Privacy Notice
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. We have a legal duty to safeguard your medical information
At EVMS Medical Group, we understand that your medical information about your health is personal. We are committed to protecting your medical information. We create a record of care and services that you receive at EVMS Medical Group. This record is important to provide you with quality care and to comply with legal requirements. We have an obligation to provide you with this notice about our privacy practices that explains how, when, and why we use and disclose your medical information. With some exceptions, we may not use or disclose any more of your medical information than is necessary to accomplish the purpose of the use or disclosure.
We are legally required to follow the privacy practices that are described in this notice. However, we reserve the right to change the terms of this notice and our privacy policies at any time. Any changes will apply to the medical information we already have. Before we make an important change to our policies, we will promptly change this notice and post a new notice. You may request a copy of this notice at any clinical department.
II. How we may use and disclose your medical information
We use and disclose your medical information with the exception of psychotherapy notes for many different reasons. Below is the description of the different categories of uses and disclosures as well as some examples of each category. Not every use or disclosure in a category will be listed.
A. For treatment
We may disclose your medical information to physicians, nurses, medical students, and other health care personnel who provide, coordinate or manage your health care. For example, if you are being treated for a knee injury, we may disclose your medical information to a physical rehabilitation department in order to coordinate your care. Information may also be disclosed to different entities such as pharmacies, laboratories, and home health agencies.
B. For payment
We may use and disclose your medical information in order to bill and collect payment for the treatment and services provided to you. For example, we may provide portions of your medical information to our billing department and your health plan to get paid for health care services. We may also provide your medical information to our third-party business associates, such as billing companies, claims processing companies, and others that process our health care claims. Whenever an arrangement between EVMS Medical Group and a business associate involves the use or disclosure of your information, we will have a written agreement with that business associate that contains terms that will protect the privacy of your information and prohibit that business associate from using your information in any way other than what we allow.
C. For health care operations
We may disclose your medical information in order to operate the EVMS Medical Group practice plan. For example, we may use your medical information in order to evaluate the quality of health care services, to evaluate the performance of the health care professionals, and teaching and training of health care personnel. We may also provide your medical information to our accountants, attorneys, consultants, and others in order to make sure we are complying with the laws that affect us.
D. When a disclosure is required by federal, state or local law, judicial or administrative proceedings, or law enforcement
Your information may be used and disclosed when required by federal, state or local law only in compliance with the law and limited to the relevant requirements of the law. Your information may be disclosed in the course of any judicial or administrative proceeding in response to a court or administrative order and/or also used or disclosed in response to a subpoena, discovery request, or other lawful process that is not accompanied by a court or administrative order if satisfactory assurance is received from the party seeking your information that reasonable efforts have been made to ensure that you have received notice of the request or a qualified protective order has been secured. Your information may be disclosed when a law requires that we report information to specific government agencies and law enforcement personnel about victims of abuse, neglect, or domestic violence; when dealing with gunshot and other wounds; or when otherwise ordered in a court order, subpoena, warrant, summons or other judicial or administrative proceeding.
E. For public health activities
For example, we report information about births, deaths and various diseases to government officials in charge of collecting that information. We also provide coroners, medical examiners, and funeral directors necessary information relating to an individual’s death.
F. For health oversight activities
For example, we will provide information to assist the government when it conducts an investigation or inspection of a health care provider or organization.
G. For purposes of organ donation
We may notify organ procurement organizations or other entities engaged in the procurement, banking or transplantation for the purpose of facilitating or assisting with organ, eye, or tissue donation and transplants.
H. For specific government functions
We may disclose your medical information to military personnel and Veterans Administration in certain situations. We may also disclose medical information for national security purposes, such as conducting intelligence operations.
I. For workers’ compensation purposes
We may provide your medical information in order to comply with workers' compensation laws.
J. To avoid harm
We may provide your medical information to law enforcement agencies or persons able to prevent or lessen harm in order to avoid serious threat to the health or safety of a person or the public.
K. Appointment reminders and health-related benefits or services
We may use your medical information to provide appointment reminders or give you information about treatment alternatives, or other health care services or benefits we offer.
L. For Research
Under certain circumstances, we may use and disclose medical information about you for research purposes. For example, a research project may involve comparing the health and recovery of all patients who receive one type of medication to those who receive another medication, for the same condition. All research projects are subject to a special approval process. This approval process entails trying to balance the research needs with the patient’s need for privacy of their medical information. We may disclose de-identified medical information about you to people preparing to conduct a research project, for example, to help them look for patients with specific medical needs. We will almost always ask for your specific permission if the researcher will have access to your name, address or other information that reveals who you are, or will be involved in your care at EVMS Medical Group or Eastern Virginia Medical School.
M. Organized Health Care Arrangement
We have entered into an agreement with Sentara Accountable Care Organization, LLC (“ACO”) and/or Sentara Quality Care Network, LLC (“CIN”) to participate in the ACO and/or CIN. Through our affiliation with the ACO and/or CIN, we and other participants in the ACO and/or CIN are designated as an Organized Health Care Arrangement (“OHCA”), as defined at 45 C.F.R. § 160.103. As a member of the OHCA, in addition to the other authorized uses and disclosures outlined in this notice, we may use and disclose your medical information/protected health information to the ACO and/or CIN and other ACO and/or CIN and OHCA participants for purposes of conducting quality assessment and improvement activities, conducting utilization review, carrying out treatment, payment, or health care operations relating to the OHCA, and performing other clinically integrated network activities.
N. Marketing activities
Authorization is needed for us to share your medical information for all treatment and health care operations communications where we receive financial remuneration for making that communication from the third party whose product or service is being marketed. This authorization must also disclosure the financial remuneration. The following are exceptions to this rule:
- Communication is face-to-face between EVMS Medical Group and the patient (telephone is not applicable)
- Communication is a gift of nominal value provided by EVMS Medical Group
- Communication is about a generic equivalent of a prescribed drug
- Communication is simply a general health promotion not marketing a product or service
- Communication is regarding government or government sponsored programs
O. Fundraising activities
We may use your medical information to raise funds at our organization. The money raised through these activities is used to expand and support the health care services and educational programs we offer the community. We would only release contact information, such as your name, address and phone number, non-specific dates you received treatment or services at EVMS Medical Group, department in which the service was provided, name of your treating physician, healthcare outcomes and health insurance status. If you do not want us to contact you for fundraising efforts, you must notify our Privacy Office through one of the following channels:
- In writing:
EVMS Medical Group Privacy Office
PO Box 936
Norfolk, VA 23501 - Through email on the Contact Us page
- By calling the Privacy Line at 757.451.6298
- By completing an “opt out” form available at each clinical unit
III. Uses and disclosures for which you may object and/or request specific permission
A. Two uses and disclosures which require you to have the opportunity to object
- Fundraising. We may use information about you (such as your name, address, and phone number) in order to contact you. If you do not wish to be contacted as a part of our fundraising efforts, you may “opt out” using one of the methods listed above.
- Disclosures to family, friends or others. We may provide your medical information to a family member, friend or other person that you indicate is involved in your care or the payment for your health care, unless you object in whole or in part.
B. Uses and disclosures which require your prior specific permission
In any other situation not described above, we will ask for your written authorization before using or disclosing any of your medical information. Authorization forms are available at each clinical department. If you choose to sign an authorization to disclose your medical information, you can later revoke that authorization in writing to stop any future uses and disclosures.
IV. Your rights regarding your medical information
You have the following rights with respect to your medical information.
A. The right to request restrictions
You have the right to request a restrictions or limitations on the medical information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. For example, you may request in writing that we not disclose information about a surgery you had in the past.
You may also restrict certain disclosures of protected health information to a health plan by paying for a health care item or service out of pocket. Payment must be made up front to provider in full and disclosure will be restricted unless otherwise required by law.
We are not required to agree to your request
If we accept your request, we will put any limits in writing and abide by them except in emergency situations. You may not limit the uses and disclosures that we are legally required or allowed to make.
To request restrictions, you must make your request in writing and include:
- What information you want to limit
- Whether you want to limit the use, disclosure or both
- To whom you want the limits to apply, for example, disclosures to your spouse.
B. The right to choose how we provide medical information to you
You have the right to ask that we send information to you to an alternative address or by alternate means. For example, you may request that we contact you at work or by mail. We will not ask the reason for your request. We will accommodate all reasonable requests so long as we can easily provide it in the format that you request.
C. The right to see and obtain a copy of your medical information
You have the right to inspect and obtain a copy of your medical information that may be used to make decisions about your care in the format that you request. Usually, this includes medical and billing records, but does not include psychotherapy notes.
If you want to a copy of your medical information, you must submit your request in writing to the site where medical service or treatment was provided to you. We may charge a fee for the cost of copying, mailing or other supplies associated with your request. If we don’t have your medical information but we know who does, we will tell you how to get it. We will respond to you in 15 days after receiving your written request. We will respond to you in 30 days if you want to inspect your medical record.
In certain situations, we may deny your request to inspect and receive a copy your medical information. If we deny your request, we will tell in you in writing our reasons for the denial and explain your right to have the denial reviewed.
D. The right to get an accounting of the disclosures we have made
You have the right to get a list of instances in which we have disclosed your medical information. This list will not include uses or disclosures made for treatment, payment, or health care operations, or for reasons involving national security, to corrections or law enforcement personnel.
We will respond within 60 days of receiving your request. Your request must state a time period which may not be longer than six years from the date of the request and may not include dates before April 14, 2003.
The list will include the date of the disclosure, to whom the medical information was disclosed, a description of the information disclosed and the reason for the disclosure. The first list you request within a twelve month period will be free. For additional lists, we may charge you for the cost of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.
E. The right to be notified of a breach
A breach is defined as any “acquisition, access, use or disclosure of protected health information in a manner not permitted”. In the event of a breach of your protected health information you will be notified along with the Department of Health and Human Services and in some cases, the media. Notification to you will include a brief description of what happened and type of information involved, steps you should take to protect yourself from potential harm, what we are doing to investigate, prevent harm, and prevent against future breaches as well as how you can obtain additional information if desired.
F. The right to correct or update your medical information
If you feel that medical information we have about you is incorrect, you may ask us to change the information. You have the right to request a correction for as long as the information is kept by or for EVMS Medical Group. To request a change to your medical information, your request and reason for the request must be in writing. We may deny your request for a change if it is not in writing or does not include a reason to support the request. We will respond within 60 days of receiving your request. We may deny your request in writing if you ask us to change information that:
- Is accurate and complete.
- Was not created by us, unless the person that created the information is no longer available to make the change.
- Is not a part of the information which you would be permitted to receive.
- Is not a part of the medical information kept by or for us.
Our written denial will state the reasons for the denial and explain your right to file a written statement of disagreement with the denial. You have the right to request that your request and our denial be attached to all future disclosures of the medical information in question. If we approve your request, we will make the change to your medical information, tell you we have made the change, and tell others that need to know about the change to your medical information.
G. The right to get this notice
You have the right to a paper copy of this notice. You may ask for a copy of this notice at any time. You may also obtain a copy at our website, evms.edu/patient_care.
V. How to complain about our privacy practices
If you believe your privacy rights have been violated, you may file a complaint with EVMS Medical Group or the Secretary of the Department of Health and Human Services. To file a complaint with us or if you have questions concerning our privacy policies, please contact our Privacy Office at 757.451.6298. All complaints must be submitted in writing. You will not be penalized for filing a complaint.
You may contact our Privacy Office at the following address:
EVMS Medical Group Privacy Office
PO Box 936
Norfolk, VA 23501
VI. Effective date of this notice
This notice was revised on September 1, 2023.