Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW IT CAREFULLY.

Our Pledge to You

OrthoVirginia, Inc. (OV) is dedicated to protecting your health information. We are legally required to do the following:

• Maintain the privacy and security of your protected health information.
• Follow the duties and privacy practices described in this Notice and give you a copy of it upon request.
• Not use or share your health information other than as described here unless you tell us we can in writing. If you grant us permission, you may change your mind at any time. You must let us know in writing if you change your mind.
• Let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

We will abide by the terms of this Notice currently in effect at the time of the disclosure. If you have any questions, please contact our HIPAA Privacy Officer at [email protected] or 1-888-822-1877.

How We May Use and Disclose Health Information about You

The following categories describe the ways OV may use or disclose your personal health information.

How we typically use and disclose your information:

Treatment. We may use your health information for your care or treatment or to refer you to another provider. Treatment examples include, but are not limited to: school or sports physicals, referral to a nursing home, home health agencies and/or referrals to other providers for treatment.

Payment. We may use your information to seek payment for our services from you or your insurer. Payment examples include but are not limited to: billing insurance companies for claims or coordinating benefits with other insurers and collection agencies.

Healthcare Operations. We may use and share your health information to run our practice, improve your care, and contact you when necessary. Healthcare operations include but are not limited to: internal quality control, including auditing of records, business planning or seeking accounting and legal services, or having medical residents, medical students, or other students observe or participate in your treatment as a part of their training.

Health Information Exchange. We currently participate in health information exchanges (HIE’s), which ultimately help enhance the quality of your care. The goal of the HIEs is to help participating providers give better, more efficient care to their patients by the sharing of health information across secure systems. This means that wherever a patient goes, the patient’s health information may be available to all doctors who use the HIEs, which helps to provide safer, more coordinated patient care.

We currently utilize CareEverywhere, eHealth Exchange and Carequality to access and share your health information with other participants of these HIE’s for treatment and payment purposes. These HIE’s allow any healthcare organization that participates in the HIE’s to have secure electronic access to patients’ records.

You may opt out of the Health Information Exchange by doing the following:

• Send your request via:
  • Call my MyChart support phone number at 877-701-6088; OR
  • Submit your request directly through MyChart; OR
  • Mail your written request to the OV Compliance Department at the address at the end of this Notice.
• Include the following information with your request so we can be sure to restrict your information from the Health Information Exchange:
  • First and last name (and middle name, if applicable)
  • OrthoVirginia medical record number, if known
  • Date of birth
  • Address

Business Associates.  We may share your information with our contractors and vendors who need patient information to work on our behalf.  Examples include scribes, requests for information, and legal services.  Business associates sign contracts with us that require them to protect our patients’ information.

We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research – as long as we meet the conditions in the law first.

If Required by Law.  We will share information about you if state or federal law requires it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.  

Public Health and Health Oversight.  We can share your information for public health purposes like disease reporting, public health investigations, or reporting quality, safety, or effectiveness data to the Food and Drug Administration. OV will also provide information to a federal or state agency that oversees the health care system or government benefit programs for audits, investigations, inspections, proceedings or disciplinary actions.

Child and Adult Abuse, Neglect or Exploitation.  We may submit your information to the appropriate authorities if our staff or providers suspect child or adult abuse, neglect, or exploitation, or other domestic violence.

Legal Proceedings and Law Enforcement/Government Purposes.  We may provide information in response to a court order, subpoena, discovery request, or other legal requests. We may also disclose your information for certain law enforcement purposes, including for locating or identifying missing persons or suspects, for crime victims, for decedents, if there is a crime on OV property, or for a medical emergency. Certain government purposes may also allow us to release your information, including military/veterans administration, national security, Presidential protective services, or National Criminal Background Check purposes.  If you are an inmate, we may release information to the facility or person that has custody of you for certain purposes.

Coroners; Funeral Directors; Organ Donation.  Coroners, medical examiners, or funeral directors may request, and we may provide, information about you for the performance of their duties. We may also share information about you with organ or tissue procurement organizations.

Research.  We may disclose your information for clinical research purposes. For example, if the research has been specifically approved by an institutional review board or a privacy board that has reviewed the research proposal and has set up protocols to ensure the privacy of your identifiable health information.  We may also permit researchers to look at your information to help them prepare for research, for example to allow them to identify patients who may be included in their research project, as long as they do not remove, or take a copy of, any of your personal health information.  

Fundraising.  We may contact you to raise funds for OrthoVirginia; however, you have the right to elect not to receive such communications.  The communications will tell you how to opt out.  If you opt out, we will not send you any more fundraising communications.

To Avert a Serious Threat to Health or Safety.  We may disclose information to prevent or lessen a serious threat to the health or safety of a person or the public if in line with ethical standards. 

Workers’ Compensation.  We can use or share your information for workers’ compensation purposes as allowed by Virginia law.

De-identified Health Information. We may use your health information to create “de-identified” information that is not identifiable to any individual in accordance with HIPAA. We may also disclose your health information to a business associate for the purpose of creating de-identified information, regardless of whether we will use the de-identified information. 

Limited Data Set. We may use your health information to create a “limited data set” (health information that has certain identifying information removed). We may also disclose your health information to a business associate for the purpose of creating a limited data set, regardless of whether we will use the limited data set.  We may use and disclose a limited data set only for research, public health, or health care operations purposes, and any person receiving the limited data set must sign an agreement to protect the health information.

You can tell us whether or not you want to allow the following disclosures.  If you are not able to tell us your preference, like if you are unconscious, we may share your information if we believe it is in your best interest: 

Family, Friends, and Others. We are permitted or required to use or disclose PHI without your consent or authorization in certain circumstances. Three examples are public health requirements (community health surveillance or investigation) court orders, or subpoenas.

You can give us the names and contact information of any family members, friends, or others involved in your care you want to have access to your personal health information, billing and/or appointment record. We will ask you for the name of the person(s) you wish to have access to your information during registration. We keep their name(s) on file on your HIPAA Disclosure Permissions List. To obtain information by telephone, the person calling the practice must share at least two of your personal identifiers with the staff. We will verify that the party contacting the office is named on your HIPAA Disclosure Permissions List. You have the right to update your list of persons with access to your health information by signing a new HIPAA Disclosure Permissions List.

We may release your information to disaster relief organizations to facilitate communications with your family, friends, and others involved in your care.  We will seek your approval before doing so unless it interferes with the emergency response.

Certain uses or disclosures always require your written authorization:

Marketing: “Marketing” means a communication that encourages you to use a service or buy a product, including those where we receive payment from a third party for making the communication. Generally, as long as we do not receive payment, it is not marketing to send you (1) refill reminders and other communications about prescribed drugs; (2) communications related to your treatment, care coordination/case management, or recommending alternative treatment, providers, or care settings; and (3) descriptions of a health-related product or service offered by OV.  We are permitted by the regulations to receive payment to cover the costs of sending refill reminders.

Before we could send you a marketing communication, we would have to obtain your authorization unless the communication is face-to-face, or it involves a promotional gift of nominal value, like a pen or key chain. We do not engage in the type of marketing that requires your authorization, but if we did, we would get your authorization first and let you know if we receive payment for making the communication. We will not sell your information for marketing by others.

We will send you notifications of new physicians, new services, and other happenings at OV. Should you wish to opt out, you must contact the HIPAA Privacy Officer at the contact information below.

Others Requiring Authorization:  We will not sell your identifiable health information without your prior written authorization.  We also do not typically have psychotherapy notes, which are only able to be released with your authorization.  If OV becomes a “lawful holder” of substance use disorder treatment records sent by a program under 42 C.F.R. Part 2, we will only use and disclose those records as permitted or required by the regulations.

Any other use or disclosure not otherwise allowed under HIPAA, state law, and this Notice requires an authorization.  You are able to revoke any authorization you sign at any time in writing.  If you revoke your authorization, we will not use or disclose information for the purposes covered by the authorization; however, we cannot take back any disclosures we have already made while the authorization was in effect.

Telephone Calls and Text Messages

We collect residential and cellular telephone numbers provided to us and may use these numbers to communicate with you about your treatment, your appointments, or procedures, to service your account, or to collect any amounts you may owe.  If we contact you by cell phone number, this could result in charges to you. We may also leave a message on voicemail in reference to any items that assist the practice in carrying out treatment, payment or our internal operations, such as appointment reminders, insurance items, and any call pertaining to your clinical care, including laboratory results.

Any message left on voice mail, with a person who answers the phone, text or in an email may include: (1) Your name (2) The location and (3) The doctor or other health care provider you have the appointment with. Calls will be recorded for quality and training purposes.

Certain text messages containing minimal information may be sent via an automated texting service or two-way communication platform to your cell phone.  For example, we may text you automated appointment reminders, prompts to sign up for MyChart, the availability of test results, that a new balance is due for payment, or a new bill is available in MyChart, or requests to provide feedback about our services. We may also contact you via a secure platform that allows for two-way communication about your upcoming visit, check-in, or payment due. You agree that OV or its vendors may contact you as described above.  You may unsubscribe from any automated phone/text messaging, by sending a message via MyChart or calling our MyChart Patient Support Line at 1-877-701-6088.

Your Rights Regarding Health Information About You

You have the following rights with respect to information about you maintained by OV:

• The right to choose someone to act for you. If someone is your legal guardian or you have given someone medical power of attorney, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action, including by requesting copies of the applicable paperwork.
• The right to access and get an electronic or paper copy of your medical record. Although your medical record is the property of OrthoVirginia, you are entitled to receive a copy of your medical record at any time. Under HIPAA and Virginia law (Va. Code 32.1-127.1:03), we are allowed to charge a fee for your record. You must sign our written request form in order for us to release your record to you or a party that you designate. We have 30 days to provide records once you have submitted the necessary written request.
  
  Requests for completion of medical-related forms, such as Disability or Family Medical Leave Act (FMLA) forms, require information from the patient’s visit but may also require the physician to address specific questions directly. There is a fee for any form that is requested to be completed by the practice. Once the fee and signed Authorization for Release of Medical Records form (available from the front desk staff, or on our website) have been received, the form(s) will be processed. Payment for forms is required in advance.
• The right to request changes to your medical record. You can ask us to correct health information about you that you think is incorrect or incomplete. You can contact us to find out how. We may not agree to your request, but we will tell you why within 60 days of receiving your request.
• The right to confidential communications. You can ask us to send confidential communications by alternative means or to alternative locations. Such request must be in writing and we must accommodate reasonable requests.
• The right to request limitations on how information is shared. You can request reasonable restrictions as to how your health information may be used or disclosed to carry out treatment, payment, or healthcare operations. Individuals who pay for their services out of pocket, in full, have the right to restrict disclosure of PHI to their insurance plan if they wish. All requests must be in writing.
• The right to receive a list of those with whom OV has shared information. You may request a list of those with whom we have shared your information for six years prior to the date you ask, who we shared it with, and why. We will include all the disclosures except for treatment, payment, and healthcare operations, and certain other disclosures (like those you have asked us to make). We will provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another list within 12 months.
• The right to receive copy of this Notice. OV will provide you with a paper copy of the effective Notice at any time upon request, even if you have agreed to receive a copy electronically.

Complaints

If you are concerned that your privacy rights have been violated, or you disagree with a decision we made about access to your records, you may contact our The OV Compliance Department at [email protected] or 1-888-223-4002.

You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1- 877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.

All complaints will be addressed by the OV Compliance Department. It is the policy of OV that no retaliatory action will be made against any individual who submits or conveys a complaint of suspected or actual non-compliance with standards.

Contact

If you have questions about our privacy practices, please contact us:

OrthoVirginia Compliance Department
1115 Boulders Parkway
STE 200
N. Chesterfield, VA 23225
Phone: 888-223-4002
Email: [email protected]

Changes to This Notice

We reserve the right to change the terms of this Notice and to make new notice provisions effective for all protected health information that we maintain. You may ask for an updated copy at any time at our office or on our website.  The Notice of Privacy Practices was last updated and effective as of August 1, 2024.