Patient Privacy Policy

Effective date: October 1, 2009

Date Amended: October 30, 2023

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

How we may use and disclose health information

Your privacy rights regarding your health information

Contact person

Changes to this Notice of Privacy Practices

Our Notice of Privacy Practices is available in the following languages:

Download Adobe Reader

This Notice applies to the MedStar Health affiliated covered entity. For a current list of the members of the affiliated covered entity, please visit this link: MedStarHealth.org/Patient-Privacy-Policy/HIPAA-Affiliated-Covered-Entity-Designation. This Notice also applies to all healthcare professionals, employees, medical staff, trainees, students, and volunteers within the MedStar Health affiliated covered entity.

MedStar Health is committed to the protection of your medical information. In our mission to serve our patients, it is our vision to be the Trusted Leader in Caring for People and Advancing Health. We create and obtain information about you and use it to provide you with quality care and to comply with certain legal requirements. We are required by law to maintain the privacy of your health information and to give you this Notice of our legal duties, our privacy practices, and your rights. We are required to follow the terms of our most current Notice. When we disclose information to other persons and companies to perform services for us, we will require them to protect your privacy. There are other laws we are required to follow that may provide additional protections, such as laws related to mental health, behavioral health, alcohol and other substance abuse, genetic information, and communicable disease or other health conditions.

Treatment

We may use and disclose your health information to provide treatment or services, to coordinate or manage your health care, or for medical consultations or referrals. For example, we may use and disclose your health information among doctors, nurses, technicians, clinical observers, medical students, and other personnel who are involved in taking care of you, professionals in-training to observe or participate in your care under proper supervision at our facilities, or with such persons outside our facilities. We may use or share information about you to coordinate the different services you need, such as prescriptions, lab work, and X-rays. We may disclose information about you to people outside our facility who may be involved in your care after you leave, such as family members, home health agencies, therapists, nursing homes, clergy, and others. We may give information to your health plan or another provider to arrange a referral or consultation.

We may use and disclose your health information so that we can receive payment for the treatment and services that were provided. For example, we may share information with your insurance company, or a third party used to process billing information. We may contact your insurance company to verify what benefits you are eligible for, to obtain prior authorization for services, and to tell them about your treatment to make sure that they will pay for your care. We may disclose information to third parties to bill you or to bill those who may be responsible for payment, such as family members involved with your payment. We may disclose information to third parties that help us process payments, such as billing companies, claims processing companies, and collection companies.

There are some services provided by MedStar Health through contracts with other vendors or providers, referred to as business associates. For example, we may use a copy service when making copies of your health record, engage with consultants, accountants, lawyers, medical transcriptionists, and third-party billing companies. When these services are contracted, we may disclose your health information to our business associates so they can perform the job we’ve asked them to do. To protect your health information, however, we require the business associate to appropriately safeguard your information.

We may use your medical information to forward promotional gifts of nominal value to you, to communicate with you about products, services, and educational programs offered by MedStar Health, to communicate with you about case management and care coordination, and to communicate with you about treatment alternatives. We do not sell your health information to any third party for their marketing activities unless you sign an authorization allowing us to do this.

We may participate in health information exchanges (HIEs) to facilitate the secure exchange of your electronic health information between and among several healthcare providers or other healthcare entities for your treatment, payment, or other healthcare operations purposes. We may share information about you through HIEs for treatment, payment, healthcare operations, or research purposes. This means we may share information we obtain or create about you with outside entities (such as hospitals, doctors’ offices, pharmacies, or insurance companies) or we may receive information they create or obtain about you (such as medication history, medical history, or insurance information) so that each of us can provide better treatment and care coordination. In addition, if you visit any MedStar Health facility, your health information may be available to other clinicians and staff who may use it to care for you, to coordinate your health services, or for other permitted purposes.

The Chesapeake Regional Information System for our Patients (CRISP) is a regional HIE serving Maryland and D.C. in which we participate. You may “opt out” and disable access to your health information available through CRISP by calling 1-877-952-7477 or completing and submitting an Opt-Out form to CRISP by mail, fax, or through their website at CRISPHealth.org. Even if you opt out of CRISP, public health reporting, and Controlled Dangerous Substances information, as part of the State Prescription Drug Monitoring Program (PDMP), will still be available to providers through CRISP as permitted by law.

We also participate in the CommonWell Health Alliance® Services (CommonWell), a national network of organizations aligned to streamline the secure sharing of health data with a goal of improving care coordination and health outcomes. You may opt out and disable access to your health information available through CommonWell by completing and submitting an Opt-Out form to us by mail, fax, e-mail, or through the opt-out form can be found here: MedStarHealth.org/Patient-Privacy-Policy/CommonWell

Public health activities

We may disclose your health information to public health or legal authorities whose official activities include preventing or controlling disease, injury, or disability. For example, we must report certain information about births, deaths, and various diseases to government agencies. We may disclose health information to coroners, medical examiners, and funeral directors as allowed by the law to carry out their duties. We may use or disclose health information to report reactions to medications, problems with products, or to notify people of recalls of products they may be using. We may use or disclose health information to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease.

Right to access, review, and receive a copy of your health information

You have the right to access, review, and receive a copy of your medical and billing records and other health information that we have about you, with certain exceptions. To do so, please contact the MedStar Health facility where you received treatment, or the MedStar Health Privacy Office listed below. You will be required to submit your request in writing. You may request to see or receive an electronic or paper copy of your health information. You may also request that we send a copy of your records directly to a person you identify in your request. Ask us how to do this. As permitted by law, we may charge you a reasonable, cost-based fee for the cost of copying or mailing your record (and the electronic media if the request is to provide the information on portable electronic media).

We will provide a copy of your medical record usually within 30 days. In certain situations, we may deny your request. If we do, we will tell you, in writing, our reasons for the denial and explain how to have the denial reviewed.

Right to request a restriction on certain uses or disclosures

You have a right to request a restriction on how we use and disclose your medical information for treatment, payment, and healthcare operations, and to certain family members or friends identified by you, who are involved in your care or the payment of your care. Your request must be in writing, and it must (1) describe the specific information you want to limit, (2) whether you want to limit our use, disclosure, or both, and (3) to whom you want the limits to apply. Generally, we are not required to agree to your request, and we will notify you if we are unable to agree. However, we must agree to your request if your request concerns disclosure of your information to you and a health plan, or to someone on your behalf, or for out-of-pocket paid in full treatment or services.

Right to choose how you receive your health information

You have the right to request that we communicate with you in a certain way, such as by mail or fax, or at a certain location, such as a home address or post office box. We will try to honor your request if we reasonably can. Your request must be in writing, and it must specify how or where you wish to be contacted. To submit a request, please contact the facility where you received treatment, or the MedStar Health Privacy Office listed below.

Right to confidential communication with us

If we contact you by mail or a phone number you provide, you have the right to request that we communicate with you in an alternate means or alternative location. Your request must be reasonable, submitted to us in writing, and must provide a method to contact you. If you direct your request to one or more of our health plans, you must also explain how the disclosure of all or part of your information would endanger you. If your request pertains to payment, you must provide information as to how payments will be handled and an alternate method for us to communicate effectively with you.

We reserve the right to change this Notice. We reserve the right to make the revised Notice effective for medical information we already have about you as well as any information we receive in the future. We will post a copy of the current Notice in each MedStar Health facility and on our website at MedStarHealth.org. In addition, you may request a copy of the Notice currently in effect and we will promptly provide you with a copy of the Notice.

Footnote: MedStar Health, Inc. is a non-profit, community-based healthcare system serving District of Columbia, Maryland, and Virginia region. The system is made up of a number of separate healthcare providers and other diversified healthcare entities. Each provider is independently responsible for providing medical services to patients in a professional manner and in compliance with applicable laws and regulations.   

top of page