Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Protecting your health information is important to us. The law says that we must keep your protected health information (PHI) private, provide you with notice of our legal duties and privacy practices with respect to PHI, follow the current terms of this notice, and notify affected individuals following a breach of unsecured PHI.

VCU Health System reserves the right to change the terms of this notice at any time. Any changes made will apply to all of your health information maintained by VCU Health System. If changes are made to this notice, the new notice will be posted and a paper copy made available upon request. The notice will also be posted on our website.

How Your Health Information Can Be Used and Disclosed Without Your Permission:

Treatment Purposes

VCU Health System may use your health information to provide treatment or services for you. The doctors, nurses, and other people caring for you may share your health information to provide you with any needed treatments or services, like x-rays, lab work, or therapy. Sometimes, this may mean speaking with health care professionals who are not part of VCU Health System, like nursing home staff, therapists, and home health care workers. We may also share your health information with non-health care personnel in an emergency situation. In addition, we may contact you to remind you of an upcoming appointment, to tell you about alternative treatments, or to tell you about health-related benefits and services that may be of interest to you.

Payment Purposes

We may use or disclose your health information so we may receive payment for the treatment and services we have provided to you. We also may contact your insurance company to learn what services are included in your health plan, to get prior approval for certain treatments or services, and to tell them about your treatment to make sure it is a covered service.

Health Care Operations

We may use and share your health information to operate our facility and make sure that all of our patients receive quality care, to rate the services that you received, or how well our staff cared for you. We may use your health information to see where we can make improvements or to find better ways to provide care. We may also use health information to make sure our health care professionals have the right skills and qualifications for their jobs. We may share information with students and professionals for review and education purposes. We may use health information for business planning, or disclose it to attorneys, accountants, consultants, and others who assist VCU Health System in its activities and to make sure we are following the law.

Other Uses and Disclosures of Your Health Information That Do Not Require Your Permission:

• Required by Law: When federal or state law says we have to.
• Public Health: For public health activities, including product recalls, preventing or controlling disease, injury, or reporting vital events, such as births and deaths.
• Abuse, Neglect, Domestic Violence: Notifying law enforcement or other agencies if we believe a patient has been the victim of abuse, neglect, or domestic violence.
• Health Oversight: For health oversight activities, such as audits, investigations, licensing, and accreditation by agencies (for example, the Centers for Medicaid and Medicare Services).
• Legal Proceedings, Lawsuits, Administrative Proceedings, and Other Legal Actions: In a legal proceeding if the request for the information is through an order from a court or administrative tribunal. Your health information may also be disclosed in response to a subpoena or other lawful process.
• Law Enforcement: If asked by law enforcement, or if the law says we must, we may disclose medical information:
  • to report certain wounds or other physical injuries if required by law to do so;
  • to identify or locate a suspect, fugitive, material witness, or missing person;
  • about a suspected victim of a crime if, under certain limited circumstances we are unable to obtain the person’s agreement;
  • about a death suspected to be the result of criminal conduct;
  • about criminal conduct at VCU Health System; and
  • in case of a medical emergency, to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.
• Coroners, Funeral Directors, Medical Examiners: To funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law.
• Organ and Tissue Donation: To help with the donation, procurement, and transplantation of organs, eyes, and tissue if you have chosen to be a donor.
• Research: For research purposes, there are times when your health information may be disclosed. All such research has to be approved through a formal process before we use or disclose any information. Information about you may be used to find patients with specific characteristics or illnesses for research study. The information reviewed in preparation for research will remain under VCU Health System control.
• Threats: To stop or reduce a serious threat to your health and safety or the health and safety of another person.
• National Security and Armed Forces: To government officials for national security and intelligence activities, or to military authorities under some circumstances if you are a member of the military.
• Specialized Government Functions: To government officials for special investigations or to protect the President of the United States, other authorized persons, or foreign heads of state. Worker’s Compensation: For worker’s compensation to provide information to process your claim.

VCU Health System may use or disclose your health information in the following ways unless you object:

• Facility Directory: Include general information in a directory of individuals located in VCU Health System. The information may include your name; location in the hospital, your condition described in general terms, and your religious affiliation. The directory information, except for your religious affiliation, will be disclosed to people who ask for you by name. Your religious affiliation may be given to members of the clergy, even if they do not ask for you by name.
• Coordination of Care: Disclose your health information with a family member, other relative, friend, or any other person you identify if they are involved in your care or the payment related to your care.
• Notify of Location: Use or disclose your information to provide notification of your location, general condition, or death to a family member, personal representative, or another person responsible for your care or to assist in a disaster relief situation.
• Fundraising: Share information about you and/or contact you about activities to raise funds to expand and support health care services, education, and research for VCU Health System. You have the right to opt out of or tell us you do not wish to receive these communications.
• Health Information Exchange (HIE): VCU Health System participates in one or more HIEs, which allow patient information to be shared electronically with physicians and other providers/facilities involved in your health care. Your health information will be shared in accordance with state and federal law, as well as this notice. You have the right to opt out of the HIE. You may obtain the HIE opt out form from VCU Health System Department of Health Information Management. Simply complete the opt out form and mail, email, or fax the form to:

VCU Health System
Department of Health Information Management
Box 980679
Richmond, Virginia 23298-0679
Email: HIM@vcuhealth.org
Phone: (804) 828-5501
Fax: (804) 828-5059

Please note that if you choose to opt out, providers will not be able to obtain your information from the HIE, but will instead obtain your information by other means, such as fax or mail.

Other Uses and Disclosures of Your Health Information:

Uses or disclosures that require your written permission include the following:

• Most uses and disclosures of psychotherapy notes
• Uses and disclosures for marketing purposes. This does not apply to:
  • face-to-face communications,
  • when promotional gift of nominal value is provided,
  • refill reminders or communications about a drug currently prescribed as long as any monies received are only for the cost of labor, supplies, and postage, or
  • communications promoting health in general that do not promote a product or service from a particular provider
• Disclosures that constitute a sale of your health information under applicable law

We will not use or share your information other than as described in this notice unless we obtain your written permission. You may revoke your written permission to use or disclose your health information except to the extent that action has already been taken in reliance on the permission you gave. Your request must be in writing and addressed to VCU Health System Department of Health Information Management, P.O. Box 980679, Richmond, Virginia 23298-0679.

Your Rights Regarding Your Health Information:

You have the following rights with respect to your health information. An individual you designate as your personal representative or with legal authority to make health care decisions for you may also exercise these rights on your behalf, except under certain circumstances:

• Access Your Record: The right to see or get a copy of your health information. There may be situations when this is not possible. In addition, you may be asked to pay a reasonable, cost-based fee for any copies of your records. Contact VCU Health System Department of Health Information Management to find out how to do this.
• Amend Your Record: The right to request an amendment or addendum if you feel the information in your health record is incorrect or incomplete. Direct your written request to VCU Health System Department of Health Information Management and include a reason why you are requesting the information be changed. In some circumstances, VCU Health System may not honor the request. If this happens, we will tell you why we did not make the changes. We will do so in writing and we will explain other rights you would have at that point.
• Accounting of Disclosures: The right to receive a list of the disclosures of your health information for six years prior to the date of your request. We will include all the disclosures except those for treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). You are allowed one free listing in a 12-month period. There will be a reasonable, cost-based fee for more than one listing in a 12-month period.
• Request Restrictions: The right to request that we not share certain health information for treatment, payment, or health care operations. VCU Health System is not required to agree to your request. If we do agree, we may still share information if it is necessary to provide emergency care to you. You may also request that information not be shared with your health insurer for purposes of payment or health care operations. We are required to agree if you, or someone on your behalf, have paid for the items or services out of pocket and in full, unless the law requires us to share that information.
• Alternative Communication: The right to request that communications, such as mail or reminders from VCU Health System be received in a confidential manner; for example, an alternate address or telephone number. We will agree to reasonable requests.
• Copy of Notice: The right to receive a paper copy of this notice even if you have agreed to accept this notice electronically.
• File a Formal Complaint: The right to file a complaint with VCU Health System and/or to the U.S. Department of Health and Human Services if you believe that your privacy rights have been violated. To file a complaint with VCU Health System, please contact:

VCU Health System
Audit and Compliance Services
P.O. Box 980471
Richmond, Virginia 23298-0471
Phone: (804) 828-0500 or 1-(800)-620-1438
Email: complianceservices@vcuhealth.org

If you choose to file a complaint, we will not do anything to retaliate against you.

If you would like more information about your rights or about the uses and disclosures of your medical information, you may contact VCU Health System Audit and Compliance Services.

This revision to the notice is effective as of March 29, 2016.