Notice of Privacy Policy

I. OUR COMMITMENT TO YOUR PRIVACY

WWH is committed to protecting the privacy of health information that we create or obtain about you. This Notice tells you about the ways in which we may use and disclose your health information and describes both your rights as well as our obligations regarding that use and disclosure.

We are required by law to make sure that your health information is protected, to give you this Notice describing our legal duties to protect your privacy, and to follow the terms of the Notice that is currently in effect. We reserve the right to change the terms of this Notice and to make a new Notice effective for all health information that we maintain.

II. WHO THIS NOTICE APPLIES TO

This Notice applies to WWH, consisting of its facilities, departments, clinics, and any other entities of WWH that are considered Covered Entities as defined under HIPAA; all WWH physicians, dentists, other licensed professionals, employees, volunteers, and trainees. This Notice, however, does not apply to any WWH providers regarding their private offices.

III. YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

You have the following rights regarding your health information:

Right to Inspect and Copy your Health Information.

With certain exceptions, you have the right to inspect and/or receive a copy of your medical and billing records, or any of the other records that are used by us to make decisions about your care. You may request that we send a copy of your health information to a third party.

To inspect and/or receive a copy of your medical records, we require that you submit your request in writing to your WWH health care provider or to the WWH Medical Records Department. If you request a copy of your medical records, we may charge you a reasonable cost-based fee for the cost of providing you with copies. In some cases, medical records may be provided free of charge. Under certain circumstances, however, we may deny your request to inspect or copy your records. If we deny your request, we will explain the reasons to you and in most cases, you may have the denial reviewed.

Generally, you can readily access without delay much of your electronic health information using the WWH patient portal. Information about the patient portal is available at www.whitman-walker.org/patient-login.

Right to Request an Amendment

If you think that the health information we have about you is incorrect or incomplete, you may ask us to correct the information, for as long as the information is kept by, or for, WWH in your medical and billing records. To request an amendment, submit your request in writing to the WWH Privacy Officer and provide the reason for the request. If we agree to your request, we will amend your record(s) and notify you of such. In certain circumstances, we cannot remove what was in the record(s), however, we may add supplemental information to clarify. If we deny your request for an amendment, we will provide you with a written explanation of why we denied it and explain your rights.

Right to Request confidential communications

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you may ask that we contact you only at home or only by mail. If you want us to communicate with you in a certain way, you will need to give us specific details about how you want to be contacted including a valid, alternative address. We will not ask you the reason for the request, and we will accommodate all reasonable requests. However, if we are unable to contact you using the ways or locations that you have requested, we may contact you using the information that we have.

Right to Request Restrictions

You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment, or our operations. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. If we agree to your request, we will comply with your request unless the information is needed to provide you with emergency treatment or if we are required by law to disclose it.

However, we are not required to agree to your request, except in the case where the disclosure is to a health plan for purposes of carrying out payment or health care operations of the health plan, and the information pertains solely to a health care item or service for which we have been paid “out of pocket” in full.

To request a restriction, you must make your request in writing to the WWH Privacy Officer (address and number provided below) and tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply. We are allowed to end the restriction if we tell you. If we end the restriction, it will only affect the health information that was created or received after we notify you.

Right to an Accounting of Disclosures

You can ask for a list (accounting) of the times we have disclosed your health information.

We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We will provide one accounting a year free but will charge a reasonable, cost-based fee if you ask for another one within 12 months.

To request an accounting of disclosures, submit your request in writing to the WWH Privacy Officer (address and number provided below). Please provide the time period for which you want to receive the accounting, which may not be longer than six years and which may not date back more than six years from the date of your request.

Right to a paper copy of this Notice

You can ask for a paper copy of this Notice at any time, even if you have agreed to receive the Notice electronically. Copies of this Notice are available at WWH facilities, from the WWH Privacy Officer (address and number provided below) and on the WWH website at Whitman-walker.org/hipaa.

Right to choose someone to act for you

If you have given someone health care (medical) power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.

Our Legal Services Department can assist you with the preparation of a health care power of attorney document if you do not have one, which provides authority for another person to act on your behalf.

IV. OUR USE AND DISCLOSURE OF YOUR INFORMATION

The following sections describe different ways that we may use and disclose your health information. Not every use or disclosure will be listed. However,all of the ways that we are permitted to use or disclose information will fall within one of these categories.

To treat you
We may use or disclose health information about you to provide you with medical treatment or health care services. We may disclose information about you to health care providers involved in your care. For example, a doctor may need to review your medical history before treating you. We may share health information about you with other health care providers, agencies, or facilities not affiliated with WWH in order to provide or coordinate the difference things you need, such as prescriptions, lab work, and x-rays. We may contact you to provide appointment reminders, patient registration information, information about treatment alternatives or other health-related benefits and services that may be of interest to you, or to follow-up on your care.

To run our organization
We may use and disclose health information about you for our health care operations, which are various activities necessary to run WWH’s business, provide quality health care services, and contact you when necessary. For example, we may share your health information to coordinate your care, evaluate our providers’ performance in caring for you, and for quality improvement activities. We may disclose your health information to medical, nursing, or other students and trainees for review and learning purposes.

In order to bill for your services
We may use and disclose health information about you for billing and payment activities. For example, we may use and disclose information so that WWH can obtain payment from you, an insurance company, or another third party. We may also tell your insurance company about a treatment that you need to obtain prior approval or check if your insurance will pay for the treatment.

Health Information Exchange

A health information exchange (HIE) provides a way of sharing your health information among participating doctors’ offices, hospitals, labs, radiology centers, and other providers through secure, electronic means.  WWH participates in CRISP DC, the District of Columbia’s designated HIE. As permitted by law, your health information (including both physical and mental health information) will be shared with this exchange in order to provide faster access, better coordination of care, and assist providers and public health officials in making informed decisions. You may “optout” and disable access to your health information available through CRISP DC by calling 877.952.7477, or by completing and submitting an Opt-Out form to CRISP DC by mail, fax, or through CRISP DC’s website at www.crisphealth.org. However, certain reporting required by law, such as public health reporting and Controlled Dangerous Substances information, will still be available to providers, even if you opt-out.

If we are treating you for a substance use disorder (“SUD”), we will not share your information through CRISP DC unless you opt-in by signing our consent form. If you do consent, health information related to your SUD and treatment will be shared through CRISP DC with other clinicians who treat you, for payment of services, and other operational purposes like quality improvement and care coordination. Note, however, that it is not possible to share some, but not all, of your health information through the HIE. If you do not consent to share your SUD information through the HIE, or if you opt-out of the HIE, then none of your health information, including your SUD, physical, and mental health information, will be shared with the HIE for purposes of coordinating your care and treatment.

In addition, it may also be necessary for your WWH provider to obtain information about your medications through the Prescription Drug Monitoring Program (PDMP) as required by state law.

Special Considerations for Other Disclosures of Certain Health Information.

In addition to the disclosures to HIE’s described above, in some cases we may want or need to share (i) records relating to your participation in a WWH substance use disorder (“SUD”) program (including the Whitman-Walker Addiction Services Co-occurring Program (WWAS Co-OP), the Substance Use Management for Harm Reduction, Understanding Your Use Group, and our other 42 CFR Part 2 programs) or (ii) your mental health records with other third parties. However, we will not share this information with those third parties, without your written authorization, unless we are permitted to do so by law: In addition, we will not use or disclose your SUD records in a civil, criminal, administrative, or legislative proceeding against you unless you provide us with written consent, or if a court orders us to do so after providing appropriate notice and an opportunity to be heard. A court order authorizing our use or disclosure of SUD records must be accompanied by a subpoena or other legal requirement compelling disclosure before we can use or disclose the requested record. We will not use or disclose your PHI to identify any person or to conduct a criminal, civil, or administrative investigation into or to impose liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care. However, in some cases, and when required by law, before disclosing reproductive health care information we will require a requestor to attest that the use or disclosure of such information is not intended for a purpose prohibited by federal law. For example, if we receive a request from a police investigative agency seeking your PHI related to your reproductive healthcare choices, we would be prohibited from disclosing the requested PHI unless (and until) the law enforcement agency provided us with a signed attestation that the requested PHI is not being requested for purposes of conducting a criminal, civil, or administrative investigation into you and your reproductive healthcare choices.

Business Associates
We can share information to third parties referred to as “business associates” that provide services on our behalf, including such things as software and other IT support, patient navigation, and legal and other professional services, We require our business associates to sign an agreement requiring them to protect your information and to use it only for the purposes for which we have contracted.

Fundraising
Although HIPAA permits us to contact you to raise funds and provide information about Whitman-Walker-sponsored activities, we generally do not do so. If you would like to learn more about how you can support WWH, please contact Charles Hastings at CHastings@Whitman-Walker.org. Likewise, if you want to “opt-out” of fundraising communications from us, contact Charles Hastings to do so.

Individuals involved in care or payment for your care
Unless you tell us not to, we may release health information to anyone involved in your medical care, such as a friend, family member, or any individual you identify. We may also give your information to someone who helps pay for your care. If you are unable to tell us your preference, for example, if you are not present or are unconscious, we may share your health information that is directly relevant to the person’s involvement with your care if we believe it is in your best interest. Additionally, we may disclose information about you to your legal representative.

Research
We may use and disclose your information, including to the Whitman-Walker Institute, for certain research purposes in compliance with the requirements of applicable law. All research, however, is subject to a special approval process, which establishes protocols to ensure that your information will continue to be protected. When required, we will obtain a written authorization from you prior to using your information for research.

When required by law
We will disclose health information about you when required to do so by federal, District of Columbia, and/or state law. This includes, but is not limited to, disclosures to mandated patient registries, including reporting adverse events with medical devices, food, or prescription drugs to the Food and Drug Administration.

Oversight Activities
We may disclose health information to health oversight agencies for activities authorized by law. These oversight activities may include licensure activities and other activities by governmental, licensing, auditing, and accrediting agencies as authorized or required by law.

Public Health Activities
We may disclose your health information for public health activities including disclosures to prevent or control disease, injury, or disability; report births and deaths; report child abuse or neglect or domestic violence; or notify a person who may have been exposed to a disease or condition.

Lawsuits and other legal actions
We may disclose health information about you to courts, attorneys, court employees and others when we get a court order, subpoena, discovery request, warrant, summons, or other lawful instructions. We may also disclose information about you to WWH attorneys and/or attorneys working on WWH’s behalf to defend ourselves against a lawsuit or other legal action.

Law enforcement purposes/ law enforcement official.
We may disclose your health information to the police or other law enforcement officials to report or prevent a crime or as otherwise required or permitted by law.

Use and disclosure in special situations
We may use and disclose your health information in the following special situations:

• Serious Threats to Health or Safety
We may use and disclose health information about you to help prevent a serious and imminent threat to your health and safety or the health and safety of the public or another person.

• Respond to organ and tissue donation requests
We can share health information about you with to organizations that handle organ procurement, eye or tissue transplantation, or to an organ donation bank as necessary to facilitate organ or tissue donation and transplantation.

• Coroner, medical examiner or funeral director
We can share health information about a deceased patient with a coroner, medical examiner, or funeral director as necessary to carry on their duties.

• Disaster relief efforts
We may disclose health information about you to an organization assisting in a disaster-relief effort so that your family can be notified about your condition, status, and location.

• Workers’ compensation claims.
We may disclose health information about you for workers’ compensation claims or similar programs as authorized or required by law.

• Presidential protective services.
We may disclose health information about you to authorized federal officials so they may conduct special investigations or provide protection to the President of the United States, other authorized persons, or foreign heads of state as authorized by law.

• Military.
If you are a member of the armed forces, domestic (United States) or foreign, we may release health information about you to the military authorities as authorized or required by law.

• National security and intelligence activities.
We may disclose health information about you to authorized federal officials for intelligence, counter-intelligence, and other national security activities as required by law.

• Inmates
If you are an inmate of a correctional institution or under the custody of law enforcement officials, we may release health information about you to the correctional institution or law enforcement officials as authorized or required by law.

V. USES/DISCLOSURES OF HEALTH INFORMATION REQUIRING AUTHORIZATION

Marketing purposes. We generally do not share your information for marketing purposes unless you give us permission to do so.

Sale of your information. We must obtain your written permission to sell or receive anything of value in exchange for your health information, with certain limited exceptions.

Psychotherapy notes. We must obtain your written permission to disclose psychotherapy notes, except in certain circumstances. For example, written permission is not required for use of these notes by their author with respect to your treatment or the use of disclosure by us in the training of mental health practitioners, or to defend WWH in a legal action brought by you.

Other Uses and Disclosures. Other uses and disclosures of your health information not covered by the categories included in this Notice or applicable laws, rules, or regulations will be made only with your written permission or authorization. If you provide us with such written permission, then you may revoke it at any time. We are not able to take back any uses or disclosures that we already made with your authorization. We are required to retain your health information regarding the care and treatment that we provided you.

VI. OUR RESPONSIBILITIES

We are required by law to maintain the privacy and security of your protected health information.

We will let you know in writing if a breach occurs that may have compromised the privacy or security of your information.

We must follow the duties and privacy practices described in this Notice and give you a copy of it.

We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

VII. QUESTIONS/COMPLAINTS

If you have questions or believe that your privacy rights have been violated, you may file a complaint with WWH or with the Secretary of the Department of Health and Human Services. You will not be retaliated against for filing a complaint.

Contact Information/How to File a Complaint

Write to Whitman-Walker Health, 1201 Sycamore Drive S.E., Suite 500, Washington, D.C. 20032, Attention: Compliance/Privacy Office, or call 202.745.7000.

Write to the U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue, SW, Washington, DC 20201, or call 877.696.6775, or visit www.hhs.gov/ocr/privacy/hipaa/complaints.

VIII. CHANGES TO THIS NOTICE

We reserve the right to change this Notice and WWH privacy practices. We further reserve the right to make the revised or changed Notice effective for information that we already have about you, as well as any information that we receive in the future.

We will post a copy of the current Notice on the WWH website at Whitman-Walker.org/hipaa.

The Notice will specify the effective date of the Notice. Each time you visit our website you will see a link to the current Notice in effect.

The original effective date of this Notice is April 14, 2003 and the Notice was most recently updated on September 27, 2024 and replaces all earlier versions.

Acknowledgement of receipt of this Notice of Privacy Practices is indicated by your signature on our Consents and Acknowledgement Form that is scanned into your electronic medical record.