Privacy Policy

Notice of Privacy Practices
This notice describes how information about you may be used and disclosed and how you can get access to this information. Please review carefully. To read in Spanish, Notificación de las Prácticas de Privacidad

Understanding Your Health Information
Each time you visit a hospital, physician or other healthcare provider, a record of your visit is made. These records contain personal information and medical information and are used for your direct care and treatment. This information also is used to produce an accurate bill for the services you receive and helps us to improve the care we render and the operations of our organization.

Who Will Follow this Notice?

  • Carilion Clinic owned hospitals, clinics, urgent care centers, and pharmacies.
  • Carilion Clinic’s community based service providers, including home health services, private duty nursing, and hospices.
  • All departments and units within Carilion Clinic’s organization.
  • All employees, contractors and volunteers associated with the facilities and services described above.
  • All health care professionals, including physicians, nurses and other providers, residents, medical students and trainees, involved in your treatment at any Carilion Clinic facility.

All of the entities and individuals described above may share your health information with each other for purposes of treatment, payment and health care operations, as discussed below.

Our Responsibilities
Carilion Clinic is required by law and is committed to:

  • Maintain the privacy of your health information.
  • Provide you with this Notice of our legal duties and privacy practices with respect to health information we collect and maintain about you.
  • Abide by the terms of this Notice.
  • Notify you if we are unable to agree to a requested restriction and, in most cases, allow you to request a review of our decision.
  • Notify you if a breach of unsecured health information has occurred that involved your information.
  • Not sell your health information without your written authorization.

Your Health Information Rights
You have the following rights with respect to your health information:

  • You may inspect and get a copy of your health information used to make decisions about your care, subject to a few limited exceptions. Your request to inspect or obtain copies of your health information must be made in writing, to the medical records coordinator at the Carilion facility providing your treatment. We may charge a fee for the costs of copying, mailing or other supplies associated with your request.
  • If you feel that the health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for our organization. Your request must be made in writing and include the reason for your request. We may deny your request if you ask us to amend information that was not created by us. We may also deny your request to amend information if we believe the information is accurate and complete.
  • You may request a restriction or limitation on the health information we use or disclose about you for treatment, payment or health care operations. You also have the right to request a limit on the medical information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend. We are not required to agree to your request. You may also request that we restrict disclosure of your health information to a health plan with respect to healthcare for which you have paid out of pocket in full at the time of service. Your request for restrictions must be made in writing and include the following information:(1) what information you want to limit; (2) how you want us to limit the information; and (3) to whom you want the limits to apply, for example, disclosures to your spouse.
  • You may request an accounting of certain disclosures we have made of health information about you. The accounting will not include disclosures made for purposes of treatment, payment or health care operations or made upon your written authorization. Other exceptions include, but are not limited to, disclosures for national security and intelligence and disclosures to law enforcement officials or correctional institutions. Your request must be in writing and state a time period for the accounting that may not be longer than six years and may not include dates before April 14, 2003. The first list you request within a 12-month period will be free.
  • You may request to receive communications of your health information by alternative means, at alternative locations or in a confidential manner. For example, you may ask that we contact you only at work or by mail. We will accommodate all reasonable requests.
  • You may request a paper copy of this Notice even if you have agreed to receive the Notice electronically. You may obtain a copy of this Notice at our website:

Permitted Uses and Disclosures Which Do Not Require Your Authorization
The following is a description of the types of uses and disclosures of your health information that we are permitted or required to make without your authorization:

  • We will use or disclose your health information for treatment, which means the provision, coordination or management of the healthcare services provided to you. For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process. Separate departments may share medical information about you in order to coordinate the different things you need, such as prescriptions, lab work and x-rays. We will also provide your physician or other healthcare provider with copies of reports that may assist him/her in treating you once you are discharged from a Carilion hospital.
  • We will use or disclose your health information for payment activities necessary for us to receive reimbursement for the services we provide to you. For example: Subject to your right to request a restriction on a disclosure of your information to a health plan if you pay for services out of pocket in full at the time services are rendered, a bill may be sent to you, an insurance company or other payer. The information on or accompanying the bill may include information that identifies you, as well as your diagnosis, procedures and supplies used.
  • We will use or disclose your health information for healthcare operations, such as quality assessments, evaluating practitioner performance, cost management and general administrative activities. For example: Members of the medical staff, the risk or quality improvement manager or members of the quality improvement team may use information in your health record to assess the care and outcomes in your case and others like it. This information will then be used in an effort to continually improve the quality and effectiveness of the healthcare and services we provide; and to provide medical training to our staff and medical students.
  • Some services are provided in our organization through contractual relationships with business associates. We may disclose your health information to our business associates so that they can perform the job we have asked them to do. Our contracts require business associates to appropriately protect the privacy and security of your health information.
  • Unless you notify us that you object, if you are admitted to one of our hospitals we will use your name, location in the facility and religious affiliation in the hospital directory. This information may be provided to members of the clergy and, except for religious affiliation, to other people who ask for you by name. If you are listed in the directory, we may also share your general condition with those requesting information. Such condition reports are typically one word, such as “good”, “fair”, “poor” or “critical”.
  • We may disclose health information relevant to your care or payment for your care to a family member, other relative, a close personal friend or any other person identified by you. During your initial visit to a facility or provider, we may ask you to identify individuals who you would like to receive information about you. We may also share information with others identified as part of your care team if, in the professional opinion of your healthcare provider, such information may help them care for you.
  • We may use or disclose health information to notify or assist in notifying a family member, personal representative, or another person responsible for your care about your location and general condition.
  • We may contact you to remind you that you have an appointment for medical care. If we call and need to leave a message, we will only leave our name, general information about the appointment, and the appointment’s time and date.
  • We may use sign-in sheets in certain locations to check you into the facility. We also may call your name in the waiting area. If you do not wish to sign the sign-in sheet or have your name called, please tell the receptionist and we will make adjustments to meet your request.
  • We may contact you to provide information about treatment alternatives or other health-related benefits and services that may be of interest to you.
  • We may contact you as part of our fundraising effort. You are not required to participate and you have the right to opt out of receiving fundraising communications from us.
  • We may use or disclose your health information for research purposes. We may share your health information with researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your health information.

We may also disclose health information as permitted or required by law, such as in the following circumstances:

  • to prevent a serious threat to your health or safety or the health or safety of others;
  • to prevent a serious threat to your health or safety or the health or safety of others;
  • for workers compensation or other similar programs, to the extent required by law;
  • to health oversight agencies in connection with audits, investigations, inspections, licensure surveys or complaint/compliment evaluations;
  • to public health or legal authorities charged with maintaining health records or preventing or controlling disease, injury or disability, or authorized by law to receive reports of abuse or neglect;
  • to the Food and Drug Administration (FDA) for the purpose of activities related to the quality, safety or effectiveness of FDA-regulated products, such as to enable product recalls, repairs or replacement;
  • to organ procurement organizations or other entities engaged in the procurement, banking or transplantation of organs for the purpose of tissue or organ donation or transplant. Organs will only be procured with written authorization;
  • to coroners, medical examiners or funeral directors as necessary to carry out their duties or to protect the health or safety of their staff;
  • in response to a court order, subpoena, warrant, summons or other lawful process;
  • to a law enforcement official when required or permitted by law;
  • to authorized federal officials for intelligence, counterintelligence and other national security activities, and as necessary to provide protection to the President of the United States or other individuals;
  • if you are a member of the armed forces, as required by military command authorities; or
  • if you are an inmate of a correctional institution, to the institution or agents in connection with your health or the health and safety of other individuals.

Other uses and disclosures of medical information not described in this Notice will be made only with your written authorization. For example, most uses and disclosures of psychotherapy notes, uses and disclosures of health information for marketing purposes where we receive financial remuneration from a third-party, and disclosures that constitute a sale of health information, require authorization. If you authorize a use or disclosure of health information, you may revoke your authorization in writing, at any time. However, please understand that we are unable to take back a disclosure we have already made with your prior authorization.

Revisions to this Notice
We reserve the right to change our privacy practices at any time and to make the new practices effective for all protected health information we maintain. Should our privacy practices change, we will amend this Notice and post a copy of the revised Notice on our website at The Notice will include an effective date on the first page. In addition, the first time you register at or are admitted to a facility for treatment or healthcare services as an inpatient or outpatient, we will offer you a copy of the current Notice then in effect.

For More Information or to Report a Problem
If you have questions about this Notice and would like additional information, you may contact Carilion’s Privacy Officer at 540-981-7000. If you believe your privacy rights have been violated, you may file a complaint with Carilion’s Information Privacy Officer, Carilion’s Information Security Officer or Carilion’s Compliance Department. You may also file a complaint with the Secretary of Health and Human Services. There will be no retaliation for filing a complaint.