Error: Please enable cookies to log in to MyChart.

Notice of Privacy Practices



This notice describes how information about you may be used and disclosed and how you can get access to this information. Please review carefully.


Understanding Your Health Information

Carilion Clinic is committed to ensuring our patients’ privacy is maintained and to following applicable laws and regulations. We are required by law to provide you with this Notice of Privacy Practices (“Notice”). This Notice describes the ways in which Carilion Clinic may use and disclose (share) health information about you. We also describe your rights related to your health information. “Health information” means any information, whether oral, electronic or paper, which is created or received by Carilion Clinic and is related to your health care or payment for the care you received. Each time you visit a hospital, physician or other health care provider, a record of your visit is made. This record is the property of Carilion Clinic. We need this record to provide you with quality care, bill for your care and comply with legal requirements. Typically, your medical record contains demographic information (such as how we can reach you and your Social Security number), symptoms, examinations, test results, diagnoses, treatments, care plans and other related information.


Who Will Follow this Notice?

All of the entities and individuals described below may share your health information with each other for purposes of treatment, payment and health care operations, as described below:

  • Carilion Clinic-owned hospitals, clinics, VelocityCare centers and pharmacies
  • Carilion Clinic’s community-based service providers, including home health services and hospices
  • Carilion Clinic departments and units that provide health care services. Carilion Wellness, MedKey and associated revenue agents are excluded.
  • All employees, contractors and volunteers associated with the facilities and services described above
  • All health care professionals, including physicians, nurses and other providers, residents, medical students and trainees, involved in your treatment at any Carilion Clinic facility


Using and Disclosing Your Information Without Your Authorization

The following is a description of the types of uses and disclosures of your health information that we are permitted or required to make without your authorization. Not every use or disclosure will be listed, but all of the ways we are permitted to use and disclose information will fall within one of the following categories.

  • Treatment: We will use or disclose your health information for treatment, which means the provision, coordination or management of the health care services provided to you. We may share information with Carilion Clinic and non-Carilion Clinic providers who are involved in your care. We will provide your physician or other health care providers with copies of reports that may assist him/her in treating you once you are discharged from a Carilion hospital or are referred for specialty services. We may use photographs, video and closed circuit television to monitor your care.
  • Payment: We will use or disclose your health information for activities necessary for us to receive payment for the services we provide to you. The information on or accompanying the bill may include information that identifies you, as well as your diagnosis, procedures and supplies used. This includes sharing information for us to obtain payment from or assist you to access the benefits of insurance companies, workers’ compensation programs or a government-funded health care program.
  • Health Care Operations: We will use or disclose your health information for health care operations. Such activities are necessary to provide you with high-quality care and for us to manage our organization. Examples include: quality improvement activities; evaluating our physicians and staff; training staff, residents and students; obtaining legal and accounting services; conducting audits; business planning; and population-based activities relating to improving health, increasing quality and reducing health care costs.
  • Business Associates: Some services are provided in our organization through contractual relationships with business associates. We may disclose your health information to our business associates so that they can perform the job we have asked them to do. Our contracts require business associates to appropriately protect the privacy and security of your health information.
  • Relatives, Close Friends and Others Involved in Your Care: Health care professionals, using their best judgment, may disclose to a family member, a close personal friend or any other person identified by you, your health information relevant to that person’s involvement in your care or payment related to your care. If family members or friends are present while care is being provided, Carilion Clinic may assume your companions may hear the discussion, unless you state otherwise. If you do not want Carilion Clinic to disclose your health information to your family members or others who are involved in your care or handling your bills, please inform the person assisting you during registration or admission.
  • Hospital Directory/Patient Census List: Unless you notify us that you object, if you are admitted to one of our hospitals, we will use your name, location in the facility and religious affiliation in the hospital directory and patient census lists. This information may be provided to members of the clergy and, except for religious affiliation, to other people who ask for you by name. If you are listed in the directory, we may also share your general condition with those requesting information. Such condition reports are typically one word, such as “good,” “fair,” “poor” or “critical.”
  • Appointment Reminders and Treatment Alternatives: We may contact you via phone, mail, MyChart message or text message to remind you that you have an appointment for medical care and to provide information about treatment and health-related benefits and services that may be of interest to you.
  • Sign-In Sheets: We may use sign-in sheets in certain locations to track your arrival. We may also call your name in the waiting area. If you do not wish to sign the sign-in sheet or have your name called, please let the staff know and we will make adjustments to meet your request.
  • Record Locator Services, Also Known as Health Information Exchanges (HIEs): To improve the coordination of patient care and treatment, Carilion Clinic may electronically release your health information to other health care providers who participate in local, state, national and/or international HIEs. This may include information related to the diagnosis and treatment of mental illness, alcohol or drug use, sexually transmitted diseases, HIV test results, developmental disabilities and genetic testing results. Sharing this information may improve the coordination of care, especially in emergency situations. Patients can opt out of participating in the HIEs at any time by completing the Carilion Clinic HIE Opt-Out Request Form. The form is available at any Carilion Clinic registration location, online at CarilionClinic.org, or by contacting the Privacy Officer at (540) 981-7000 or emailing privacy@carilionclinic.org.
  • Workers’ Compensation: If you are seeking workers’ compensation for a work-related illness or injury, we may disclose your health information as permitted or authorized by the state Workers’ Compensation program.
  • Medical Research: Conducting medical research is an important part of Carilion Clinic’s mission. Federal regulations permit use of your health information in medical research, either with your authorization or when the research study is reviewed and approved by an Institutional Review Board before the study begins. In some situations, limited information may be used before approval of the study to allow a researcher to determine whether enough patients exist to make a study scientifically valid.
  • Health Oversight Activities: We may disclose your health information to a health oversight agency for legally authorized activities such as audits, investigations, inspections and licensure. Through these activities, the government monitors the health care system, government programs and compliance with applicable laws and regulations.
  • Disaster Relief: In the event of a declared disaster, we may disclose your name and location to a public or private entity authorized by law or by its charter to assist in disaster relief efforts (e.g., the American Red Cross).
  • Fundraising: We may contact you about our fundraising efforts, programs and events to support our mission. We may use your health information to determine when and how to contact you. We may also disclose this information to our institutionally related foundations. You are not required to participate and you have the right to opt out of receiving fundraising communications from us. Please see the opt-out instructions provided on the letter or materials sent to you.
  • Marketing: We generally must obtain your written authorization before using your health information for marketing purposes. Without your written authorization, we can provide you with marketing materials in a face-to-face encounter and we can provide you with a promotional gift of very small value, if we so choose. We may also communicate with you about products and services relating to your treatment, to coordinate or manage your care, or to provide you with information about different treatments, providers or care settings.
  • Organ and Tissue Donation: In the event our clinical professionals determine that a patient may be a candidate for organ/tissue donation and consistent with applicable law, we may disclose health information to organizations or other entities engaged in the procurement, banking or transplantation of organs/tissues or to other health care providers as needed to make transplantation possible.
  • Coroners, Medical Examiners and Funeral Directors: We may disclose your health information to a coroner or medical examiner when necessary for identification, to determine a cause of death or as otherwise authorized by law. Carilion Clinic may also disclose your health information to a funeral director as necessary to carry out their duties, including arrangements in reasonable anticipation of and after death.
  • Public Health Activities: We may disclose your health information for legally authorized or required public health activities, such as in cases of “mandatory reporting.” These may include such things as preventing and controlling disease, injury or disability; reporting births and deaths; reporting reactions to medication or problems with products; recall notifications; and reporting immunization status to schools. This also includes the reporting of the existence, or probable existence, of a mental or physical disability or infirmity of any person licensed to operate a motor vehicle or aircraft which the physician believes affects such person’s ability to operate a motor vehicle or aircraft safely.
  • To Avert a Serious Threat or Harm: Under certain circumstances, we may use and disclose your health information when necessary to prevent a serious and imminent threat to the health and safety of you, another person or the general public.
  • Military Authorities/National Security: We may disclose your health information to authorized state or federal officials for military, intelligence, counterintelligence or other national security activities authorized by law. This includes providing protection to the President of the United States or other authorized individuals.
  • Law Enforcement Activities: We may disclose your health information to the police or other law enforcement officials as required or permitted by law, including a response to a court order, subpoena, summons, warrant or similar process. If we reasonably believe you are a victim of abuse, neglect or domestic violence and the reporting of such is required or permitted by law, we may disclose your health information to a governmental authority, including a social service or protective services agency. Should you be an inmate of a correctional institution, we may disclose to the institution or their agents the health information necessary for your health and the health and safety of other individuals in accordance with state and federal requirements.
  • Judicial and Administrative Proceedings: We may disclose your health information in the course of any judicial or administrative proceeding as required or permitted by law, including responses to a court/administrative order, subpoena or similar process.
  • Required by Other Laws: We may use or disclose your health information when required by other federal, state or local law or regulations.


Using and Disclosing Your Information With Your Authorization

We may use or disclose your health information only with your written authorization (permission) except as described by this Notice or specifically required or permitted by law. For example:

  • Certain marketing activities
  • The sale of your health information
  • Certain types of health information that may have additional protections under federal or state law. For example, HIV/AIDS diagnoses, genetic testing and psychotherapy notes have additional protections under certain state laws. To the extent applicable, Carilion Clinic may need to obtain your written authorization before disclosing that information to others under several circumstances.
  • Substance abuse records: if you are a recipient of alcohol or drug abuse treatment, provided by a federally assisted alcohol and drug abuse program your health information has additional protections per special federal confidentiality laws (42 CFR Part 2). Carilion Clinic will not respond to inquiries about your treatment and will not disclose information revealing that you are a patient of the alcohol or drug abuse treatment program to unauthorized individuals who call Carilion Clinic seeking information about your care, unless your written authorization is obtained. If you are a minor or have a personal representative (such as a guardian or person authorized under a power of attorney) you will be consulted prior to sharing information with such person. If you refuse to grant permission, or are unable to grant permission, information may be shared with your personal representative only to the extent permitted or required by state law.
  • If you give written authorization, you have the right to withdraw your authorization for future uses and disclosures by notifying Carilion Clinic in writing. A form to revoke your permission is available from the local medical records department or through contacting Carilion Clinic’s Privacy Officer at (540) 981-7000 or privacy@carilionclinic.org. Your permission will end upon the receipt and approval of the signed form.


Your Health Information Rights

You have the following rights with respect to your health information:

Right To Inspect and Copy: You have the right to request, in writing, to see and obtain a copy of the health information we use to make decisions about your care. You have the right to request that the copy be provided in an electronic form or format. If the form and format are not readily producible, we will work with you to provide the records in a reasonable manner. We may charge you a fee for the costs of copying, mailing or other supplies and services associated with your request. Contact your local medical records department for more information on how to make this request.

We may deny your request to inspect or obtain a copy in certain circumstances (e.g., we may deny access if your physician believes it will be harmful to your health or could cause a threat to others). If this occurs, you may request that the denial be reviewed, if permitted by law. If such a review is agreed upon, another licensed health care professional, chosen by Carilion Clinic, may review your request and we will comply with the outcome of that review.

Right To Request Alternate Methods of Communication: You have the right to request, in writing, but without needing to state a reason, that confidential communications about you be made in an alternative manner such as by phone, secure messaging or at a certain location. We will accommodate reasonable requests. Your request must specify how and where you wish to be contacted in the future. Please realize that we reserve the right to contact you by other means and at other locations if you fail to respond to any communication from us that requires a response. To make such a request, please contact your local medical records department or Carilion Clinic’s Privacy Officer at (540) 981-7000 or privacy@carilionclinic.org.

Right To Request Restrictions: You have the right to request a restriction or limitation on the health information we use and disclose about you for treatment, payment or health care operations, or to assist others’ involvement in your care. Your request must be in writing, state the restrictions that you are requesting and state to whom the restrictions apply. To make such a request, please contact your local medical records department or by contacting Carilion Clinic’s Privacy Officer at (540) 981-7000 or privacy@carilionclinic.org.

Please note: Due to the integrated nature of Carilion Clinic’s medical record, Carilion Clinic is generally not technically able to honor most requests; nor, in most cases is Carilion Clinic legally required to do so. We must accept your request that we not disclose health information to a health plan for services in which you have paid out of pocket in full at the time of service. If we do agree to your request, we will comply with your request unless the restricted information is needed to provide you with emergency treatment or we notify you that we are terminating our agreement to a restriction.

Right To Request Amendment: If you believe that health information we have about you is incorrect or incomplete, you may make a written request to ask us to amend (change) the information. The request should state the reason for the amendment and specify the information to be amended. Any amendment we make to your health information will be shared to those with whom we previously disclosed the amended information. To make such a request, please contact your local medical records department or contact Carilion Clinic’s Privacy Officer at (540) 981-7000 or privacy@carilionclinic.org.

We may deny your request for an amendment if the request is not in writing or is incomplete. We may also deny your request if the information to be amended was not created by Carilion Clinic, is no longer maintained by Carilion Clinic, is not part of the information in which you would be permitted to inspect or copy or is accurate and complete. We will respond to your request in a timely manner. If we deny your request, you may submit a statement disagreeing with our denial, or you may direct that your request for amendment and our denial be included with any future disclosures of the information you requested to amend. If you submit a statement of disagreement, we may prepare and provide you with a copy of a written statement of rebuttal and your statement of disagreement and our rebuttal will be included in subsequent disclosures of the information.

Right to an Accounting of Certain Disclosures: You have the right to make a written request for an accounting (list) of disclosures we have made of your health information, except for uses and disclosures for treatment, payment and health care operations and those for which you have authorized disclosure. Your request must state the time period the request spans, which may not be greater than six years. The first list requested within a 12-month period shall be provided at no charge. For additional lists requested during the same 12-month period, Carilion Clinic may charge for the costs of providing the lists. To make such a request, please contact your local medical records department or contact Carilion Clinic’s Privacy Officer at (540) 981-7000 or privacy@carilionclinic.org. Right to Notification of a Breach of Your Health Information: Carilion Clinic is required by law to maintain the privacy of your information and to notify you following a breach of your unsecured health information.


Key Information About This Notice

This Notice takes effect Jan. 2, 2018. It will remain in effect until we replace it. We may change this Notice and make changes applicable for all health information we created or received before and after we made changes to our Notice. We will make any revised Notice available in hard copy at any registration location, display the Notice at our locations and post at CarilionClinic.org. You will be provided a copy of the new Notice upon your next visit to Carilion Clinic. If you have any questions or would like to discuss this Notice in more detail, please contact Carilion Clinic’s Privacy Officer at (540) 981-7000 or privacy@carilionclinic.org.


For More Information or to Report a Concern

If you would like additional information or if you believe your privacy rights have been violated, you may contact Carilion Clinic’s Privacy Officer at (540) 981-7000 or privacy@carilionclinic.org. Under no circumstances will we ever ask you to waive your rights under this Notice or retaliate against you for raising a concern. You may also file a complaint with the U.S. Department of Health and Human Services - Office for Civil Rights. Our Privacy Officer can provide you with information on how to file such a complaint.