Va. Code § 37.2-711
The Department and state facilities may exchange specific information about individuals who are receiving or who have received services with community services boards or behavioral health authorities to monitor the delivery, outcome, and effectiveness of services; however, no publicly available report or information produced or generated by them shall reveal the identity of any individual who is receiving or who has received services. Publicly available information shall be designed to prevent persons from being able to gain access to combinations of characteristic data elements about individuals who are receiving or who have received services that reasonably could be expected to reveal the identity of any individual. In order to collect unduplicated information, the Department, subject to all regulations adopted by the Board or by agencies of the United States government that govern confidentiality of information about individuals who are receiving or who have received services, may require that the individuals disclose or furnish their social security numbers.
Va. Code § 37.2-711