Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Protecting your health information is important to us. The law says that we must keep your Protected Health Information (PHI) private, provide you with notice of our legal duties and privacy practices with respect to PHI, follow the current terms of this notice, and notify affected individuals following a breach of unsecured PHI.

VCU Health reserves the right to change the terms of this Notice at any time. Any changes made will apply to all your health information maintained by VCU Health. If changes are made to this Notice, the new notice will be posted and a paper copy made available upon request. The Notice will also be posted on our website.

How your health information can be used and disclosed without your permission

Treatment Purposes. VCU Health may use your health information to provide treatment or services for you. The doctors, nurses, and other people caring for you may share your health information to provide you with any needed treatments or services, like x-rays, lab work, or therapy. Sometimes, this may mean speaking with health care professionals who are not part of VCU Health, like nursing home staff, therapists, and home health care workers. We may also share your health information with non-health care personnel in an emergency situation. In addition, we may contact you to remind you of an upcoming appointment, to tell you about alternative treatments, or to tell you about health-related benefits and services that may be of interest to you.
Payment Purposes. We may use or disclose your health information so we may receive payment for the treatment and services we have provided to you. We also may contact your insurance company to learn what services are included in your health plan, to get prior approval for certain treatments or services, and to tell them about your treatment to make sure it is a covered service.
Health Care Operations. We may use and share your health information to operate our facility and make sure that all of our patients receive quality care, to rate the services that you received, or how well our staff cared for you. We may use your health information to see where we can make improvements or to find better ways to provide care. We may also use health information to make sure our health care professionals have the right skills and qualifications for their jobs. We may share information with students and professionals for review and education purposes. We may use health information for business planning, or disclose it to attorneys, accountants, consultants, and others who assist VCU Health in its activities and to make sure we are following the law.

Other uses and disclosures of your health information that do not require your permission:

Required by Law. When federal or state law says we have to.
Public Health. For public health activities, including product recalls, preventing or controlling disease, injury, or reporting vital events, such as births and deaths.
Abuse, Neglect, Domestic Violence. Notifying law enforcement or other agencies if we believe a patient has been the victim of abuse, neglect, or domestic violence.
Health Oversight. For health oversight activities, such as audits, investigations, licensing, and accreditation by agencies (for example, the Centers for Medicaid and Medicare Services).
Legal Proceedings, Lawsuits, Administrative Proceedings, and Other Legal Actions. In a legal proceeding if the request for the information is through an order from a court or administrative tribunal. Your health information may also be disclosed in response to a subpoena or other lawful process.
Law Enforcement. If asked by law enforcement, or if the law says we must, we may disclose medical information:
- to report certain wounds or other physical injuries if required by law to do so;
- to identify or locate a suspect, fugitive, material witness, or missing person;
- about a suspected victim of a crime if, under certain limited circumstances we are unable to obtain the person’s agreement;
- about a death suspected to be the result of criminal conduct;
- about criminal conduct at VCU Health; and
- in case of a medical emergency, to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.
Coroners, Funeral Directors, Medical Examiners. To funeral directors as needed, and to coroners or medical examiners to identify a deceased person, determine the cause of death, and perform other functions authorized by law.
Organ and Tissue Donation. To help with the donation, procurement, and transplantation of organs, eyes, and tissue if you have chosen to be a donor.
Research. For research purposes, there are times when your health information may be disclosed. All such research has to be approved through a formal process before we use or disclose any information. Information about you may be used to find patients with specific characteristics or illnesses for research study. The information reviewed in preparation for research will remain under VCU Health control.
Threats. To stop or reduce a serious threat to your health and safety or the health and safety of another person.
National Security and Armed Forces. To government officials for national security and intelligence activities, or to military authorities under some circumstances if you are a member of the military.
Specialized Government Functions. To government officials for special investigations or to protect the President of the United States, other authorized persons, or foreign heads of state.
Worker’s Compensation. For worker’s compensation to provide information to process your claim.

VCU Health may use or disclose your health information in the following ways unless you object:

Facility Directory. Include general information in a directory of individuals located in VCU Health. The information may include your name, location in the hospital, your condition described in general terms, and your religious affiliation. The directory information, except for your religious affiliation, will be disclosed to people who ask for you by name. Your religious affiliation may be given to members of the clergy, even if they do not ask for you by name. To opt out of your information being available in the Facility Directory, inform a member of the Registration team or your care team.
Coordination of Care. Disclose your health information with a family member, other relative, friend, or any other person you identify if they are involved in your care or the payment related to your care. To opt out of your information being available in the facility directory, inform a member of the registration team or your care team.
Notify of Location. Use or disclose your information to provide notification of your location, general condition, or death to a family member, personal representative, or another person responsible for your care or to assist in a disaster relief situation.
Fundraising. Share information about you and contact you about activities to raise funds to expand and support healthcare services, education and research for VCU Health, unless you opt out. You may opt out of receiving fundraising communications from VCU Health, call 1-844-445-9126 or email FundraisingOptOut@vcuhealth.org
Health Information Exchanges. VCU Health participates in one or more Health Information Exchanges (HIEs), including the Trusted Exchange Framework and Common Agreement (TEFCA), a nationwide program that enables secure sharing of health information across Qualified Health Information Networks (QHINs).

These exchanges allow your health information to be shared electronically with physicians and other providers and facilities involved in your health care to support continuity and coordination of care. Your health information will be shared in accordance with state and federal law, TEFCA requirements, and this Notice.

We use industry-standard safeguards, including NIST-based security controls to protect your information. You have the right to opt-out of the HIE. You may obtain the HIE Opt-Out form from the VCU Health website or the Department of Health Information Management. Simply complete the opt-out form and mail, email, or fax the form to:

VCU Health Department of Health Information Management
Box 980679
Richmond, VA 23298-0679
Email: HIM-admin-fax@vcuhealth.org
Fax: 804-828-5059
Phone: 804-828-5501

Please note that if you choose to opt-out, providers will not be able to obtain your information from the HIE, including TEFCA exchanges, but will instead obtain your information by other means, such as fax or mail.

Other uses and disclosures of your health information that require your written permission include the following:

Most uses and disclosures of psychotherapy notes and substance use disorder counseling notes
Uses and disclosures for marketing purposes. This does not apply to:
- face-to-face communications,
- when promotional gift of nominal value is provided,
- refill reminders or communications about a drug currently prescribed as long as any monies received are only for the cost of labor, supplies, and postage, or
- communications promoting health in general that do not promote a product or service from a particular provider
Disclosures that constitute a sale of your health information under applicable law
Virginia law allows minors to make their own healthcare decisions and control who can see related health information in certain treatment situations. Those situations will require authorization of the minor seeking treatment

We will not use or share your information other than as described in this Notice unless we obtain your written permission. You may revoke your written permission to use or disclose your health information except to the extent that action has already been taken in reliance on the permission you gave. Your request must be in writing and addressed to Health Information Management, Box 980679, Richmond, VA 23298.

Substance use disorder records

If we receive and keep any of your substance use disorder information that is protected by Part 2 (called Part 2 records), we can only use and share those records as the Part 2 rules allow. In most cases, Part 2 requires your consent before we use or share your Part 2 records. There are only a few exceptions, such as medical emergencies, research, and audits or evaluations. For example, if we receive your Part 2 records because you consented to let them be used and disclosed for purposes of treatment, payment, and health care operations, we may use and disclose your Part 2 records for any purpose permitted by HIPAA, as described in this Notice. But we cannot use these records against you in any civil, administrative, criminal, or legislative proceedings unless you give specific consent or a court orders it. A court order authorizing such a use must be accompanied by a subpoena or other legal requirement that requires the disclosure. Part 2 does not apply to reports of suspected child abuse or neglect. We will also not use or disclose your Part 2 records for our own fundraising without first giving you the chance to opt out of such communications.

Certain health records related to substance use disorder treatment are protected by federal law under 42 USC 290dd-2 and 42 CFR Part 2 (called “Part 2”). If you receive care for a substance use disorder from one of our Part 2 programs, you will be provided with a separate notice explaining these protections from your Part 2 program provider.

Your rights regarding your health information

You have the following rights with respect to your health information. An individual you designate as your personal representative or with legal authority to make health care decisions for you may also exercise these rights on your behalf, except under certain circumstances.

Access Your Record. The right to see or get a copy of your health information. There may be situations when this is not possible. In addition, you may be asked to pay a reasonable, cost-based fee for any copies of your records. Contact the Health Information Management Department to find out how to do this.
Audit Trail. Virginia law gives you the right, when specifically requested, to receive an audit trail showing certain changes made to your medical record.
Amend Your Record. The right to request an amendment or addendum if you feel the information in your health record is incorrect or incomplete. Direct your written request to the Health Information Management Department and include a reason why you are requesting the information be changed. In some circumstances, VCU Health may not honor the request. If this happens, we will tell you why we did not make the changes. We will do so in writing, and we will explain other rights you would have at that point.
Accounting of Disclosures. The right to receive a list of the disclosures of your health information for six years prior to the date of your request. We will include all the disclosures except those for treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). You are allowed one free listing in a 12-month period. There will be a reasonable, cost-based fee for more than one listing in a 12-month period.
Request Restrictions. The right to request that we not share certain health information for treatment, payment, or health care operations. VCU Health is not required to agree to your request. If we do agree, we may still share information if it is necessary to provide emergency care to you. You may also request that information not be shared with your health insurer for purposes of payment or health care operations. We are required to agree if you, or someone on your behalf, have paid for the items or services out of pocket and in full, unless the law requires us to share that information.
Alternative Communication. The right to request that communications, such as mail or reminders from VCU Health be received in a confidential manner; for example, an alternate address or telephone number. We will agree to reasonable requests.
Breach Notification. If your health information is involved in a data breach, we will notify you without unreasonable delay, as required by Virginia law.
Copy of Notice. The right to receive a paper copy of this Notice even if you have agreed to accept this notice electronically.
File a Formal Complaint. The right to file a complaint with VCU Health or the United States Department of Health and Human Services if you believe that your privacy rights have been violated. To file a complaint with VCU Health, please contact:

VCU Health Compliance Services
Box 980471
Richmond, VA 23298-0471
Phone: 804-828-0500 or 1-800-620-1438
Email: privacyoffice@vcuhealth.org

If you choose to file a complaint, we do not discriminate and will not retaliate against you. If you would like more information about your rights or about the uses and disclosures of your medical information, you may contact VCU Health Compliance Services.

This revision to the Notice is effective as of February 16, 2026.