When we have your written permission

If you give us written permission to use or disclose your health information to someone else, we will disclose it according to your instructions.  You may revoke your permission, in writing, at any time, except to the extent that we have already used or disclosed the information based on your permissions for its use and disclosure.

When we do not Have your written permission

Once you have given your consent for services at CPSD, we may use or disclose your PHI for treatment, payment, and health care operations.

Treatment is when we provide, coordinate, or manage your health care and other services related to your health care.  Information may be shared between CPSD supervisors and trainees in order to provide you effective and efficient care. 

Payment is when we bill and receive payment for the services you receive at the CPSD.  We are required to follow Virginia law that limits the amount of PHI we can disclose about you. For example, we may send a bill to you or someone who has agreed to pay for your services.  The information we send may include your name, the date of services and a brief description of the type of services provided, and your relationship to the person who has agreed to make payment.

Health Care Operations are activities that relate to the performance and operation of the CPSD. Examples include quality assessment and improvement activities, supervision, case management and care coordination.

We may use or disclose PHI without your consent or authorization in the following situations:

Serious Threat to Health or Safety: If CPSD staff reasonably believe there is a substantial risk that you will in the near future (a) cause serious physical harm to yourself or others, or (b) suffer serious harm due to lack of capacity to protect yourself or to provide for your basic needs, we must take steps to protect you and/or the intended victim.  These steps may include disclosing information to (1) obtain emergency care for you; (2) inform your emergency contacts; (3) notify law enforcement officers; and/or (4) notify the intended victims.

Child / Elder Abuse: Mental health providers are considered mandated reporters under state law.  We are required to report cases of suspected abuse/neglect/exploitation of a child, or elder or incapacitated adult to the relevant state agency.

Judicial or Administrative Proceedings: If you are involved in a court proceeding and a request is made for information about your diagnosis, treatment and/or other records, such information is privileged under state law.  We will not release information without your written authorization or that of your legal representative, or a court order.  If you file a complaint against a CPSD staff member, relevant information may be disclosed to those receiving or responding to the complaint, including the Virginia Commonwealth University’s legal counsel.

Oversight activities: We may release your health information during oversight activities including internal and external audits, chart reviews, investigations, and inspections required for compliance with government, university, and accreditation programs and laws.  Only the minimal necessary information will be released and it will usually be of a general/composite nature. However, on occasion, reviews will involve sighting of individual information by the auditor, accreditation examiner, or qualified professional. 

Threat Assessment: If you are a student at Virginia Commonwealth University we may release your health information in response to an inquiry from the university’s Threat Assessment Team.

As permitted by law: we may use and disclose your health information to the following types of entities, including but not limited to:

• Public Health or Legal Authorities charged with preventing or controlling disease, injury or disability
• Workers Compensation Agents
• Military Command Authorities
• National Security and Intelligence Agencies
• Protective Services for the President and Others
• Food and Drug Administration
• Correctional Institutions

As required by law:  we may disclose your health information when required to do so by law.

Law Enforcement: We may release your health information, in a limited form, to a law enforcement official to aid in the location of a missing person or report a crime.

Research: We may release your health information in aggregate form to researchers, when this information does not identify you or any other person or when research has been approved by an institutional review board that has established procedures to ensure the privacy of your health information.

Future communications: We may communicate with you via mail or other means regarding your satisfaction with the services you received at the CPSD or as a follow-up to your psychotherapy or assessment.  We may also communicate with you in the course of psychological research to verify data in our records or collect additional data.  You have the right to refuse communications in the future.

For a full list of permitted ways that we may release your health information, ask CPSD staff for a printed copy of the US Department of Health and Human Services, “Summary of the HIPAA Privacy Rule”.

You have the right to inspect and/or obtain a copy of your PHI that is maintained in the CPSD record. We may deny your access under certain circumstances but you have the right to request a review of the denial. If asked, CPSD staff will discuss the details of the process with you.  We may charge a fee for copying, labor, supplies, and postage needed to fulfill your request.

You have the right to request restrictions on certain uses and disclosures of your PHI. However, we are not required to agree to your requested restrictions.  If we do agree, we may still share information if it is necessary to provide you with emergency care.

You have the right to receive confidential communications of PHI by alternative means and/or at alternative locations. We will agree to reasonable requests, such as using an alternate mailing address or contacting you at a specific phone number.

You have the right to request an amendment to your PHI for as long as the PHI is maintained in the CPSD record. This request must be in writing.  We may deny your request.  If asked, CPSD staff will discuss the details of the request and denial process with you.

You have the right to receive an accounting of disclosures of PHI for which you have not given permission (as described above).  We will include all disclosures except for those about treatment, payment, and health care operations.  We will provide one accounting per year at no charge but may charge a reasonable fee if you request another accounting within 12 months.  If asked, CPSD staff will discuss the details of the accounting process with you.

You have the right to obtain a paper copy of this notice upon request.

If you have questions about this notice, disagree with a decision we have made about access to your records, or have other concerns about your privacy rights, you may contact:

Mary Beth Heller, Ph.D., Director of CPSD, at (804) 828-8069.

If you believe that your privacy rights have been violated and wish to file a complaint with us, you may send your written complaint to:

Mary Beth Heller, Ph.D.

Center for Psychological Services and Development

612 N Lombardy Street

PO Box 843033

Richmond VA  23284-3033

You may also send a written complaint to the Commonwealth of Virginia Board of Health Professions and or the Secretary of the U.S. Department of Health and Human Services. You may call us at (804) 828-8069 to ask for the mailing address and phone number for either agency.

CPSD staff will not retaliate against you for exercising your right to file a complaint.

CPSD is required to abide by the terms of the notice currently in effect. We reserve the right to change the terms of this notice and to make the new notice provisions effective for all PHI that it maintains.  Our office and web site will display the most current policy.

Notice effective May, 2016