Privia Health

Patient Portal Terms and Conditions

These terms and conditions constitute a binding agreement between you and Privia Health ("we," "us," or "our").

The Patient Portal is an Internet service that allows our patients to: communicate with us; access their health records; request or reschedule appointments; view and update personal information; request prescriptions; receive test results; read patient educational material; view statements; pay bills; and access related services and content.

The Patient Portal is provided on behalf us and our physicians, employees, managers, officers, directors, agents, and representatives and powered by athenahealth, Inc. (all of the foregoing, collectively, the "Practice Entities"). The Practice Entities are intended third-party beneficiaries of this agreement and entitled to enforce all terms and conditions of this agreement.

By accessing or using the Patient Portal, you confirm that you agree to these terms and conditions. If you don't agree, don't use the Patient Portal. By agreeing to these terms and conditions, you acknowledge that you are at least 18 years of age, or legally emancipated, and that you are requesting access to Patient Portal. You acknowledge that Patient Portal is offered as a courtesy to our patients and agree that we may limit or discontinue your use of Patient Portal at any time for any reason.

Minimum Requirements and Security

• This website uses encryption software. In order to use Patient Portal, you must have:
  • a personal computer equipped with an Internet browser that has 128-bit encryption enabled and configured to accept cookies (e.g., Internet Explorer 7 or 8, Safari, or Firefox; Internet Explorer 6 may not allow you to view some materials, such as test results);
    
    
  • Internet access, a valid email account, software to receive and read email messages, and spam filters set to accept email from our domain; and
    
    
  • Adobe Reader installed (to download a copy of Adobe Reader, please go to http://www.adobe.com/products/acrobat/readstep2.html).
    
    
• While we use state-of-the-art security, no system can guard against risks of intentional intrusion or inadvertent disclosure of information. When using Patient Portal, information may be transmitted over media that are beyond the control of the Practice Entities and their contractors and subcontractors and that may not be secure. For example, you may receive email, text, or telephone communications in connection with your use of Patient Portal, all of which are inherently unsecure and subject to disclosure to or access by third parties (e.g., if your phone is used by someone else, you do not keep your phone or email information up to date on Patient Portal and communications are misdirected, or the network or systems of a telecommunications provider are hacked). Furthermore, electronic services such as those provided by the Practice Entities, their contractors and subcontractors, and any telecommunications providers involved in the transmission of data are all inherently subject to failure and none of the foregoing can guarantee that their services will be provided without error or interruption at all times that you may wish to use those services. YOU HEREBY EXPRESSLY ASSUME THE RISK OF ANY UNAUTHORIZED DISCLOSURE OR INTENTIONAL INTRUSION, OR OF ANY DELAY, FAILURE, INTERRUPTION, OR CORRUPTION OF DATA OR OTHER INFORMATION TRANSMITTED IN CONNECTION WITH THE USE OF ANY SERVICE RELATED TO PATIENT PORTAL. Once information is received by us, your medical information will be treated as confidential and given the same protection that all of our other medical records are given.

Security, Confidentiality, and Usage Guidelines for Patient Portal

• YOU MUST NOT SEND ANY MESSAGES REQUIRING URGENT ATTENTION USING PATIENT PORTAL. Doing so may create a delay in your receiving necessary medical treatment and could result in loss of life, permanent injury, or significant deterioration in your health. If you believe that you have an urgent medical matter, you should call 911 immediately or proceed to the nearest emergency room. If the matter is not urgent but you need a response in less than two business days, please contact your clinician's office directly by telephone during our regular business hours, which you may find on the log-in screen for Patient Portal.
  

  FOR ALL MEDICAL EMERGENCIES, IMMEDIATELY CALL 911

  
  
• Patient portal is designed as a secure Internet-based environment through which you may receive confidential medical information about yourself. When you initially enroll to use the Patient Portal, you will need to confirm your identity via two unique workflows, as well as establish an email and a confidential password for login credentials. Please DO NOT SHARE YOUR PASSWORD with anyone. Anyone with access to your password will be able to view your medical and financial information and communicate with your health care team as if that person were you. Thus, when you give someone your password, you are authorizing that person to access your account, and you are responsible for all transactions that person performs while using your service. It is your responsibility to prevent disclosure of your password and to change your password if you feel that your security has been compromised. If you believe that your password has become known to an unauthorized person and want verification of any changes that may have been made to your account, please contact us for assistance. You can change your password in the Patient Portal at any time by clicking the "Security Settings" link under "My Profile."
  
  
• You may request a Patient Portal account for yourself. You may not request or access a Patient Portal account for anyone else, except that a parent or guardian may request and access an account on behalf of a minor child. By accepting these terms and conditions, you certify that you are authorized to open or access the account you are requesting and that all information you have provided to us is true and correct to the best of your knowledge.
  
  
• Once you have activated your Patient Portal account, the Patient Portal Inbox will become the primary vehicle to receive important messages from your participating provider(s) and other personal medical information. You MUST provide us with your email address when activating your Patient Portal account and keep your email address current via the My Profile link, to ensure that you receive notification of newly released information in a timely manner. You may continue to receive communications via the United States Postal Service or other means from us.
  
  
• We keep track of the pages our patients visit within Patient Portal, in order to determine what services are the most popular. This data is used to deliver customized content within Patient Portal to patients whose behavior indicates that they are interested in a particular subject area.
• We secure your personal information from unauthorized access, use or disclosure. The personally identifiable information you provide is maintained by us on computer servers in a controlled, secure environment, protected from unauthorized access, use or disclosure. When personal information is transmitted from your PC and/or mobile devices to Patient Portal, it is protected through the use of encryption, such as the Secure Socket Layer (SSL) protocol. As a user of Patient Portal you hereby agree that you (and not the Practice Entities) are solely liable for viruses, worms, Trojan horses, cancel bots, and other electronic mechanisms designed to destroy or impair the functioning of computer systems already residing on your PC and/or mobile device.
• When you use the Patient Portal, we collect personally identifiable information, such as your email address, name, home address, telephone number, ZIP code, age, gender, contact preferences, access times, and account activity. This information is used by us for the operation of the service, to maintain quality of the service, and to provide general statistics regarding use of Patient Portal. We may share data with business associates working on our behalf to help us perform statistical analysis, send you email or postal mail, provide customer support, or arrange for deliveries. We encourage you to review the Privacy Statement for further information regarding how your personal information may be used.
• Cookies are used for system performance functionality. You have the ability to accept or decline cookies. Most Web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully experience the interactive features of the Patient Portal services.

How We Protect Your Personal Health Information

• We consider the privacy of your health information to be one of the most important elements in our relationship with you and one we take very seriously. By accessing or using Patient Portal, you acknowledge that you have received and read a copy of our Notice of Privacy Practices, which can be found in paper copy at our office locations or through your Patient Portal account under the "Forms" link.
  
  
• We are committed to protecting the privacy of the information you send and receive through Patient Portal, and will only collect and use such information as permitted under the Patient Portal Privacy Statement, which can be found online within Patient Portal. By using Patient Portal, you also consent to all of the terms and conditions described in the Privacy Statement.
  
  
• All communications between you and our health care team using Patient Portal are carried over a secure, encrypted connection directly into our electronic medical record. While you may receive email messages notifying you of new messages in your Patient Portal Inbox, these emails will not contain any personal health information. It is your responsibility to login to your Patient Portal account and read the messages promptly.

Your Responsibilities

• Patient Portal is a communication service offered as a convenience to our patients. We reserve the right to change the terms, conditions, and notices under which Patient Portal is offered. By accessing or using Patient Portal, you further agree that any and all such modifications are effective and binding upon you immediately upon posting of the modified version. We reserve the right in the future to charge a fee for the use of Patient Portal. You will be notified in advance of any such change and asked to re-apply if you agree to the fee and wish to continue with the Patient Portal service.
  
  
• You understand that by accepting the terms and conditions of this Agreement you are agreeing to receive your patient balance statements delivered electronically to your Patient Portal account. You have the option at any time to revert back to receiving your patient balance statements as paper statements sent to you via U.S. Mail. You may exercise that option by checking the appropriate checkbox located at the bottom of the Billing Tab in Patient Portal under "Patient Preferences."
  
  
• You acknowledge that by entering your home and/or mobile telephone number into Patient Portal you are providing written consent for the Practice Entities to send automated, prerecorded, or artificial voice telephone calls to all provided numbers. You may opt-out of receiving these calls on the "Contact Preferences" page, located under the My Profile tab.
• You understand that Patient Portal provides you with online access to some clinical information about you. You are solely responsible for any sharing of Patient Portal content that you intentionally or unintentionally communicate to others.

Patient Portal Messaging

• By using Patient Portal, you acknowledge and agree that this messaging service is intended to facilitate dialogue regarding personal health matters. You agree not to use Patient Portal to post or send or post any illicit or offensive material.
  
  
• You understand that messages will be routed to the appropriate department as necessary for handling, and therefore our employees other than your physician, nurse practitioner, or physician's assistant may be involved in addressing your request. If your physician is out of the office or unavailable to respond, messages sent via Patient Portal may be routed to other authorized healthcare providers within our practice to facilitate a timely response to your request. Therefore, use of Patient Portal may not be appropriate if there is sensitive information that you want to discuss directly with your healthcare provider.
  
  
• You understand that your health care team may send you messages, test results, and other communications via Patient Portal as authorized in the sole discretion of your physician. These messages may contain information important to your health and medical care. It is your responsibility to monitor these messages. By entering your valid and functional email address at registration, you have enabled us to notify you of messages sent to your Patient Portal Inbox.

Discontinuing Use of Patient Portal

• You may discontinue your use of Patient Portal at any time by sending a secure message to your primary care provider's office requesting this change.
  
  
• We reserve the right, in our sole discretion, to limit or discontinue your use of Patient Portal at any time and for any reason, including, but not limited to, your use of Patient Portal on behalf of another person.
  
  
• Your Patient Portal service will be discontinued if you no longer have a primary care provider who participates in Patient Portal at your practice.
  
  
• You will be notified if your Patient Portal service is discontinued.
  
  

Your Clinical Information

• As we provide your health care, we are required to maintain documentation of your medical history, current conditions, treatment plan, and all treatments given, including the results of all tests, procedures, and therapies. Patient Portal is an Internet application that enables a patient to have secure web-based access to personal clinical information, as released by the treating physician, and allows secure electronic messaging with our participating physicians. By using Patient Portal, you understand that not all of your medical record with us will be accessible through your Patient Portal account. Posting of information to your Patient Portal account is at the sole discretion of your individual physician(s).
  
  
• Messages you send or receive via Patient Portal may become part of your permanent medical record at the sole discretion of your physician. If such messages are made part of your permanent medical record, they will be accessible to our current and future staff members who are involved with your care.
  
  
• All of our electronic medical records are subject to state and federal regulations governing the security and confidentiality of medical records.
  
  

Copyright and Trademarks

All content included in Patient Portal and on all of our, including, but not limited to, text, photographs, graphics, button icons, images, artwork, names, logos, trademarks, service marks, and data ("Content"), in any form, are protected by U.S. and international copyright and trademark law and conventions. The Content includes both Content owned or controlled by one or more of the Practice Entities, as well as Content owned or controlled by third parties and licensed to one or more of the Practice Entities, and no right, title, or interest is granted to you in or to any Content other than the right to use such content in connection with your use of Patient Portal. Reproduction of any Content, in whole or in part, by any means, is prohibited without our express written consent.

Site Access and Licenses

• We grant to you a non-assignable, non-sublicensable, terminable, limited license to make personal use of our website, Patient Portal, and the associated services in accordance with these terms and conditions. This license expressly excludes, without limitation, any reproduction, duplication, sale, resale, or other commercial use of the website, Patient Portal, or any of the associated services; making any derivative of the website, Patient Portal, or any of the associated services; and the collection and use of user email addresses or other user information (including, without limitation, health information or any data extraction or data mining whatsoever).
  
  
• Failure to comply with any of the terms and conditions contained herein may result in revocation of your license and cancellation of your Patient Portal account, including the right to access information through Patient Portal. We reserve the right to report violations of law to appropriate law enforcement agencies and to pursue all other rights and remedies available to it under civil or criminal law.
  
  

Links to Third-Party Websites

This website and Patient Portal contain links to websites operated by other parties. The Practice Entities do not sponsor, operate, control, or endorse any of these sites, nor the information, products, or services provided by third parties through the Internet, nor do the Practice Entities make any guarantee, warranty, or representation regarding the accuracy of the information contained on the websites. The Practice Entities have no control over the security or privacy practices of these external websites. Use of other sites is strictly at your own risk including, but not limited to, any risks associated with destructive viruses. You are responsible for viewing and abiding by the terms and conditions of use and the privacy statements of the other websites.

No Warranties

This Patient Portal and all other sites hosted by any of the Practice Entities and the content contained herein and therein are provided by the Practice Entities on an "As Is" basis. THE PRACTICE ENTITIES MAKE NO REPRESENTATIONS OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, AS TO THE OPERATION OF ITS SITES, OR THE CONTENT, PRODUCTS, OR SERVICES INCLUDED THEREIN. TO THE FULLEST EXTENT PERMISSIBLE BY APPLICABLE LAW, THE PRACTICE ENTITIES DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND INFRINGEMENT.

Limitation of Liability

• Some of the material on our website and in Patient Portal is provided by third parties, and the Practice Entities shall not be held responsible for any such third-party material. The Practice Entities disclaim any responsibility for, or liability related to, such third-party material. Any questions, complaints, or claims related to any product should be directed to the appropriate third party.
  
  
• None of the Practice Entities or any of their contractors or subcontractors shall be liable for any loss, injury, illness, damages, or claims of any kind resulting from your failure to timely read messages you may receive through Patient Portal.
  
  
• If you have any basis for recovering damages from the Practice Entities or its affiliates or vendors, you can only recover direct damages up to $10. You cannot recover any other damages, including consequential, lost profits, special, indirect, incidental, or punitive damages.
  
  
• Some or all of these limitations or exclusions may not apply to you if your state, province, or country does not allow the exclusion or limitation of incidental, consequential, or other damages.
  
  

General

By using our website (including, but not limited to, Patient Portal), you agree that the laws of the Commonwealth of Massachusetts, without regard to principles of conflict of laws, will govern these terms and conditions and any dispute that might arise between you and any of the Practice Entities. You expressly agree that exclusive jurisdiction for any dispute with any of the Practice Entities resides in the courts of Middlesex County, Massachusetts, and you further agree and expressly consent to the exercise of personal jurisdiction in the courts of Middlesex County, Massachusetts, in connection with any claim involving any of the Practice Entities. Use of our website is unauthorized in any jurisdiction that does not give effect to the terms and conditions set forth herein.

Privia is committed to maintaining the privacy of your health information. We are required by law to (i) maintain the privacy of your health information; (ii) provide you with this notice of our legal duties and privacy practices with respect to your health information; (iii) follow the terms of the notice of privacy practices currently in effect; and (iv) notify you if there is a breach of your health information. We must also provide you with the following important information: (a) how we may use and disclose your health information; (b) your privacy rights; and (c) our obligations concerning the use and disclosure of your health information.

This Notice of Privacy Practices is NOT an authorization.  Rather it describes how we, our Business Associates, and their subcontractors may use and disclose your Protected Health Information to carry out treatment, payment, or health care operations, and for other purposes as permitted or required by law.  It also describes your rights to access and control your Protected Health Information.

“Protected Health Information” (“PHI”) means information that identifies you individually; including demographic information, and information that relates to your past, present, or future physical or mental health condition and/or related health care services.

The terms of this notice apply to all your PHI created or maintained by Privia. We reserve the right to revise or amend this Notice at any time. Any revision or amendment to this notice will be effective for all of your records that we created or maintained in the past and for any of your records that we may create or maintain in the future. We will post a copy of our current Notice online at:

http://www.priviahealth.com/HIPAA and you may request a copy of our most current Notice at any time.

B. Summary of this Notice

1.  We may use and share your information to:

• Provide care and treatment

•  Bill or seek payment for services we have provided

• Conduct our business

• File reports with public health and safety entities

• Conduct certain research activities

• Respond to organ and tissue donation requests

•  Work with a medical examiner or funeral director

•  Respond to workers’ compensation, law enforcement and other government requests

• Defend lawsuits and legal actions

For more information, see Section E below.

2.  You may have certain choices about how we use and share information:

• When we share information with your family and friends

• When we participate in disaster relief services

• Regarding your “sensitive” health information

• When we market our services

• When you pay out-of-pocket for services

• When we conduct certain research activities

For more information see sections F & G below.

3.  You have the right to:

• Get a copy of your medical record

• Request a correction of your medical record

• Request how we communicate with you

• Ask us to further restrict the information we share

• Get a list of those with whom we’ve shared your information

• Get a copy of this privacy notice

•  Choose someone to act for you if you are unable to make your own decisions

• File a complaint if you believe your privacy rights have been violated

For more information see Section G below.

C. Contact for Questions

For more information or questions about Privia Medical Group’s privacy policies, please contact:

Privacy Officer

950 N Glebe Rd, Suite 4000

Arlington, VA 22203

(571) 317-0679

compliance@priviahealth.com

D. Persons/Entities Covered by This Notice

Your provider is part of an Affiliated Covered Entity (“ACE”) by virtue of his or her affiliation with a member of the Privia Medical Group family or  Privia Quality Network (Privia Health’s Clinically Integrated Network and Accountable Care Organization) (collectively these entities are referred to as “Privia”). For the purposes of complying with federal privacy and security requirements, the above-described entities have designated themselves as an ACE. These entities are under common ownership and/or control and have agreed to treat themselves as a single “covered entity” under HIPAA.  Privia providers follow the terms of this Notice when providing services through Privia and although each provider’s care center is legally separate and responsible for its own acts, Privia coordinates privacy practices among all Privia care centers.  Patient information is shared across the ACE for treatment, payment, and healthcare operations related to the ACE. Your PHI can be shared across the ACE for the purposes of your treatment, payment, and healthcare operations. When PHI is shared for healthcare operations, the person or organization using your PHI must have a relationship with you, unless your PHI is used for quality assurance, utilization review, and peer review purposes.

Note: This notice applies to all providers affiliated with Privia, including members of Privia Medial Group Mid-Atlantic, Privia Medical Group – Georgia, Privia Medical Group – Gulf Coast, and Privia Medical Group – North Texas. The independent care center entities owned by Privia providers are business associates of Privia under HIPAA. The complete list of Privia providers for whom this Notice of Privacy Practices applies can be viewed at:  http://www.priviahealth.com/HIPAA.

Important: Privia may disclose your PHI to members of a Privia medical group and other independent medical professionals in order to provide treatment, payment and healthcare operations. Although those professionals have agreed to follow this Notice and participate in the Privia privacy program, they are independent professionals and Privia expressly disclaims any responsibility or liability for their acts or omissions relating to your care or privacy/security rights.

E. Use and Disclosure of your Individually Identifiable Health Information (PHI)

1.  Treatment. Privia may use or share your PHI to provide medical treatment or services for you and manage and coordinate your medical care.  Privia may disclose your PHI to physicians and health care providers, durable medical equipment (DME) vendors, surgery centers, hospitals, rehabilitation therapists, home health providers, laboratories, nurse case managers, worker’s compensation adjusters, etc. to ensure that your medical providers have the necessary information to diagnose and provide treatment to you.  For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may affect the healing process. Privia may also disclose your PHI to individuals who are directly involved in your care, including family members, friends or other care providers.  If you participate in a virtual visit (telehealth), your information will be shared electronically via a secure transmission to facilitate the virtual visit.

2. Payment. Privia may use and disclose your PHI in order to bill for services provided and collect payment from health plans or other entities. For example, we may disclose PHI to your health insurance plan so it will pay for your services, determine your eligibility for coverage, or to obtain prior approval from the insurer to cover payment for treatment. Privia also may use and disclose your PHI to obtain payment from third parties that may be responsible for such costs, including family members. Privia may also disclose your information to a collection agency to obtain overdue payment or to a regulatory agency or insurance company to determine whether the services we provided were medically necessary or appropriately billed.

3. Health Care Operations. Privia may use and disclose your PHI to run our practices, improve your care, and contact you when necessary. For example:  We may use or disclose your PHI: (1) to conduct quality or patient safety activities, population-based activities relating to improving health or reducing health care costs, case management and care coordination, and contacting your health care providers and you with information about treatment alternatives; (2) when conducting training programs or performing accreditation, licensing, or credentialing activities; (3) when conducting or arranging for medical review, legal services, and auditing functions; and (4) for our proper management and administration, including customer service, resolving complaints, strategic planning, etc.  In addition, we may use or disclose de-identified information or a limited data set for certain healthcare operations purposes. We may also record your visit in order to facilitate the documentation of your care by your provider via a scribe or virtual scribe service.

4. Appointment Reminders, Check-In and Results. Privia may use and disclose your PHI to contact you and remind you of an appointment. Privia may use a sign-in sheet at the registration desk and call you by name in the waiting room when your provider is ready to see you. Privia may also use your PHI to contact you about test results. Privia may leave a message reminding you of an appointment or the results of certain tests, but will leave the minimum amount of information necessary to communicate this information.

5. Treatment Options and Health-Related Benefits and Services. Privia may use and disclose your PHI to inform you of treatment options or alternatives as well as certain health-related benefits or services that may be of interest to you. Privia may also use and disclose your PHI to describe health-related products or services (or payment for such products or services) provided through your benefit plan or to offer information on other providers participating in a healthcare network that we participate in. 

6. Disclosures to Family or Friends. Privia may disclose your PHI to individuals involved in your care or treatment or responsible for payment of your care or treatment. If you are incapacitated, we may disclose your PHI to the person named in your Durable Power of Attorney for Health Care or your personal representative (the individual authorized by law to make health-related decisions for you).  In the event of a disaster, your PHI may be disclosed to disaster relief organizations to coordinate your care and/or to notify family members or friends of your location and condition.

7. Disclosures Required By Law. Privia will use and disclose your PHI when we are required to do so by federal, state or local law. For example, Privia may disclose PHI to comply with child and elder abuse reporting laws or to report certain diseases, injuries or deaths to state or federal agencies.

F. Use and Disclosure of Your PHI in Certain Special Circumstances

1. Public Health Reporting. Privia may disclose and may be required by law to disclose your PHI for certain public health purposes. For example, Privia may disclose your PHI to the Food and Drug Administration (FDA) regarding the quality and safety of an FDA-regulated product or activity; to prevent or control disease; report births and deaths; to report child abuse and/or neglect; to report reactions to medications or problems with health products; to provide notification of recalls of products; or report a person who may have been exposed to a disease or may be at risk of contracting and/or spreading a disease or condition. In addition, Privia may provide proof of immunizations to a school that requires a patient’s immunization record prior to enrollment or admittance of a student if you have informally agreed to the disclosure for yourself or on behalf of your legal dependent.

2. Health Oversight Activities. Privia may disclose your PHI to a health oversight agency for investigations, inspections, audits, surveys, licensure and disciplinary actions, and in certain civil, administrative, and criminal procedures or actions, or other health oversight activities as authorized by law.

3. Lawsuits and Disputes. Privia may disclose your PHI in response to a court or administrative order, subpoena, request for discovery, or other legal processes.  However, absent a court order, Privia will generally disclose your PHI if you have authorized the disclosure or efforts have been made to inform you of the request or obtain an order protecting the information requested. Your information may also be disclosed if required for our legal defense in the event of a lawsuit.

4. Law Enforcement. Privia may disclose your PHI if requested by a law enforcement official: (a) regarding a crime victim in certain situations, if we are unable to obtain the person’s agreement; (b) about a death we believe resulted from criminal conduct; (c) regarding criminal conduct on our premises; (d) in response to a warrant, summons, court order, subpoena or similar legal process; (e) to identify/locate a suspect, material witness, fugitive or missing person; or (f) in an emergency, to report a crime (including the location or victim(s) of the crime, or the description, identity or location of the perpetrator).

5. Deceased Patients. Privia may disclose your PHI to a medical examiner or coroner to identify a deceased individual or to identify the cause of death. In addition, we may disclose PHI necessary for funeral directors to fulfill their responsibilities.

6. Organ and Tissue Donation. Privia may disclose your PHI to organizations that handle organ, eye or tissue procurement or transplantation, including organ donation or blood banks, as necessary to facilitate donation and transplantation if you are a donor.

7. Research. Privia may use and disclose your PHI to researchers for the purpose of conducting research with your written authorization or when the research has been approved by an Institutional Review and is in compliance with law governing research.  In certain situations, the need for your individual consent may be waived by a Privacy Board.

8. Serious Threats to Health or Safety. Privia may use and disclose your PHI when necessary to reduce or prevent a serious threat to your health and safety or the health and safety of another individual or the public. Under these circumstances, we will only make disclosures to a person or organization able to help prevent the threat.

9. Military, National Security, and other Specialized Government Functions: If you are in the military or involved in national security or intelligence, Privia may disclose your PHI to authorized officials.  Privia also may disclose your PHI to authorized federal officials in order to protect the President, other officials or foreign heads of state, or to conduct certain investigations.

10. Workers’ Compensation. Privia will disclose only the PHI necessary for worker’s compensation in compliance with worker’s compensation laws.  This information may be reported to your employer and/or your employer’s representative in the case of an occupational injury or illness.

11.  Inmates. If you are an inmate or in the custody of a law enforcement official, Privia may disclose your PHI to correctional institutions or law enforcement officials as necessary: (a) for the institution to provide health care services to you; (b) for the safety and security of the law enforcement officer or the correctional institution; and/or (c) to protect your health and safety or the health and safety of other individuals.

12. Minors. If you are a minor (generally an individual under 18 years old), we may disclose your PHI to your parent or guardian unless otherwise prohibited by law.

G. Your Privacy Rights Regarding Your PHI

1. Inspection and Copies. You may request a copy of, or request to inspect, the PHI that is used to make decisions about you, including medical and billing records and laboratory and imaging reports. You have the right to obtain an electronic copy if it is readily producible by us in the form and format requested, or you may request that we provide a paper copy of your record. You may also request a summary of your record. We will provide your health information, to you or whomever you designate to receive it, usually within thirty (30) days of your request. Privia may charge a reasonable cost-based fee to cover the costs of copying, mailing, labor and supplies associated with your request. Privia may deny your request to inspect and/or copy in certain limited circumstances; however, you may request a review of our denial. There may be times that your provider, in his or her professional judgment, may not think it is in your best interest to have access to your medical record. Depending on the reason for the decision to deny a request, we may ask another licensed provider chosen by us to conduct a review of your request and its denial.

2. Confidential Communications. You may request in writing that we communicate with you in a specific way or send mail to a different address. For example, you may request that we contact you at home, rather than work or by mail. Privia will accommodate all reasonable requests. You do not need to give a reason for your request.  We will comply with your request if you are reasonably able to do so.

3. Amendment. You may request a correction or amendment of your PHI if you believe it is incorrect or incomplete.  You may make a written request for a correction or amendment for as long as your PHI is maintained by or for Privia. Requests must provide a reason or explanation that supports the request. Privia will deny your request if it is not in writing or if, in the provider’s opinion, the information is: (a) accurate and complete; (b) not part of the PHI maintained by or for Privia; (c) not part of the PHI that you have the right to inspect and copy; or (d) not created by Privia, unless the individual or entity that created the information is not available to amend the information. Privia will notify you in writing within sixty (60) days if we cannot fulfill your request.

4. Accounting of Disclosures. You may request an accounting of certain disclosures that Privia has made of your PHI. This accounting will list the disclosures that we have made of your PHI but will not include disclosures made for the purposes of treatment, payment, health care operations, disclosures required by law, and certain other disclosures (such as any you asked us to make).  Your request must be in writing and state the time period for which you want the accounting (not to exceed six (6) years prior to the date you make the request). Privia will provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within twelve (12) months. Privia will notify you of the costs involved with any additional request and you may withdraw your request before you incur any costs.

5. Requests for Restrictions. You have the right to request that Privia not use or share your PHI for treatment, payment, or health care operations. We are not required to agree to your request, and we may say “no” if we believe it might affect your care. If you pay for a service or health care item out-of-pocket in full, you may ask us not to share that information for the purpose of payment or our operations with your health insurer. In that case, we will approve your request unless a law specifically requires us to share that information.

6.  Health Information Exchange Opt-Out:  You have the right to opt-out of disclosure of your medical records to or via an electronic health information exchange (“HIE”) (For example, Surescripts, Commonwell, CareQuality aka The Sequoia Project, ConnectVirginia and/or the Chesapeake Regional Information System for our Patients, Inc. (“CRISP”)).  However information that is sent to or via an HIE prior to processing your opt-out may continue to be maintained by and be accessible through the HIE. You must opt out of disclosures to or via an HIE through each of your individual treating providers who may participate in any given HIE.  See I. USING TECHNOLOGY TO IMPROVE HEALTHCARE below for more information regarding HIE.

7. Right to Receive a Notice of a Breach of Unsecured Medical/Billing Information. You have the right to receive prompt notice in writing of a breach of your PHI that may have compromised the privacy or security of your information.  

8. Right to a Paper Copy of This Notice. You have the right to receive a paper copy of this notice at any time even if you have agreed to receive the notice electronically. You may also obtain a copy of this notice at our website:

http://www.priviahealth.com/HIPAA.

9. Right to File a Complaint. If you believe your rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services (“HHS”), Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.                   All complaints must be submitted in writing. You will not be penalized for filing a complaint.

H. Additional Information

1. Patient Portal and Other Patient Electronic Correspondence. Privia may use and disclose your PHI through various secure patient portals that allow you to view, download and transmit certain medical and billing information and communicate with certain health care providers in a secure manner through the portal. For more information on the Privia patient portal, please visit our website at

http://www.priviahealth.com/signin.html.

2.    Your Contact Information: Home and Email Addresses/Phone Numbers. If you provide us with a home or email address, home/work/cell telephone number, or other contact information during any registration or administrative process we will assume that the information you provided us is accurate and that you consent to our use of this information to communicate with you about your treatment, payment for service and health care operations.  You are responsible to notify us of any change of this information.  Privia reserves the right to utilize third parties to update this information for our records as needed.

3. Email or Downloading PHI.  If you email us medical or billing information from a private email address (such as a Yahoo, Gmail, etc. account), that information may not be secure.  We recommend that you use a secure messaging portal, such as your Privia patient portal to communicate with us.  If you request that Privia email your PHI to a private email address, we will send it in an encrypted manner unless you request otherwise.  If you request us to post your information in a dropbox or on a flash drive, CD, etc., your information may not be secure. Privia is not responsible for the privacy or security of your PHI if you request that we send it to you in an unsecured manner or download or post it on a dropbox, flash drive, CD or other unsecure medium.  In addition, Privia is not responsible if your PHI is redisclosed, damaged, altered or otherwise misused by an authorized recipient. In addition, if you share an email account with another person (for example, your spouse/partner/roommate) or you choose to store, print, email, or post your PHI, it may not be private or secure.

4.  Sensitive Health Information.   Federal and state laws provide special protection for certain types of health information, including psychotherapy notes, information about substance use disorders and treatment, mental health and AIDS/HIV or other communicable diseases, and may limit whether and how we may disclose information about you to others.

5. Substance Use Disorder Records and Information.  The confidentiality of patient records maintained by federally assisted substance use disorder rehabilitation programs is protected by Federal law and regulations. Generally, such programs may not disclose any information that would identify an individual as having or being treated for a substance use disorder unless:

a.    the individual consents in writing;

b.    the disclosure is allowed by a court order;

c.    the disclosure is made to medical personnel in a medical emergency or to qualified personnel for research, audit, or program evaluation; or

d.      as otherwise permitted by law.

Violation of these laws and regulations is a crime. Suspected violations may be reported to appropriate authorities in accordance with Federal regulations. Federal law and regulations do not protect any information about a crime committed by a patient either at the program or against any person who works for the program or about any threat to commit such a crime. Federal laws and regulations do not prevent any information about suspected child abuse or neglect from being reported under state law to appropriate state or local authorities.

6. Consent to Disclose Sensitive Health and Substance Use Disorder Information. During the registration process, you consent to the release of federally assisted substance use disorder information, information regarding treatment of communicable diseases and mental health information for the purposes specified in this notice.  If you do not wish for this information to be disclosed, you must notify us in writing and we will determine if it is feasible for us to accept your request.

7. Incidental Disclosures.  Despite our efforts to protect your privacy, your PHI may be overheard or seen by people not involved in your care. For example, other individuals at your provider’s office could overhear a conversation about you or see you getting treatment.  Such incidental disclosures are not a violation of HIPAA.

8. Business Associates. Your PHI may be disclosed to individuals or entities who provide services to or on behalf of Privia.  Pursuant to HIPAA, Privia requires these companies sign business associate or confidentiality agreements before we disclose your PHI to them.  However, Privia generally does not control the business, privacy, or security operations of our business associates.

9. Authorization for Other Uses and Disclosures. Privia will obtain your written authorization for uses and disclosures that are not identified by this notice or otherwise required or permitted by applicable law. Any authorization you provide regarding the use and disclosure of your PHI may be revoked at any time in writing. After you revoke your authorization, we will no longer use or disclose your PHI for the reasons described in the authorization. However, your revocation will not affect actions we have already taken; in other words, we are unable to take back any disclosures of PHI we have already made.

I. USING TECHNOLOGY TO IMPROVE HEALTHCARE

Health Information Exchange (HIE) enables your healthcare providers to quickly and securely share your health information electronically among a network of healthcare providers, including physicians, hospitals, laboratories and pharmacies. Your health information is transmitted securely and only authorized healthcare providers with a valid reason may access your information.

How does HIE Help You?

Improved access to information will enable us to provide better care for our patients.

• Improved Care - Access to information about your health history and medical care gives your healthcare provider a more complete picture of your overall health. This can help your provider make better decisions about your care. The information may also prevent you from having repeat tests, saving you time, money and worry.

• Emergency Treatment - In an emergency, your providers may immediately check to see if you have allergies, health problems, test results, medications or previous concerns that may help them provide you with emergency care.

• Helps to Protect Privacy and Information Security - By sharing information electronically through a secure system, the risk that your paper or faxed records will be misused or misplaced is reduced.

How does HIE help protect your medical information and keep it secure?

Privia is committed to protecting the privacy and security of your health information, including the sharing and accessing of your information through HIE.

• Every HIE and its participants must protect your private medical information under HIPAA law, as well as applicable state laws and regulations.

• Information shared via HIE is encrypted, meaning it can be accessed only by authorized users. This prevents hackers from accessing your information.

• Every individual who can access your information must have their own user name and password and must receive training before they can access your information.

• The HIE records every time someone accesses your information. Upon request, the HIE can track who accessed your information and provide a report to the Privia Privacy Officer.

What HIEs does Privia participate in? 

Privia participates in a number of HIEs, including, but not limited to, Surescripts, Commonwell, CareQuality aka The Sequoia Project, ConnectVirginia and CRISP. (Note: This list is subject to change.)

You have choices about participating in HIE.

Privia recognizes you have certain rights related to how we share your information. You have the following choices:

Choice 1: Say Yes. No further action needed.

If you agree to have your medical information shared through HIE and you have a current Authorization and Consent to Treat form on file, you do not need to do anything. By signing the form, you have granted us permission to share your health information to HIE.

Choice 2: Say No Thanks. Follow the Instructions on the HIE Opt-Out Form.

We recognize your right to choose not to participate in HIE, also referred to as opting-out. If you decide to opt-out of HIE, healthcare providers will not be able to access your health information through HIE. You should understand that providers may still request and receive your medical information from other providers using other methods permitted by law, such as fax, mail or other electronic communication.

If you want to opt-out of participating in HIE, please follow the appropriate procedure as outlined on the Privia HIE Opt-Out Request Form and/or contact the HIE directly. You may download and print the form on your computer or ask for a copy at any Privia care center location. Please read the Opt-Out Request Form carefully and follow the instructions on the form to opt out of HIE.

Please note, your opt-out does not affect health information that was disclosed through HIE prior to the time that you opted out.

Choice 3: You can change your mind at any time.

You can consent today to the sharing of your information via HIE and change your mind later by following the instructions on the opt-out form described under Choice 2.

You can opt out of HIE today and change your mind later by submitting a Privia HIE Reinstatement of Participation Form or, in certain cases, by contacting the HIE directly. The reinstatement form is available to download and print on your computer or you may ask for a copy of the form at any Privia care center location. Please follow the instructions on the form to opt back in to HIE.

If you have any questions about HIE or for more information, please email us at         Privacy@PriviaHealth.com or call the Privia Privacy Officer at (571) 317-0679.

J. CHANGES TO THIS NOTICE. Privia reserves the right to change this Notice at any time. Privia reserves the right to make the revised or changed Notice effective for medical information we already have about you, as well as for any information we receive in the future. Privia will post the current Notice at registration sites throughout Privia and on our website at http://www.priviahealth.com/HIPAA.

K. CONTACT INFORMATION.  If you have any questions about this Notice or wish to file a privacy complaint, please contact:

Privacy Officer

950 N Glebe Rd, Suite 4000

Arlington, VA 22203

(571) 317-0679

compliance@priviahealth.com

Privia Notice of Privacy Practices

Effective: February 2018

Below you will find answers to commonly asked questions concerning the website. For technical issues with this website during normal business hours, please contact our office.