Notice of Privacy Practices

Notice of Privacy Practices


Our Pledge to You

OrthoVirginia, Inc. (OV) is dedicated to protecting your health information. We are legally required to do the following:

We will abide by the terms of this Notice currently in effect at the time of the disclosure. If you have any questions, please contact our HIPAA Privacy Officer at [email protected] or 1-888-822-1877.

How We May Use and Disclose Health Information about You

The following categories describe the ways OV may use or disclose your personal health information.

How we typically use and disclose your information:

Treatment. We may use your health information for your care or treatment or to refer you to another provider. Treatment examples include, but are not limited to: school or sports physicals, referral to a nursing home, home health agencies and/or referrals to other providers for treatment.

Payment. We may use your information to seek payment for our services from you or your insurer. Payment examples include but are not limited to: billing insurance companies for claims or coordinating benefits with other insurers and collection agencies.

Healthcare Operations. We may use and share your health information to run our practice, improve your care, and contact you when necessary. Healthcare operations include but are not limited to: internal quality control, including auditing of records, business planning or seeking accounting and legal services, or having medical residents, medical students, or other students observe or participate in your treatment as a part of their training.

Health Information Exchange. We currently participate in health information exchanges (HIE’s), which ultimately help enhance the quality of your care. The goal of the HIEs is to help participating providers give better, more efficient care to their patients by the sharing of health information across secure systems. This means that wherever a patient goes, the patient’s health information may be available to all doctors who use the HIEs, which helps to provide safer, more coordinated patient care.

We currently utilize CareEverywhere, eHealth Exchange and Carequality to access and share your health information with other participants of these HIE’s for treatment and payment purposes. These HIE’s allow any healthcare organization that participates in the HIE’s to have secure electronic access to patients’ records.

You may opt out of the Health Information Exchange by doing the following:

Business Associates.  We may share your information with our contractors and vendors who need patient information to work on our behalf.  Examples include scribes, requests for information, and legal services.  Business associates sign contracts with us that require them to protect our patients’ information.

We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research – as long as we meet the conditions in the law first.

If Required by Law.  We will share information about you if state or federal law requires it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.  

Public Health and Health Oversight.  We can share your information for public health purposes like disease reporting, public health investigations, or reporting quality, safety, or effectiveness data to the Food and Drug Administration. OV will also provide information to a federal or state agency that oversees the health care system or government benefit programs for audits, investigations, inspections, proceedings or disciplinary actions.

Child and Adult Abuse, Neglect or Exploitation.  We may submit your information to the appropriate authorities if our staff or providers suspect child or adult abuse, neglect, or exploitation, or other domestic violence.

Legal Proceedings and Law Enforcement/Government Purposes.  We may provide information in response to a court order, subpoena, discovery request, or other legal requests. We may also disclose your information for certain law enforcement purposes, including for locating or identifying missing persons or suspects, for crime victims, for decedents, if there is a crime on OV property, or for a medical emergency. Certain government purposes may also allow us to release your information, including military/veterans administration, national security, Presidential protective services, or National Criminal Background Check purposes.  If you are an inmate, we may release information to the facility or person that has custody of you for certain purposes.

Coroners; Funeral Directors; Organ Donation.  Coroners, medical examiners, or funeral directors may request, and we may provide, information about you for the performance of their duties. We may also share information about you with organ or tissue procurement organizations.

Research.  We may disclose your information for clinical research purposes. For example, if the research has been specifically approved by an institutional review board or a privacy board that has reviewed the research proposal and has set up protocols to ensure the privacy of your identifiable health information.  We may also permit researchers to look at your information to help them prepare for research, for example to allow them to identify patients who may be included in their research project, as long as they do not remove, or take a copy of, any of your personal health information.  

Fundraising.  We may contact you to raise funds for OrthoVirginia; however, you have the right to elect not to receive such communications.  The communications will tell you how to opt out.  If you opt out, we will not send you any more fundraising communications.

To Avert a Serious Threat to Health or Safety.  We may disclose information to prevent or lessen a serious threat to the health or safety of a person or the public if in line with ethical standards. 

Workers’ Compensation.  We can use or share your information for workers’ compensation purposes as allowed by Virginia law.

De-identified Health Information. We may use your health information to create “de-identified” information that is not identifiable to any individual in accordance with HIPAA. We may also disclose your health information to a business associate for the purpose of creating de-identified information, regardless of whether we will use the de-identified information. 

Limited Data Set. We may use your health information to create a “limited data set” (health information that has certain identifying information removed). We may also disclose your health information to a business associate for the purpose of creating a limited data set, regardless of whether we will use the limited data set.  We may use and disclose a limited data set only for research, public health, or health care operations purposes, and any person receiving the limited data set must sign an agreement to protect the health information.

You can tell us whether or not you want to allow the following disclosures.  If you are not able to tell us your preference, like if you are unconscious, we may share your information if we believe it is in your best interest: 

Family, Friends, and Others. We are permitted or required to use or disclose PHI without your consent or authorization in certain circumstances. Three examples are public health requirements (community health surveillance or investigation) court orders, or subpoenas.

You can give us the names and contact information of any family members, friends, or others involved in your care you want to have access to your personal health information, billing and/or appointment record. We will ask you for the name of the person(s) you wish to have access to your information during registration. We keep their name(s) on file on your HIPAA Disclosure Permissions List. To obtain information by telephone, the person calling the practice must share at least two of your personal identifiers with the staff. We will verify that the party contacting the office is named on your HIPAA Disclosure Permissions List. You have the right to update your list of persons with access to your health information by signing a new HIPAA Disclosure Permissions List.

We may release your information to disaster relief organizations to facilitate communications with your family, friends, and others involved in your care.  We will seek your approval before doing so unless it interferes with the emergency response.

Certain uses or disclosures always require your written authorization:

Marketing: “Marketing” means a communication that encourages you to use a service or buy a product, including those where we receive payment from a third party for making the communication. Generally, as long as we do not receive payment, it is not marketing to send you (1) refill reminders and other communications about prescribed drugs; (2) communications related to your treatment, care coordination/case management, or recommending alternative treatment, providers, or care settings; and (3) descriptions of a health-related product or service offered by OV.  We are permitted by the regulations to receive payment to cover the costs of sending refill reminders.

Before we could send you a marketing communication, we would have to obtain your authorization unless the communication is face-to-face, or it involves a promotional gift of nominal value, like a pen or key chain. We do not engage in the type of marketing that requires your authorization, but if we did, we would get your authorization first and let you know if we receive payment for making the communication. We will not sell your information for marketing by others.

We will send you notifications of new physicians, new services, and other happenings at OV. Should you wish to opt out, you must contact the HIPAA Privacy Officer at the contact information below.

Others Requiring Authorization:  We will not sell your identifiable health information without your prior written authorization.  We also do not typically have psychotherapy notes, which are only able to be released with your authorization.  If OV becomes a “lawful holder” of substance use disorder treatment records sent by a program under 42 C.F.R. Part 2, we will only use and disclose those records as permitted or required by the regulations.

Any other use or disclosure not otherwise allowed under HIPAA, state law, and this Notice requires an authorization.  You are able to revoke any authorization you sign at any time in writing.  If you revoke your authorization, we will not use or disclose information for the purposes covered by the authorization; however, we cannot take back any disclosures we have already made while the authorization was in effect.

Your Rights Regarding Health Information About You

You have the following rights with respect to information about you maintained by OV:


If you are concerned that your privacy rights have been violated, or you disagree with a decision we made about access to your records, you may contact our HIPAA Privacy Officer at [email protected] or 1-888-822-1877.

You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1- 877-696-6775, or visiting

All complaints will be addressed by the HIPAA Privacy Officer and/or Chief Compliance Officer. It is the policy of OV that no retaliatory action will be made against any individual who submits or conveys a complaint of suspected or actual non-compliance with standards.


If you have questions about our privacy practices, please contact us:

OrthoVirginia HIPAA Privacy Officer
1115 Boulders Parkway
Richmond, VA 23225
Phone: 888-822-1877
Email: [email protected]

Changes to This Notice

We reserve the right to change the terms of this Notice and to make new notice provisions effective for all protected health information that we maintain. You may ask for an updated copy at any time at our office or on our website.  The Notice of Privacy Practices was last updated and effective as of July 24, 2020.