This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review carefully.

Who Will Follow This Notice

This notice describes the health information policies of Prince William Health System, Prince William Hospital, Prince William Hospital — Home Health Care, Prince William Hospital — Behavioral Medicine Center, and Continuing Care Corporation doing business as Annaburg Manor (the "System Providers"). This notice applies to all departments and units of Prince William Hospital and the other providers listed above. The practices outlined in this notice will also apply to employees, staff, personnel and volunteers of these System Providers. In addition, as the System Providers are clinically integrated, you may receive care through independent physicians or other healthcare providers while at Prince William Hospital or other System Providers. This notice applies to all those additional providers who may use or disclose your health information in connection with care while at a System Provider and to all records of that care. The System Providers may share medical information with each other for treatment, payment and healthcare operations, and may disclose your health information to other healthcare providers involved in your care at a System Provider for purposes of your treatment, in connection with payment for such services or treatment, and in connection with healthcare operations connected to any such services provided at a System Provider. Emergency room physicians and most other physicians who may provide services at the System Providers are independent practitioners, are not employed by us and are not our agents, and generally will bill separately from the System Providers for their services. Physicians and other healthcare providers may have different policies or notices regarding their use and disclosure of your health information in their offices, clinics or other locations outside of the System Providers.

Our Pledge Regarding Medical Information

We are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to:

make sure that health information that identifies you is kept confidential as provided by law.
give you this notice of our legal duties and privacy practices concerning your health information.
follow the terms of the notice that is currently in effect.

How We May Use And Disclose Health Information About You

The following is a summary of ways that we use and disclose health information about you. In order to provide and coordinate your care, your healthcare information will be shared and used under the following conditions:

To Provide Treatment
We may use health information about you to provide you with medical treatment and services. Health information about you may be disclosed to doctors, nurses and employees involved in your medical care. Your information will be shared with caregivers in order to coordinate your treatment during hospitalization or episode of treatment. For example, physicians involved in your care will need and will be given information about your symptoms in order to prescribe appropriate medications. We may disclose health information to others outside of the System Providers who may be involved in your medical care, including family members, physicians, pharmacists, suppliers of medical equipment or other healthcare professionals.

To Obtain Payment
We may use and disclose health information about you so that treatment and services rendered through System Providers may be billed to and payment may be collected from you, insurance companies and/or third parties. For example, we may need to release to your health plan provider a description of your condition and the treatment you received so that your health plan provider will reimburse us for your treatment. We also may need to notify your health plan provider about a treatment you are scheduled to receive to obtain prior approval for payment or to determine whether your health plan will cover the treatment. This information may be released via paper copy, facsimile or electronic transmission.

To Conduct Routine Healthcare Operations
We may use and disclose health information about you for operations of the System Providers. These uses and disclosures are necessary for routine operations. For example, we may use and disclose information to evaluate services you receive to ensure that our patients receive quality care and to ensure that we continue to earn professional accreditation. In addition, we may use your information to contact you for purposes such as the following:

Appointment reminders: We may use and disclose your information to contact you as a reminder that you have an appointment for an office visit, lab test or other treatment.
Treatment alternatives and health-related services: We may use and disclose your information to tell you about alternative treatments or health-related benefits or services that may be of interest to you. We may also use and disclose your medical information to assess your satisfaction with our services.
Fundraising: We may use and disclose limited information about you to contact you in an effort to raise money for the benefit of System Providers. If you prefer not to receive such fundraising notices, you must notify our Privacy Officer in writing at the address set forth on the back of this notice.
Patient Directory: Unless you object, we will list limited information about you (name, room number, general condition such as "fair") in our directory while you are a patient. We will give this information to anyone who asks for you. In this way, family and friends can visit or check on your progress and florists can deliver flowers to you while you are being cared for at a System Provider. In addition, if you choose, you may provide us with your religious affiliation so that clergy — such as your priest, minister or rabbi — can identify their congregation members who are being treated by our facilities.
Individuals involved in your care or payment for care: We may release information about you to a family member or friend who is involved in your care or payment for your care. We may also release information about you to such an individual in a medical emergency.
Business Associates: There are some services within our organization that are carried out through contracts with business associates. For example, we may contract with billing services, accounting firms and healthcare consultants to assist in certain functions. We may disclose your health information to business associates. However, unless the disclosure is made to a healthcare provider, we will generally have entered into a formal agreement with the business associate requiring that patient information be confidentially maintained.
Special Situations: In addition to the above, there may be times when we use or disclose your health information for the following reasons:
As required by law: We will disclose health information about you when required to do so by federal, state or local law.
To avert a serious threat to health or safety: We may use and disclose health information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone reasonably able to prevent or reduce the threat. This may include disaster relief agencies.
Organ and Tissue Donation: If you are an organ donor, we may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.
Worker's Compensation: We may disclose your health information to comply with laws relating to worker�s compensation or other similar programs that provide benefits for work-related injuries or illness without regard to fault.
Military and veterans: If you are a member of the armed forces, we may release health information about you as required by military authorities.
Public health risks: We may disclose health information about you for public health activities. These activities generally include the following: to prevent or control disease, injury or disability; to report child abuse or neglect; to report reactions to medications or problems with products; to notify people of recalls of products they may be using; to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.
Abuse, neglect or domestic violence: We may disclose health information about you to government authorities (including social service or protective service agencies) if we believe you have been the victim of abuse, neglect or domestic violence and if (i) you agree to the disclosure or (ii) we are required by law to do so, or (iii) the disclosure is authorized by law and we believe it is necessary to prevent serious harm.
Health oversight activities: We may disclose health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections and licensure activities. These activities are necessary for the government to monitor the healthcare system, government programs and compliance with civil laws.
Research: Under certain circumstances, we may use and disclose medical information about you for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received one medication with those who received another, for the same condition. All research projects, however, are subject to a special approval process. This process evaluates a proposed research project and use of medical information, trying to balance the research needs with patients� need for privacy of their medical information. We may also disclose medical information about you to people preparing to conduct a research project, for example, to help them look for patients with specific medical needs, so long as the medical information they review does not leave the System Provider that maintains the information. Before we use or disclose medical information for research, the project will have been approved through this research approval process. We will almost always ask for your specific authorization if the researcher will have access to your name, address or other information that reveals who you are, or will be involved in your care at the System Provider.
Lawsuits and disputes: We may disclose health information about you in accordance with a court or administrative order. In addition, we may disclose health information about you in response to a valid subpoena, discovery request or other lawful process, but only if efforts have been made to notify you of the requested disclosure.
Law Enforcement: We may release health information if asked to do so by a law enforcement official (i) in response to a court order, subpoena, warrant or summons issued by a judicial officer, (ii) for the purpose of identifying or locating suspects, fugitives, material witnesses or missing persons, (iii) concerning the victims of crime, (iv) about a death suspected to be the result of a crime, (v) about criminal conduct on our premises, (vi) in emergency circumstances, to alert the official to the commission and nature of a crime and similar matters, or (vii) when required to do so by law.
Coroners, Medical Examiners and Funeral Directors: We may release health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or to determine the cause of death. We may also release medical information about patients of our facilities to funeral directors as necessary to carry out their duties.
National Security: We may release health information about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations, or for intelligence, counterintelligence, and other national security activities authorized by law.
Inmates: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release health information about you to the correctional institution or law enforcement official. This release would be necessary (i) for the institution to provide you with healthcare; (ii) to protect your health and safety or the health and safety of others; and (iii) for the safety and security of the correctional institution.

Other Uses of Medical Information

Other uses and disclosures of medical information not covered by this notice or the laws that apply to us will be made with your written permission. If you give us permission to use or disclose medical information about you, you may revoke that permission in writing at any time. If you revoke permission, thereafter we will no longer use or disclose medical information about you for the reasons covered by your written authorization. You must understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the care that we provided to you.

Your Rights Regarding Medical Information About You

You have the following rights regarding the health information about you:

Right to Inspect and Copy: You have the right to inspect and obtain a copy of medical information that may be used by System Providers to make decisions about your care. Usually, this includes medical and billing records, but it does not include psychotherapy notes.

To inspect and copy medical information that may be used to make decisions about you, you must submit your request in writing to our Privacy Officer at the address set forth on the back of this notice. If you request a copy of the information, we may charge a fee for the costs of copying and postage.

We may deny your request to inspect and copy your information in certain and very limited circumstances. If your request is denied, we will inform you of the denial, the reason for it, and how to request a review of the denial, if the denial is subject to review by law. If your request is denied and you appropriately request a review, a licensed healthcare professional who did not participate in the original denial decision will review your request and the denial. We will comply with the outcome of that review.

Right to Request an Amendment: If you believe that medical information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by the System Provider.

To request an amendment, your request must be made in writing, must provide a reason that supports your request, and must be submitted to our Privacy Officer at the address set forth on the back of this notice.

We may deny your request for an amendment if it is not in writing or if it does not include a reason to support the request. In addition, we may deny your request if (i) you ask us to amend information that was not created by a System Provider (unless you provide information that the originator is no longer available to amend the information), (ii) the information is not maintained by us, (iii) the information is not available for inspection, or (iv) the information is accurate and complete as currently maintained.

Right to an Accounting of Disclosures: You have the right to an "accounting of certain disclosures." This is a list or report of the disclosures we made of medical information without your written authorization other than disclosures for your care, payment, healthcare operations and certain other matters.

To request this list or accounting of disclosures, you must submit your request in writing to our Privacy Officer at the address set forth on the back of this notice. Your request should state the time period for which you are requesting the accounting (for example, for disclosures within one year prior to the date of the request). The accounting will not include disclosures made prior to April 14, 2003, and will not include any disclosures more than six years prior to the request date. The first list you request within a 12-month period will be free. For additional lists during the same 12-month period, we may charge you for the cost of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at the time before any costs are incurred. We may also provide a summary list as an option.

Right to Request Restrictions: You have the right to request a restriction or limitation on the medical information we use or disclose about you for treatment, payment or healthcare operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment of your care such as a family member or friend.

We are not required to agree to your request. If we do agree, we will comply with your request unless (i) the information is needed to provide you with emergency treatment, (ii) the disclosure is required by law, or (iii) the disclosure relates to public health activities, victims of abuse, neglect or domestic violence, health oversight activities, judicial and administrative proceedings, disclosures concerning crimes and certain similar matters.

To request restrictions, you must furnish your request in writing to the Privacy Officer at the address set forth on the back of this notice or make your request known on the Privacy Disclosure Form. The request must include a statement of (i) what use or disclosure you want to limit, (ii) what information you want to limit, and/or (iii) to whom you want the limits to apply.

Right to Request Confidential Communications: You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we contact you only at work or by mail.

To request confidential communications, you must furnish your request in writing to the Privacy Officer at the address set forth on the back of this notice or include your request on the Privacy Disclosure Form. The Privacy Disclosure Form indicates several alternative ways we may contact you. A request that we communicate with you in a certain way or at a certain location must include a mailing address where you will receive bills and correspondence relating to payment for services.

Right to a Paper Copy of This Notice: You have the right to a paper copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. To obtain a paper copy of this notice, please request one at any registration desk or contact the Privacy Officer.

Virginia Prescription Monitoring Program

The Virginia Prescription Monitoring Program collects prescription data for specified drug schedules into a central database, which can then be used by authorized users to promote the appropriate prescribing and dispensing of controlled substances for legitimate medical purposes while deterring the illegitimate use of these drugs. This database is maintained by the Department of Health Professionals.

Changes To This Notice

We reserve the right to change this notice. We reserve the right to make the revised or changed notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current notice. The notice will contain the effective date in the top right-hand corner of the first page.

Complaints

If you believe your privacy rights have been violated or that we are not in compliance with these privacy practices, you may file a complaint with the Privacy Officer for Prince William Health System or with the Secretary of the Department of Health and Human Services. To file a complaint with a System Provider, call (800) 93 Alert [932-5378] or write to our Privacy Officer whose information is provided on the back of this notice.

All complaints will be investigated on behalf of Prince William Health System. You will not be penalized in any way for filing a complaint.

Complaints filed with the Secretary of Health and Human Services must be in writing and must be sent within 180 days of when you knew (or should have known) that the act or omission occurred. Your letter must include the following points:

The name of the facility affiliated with Prince William Health System.
A description of the acts or omissions that you believe are in violation of privacy requirements.
Mail to:

Secretary of Health and Human Services
The U.S. Department of Health and Human Services
200 Independence Ave., S.W.
Washington, D.C. 20201

Privacy Officer

For further information about this Privacy Notice, please contact:

Privacy Officer
Prince William Health System
8700 Sudley Road
Manassas, VA 20110
Telephone: (703) 369-8270

Last updated: 1/10