Privacy Policy

All of the entities and individuals described below may share your health information with each other for purposes of treatment, payment, and healthcare operations, as described below:

• Carilion Clinic-owned hospitals, clinics, VelocityCare centers, and pharmacies
• Carilion Clinic’s community-based service providers, including home health services and hospices
• Carilion Clinic departments and units that provide healthcare services (Carilion Wellness and associated revenue agents are excluded)
• All employees, contractors and volunteers associated with the facilities and services described above
• All health care professionals, including physicians, nurses and other providers, residents, medical students and trainees, involved in your treatment at any Carilion Clinic facility

The following is a description of the types of uses and disclosures of your health information that we are permitted or required to make without your authorization. Not every use or disclosure will be listed, but all of the ways we are permitted to use and disclose information will fall within one of the following categories:

• Treatment: We can use your health information and share it with other professionals who are treating you. For example, a doctor treating you for an injury may ask another doctor about your overall health condition. 
• Payment: We can use and share your health information to bill and get payment from health plans or other entities. For example, we give information about you to your health insurance plan so it will pay for your services. 
• Healthcare Operations: We can use and share your health information for our operations, to improve your care, and to contact you when necessary. For example, we use health information about you to manage your treatment and services. 
• Business Associates: Some services are provided in our organization through contractual relationships with business associates. We may disclose your health information to our business associates so that they can perform the job we have asked them to do. Our contracts require business associates to appropriately protect the privacy and security of your health information.
• Relatives, Close Friends, and Others Involved in Your Care: Health care professionals, using their best judgment, may disclose to a family member, a close personal friend, or any other person identified by you, your health information relevant to that person’s involvement in your care or payment related to your care. If family members or friends are present while care is being provided, Carilion Clinic may assume your companions may hear the discussion, unless you state otherwise. If you do not want Carilion Clinic to disclose your health information to your family members or others who are involved in your care or handling your bills, please inform the person assisting you during registration or admission.
• Hospital Directory/Patient Census List: Unless you notify us that you object, if you are admitted to one of our hospitals, we will use your name, location in the facility, and religious affiliation in the hospital directory and patient census lists. This information may be provided to members of the clergy and, except for religious affiliation, to other people who ask for you by name. If you are listed in the directory, we may also share your general condition with those requesting information. Such condition reports are typically one word, such as “good,” “fair,” “poor,” or “critical.”
• Appointment Reminders and Treatment Alternatives: We may contact you via phone, email, mail, MyChart message, or text message to remind you that you have an appointment for medical care and to provide information about treatment and health-related benefits and services that may be of interest to you.
• Sign-In Sheets: We may use sign-in sheets in certain locations to track your arrival. We may also call your name in the waiting area. If you do not wish to sign the sign-in sheet or have your name called, please let the staff know and we will make adjustments to meet your request.
• Record Locator Services, Also Known as Health Information Exchanges (HIEs): To improve the coordination of patient care and treatment, Carilion Clinic may electronically release your health information to other healthcare providers who participate in local, state, national, and/or international HIEs. This may include information related to the diagnosis and treatment of mental illness, alcohol or drug use, sexually transmitted diseases, HIV test results, developmental disabilities, and genetic testing results. Sharing this information may improve the coordination of care, especially in emergency situations. Patients can opt out of participating in the HIEs at any time by completing the Carilion Clinic HIE Opt-Out Request Form. The form is available at any Carilion Clinic registration location, online at CarilionClinic.org, or by contacting the Privacy Office at 540-510-4600 or emailing privacy@carilionclinic.org.
• Workers’ Compensation: If you are seeking workers’ compensation for a work-related illness or injury, we may disclose your health information as permitted or authorized by the state Workers’ Compensation program.
• Medical Research: Conducting medical research is an important part of Carilion Clinic’s mission. Federal regulations permit use of your health information in medical research, either with your authorization or when the research study is reviewed and approved by an Institutional Review Board before the study begins. In some situations, limited information may be used before approval of the study to allow a researcher to determine whether enough patients exist to make a study scientifically valid.
• Health Oversight Activities: We may disclose your health information to a health oversight agency for legally authorized activities such as audits, investigations, inspections, and licensure. Through these activities, the government monitors the healthcare system, government programs and compliance with applicable laws and regulations.
• Disaster Relief: In the event of a declared disaster, we may disclose your name and location to a public or private entity authorized by law or by its charter to assist in disaster relief efforts (e.g., the American Red Cross).
• Fundraising: We may contact you about our fundraising efforts, programs, and events to support our mission. We may use your health information to determine when and how to contact you. We may also disclose this information to our institutionally related foundations. You are not required to participate, and you have the right to opt out of receiving fundraising communications from us. Please see the opt-out instructions provided on the letter or materials sent to you.
• Marketing: We generally must obtain your written authorization before using your health information for marketing purposes. Without your written authorization, we can provide you with marketing materials in a face-to-face encounter and we can provide you with a promotional gift of very small value, if we so choose. We may also communicate with you about products and services relating to your treatment, to coordinate or manage your care, or to provide you with information about different treatments, providers, or care settings.
• Organ and Tissue Donation: In the event our clinical professionals determine that a patient may be a candidate for organ/tissue donation and consistent with applicable law, we may disclose health information to organizations or other entities engaged in the procurement, banking, or transplantation of organs/tissues or to other health care providers as needed to make transplantation possible.
• Coroners, Medical Examiners, and Funeral Directors: We may disclose your health information to a coroner or medical examiner when necessary for identification, to determine a cause of death, or as otherwise authorized by law. Carilion Clinic may also disclose your health information to a funeral director as necessary to carry out their duties, including arrangements in reasonable anticipation of and after death.
• Public Health Activities: We may disclose your health information for legally authorized or required public health activities, such as in cases of “mandatory reporting.” These may include such things as preventing and controlling disease, injury, or disability; reporting births and deaths; reporting reactions to medication or problems with products; recall notifications; and reporting immunization status to schools. This also includes the reporting of the existence, or probable existence, of a mental or physical disability or infirmity of any person licensed to operate a motor vehicle or aircraft which the physician believes affects such person’s ability to operate a motor vehicle or aircraft safely.
• To Avert a Serious Threat or Harm: Under certain circumstances, we may use and disclose your health information when necessary to prevent a serious and imminent threat to the health and safety of you, another person, or the general public.
• Military Authorities/National Security: We may disclose your health information to authorized state or federal officials for military, intelligence, counterintelligence, or other national security activities authorized by law. This includes providing protection to the President of the United States or other authorized individuals.
• Law Enforcement Activities: We may disclose your health information to the police or other law enforcement officials as required or permitted by law, including a response to a court order, subpoena, summons, warrant, or similar process. If we reasonably believe you are a victim of abuse, neglect, or domestic violence and the reporting of such is required or permitted by law, we may disclose your health information to a governmental authority, including a social service or protective services agency. Should you be an inmate of a correctional institution, we may disclose to the institution or their agents the health information necessary for your health and the health and safety of other individuals in accordance with state and federal requirements.
• Judicial and Administrative Proceedings: We may disclose your health information in the course of any judicial or administrative proceeding as required or permitted by law, including responses to a court/administrative order, subpoena, or similar process.
• Required by Other Laws: We may use or disclose your health information when required by other federal, state, or local law or regulations.

We may use or disclose your health information only with your written authorization (permission) except as described by this Notice or specifically required or permitted by law. For example:

• Certain marketing activities
• Sales of your health information
• Certain types of health information that may have additional protections under federal or state law. For example, HIV/AIDS diagnoses, genetic testing, and psychotherapy notes have additional protections under certain state laws. To the extent applicable, Carilion Clinic may need to obtain your written authorization before disclosing that information to others under several circumstances.
• If you give written authorization, you have the right to withdraw your authorization for future uses and disclosures by notifying Carilion Clinic in writing. A form to revoke your permission is available from the local medical records department or through contacting Carilion Clinic’s Privacy Office at 540-510-4600 or privacy@carilionclinic.org. Your permission will end upon the receipt and approval of the signed form.

You have the following rights with respect to your health information:

• Right To Inspect and Copy: You have the right to request, in writing, to see and obtain an electric or paper copy of the health information we use to make decisions about your care. Ask us how to do this. You have the right to request copies in specific format. If the form and format are not readily produced, we will work with you to provide the records in a reasonable manner. We may charge a reasonable cost-based fee. 
• Right To Request Alternate Methods of Communication: You have the right to request that we contact you in a specific way (for example, home or office phone) or send mail to a different address. We will accommodate reasonable requests. To make such a request, please contact your local medical records department or Carilion Clinic’s Privacy Office at 540-510-4600 or privacy@carilionclinic.org.
• Right To Request Restrictions: You have the right to request a restriction or limitation on the health information we use and disclose about you for treatment, payment, or healthcare operations, or to assist others’ involvement in your care. We are not required to agree to your request unless your request is to not disclose health information to your health plan for services you have paid out of pocket in full. Your request must be in writing, state the restrictions that you are requesting and state to whom the restrictions apply. To make such a request, please contact your local medical records department or by contacting Carilion Clinic’s Privacy Office at 540-510-4600 or privacy@carilionclinic.org.
• Right To Request Amendment: If you believe that health information we have about you is incorrect or incomplete, you may make a written request to ask us to amend (change) the information. The request should state the reason for the amendment and specify the information to be amended. Any amendment we make to your health information will be shared with those with whom we previously disclosed the amended information. To make such a request, please contact your local medical records department or contact Carilion Clinic’s Privacy Office at 540-510-4600 or privacy@carilionclinic.org. We may deny your request if the information was not created by Carilion Clinic, is no longer maintained by Carilion Clinic, is not part of your permitted records to inspect or copy, or is accurate and complete. 
• Right To an Accounting of Certain Disclosures: You have the right to make a written request for an accounting (list) of disclosures we have made of your health information, except for uses and disclosures for treatment, payment, and healthcare operations and those for which you have authorized disclosure. Your request must state the time period the request spans, which may not be greater than 6 years. The first list requested within a 12-month period shall be provided at no charge. For additional lists requested during the same 12-month period, Carilion Clinic may charge for the costs of providing the lists. To make such a request, please contact your local medical records department or contact Carilion Clinic’s Privacy Office at 540-510-4600 or privacy@carilionclinic.org.
• Right To Receive Paper Copy of Notice of Privacy Practices: You can request a paper copy of this notice at any time, even if you agreed to receive the notice electronically. 

Some of the health information we maintain may relate to substance use disorder diagnosis, treatment, or referral for treatment and is protected by federal law (42 CFR Part 2). These records are subject to stricter privacy protections than those that apply under HIPAA.

In general, we may not use or disclose substance use disorder records protected by 42 CFR Part 2 without your written consent, except in limited circumstances permitted by law.

• Uses and Disclosures: You may choose to give one written consent that allows us to use and disclose your substance use disorder records for future treatment, payment, and healthcare operations. You may revoke your consent in writing at any time, except to the extent that we have already relied on it.
• Legal Proceedings: Substance use disorder records and testimony relating to those records generally may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or a court order that meets the requirements of federal law.
• Redisclosure: If your substance use disorder records are disclosed for treatment, payment, or healthcare operations to a recipient subject to HIPAA, that recipient may further use or disclose the information as permitted by HIPAA, unless you have placed additional restrictions.
• Fundraising: We may use or disclose SUD records for fundraising purposes; you have the right to opt out of receiving such communications prior to the use or disclosure.
• Patient Rights: In addition to HIPAA rights, patients have specific rights with respect to SUD records, including the right to request restrictions, receive an accounting of disclosures, revoke consent as noted above, and file a complaint if they believe their rights under 42 CFR Part 2 have been violated. 

This Notice takes effect Feb. 13, 2026. It will remain in effect until we replace it. We may change this Notice and make changes applicable for all health information we created or received before and after we made changes to our Notice. We will make any revised Notice available in hard copy at any registration location, display the Notice at our locations, and post at CarilionClinic.org. You will be provided a copy of the new Notice upon your next visit to Carilion Clinic. If you have any questions or would like to discuss this Notice in more detail, please contact Carilion Clinic’s Privacy Office at 540-510-4600 or privacy@carilionclinic.org.

If you would like additional information or if you believe your privacy rights have been violated, you may contact Carilion Clinic’s Privacy Office at 540-510-4600 or privacy@carilionclinic.org. Under no circumstances will we ever ask you to waive your rights under this Notice or retaliate against you for raising a concern. You may also file a complaint with the U.S. Department of Health and Human Services - Office for Civil Rights. Our Privacy Officer can provide you with information on how to file such a complaint.