Notice of Privacy Practices for MOTIVATE programs

For substance use disorder records

This notice describes:

How health information about you may be used and disclosed.
Your rights with respect to your health information.
How to file a complaint concerning a violation of the privacy or security of your health information, or of your rights concerning your information.

You have a right to a copy of this notice (in paper or electronic form) and to discuss it with privacy director at privacyoffice@vcuhealth.org or 804-828-0500 if you have any questions.

Our duties

Federal law, 42 U.S.C. 290dd-2 and 42 C.F.R. Part 2 (called “Part 2”), protects the confidentiality of certain substance use disorder (SUD) patient records. We are required by this federal law to:

Protect the privacy of records that may identify a patient as having (or having had) a SUD (called “SUD records”).
Provide patients admitted to our program with a copy of this Notice.
Notify affected patients following a breach of unsecured SUD records.

VCU Health reserves the right to change the terms of this notice at any time, and the revised Notice will be effective for all your health information (including, SUD records) that we maintain. If changes are made to this notice, the new notice will be posted and a paper copy made available upon request. The notice will also be posted on our website.

Using and disclosing SUD records without your written consent

We may acknowledge your presence at our program or share your SUD records without your written consent except in limited circumstances permitted by Part 2. For example, we may use and disclose SUD records without your consent for:

Medical Emergencies. We may disclose your identifying information to medical personnel to the extent necessary in a medical emergency or the U.S. Food and Drug Administration (FDA) for the exclusive purpose of notifying patients and physicians of potential dangers related to errors in the manufacturing, labeling, or sale of products.
Research. We may use and disclose your patient identifying information for scientific research under certain circumstances. The information reviewed in preparation for research will remain under VCU Health control.
Audits and Evaluations. We may disclose your patient identifying information for audits and evaluations involving our program under certain circumstances.
Fundraising. We may use or disclose SUD records to fundraise for our program,  but only if you have not opted out of such fundraising. You may opt out of receiving fundraising communications from VCU Health, call 1-844-445-9126 or email FundraisingOptOut@vcuhealth.org
Public Health Purposes. We may disclose deidentified information to public health authorities for public health purposes.
Qualified Service Organizations (QSOs). We may share SUD records with contractors who provide certain services to us or on our behalf. These contractors are called qualified service organizations or QSOs. Our QSOs are required to agree in writing to protect your SUD records.
Crimes. We may disclose limited information to law enforcement to report a crime or threatened crime on VCU Health premises or against our personnel.
Suspected Child Abuse and Neglect Reports. We may disclose information to the appropriate authorities to report suspected child abuse and neglect as required by state law.
Adult Patients Who Lack Capacity and Deceased Patients. If an adult patient is adjudicated as lacking capacity or dies, we may disclose SUD records with the consent of the patient’s personal representative.
Substantial Threat to Life or Well-being. We may disclose facts relevant to reducing a substantial threat to a person’s life or physical well-being to a minor patient’s personal representative if certain conditions are met.
Vital Statistics. We may disclose patient identifying information relating to a patient’s cause of death or death investigation as required or permitted by applicable law.
Secretary of the United States Department of Health and Human Services (HHS). We must disclose SUD records to the HHS Secretary if required for an investigation or to determine compliance with Part 2.
Court Orders with Legal Process that Satisfy 42 CFR Part 2, Subpart E Requirements. SUD records, or testimony relaying the content of such SUD records, cannot be disclosed or used against a patient in any civil, administrative, criminal, or legislative proceedings, unless based on such a court order or with your specific written consent. We may only use or disclose your SUD records based on a court order after notice and an opportunity to be heard is provided to you or to us, if required by Part 2. The court order must also be accompanied by a subpoena or other similar legal mandate compelling disclosure before the SUD record is used or disclosed.
Other permissible purposes. We may use or disclose SUD records as otherwise permitted by Part 2.

We will not use or disclose your SUD records for other purposes not described in this Notice without your written consent. To the extent other applicable law is more protective than Part 2, we comply with that law.

Uses and disclosures of SUD records that require your consent

You may give written consent to the use or disclosure of your SUD records for any purpose and can change your mind at any time. For example, you may sign a written consent for the use and disclosure of your SUD records for the following reasons:

For treatment, payment and health care operations (called a “TPO consent”). You may provide a single consent for all future uses or disclosures for treatment, payment and health care operations (TPO) purposes. For example, you may give permission to share your SUD records with all your treating providers and health plans for TPO purposes. SUD records disclosed under a TPO consent to another SUD program subject to Part 2 or an individual or entity subject to the Health Insurance Portability and Accountability Act (HIPAA) may be redisclosed by them for any HIPAA-permitted purpose without asking you again, if HIPAA permits it. However, your SUD records cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against the patient without the patient’s written consent.
For criminal justice referrals, if participation in our SUD program is a condition of release or disposition of a criminal proceeding. You may not take back the consent (revoke it) until a certain amount of time has passed or an event has occurred, such as not permitting revocation until final disposition of the conditional release.
For participation in central registries and withdrawal management or maintenance treatment programs.
For disclosures to prescription drug monitoring programs.
For use and disclosure in civil, administrative, criminal or legislative proceedings against the patient. We must have your specific consent to do this, unless we receive a Part 2 court order with legal process.
Other prohibited purposes. For any other purpose for which Part 2 does not allow use or disclosure without your written consent.

If you want to take back (revoke) your consent, you must write to us at: HIM-admin-fax@vcuhealth.org or VCU Health, Department of Health Information Management, Box 980679, Richmond, VA 23298-0679. We will honor a request to revoke consent but will be unable to stop the continued use or redisclosure of any information that has already been released.

Your rights

You have the following rights with respect to your SUD records and this Notice:

Request Restrictions. You have the right to request restrictions on disclosures made under a TPO consent. Such requests must be made in writing. We are not required to agree to such request, unless it is to not share information with your health plan for services paid in full by the patient or someone other than the health plan. If we agree to a restriction, we may still share the restricted information if needed for emergency care, required by law, or permitted by Part 2 for purposes other than treatment, payment or health care operations.
Accounting of Disclosures. You have a right to obtain a list of certain uses and disclosures of your SUD records, including disclosures made by certain intermediaries within the past 3 years from the date of the request.
Breach Notification. You have a right to notification of breach of your unsecured SUD records.
Opt Out of Fundraising Communications. You have the right to opt out of fundraising communications before such communications.
Copy of this Notice. You have a right to a paper or electronic copy of this Notice upon request.
Discussion of this Notice. You have a right to discuss this Notice with the department listed at the top of this Notice.
Amend Your Record. The right to request an amendment or addendum if you feel the information in your health record is incorrect or incomplete. Direct your written request to the Health Information Management Department and include a reason why you are requesting the information be changed. In some circumstances, VCU Health may not honor the request. If this happens, we will tell you why we did not make the changes. We will do so in writing, and we will explain other rights you would have at that point.

File a formal complaint

You have the right to file a complaint with VCU Health or to the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. To file a complaint with us, please contact:

VCU Health Compliance Services
Box 980471
Richmond, Virginia 23298-0471
Phone: 804-828-0500 or 1-800-620-1438
Email: privacyoffice@vcuhealth.org

If you choose to file a complaint, we do not discriminate and we will not retaliate against you.

This revision to the Notice is effective as of February 16, 2026.