall be maintained or caused to be maintained by the utilization review entity for a period of six years, and all such records shall be subject to examination by the Commissioner or his designee.
Va. Code § 32.1-137.16