HIPAA Privacy Practices

HIPAA Privacy Practices


This notice describes the privacy practices of the Department of Behavioral Health and Developmental Services (DBHDS), including the Central Office and each of the psychiatric hospitals and mental retardation training centers DBHDS operates. DBHDS is required by law to maintain the privacy of protected health information. We are also required by law to provide you with this notice telling you about our legal duties and privacy practices with respect to protected health information.

If you have someone making decisions on your behalf because you are not able to make decisions yourself, we will give a copy of this notice to that person, and we will work with that person in all matters relating to uses and disclosures of your health information.

How We May Use and Disclose Health Information About You to Other People

When we have your written permission. If you give us written permission to use or disclose your health information to someone else, we will use or disclose it according to your instructions. You may revoke your permission, in writing, at any time, except to the extent that we have already used or disclosed the information that you gave us permission to use or disclose.

When we do not have your written permission. Sometimes we will disclose information without your permission. In each of these cases, we will attach a statement that tells the person receiving the information that they cannot disclose it to anyone else unless you give them permission or unless a law allows or requires them to disclose the information without your permission.

Any time we disclose information without your permission to anyone except employees of DBHDS, a community services board or other providers, we will place in your medical record a written notation of the information we disclosed, the name of the person who received the information, the purpose of the disclosure, and the date of disclosure. We will also let you know in writing about the disclosure, including the name of each person who received the information and the nature of the information. We will do this before the disclosure or, in an emergency, as soon as we can afterwards.

If the disclosure is not required by law, we will give strong consideration to any objections from you in making the decision to release information.

Before we disclose information to anyone, we will verify the identity and authority of the person receiving the information.

The following categories describe different ways that we may use and disclose health information about you without your written permission. Not every use or disclosure in a category will be listed. However, all of the ways that we are permitted to use and disclose information without your permission will fall within one of these categories.

To find someone to make decisions on your behalf. If you are not capable of making medical decisions, we may disclose your health information in order to identify someone to make those decisions for you (called a “legally authorized representative” or “LAR”). Before we disclose any information, we must determine that disclosure is in your best interests.

Treatment. We may use health information about you to provide you with medical and mental health treatment or services, and we may disclose this information to other health care providers to help them treat you. For example:

We may disclose health information about you to doctors, treatment workforce members, medical students, or other facility personnel who are involved in your treatment here. Different facilities and different departments or offices within this facility may share health information about you in order to coordinate the different things you need, such as medication orders, lab work, and various tests.
We may disclose to community services boards or to other providers health information they may need to prescreen you for services or to prepare and carry out your individualized services or discharge plan.

Payment. We may use and disclose health information about you so that we can bill and receive payment for the treatment and services you receive at the facility and so that other providers can bill and be paid for the treatment services they provide. We have to follow Virginia law that limits the amount of health information we can disclose about you. For example, we may send a bill to you or someone who has agreed to pay your medical bills, such as an insurance carrier or Medicaid. The information we send to an insurer may include your name; the date you were admitted to our facility; the date you became ill; the date you are discharged from our facility; your diagnosis; a brief description of the type and number of services we provided you; your status; and your relationship to the person who has agreed to pay your bills.

Health Care Operations. We may use and disclose health information about you to operate the facility and DBHDS and to make sure that all individuals in the facility and in other DBHDS facilities receive quality care. For example, we may disclose information to physicians and other treatment professionals so that they can review and make suggestions about your care or so they can learn something new about treatment. We may combine the health information we have with health information from the other facilities DBHDS operates to compare how we are doing and see where we can make improvements in care and services.

Business Associates. Some of our services are provided through contracts or agreements with other public and private entities, and some of these contracts or agreements require that health information be disclosed to the contractor. These contractors are known as “business associates.” Examples include physician consultants, laboratories, dentists and lawyers from the Office of the Attorney General. We may disclose your health information to these people so that they can perform the job we have asked them to do.

Facility Directory. We may include your name, your location, and a general description of your medical condition in a facility directory. This directory will not be shared with anyone outside the facility unless you give us permission to disclose it. You have the right to restrict the use of the health information contained in the directory.

Required by Law. We will disclose health information about you when we are required to do so by a federal, state, or local law or regulation.

Public Safety. If we reasonably believe that you pose a serious and imminent threat to a specifically identifiable person or the public, we may communicate those facts necessary to prevent or lessen the potential threat.

Public Health. As authorized by law, we will disclose your health information to public health authorities charged with preventing or controlling disease, injury, or disability

Organ and Tissue Donation. We may release health information to organizations that handle organ procurement, as permitted by law.

Workers’ Compensation. We may release health information about you for workers’ compensation or similar programs that provide benefits for work-related injuries or illness, as authorized by, and to the extent we are required to do so to comply with, law.

Food and Drug Administration (FDA). We may disclose information about you to the FDA as necessary for product recalls, withdrawals, and other problems with a product; to track products; or to report adverse events, product defects, or other problems with products.

Health Oversight Agencies. We may disclose your health information to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensing. Information may be disclosed to the Office of the Inspector General, the Department of Health Office of Quality Care, the Virginia Office for Protection and Advocacy, the DBHDS Office of Licensing, the DBHDS Office of Human Rights, and other similar oversight agencies.

Coroners, Medical Examiners and Funeral Directors. We may release health information regarding decedents to coroners, medical examiners, or funeral directors, as authorized by law. For example, Virginia law requires us to notify the medical examiner when an individual dies in one of our facilities. We are also required to report to a funeral director any infectious disease that someone who died may have had.

National Security, Intelligence Activities and Protective Services for the President. We may disclose health information to a public official for national security activities and the protective services of the President and others when we are required to comply with a valid subpoena or other legal processes, or if such disclosure is required by state or federal law.

Correctional Institutions and Other Law Enforcement Custodial Situations. We may disclose health information to a correctional institution if it is necessary for your care or if the disclosure is required by state or federal law.

Judicial and Administrative Proceedings. When a court orders us to disclose health information, we will disclose the information that the court orders. We will also disclose health information in response to a subpoena that meets the requirements of Virginia law.

Law Enforcement Officials. We may disclose health information to a law enforcement official in response to a valid subpoena or other legal process or if the disclosure is required by state or federal law.

Research. We may disclose aggregate health information to researchers, when this information does not identify you or any other person or when research has been approved by an institutional review board that has established procedures to ensure the privacy of your health information.

Victims of Abuse and Neglect. If we reasonably believe that you are a victim of abuse or neglect, we will disclose health information about you to a government agency authorized by law to receive such information, to the extent that we are required to do so by law.

Other uses and disclosures will be made only with your written authorization (permission). You may revoke your authorization in writing at any time, except to the extent that we have acted in reliance on the authorization.

Your Rights Regarding Health Information About You

You have the following rights regarding the health information we maintain about you:

Right to Inspect and Copy. You have the right to inspect and copy health information that we maintain about you as allowed by state and federal law. If you request a copy of your information, we may charge a fee for copying, labor, supplies and mailing.

We may deny your request in certain circumstances. If you are denied access to your health information, you may request that the denial be reviewed. A physician or a licensed clinical psychologist not involved with your care will review your request and the denial. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review. If you are denied access to any portion of your record, you have the right to ask that a psychiatrist, doctor, psychologist or lawyer of your choosing get a copy of what has been denied to you.

Right to Amend. If you feel that health information that we have about you is incorrect or incomplete, you may ask us to amend, or correct, the information. You have the right to request an amendment for as long as the information is kept by or for us.

We may deny your request to amend information that:

Was not created by us, unless the person or organization that created the information is no longer available to make the amendment;
Is not part of the health information kept by or for us;
Is not part of the information that you would be permitted to inspect and copy; or
Is accurate and complete.
If your request is denied, you have the right to ask us to put a statement of disagreement in your record.

Right to an Accounting of Disclosures. You have the right to request and receive a list of the disclosures that we have made of your health information except for disclosures made to employees of the Department. Your request may indicate a time period, and you should tell us the form in which you want the list (for example, on paper or electronically).

Right to Request Restrictions. You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment or health care operations.

We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment.

To request restrictions, you must make your request in writing to:

In your request you must tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply

Right to Request Confidential Communications. You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing to the DBHDS Chief Privacy Officer, at DBHDS, P.O. Box 1797, Richmond, VA 23218-1797. If you wish to request confidential communications from a specific state facility, please direct your request to the privacy officer for that facility.

We will not ask you the reason for your request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to a Paper Copy of This Notice. Upon your request, you have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. You may also obtain a copy of this notice on the DBHDS website. To obtain a paper copy of this notice, contact: the DBHDS Chief Privacy Officer at DBHDS, P.O. Box 1797, Richmond, VA 23218-1797, or call the Privacy Office at 804-225-3396.

[If applicable: We use photography, including (insert types) to document certain aspects of your treatment and care while you are here. Describe practices related to photography in detail here.]

We are required to abide by all of the terms of the Notice of Privacy Practices currently in effect.

We reserve the right to change the terms of this Notice and to make the new notice provisions effective for all protected health information we maintain. If our notice changes, a revised notice will be displayed at a prominent location in your living area, and you may get a copy if you request one.

For more information: If you have questions and would like additional information, you may contact  Glenn Schmitz, CISSP Chief Information Security Officer.

If you believe your privacy rights have been violated, you may file a complaint by contacting Deb Lochart, Acting DBHDS Human Rights Director, or the human rights advocate for the specific facility where you have a concern (click on the link for state facilities to obtain numbers to request more specific facility contact information).

The Secretary of the United States Department of Health and Human Services, at  202-619-0257; or toll free at 1-877-696-6775.

No one will retaliate against you in any way for filing a complaint.


I have been provided a copy of the Department of Behavioral Health and Developmental Services’ Notice of Privacy Practices.

Signature of Individual or Legally Authorized Representative

Name of Individual or Legally Authorized Representative (Please print)

Date Notice given

Staff Notes: