NOTICE OF PRIVACY PRACTICES
Effective Date: February 16, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. Our Pledge Regarding Your Health Information
At The Vienna Clinic, a direct primary care (DPC) practice, we understand that your medical information is personal. We are committed to protecting it. We create a record of the care and services you receive to provide quality care and comply with legal requirements. This notice applies to all records of your care generated by our practice.
II. How We May Use and Disclose Your Health Information
We may use and disclose your Protected Health Information (PHI) in the following ways:
Treatment: To provide, coordinate, or manage your healthcare. For example, we may share information with a specialist to whom you are referred.
Payment: To obtain payment for services. While we do not bill insurance for your membership fee, we may disclose PHI to a third-party payer (like a health sharing ministry or employer) if they are paying your $2,000 annual fee on your behalf.
Healthcare Operations: To run our practice and ensure all patients receive quality care.
Substance Use Disorder (SUD) Records: Per 2026 federal requirements (42 CFR Part 2), if we receive or maintain SUD records, they are subject to heightened confidentiality protections. We will not use or disclose these records in civil, criminal, administrative, or legislative proceedings against you without your express written consent or a specific court order.
Required by Law: We will disclose PHI when required by federal, state (Virginia), or local law, including public health reporting and oversight.
III. Your Rights Regarding Your PHI
Access & Copies: You have the right to inspect and obtain a copy of your health records. In Virginia, we must respond to your written request within 15 days. We may charge a reasonable, cost-based fee for copies.
Amendments: You may ask us to amend your record if you feel it is incorrect.
Accounting of Disclosures: You may request a list of certain disclosures we have made of your PHI over the last six years.
Restrictions on Disclosure: You have the right to request a restriction on how we use or share your PHI. Important for DPC: If you pay for a service entirely out-of-pocket, you have the right to restrict disclosure of that information to your health plan for payment or operations.
Breach Notification: We will notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
IV. Virginia-Specific Disclosures
Under Virginia Code § 32.1-127.1:03, we may disclose your records without your authorization in specific circumstances, including:
In response to a valid subpoena duces tecum (subject to a 15-day notice period allowing you to object).
To establish or collect your annual membership fee.
To a "threat assessment team" if a specific and immediate threat to public safety is identified.
V. Potential for Redisclosure
Information disclosed pursuant to this notice may be subject to redisclosure by the recipient and may no longer be protected by the HIPAA Privacy Rule, unless more stringent rules (like SUD/Part 2) apply.
VI. Complaints
If you believe your privacy rights have been violated, you may file a complaint with us or the Secretary of the U.S. Department of Health and Human Services. You will not be penalized for filing a complaint.
Contact Our Privacy Officer:
email: privacy@theviennaclinic.com
call: 703-239-6200