HIPAA Statement
Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE READ IT CAREFULLY.
Virago Health, PLLC (the “Practice” or “we”) will gather certain health information about you and will create a record of the care provided to you. Other individuals or organizations that are part of your “circle of care”—such as your other healthcare providers, your health plan, and close friends or family members—may also share information with us. We may also use or share information with other parties for a variety of important purposes, including some purposes described below.
Protected Health Information (PHI)
Information about your health is private, and it should remain private. That is why this healthcare practice is required by federal and state law to (i) protect and maintain the privacy of your health information; (ii) provide this Notice of our legal duties and privacy practices to you; and (iii) abide by the terms of this Notice currently in effect.
The basis for federal privacy protection is the Health Insurance Portability and Accountability Act (HIPAA) and its regulations, known as the “Privacy Rule” and “Security Rule” and other federal and state privacy laws.
We reserve the right to make changes to this notice at any time and to make such changes effective for personal health information we have about you, as well as any information we receive in the future. In the event there is a material change in this Notice, the revised Notice will be posted and made available to you upon request.
Who Will Follow This Notice
This Notice describes the information privacy practices followed by our clinic employees, volunteers, and related personnel.
Clinic employees, volunteers, and related personnel must follow this Notice with respect to:
· How we use your PHI
· Disclosing your PHI to others
· Your privacy rights
· Our privacy duties
Using or Disclosing Your PHI
For Treatment
During the course of your treatment, we will use health information about you to furnish healthcare services and supplies to you, in accordance with our policies and procedures. We may also communicate with other healthcare providers to coordinate or manage your healthcare.
For Payment
We collect payment through out of network payment. In some instances, you may request a Superbill to submit to your insurer on your own. Some of your health information may be on that Superbill. This may include a description of your health problem, the treatment we provided and your membership number in your employer’s health plan.
Or, your insurer may want to review your medical record to determine whether your care was necessary. Also, we may disclose to a collection agency some of your PHI for collecting a bill that you have not paid.
For Healthcare Operations
We will use and disclose your health information to conduct the business activities of our organization. These activities include, but are not limited to, quality assessment and improvement activities, review of the performance and qualifications of employees, evaluating practitioner and provider performance, conducting training programs, accreditation, certification, licensing or credentialing activities.
Special Uses
Your relationship to us as a patient might require using or disclosing your PHI in order to
· Remind you of an appointment for treatment
· Tell you about treatment alternatives and options
· Tell you about our other health benefits and services
We may also use a sign-in sheet at the registration desk where you will be asked to sign your name or call you by name in the waiting room when we are ready to begin your treatment.
Your Authorization May Be Required
In many cases, we may use or disclose your PHI, as summarized above, for treatment, payment or healthcare operations or as required or permitted by law. In other cases, we must ask for your written authorization with specific instructions and limits on our use or disclosure of your PHI. This includes, for example, uses or disclosures of documented visit notes, uses or disclosures for marketing purposes, or for any disclosure which is a sale of your PHI. If you sign a written authorization allowing us to disclose PHI about you in a specific situation, you may later revoke your authorization in writing by contacting us at the address below. If you cancel your authorization in writing, we will not disclose PHI about you after we receive your cancellation, except for disclosures which were being processed before we received your cancellation.
Certain Uses and disclosures of your PHI required or permitted by law
We may disclose health information about you when we are required to do so by federal, state, or local law, subject to the limitations of such law and the physician-patient privilege, as applicable.
Required or Permitted Uses and Disclosures
· We may disclose health information about you (i) to a relative, close personal friend, or any other person you identify as part of your “circle of care,” if the information is directly relevant to their involvement in your care; or (ii) to the above individuals or a disaster relief organization (such as the Red Cross), if we need to notify someone about your location or condition. You may object to any of these disclosures, and if you object, we will not disclose the information except in certain circumstances such as an emergency.
· We may use or disclose your PHI for research if we receive certain assurances which protect your privacy. We may use or disclose certain personal health information about your condition and treatment for research purposes where an Institutional Review Board or a similar body referred to as a Privacy Board determines that your privacy interests will be adequately protected in the study. We may also use and disclose your protected health information to prepare or analyze a research protocol and for other research purposes.
We may also use or disclose your PHI
· For public health reporting activities. For instance, we may disclose such information to a public health authority authorized to collect or receive PHI for the purpose of preventing or controlling disease, injury or disability, or, at the direction of a public health authority, to an official of a foreign government agency that is acting in collaboration with public health authority. Public health authorities include state health departments, the Center for Disease Control, the Food and Drug Administration, the Occupational Safety and Health Administration and the Environmental Protection Agency, to name a few. We are also permitted to disclose protected health information to a public health authority or other government authority authorized by law to receive reports of child abuse or neglect. Additionally, we may disclose protected health information to a person subject to the Food and Drug Administration’s power for the following activities: to report adverse events, product defects or problems, or biological product deviations, to track products, to enable product recalls, repairs or replacements, or to conduct post marketing surveillance.
· To report neglect, abuse or domestic violence.
· For health oversight activities and to government regulators or agents to determine compliance with applicable rules and regulations. Health oversight activities include audit, investigation, inspection, licensure or disciplinary actions, and civil, criminal, or administrative proceedings or actions or any other activity necessary for the oversight of 1)the health care system, 2) governmental benefit programs for which health information is relevant to determining beneficiary eligibility, 3) entities subject to governmental regulatory programs for which health information is necessary for determining compliance with program standards, or 4) entities subject to civil rights laws for which health information is necessary for determining compliance.
· In judicial or administrative proceedings that involve you. We may release such information upon order of a court or administrative tribunal. We may also release protected health information in the absence of such an order and in response to a subpoena, discovery request or other lawful request, if certain steps have been taken to notify you or secure a protective order.
· To a coroner for purposes of identifying a deceased person or determining cause of death, or to a funeral director for making funeral arrangements. We may also release personal health information to rogan procurement organizations, transplant centers, and eye or tissue banks.
· For creating special types of health information that eliminate all legally required identifying information or information that would directly identify the subject of the information.
· In accordance with the legal requirements of a workers compensation program or similar programs.
· In response to a warrant, subpoena, or other order of a court or administrative hearing body, and in connection with certain government investigations and law enforcement activities.
· If we reasonably believe that use or disclosure will avert a serious threat to your health and safety or the health and safety of others.
· For national security purposes including to the Secret Service or if you are Armed Forces personnel and it is deemed necessary by appropriate military command authorities.
· For work with outside individuals and businesses that help us operate our business successfully. We may disclose your health information to these business associates so that they can perform the tasks that we hire them to do. Our business associates must provide us with certain written assurances that they will respect the confidentiality of your personal and identifiable health information.
Your Privacy Rights and How to Exercise Them
Under the federally required privacy program, patients have specific rights. To exercise any of your rights, please contact us at:
Virago Health PLLC
Attn: Privacy Officer
616 Broome Street Suite 103
Waxhaw NC, 28173
(704) 741-9326
Your Right to Request Limited Use or Disclosure
You have the right to ask for restrictions on the ways in which we use and disclose your PHI beyond those imposed by law. We will consider your request, but we are not required to agree to it. However, we must abide by your request
to restrict disclosures to your health plan (insurer) for health services or items for which you paid out-of-pocket in full.
You may request a restriction by sending your request in writing to our Privacy Officer.
Your Right to Confidential Communication
You have the right to request that you receive communications containing your protected health information form us by alternative means or at alternative locations. We will try to accommodate reasonable requests. We may also condition this accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact. We will not request an explanation from you as to the basis of this request. Please make this request in writing by contacting our Privacy Officer.
Your Right to Revoke Your Authorization
You may revoke, in writing, the authorization you granted us for use or disclosure of your PHI. However, if we have
relied on your consent or authorization, we may use or disclose your PHI up to the time you revoke your consent.
Your Right to Inspect and Copy
Except in certain circumstances, you have the right to access, inspect and copy medical and billing records about you, if requested in writing to the Privacy Officer. We may refuse to give you access to your PHI if we think it may cause you harm, but we must explain why and provide you with someone to contact for a review of our refusal.
Your Right to Amend Your PHI
If you believe that certain information in your records is incorrect or incomplete, you have the right to request, in writing, that we correct or supplement the records. We may refuse to make the amendment and you have a right to disagree in writing. If we still disagree, we may prepare a counter-statement. Your statement and our counter-statement must be made part of our record about you.
Your Right to Know Who Else Sees Your PHI
You have the right to request an accounting of certain disclosures we have made of your PHI since Novemember 3, 2025. We are not required to account for all disclosures, including those made to you, authorized by you or those involving treatment, payment and healthcare operations as described above. There is no charge for an annual accounting, but there may be reasonable cost-based charges for additional accountings. We will inform you if there is a charge and you have the right to withdraw your request or pay to proceed.
Your Right to be Notified of a Breach
You have the right to be notified in the event we discover a breach of unsecured PHI involving your medical information.
Your Right to Obtain a Paper Copy of This Notice
You have the right to obtain a paper copy of this Notice upon request, even if you have agreed to receive the Notice
electronically.
What if I have a complaint?
If you believe that your privacy has been violated or you disagree with a decision we have made regarding your access to your health information or any other request you have made in the exercise of your rights, you may file a complaint with our Privacy Officer at the address and telephone number listed above or with the Secretary of Health and Human Services in Washington, D.C. We will not retaliate or penalize you for filing a complaint with us or the Secretary.
To file a complaint with us, please contact our Privacy Officer at the address and telephone Your complaint should provide specific details to help us in investigating a potential problem.
To file a complaint with the Secretary of Health and Human Services, write to: Region IV, Office for Civil Rights, U.S. Department of Health and Human Services, Atlanta Federal Center, Suite 3B70, 61 Forsyth Street, SW, Atlanta, Georgia 30303-8909
Some of Our Privacy Obligations and How We Fulfill Them
We will abide by the privacy practices set forth in this Notice. We are required to abide by the terms of the Notice currently in effect. However, we reserve the right to change this Notice and our privacy practices when permitted or as required by law. If we change our Notice of Privacy Practices, we will provide you with a copy to take with you upon request and we will post the new notice.
Compliance with Certain State Laws
When we use or disclose your PHI as described in this Notice, or when you exercise certain of your rights set forth in this Notice, we may apply state laws about the confidentiality of health information in place of federal privacy regulations. We do this when these state laws provide you with greater rights or protection for your PHI. When state laws are not in conflict or if these laws do not offer you better rights or more protection, we will continue to protect your privacy by applying the federal regulations.