Chesterfield County, Virginia
Privacy Practices Notice

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. The privacy of your medical information is important to us.

Our Legal Duty

We are required by applicable federal and state law to maintain the privacy of your medical information. We are also required to give you this notice about our privacy practices, our legal duties, and your rights concerning your medical information. We must follow the privacy practices that are described in this notice while it is in effect.

This notice takes effect MAY 18, 2005, and will remain in effect until we replace it.

We reserve the right to change our privacy practices and the terms of this notice at any time, provided such changes are permitted by applicable law. We reserve the right to make the changes in our privacy practices and the new terms of our notice effective for all medical information that we maintain, including medical information we created or received before we made the changes. Before we make a significant change in our privacy practices, we will change this notice and make the new notice available upon request.

You may request a copy of our notice at any time. For more information about our privacy practices, or for additional copies of this notice, please contact us using the information listed at the end of this notice.

Chesterfield County

Fire and EMS Department
Mental Health/Mental Retardation/Substance Abuse Department
Department of Human Resource Management

Uses and Disclosures of Medical Information

We use and disclose medical information about you for treatment, payment, and health care operations. For example:

Treatment: We may use or disclose your medical information to a physician or other health care provider in order to provide treatment to you.

Payment: We may use and disclose your medical information to obtain payment for services we provide to you. We may disclose your medical information to another health care provider or entity subject to the federal Privacy Rules so they can obtain payment.

Health Care Operations: We may use and disclose your medical information in connection with our health care operations. Health care operations include:

• quality assessment and improvement activities;
• reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, conducting training programs, accreditation, certification, licensing or credentialing activities;
• medical review, legal services, and auditing, including fraud and abuse detection and compliance;
• business planning and development; and
• business management and general administrative activities, including management activities relating to privacy, customer service, resolution of internal grievances, and creating de-identified medical information or a limited data set.

We may disclose your medical information to another entity which has a relationship with you and is subject to the federal Privacy Rules, for their health care operations relating to quality assessment and improvement activities, reviewing the competence or qualifications of health care professionals, or detecting or preventing health care fraud and abuse.

On Your Authorization: You may give us written authorization to use your medical information or to disclose it to anyone for any purpose. If you give us an authorization, you may revoke it in writing at any time. Your revocation will not affect any use or disclosures permitted by your authorization while it was in effect. Unless you give us a written authorization, we cannot use or disclose your medical information for any reason except those described in this notice.

To Your Family and Friends: We may disclose your medical information to a family member, friend or other person to the extent necessary to help with your health care or with payment for your health care. We may use or disclose your name, location, and general condition or death to notify, or assist in the notification of (including identifying or locating), a person involved in your care.

Before we disclose your medical information to a person involved in your health care or payment for your health care, we will provide you with an opportunity to object to such uses or disclosures. If you are not present, or in the event of your incapacity or an emergency, we will disclose your medical information based on our professional judgment of whether the disclosure would be in your best interest.

We will also use our professional judgment and our experience with common practice to allow a person to pick up filled prescriptions, medical supplies, x-rays or other similar forms of medical information.

Public Benefit: We may use or disclose your medical information as authorized by law for the following purposes deemed to be in the public interest or benefit:

• as required by law;
• for public health activities, including disease and vital statistic reporting, child abuse reporting, FDA oversight, and to employers regarding work-related illness or injury;
• to report adult abuse, neglect, or domestic violence;
• to health oversight agencies;
• in response to court and administrative orders and other lawful processes;
• to law enforcement officials pursuant to subpoenas and other lawful processes, concerning crime victims, suspicious deaths, crimes on our premises, reporting crimes in emergencies, and for purposes of identifying or locating a suspect or other person;
• to coroners, medical examiners, and funeral directors;
• to organ procurement organizations;
• to avert a serious threat to health or safety;
• in connection with certain research activities;
• to the military and to federal officials for lawful intelligence, counterintelligence, and national security activities;
• to correctional institutions regarding inmates; and
• as authorized by state worker’s compensation laws.

Disaster Relief: We may use or disclose your medical information to a public or private entity authorized by law or by its charter to assist in disaster relief efforts.

Health Related Services. We may use your medical information to contact you with information about health-related benefits and services or about treatment alternatives that may be of interest to you.

Your Rights

1. You have the right to request restrictions on our uses and disclosures of protected health information for treatment, payment and health care operations. However, we are not required to agree to your request. To request a restriction, you must make your request in writing to the County’s Privacy Official, or the Privacy Officer within the department providing you with health service.
2. You have the right to reasonably request to receive confidential communications of protected health information by alternative means or at alternative locations. To make such a request, you must submit your request in writing to the County’s Privacy Official, or the Privacy Officer within the department providing you with health service.
3. You have the right to inspect and copy the protected health information contained in your medical and billing records and in any other Practice records used by us to make decisions about you, except:
   1. for psychotherapy notes, which are notes that have been recorded by a mental health professional documenting or analyzing the contents of conversations during a private counseling session or a group, joint or family counseling session and that have been separated from the rest of your medical record;
   2. for information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding;
   3. for protected health information involving laboratory tests when your access is restricted by law;
   4. if you are a prison inmate, obtaining a copy of your information may be restricted if it would jeopardize your health, safety, security, custody, or rehabilitation or that of other inmates, or the safety of any Official, employee, or other person at the correctional institution or person responsible for transporting you;
   5. if we obtained or created protected health information as part of a research study, your access to the health information may be restricted for as long as the research is in progress, provided that you agreed to the temporary denial of access when consenting to participate in the research;
   6. for protected health information contained in records kept by a Federal agency or contractor when your access is restricted by law; and
   7. for protected health information obtained from someone other than us under a promise of confidentiality when the access requested would be reasonably likely to reveal the source of the information.
4. In order to inspect and copy your health information, you must submit your request in writing to the County’s Privacy Official, or the Privacy Officer within the department providing you with health service. If you request a copy of your health information, we may charge you a fee for the costs of copying and mailing your records, as well as other costs associated with your request.
   
   We may also deny a request for access to protected health information if:
   • a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to endanger your life or physical safety or that of another person;
   • the protected health information makes reference to another person (unless such other person is a health care provider) and a licensed health care professional has determined, in the exercise of professional judgment, that the access requested is reasonably likely to cause substantial harm to such other person; or
   • the request for access is made by the individual’s personal representative and a licensed health care professional has determined, in the exercise of professional judgment, that the provision of access to such personal representative is reasonably likely to cause substantial harm to you or another person.
     
     If we deny a request for access for any of the three reasons described above, then you have the right to have our denial reviewed in accordance with the requirements of applicable law.
5. You have the right to request an amendment to your protected health information, but we may deny your request for amendment, if we determine that the protected health information or record that is the subject of the request:
   1. was not created by us, unless you provide a reasonable basis to believe that the originator of protected health information is no longer available to act on the requested amendment;
   2. is not part of your medical or billing records or other records used to make decisions about you;
   3. is not available for inspection as set forth above; or
   4. is accurate and complete.
6. In any event, any agreed upon amendment will be included as an addition to, and not a replacement of, already existing records. In order to request an amendment to your health information, you must submit your request in writing to the County’s Privacy Official, or the Privacy Officer within the department providing you with health service, along with a description of the reason for your request.
7. You have the right to receive an accounting of disclosures of protected health information made by us to individuals or entities other than to you for the six years prior to your request, except for disclosures:
   1. to carry out treatment, payment and health care operations as provided above;
   2. incident to a use or disclosure otherwise permitted or required by applicable law;
   3. pursuant to a written authorization obtained from you;
   4. to persons involved in your care or for other notification purposes as provided by law;
   5. for national security or intelligence purposes as provided by law;
   6. to correctional institutions or law enforcement officials as provided by law;
   7. as part of a limited data set as provided by law; or
   8. that occurred prior to April 14, 2003

Disclosure Accounting

To request an accounting of disclosures of your health information, you must submit your request in writing to the County’s Privacy Official, or the Privacy Officer within the department providing you with health service. Your request must state a specific time period for the accounting (e.g., the past three months). The first accounting you request within a twelve (12) month period will be free. For additional accountings, we may charge you for the costs of providing the list. We will notify you of the costs involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.

Complaints

If you believe that your privacy rights have been violated, you should immediately contact the County’s Privacy Official, or the Privacy Officer within the department providing you with health service. We will not take action against you for filing a complaint. You also may file a complaint with the Secretary of Health and Human Services.

Contact Persons

If you have any questions or would like further information about this notice, you may contact:

County Privacy Official,
Director of Risk Management
Risk Management Department (804-796-2128)
P.O. Box 788 Chesterfield, VA 23832.

County HIPAA Security Official
Data Security Administrator
Information Systems Technology (804-751-4942)
P.O. Box 40 Chesterfield, VA 23832

Privacy Officers contact information:

For the Fire and EMS Department:
Fire and EMS Privacy Officer, (804) 768-7594

For the Community Services Board, Department of Mental Health/Mental Retardation/Substance Abuse:
CSB Privacy Officer, (804) 768-7247

For the Department of Human Resource Management:
HRM Privacy Officer (804) 748-1143