Notice of Privacy Policy

I. OUR COMMITMENT TO YOUR PRIVACY

WWH is committed to protecting the privacy of health information that we create or obtain about you. This Notice tells you about the ways in which we may use and disclose your health information and describes both your rights as well as our obligations regarding that use and disclosure.

We are required by law to make sure that your health information is protected, to give you this Notice describing our legal duties to protect your privacy, and to follow the terms of the Notice that is currently in effect. We reserve the right to change the terms of this Notice and to make a new Notice effective for all health information that we maintain.

II. WHO THIS NOTICE APPLIES TO

This Notice applies to WWH, consisting of its facilities, departments, clinics, and any other entities of WWH that are considered Covered Entities as defined under HIPAA; all WWH physicians, dentists, other licensed professionals, employees, volunteers, and trainees. This Notice, however, does not apply to any WWH providers regarding their private offices.

III. HEALTH INFORMATION COVERED BY THIS NOTICE

This Notice applies to the health information protected by the federal law known as the Health Insurance Portability and Accountability Act, better known as HIPAA. HIPAA applies to all the health information that we create, obtain and maintain about you when you receive primary care, behavioral health care or dental care from us. Your health information includes clinical and billing records. Some health information is also protected by other federal, state, and District of Columbia laws. Additional legal protections that might apply to your health information include:

• Requiring written permission to share substance use disorder records protected by 42 CFR Part 2 for purposes of treatment, payment, health care operations, except in limited situations. WWH’s Part 2 Programs, are Whitman-Walker Addiction Services Co-occurring Program (WWAS Co-OP), the Substance Use Management for Harm Reduction, or the Understanding Your Use Group (together the “Part 2 programs”). If you participate in WWH’s Part 2 Programs, you must sign a consent to share your records from the Part 2 Programs. WWH has a separate Notice of Privacy Practices for Part 2 SUD Treatment Information that describes these additional protections. It is available at https://www.whitman-walker.org/disclaimers/.

• The unauthorized disclosure of mental health information violates the provisions of the District of Columbia Mental Health Information Act of 1978 (Sections 7-1201.01 to 7-1207.02). Disclosures may only be made pursuant to a valid authorization by the client or as provided in Title III or IV of that Act.

III. YOUR RIGHTS RELATED TO YOUR HEALTH INFORMATION

You have the following rights regarding your health information:

Right to inspect and get a copy of your health information

You have the right to inspect and/or receive a copy of the health information we maintain about you. You may request that we send a copy of your health information to a third party.

To get a copy of your health information, you may:

1. Submit your request in writing to your WWH health care provider or to the WWH Medical Records Department. If we agree to your request, we will provide a copy of a summary of your health information, usually within 30 days of your request. We may charge you a reasonable cost-based fee. If we deny your request, we will provide you with a written explanation of why we denied it and explain your rights.
2. Access most of your electronic health information by using WWH’s patient portal, known as MyChart. For information about MyChart, please go to https://www.mychart.com/features. For additional information about our electronic medical records system, Epic, please go to https://www.whitman-walker.org/epic-faq.  

Right to request an amendment

If you think the health information we have about you is incorrect or incomplete, you may ask us to correct the information, for as long as the information is kept by, or for, WWH in your medical and billing records.

To request an amendment, submit your request in writing to the WWH Privacy Officer (contact information provided below) and provide the reason for the request. If we agree to your request, we will notify you and will amend your record(s). In certain circumstances, we cannot remove what was in the record(s), however, we may be able to add supplemental information to clarify. If we deny your request for an amendment, we will provide you with a written explanation of why we denied it and explain your rights.

Right to request confidential communications

You have the right to request that we communicate with you in a certain way or at a certain location. For example, you may ask that we contact you only at home or only by mail.

To request we communicate with you in a certain way, submit specific details about how you want to be contacted. We will not ask you the reason for the request, and we will accommodate all reasonable requests. If we are unable to contact you using the ways or locations that you have requested, we may contact you using the information that we have.

Right to request restrictions

You have the right to request a restriction or limitation on the health information we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the health information we disclose about you to someone who is involved in your care or the payment for your care, such as a family member or friend.

To request a restriction, submit your request in writing to the WWH Privacy Officer (contact information  provided below) and tell us: (1) what information you want to limit; (2) whether you want to limit our use, disclosure, or both; and (3) to whom you want the limits to apply. If we agree to your request, we will comply with your request unless the information is needed to provide you with emergency treatment or if we are required by law to disclose it. If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will agree, unless a law requires us to share that information. We are allowed to end the restriction if we tell you. If we end the restriction, it will only affect the health information that was created or received after we notify you. We may deny your request if it would affect your care. 

Right to an accounting of disclosures

You can ask for a list (accounting) of the times we have shared your health information, who we shared it with, and why.

To request an accounting of disclosures, submit your request in writing to the WWH Privacy Officer (contact information provided below) and provide the time for the accounting (not more than six years from the date of your request). If we agree to your request, we will include all the disclosures, except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We will provide one accounting a year free and may charge a reasonable, cost-based fee if you ask for another one within 12 months.

Right to a paper copy of this notice

You can ask for a paper copy of this Notice at any time, even if you have agreed to receive the Notice electronically. Copies of this Notice are available at WWH facilities, from the WWH Privacy Officer (contact information provided below) and on the WWH website at. https://www.whitman-walker.org/disclaimers/hipaa.

Right to choose someone to act for you

If you have given someone health care (medical) power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. Our Legal Services Department can assist you with the preparation of a health care power of attorney document if you do not have one, which provides authority for another person to act on your behalf.

IV. YOUR CHOICES

For certain health information and in certain situations, you can tell us your choices about what we share.

1. You have both the right and the choice to tell us to share information with:

• Individuals involved in your care or payment for your care. Unless you tell us not to, we may share health information with anyone involved in your medical care, such as a friend, family member, or any individual you identify. We may also give your information to someone who helps pay for your medical care. If you are unable to tell us your preference, for example, if you are not present or are unconscious, we may share health information that is directly relevant to the person’s involvement with your care, if we believe it is in your best interest. Additionally, we may disclose information about you to your legal representative.

1. You must provide written permission for us to share your information as follows:

• Marketing purposes.
• Sale of your health information.
• Psychotherapy notes, except for certain internal circumstances.

1. You can tell us not to contact you for:

• We may contact you to raise funds.If we do you can tell us not to do so again. If you do not want us to contact you for fundraising purposes, or if your health information includes Part 2-protected records and you do not want to receive fundraising communications, please contact the HIPAA Privacy Officer (contact information below).

V. OUR USE AND DISCLOSURE OF YOUR INFORMATION

This section describes different ways that we may use and disclose your health information without your consent or authorization. All of the ways that we are permitted to use or disclose information will fall within one of these categories; however, not every use or disclosure will be listed.

1. Typical uses and disclosures of health information

We typically use and disclose health information for the following purposes:

• To treat you: We may use or disclose health information about you to provide you with medical treatment or health care services. We may disclose information about you to health care providers involved in your care. For example, a doctor may need to review your medical history before treating you. We may share health information about you with other health care providers, agencies, or facilities not affiliated with WWH to provide or coordinate the different things you need, such as prescriptions, lab work, and x-rays. We may contact you to provide appointment reminders, to collect registration information, to provide information about treatment alternatives or other health-related benefits and services that may be of interest to you, or to follow-up on your care.
• To run our organization: We may use and disclose health information about you for our health care operations, which are various activities necessary to run WWH’s business, provide quality health care services, and contact you when necessary. For example, we may share your health information to coordinate your care, evaluate our providers’ performance in caring for you, and for quality improvement activities. We may disclose your health information to medical, nursing, or other students and trainees for review and learning purposes.
• To bill for your services: We may use and disclose health information about you for billing and payment activities. For example, we may share your health information so that WWH can obtain payment from an insurance company or another third party. We may also tell your insurance company about a treatment that you need to obtain prior approval or check if your insurance will pay for the treatment.

We typically use and disclose health information in the following ways:

• Health information exchanges: A health information exchange (HIE) provides a way for us to share your health information with your other care providers (doctors’ offices, hospitals, labs, radiology centers, and other providers) through secure, electronic means.

WWH participates in the following HIEs:

• Care Everywhere: This is an HIE technology that securely connects providers that use the Epic electronic records system together, both in the United States and internationally, to share patient data between health providers, such as physician practices, health clinics, hospitals and health systems. The goal is to provide a comprehensive picture of a patient’s health information. Through Care Everywhere, Epic practices are also connected to Carequality, which enables different health records systems to securely share health information.
• CRISP: This is a regional HIE that allows health care providers to share health information with each other electronically. CRISP ingests data from hospitals and outpatient clinics located in the District of Columbia, Maryland, Virginia, West Virginia, and Delaware.

Information about your past medical care and current medical conditions and medications is available to us or to your non-Whitman-Walker health care providers through these HIEs for treatment purposes. Most health information can be shared for treatment purposes through an HIE without written permission, except for:

• Substance use disorder records from WWH’s Part 2 Programs: You must sign a consent to share your records from WWH’s Part 2 Programs through an HIE. If your Part 2-protected records cannot be segregated or separated from your other health information, all your health information may be excluded from an HIE until you sign a consent to share your Part 2-protected records. WWH has a separate notice for Part 2-protected records that describes these additional protections. It is available at https://www.whitman-walker.org/disclaimers/

• Reproductive health records: Maryland law provides extra privacy protections for certain reproductive health information in HIEs. To comply with these laws, certain reproductive health information is filtered out (removed) from patient records before they are shared through HIEs. This applies to all WWH patient records, regardless of where you live or where you received care.

For more information about Care Everywhere, Carequality and CRISP, including who can access the health information, how the health information is shared, and how to “opt-out” of participating, please visit https://www.whitman-walker.org/epic-faq. 

• Business associates: We can share health information with third parties referred to as “business associates” that provide services on our behalf, including such things as software and other IT support, patient navigation, and legal and other professional services, We require our business associates to sign an agreement requiring them to protect your information and to use it only for the purposes for which we have contracted.

1. Other allowed or required uses and discloses of health information

We are allowed or required to share your health information in other ways – usually in ways that contribute to the public good, such as public health and research. We can share health information in certain situations such as:

• Research: We may use and disclose your information, including to the Whitman-Walker Institute, for certain research purposes in compliance with the requirements of applicable law. All research, however, is subject to a special approval process, which establishes protocols to ensure that your information will continue to be protected. When required, we will obtain a written authorization from you prior to using your information for research.
• When required by law: We will disclose health information when required to do so by federal, District of Columbia, and/or state law. This includes, but is not limited to, disclosures to mandated patient registries, including reporting adverse events with medical devices, food, or prescription drugs to the Food and Drug Administration.
• Oversight Activities: We may disclose health information to health oversight agencies for activities authorized by law. These oversight activities may include licensure activities and other activities by governmental, licensing, auditing, and accrediting agencies as authorized or required by law.
• Public Health Activities: We may disclose health information for public health activities including disclosures to prevent or control disease, injury, or disability; report births and deaths; report child abuse or neglect or domestic violence; or notify a person who may have been exposed to a disease or condition.
• Lawsuits and other legal actions:
  • We may disclose health information to courts, attorneys, court employees and others when we get a court order, subpoena, discovery request, warrant, summons, or other lawful instructions. We may also disclose information about you to WWH attorneys and/or attorneys working on WWH’s behalf to defend ourselves against a lawsuit or other legal action.
  • If your health information includes Part 2-protected records, we may not use or disclose them in civil, criminal, administrative or legislative proceeds against you, unless you provide written consent or we receive a court order and subpoena, as described in WWH’s separate notice for Part 2-protected records available at https://www.whitman-walker.org/disclaimers/.

• Law enforcement purposes/ law enforcement official:
  • We may disclose health information to the police or other law enforcement officials to report or prevent a crime or as otherwise required or permitted by law.
  • If your health information includes Part 2-protected records, we may not use or disclose them in civil, criminal, administrative or legislative proceeds against you, unless you provide written consent or we receive a court order and subpoena, as described in WWH’s separate notice for Part 2-protected records available at https://www.whitman-walker.org/disclaimers/.
• Use and disclosure in special situations: We may use and disclose health information in the following special situations:
  • Serious Threats to Health or Safety: We may use and disclose health information to help prevent a serious and imminent threat to your health and safety or the health and safety of the public or another person.
  • Respond to organ and tissue donation requests: We can share health information with organizations that handle organ procurement, eye or tissue transplantation, or to an organ donation bank as necessary to facilitate organ or tissue donation and transplantation.
• Coroner, medical examiner or funeral director: We can share health information about a deceased patient with a coroner, medical examiner, or funeral director as necessary to carry on their duties.
• Disaster relief efforts: We may disclose health information to an organization assisting in a disaster-relief effort so that families can be notified about your condition, status, and location.
• Workers’ compensation claims: We may disclose health information for workers’ compensation claims or similar programs as authorized or required by law.
• Presidential protective services: We may disclose health information to authorized federal officials so they may conduct special investigations or provide protection to the President of the United States, other authorized persons, or foreign heads of state as authorized by law.
• For members of the armed forces, domestic (United States) or foreign, we may release health information to the military authorities as authorized or required by law.
• National security and intelligence activities. We may disclose health information to authorized federal officials for intelligence, counter-intelligence, and other national security activities as required by law.
• Inmates For inmates of a correctional institution or under the custody of law enforcement officials, we may release health information to the correctional institution or law enforcement officials as authorized or required by law.

1. Notice of redisclosure

Once your health information is shared, it may be redisclosed by the recipient and it may no longer be protected by HIPAA.

VII. OUR RESPONSIBILITIES

• We are required to retain your health information regarding the care and treatment that we provide to you.
• We are required by law to maintain the privacy and security of your health information.
• We will let you know in writing if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this Notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind. We are not able to take back any uses or disclosures that we have already made with your permission.

VIII. QUESTIONS/COMPLAINTS

If you have questions or believe that your privacy rights have been violated, you may file a complaint with:

• WWH: Write to Whitman-Walker Health, 1201 Sycamore Drive S.E., Suite 500, Washington, D.C. 20032, Attention: Compliance/Privacy Office, or call 745.7000.
• Secretary of the Department of Health and Human Services: Write to the U.S. Department of Health and Human Services Office for Civil Rights, 200 Independence Avenue, SW, Washington, DC 20201, or call 696.6775, or visit www.hhs.gov/ocr/privacy/hipaa/complaints.

You will not be retaliated against for filing a complaint.

IX. NOTICE OF AVAILABILITY OF LANGUAGE SERVICES AND AUXILIARY AIDS

WWH provides free aids and services to deaf and hard of hearing individuals to communicate effectively with us, such as:

• Qualified sign language interpreters
• Written information in other formats (large print, audio, accessible electronic formats, other formats)

WWH also provides language services to people whose primary language is not English, such as:

• Qualified interpreters
• Information written in other languages

For additional information, please see https://www.whitman-walker.org/disclaimers/language-access-notice.

X. NONISCRIMINATION NOTICE

WWH complies with applicable Federal civil rights laws and does not discriminate on the basis of race, color, religion, sex, marital status, sexual orientation, gender identity or expression, English language proficiency, national origin, age, disability, veteran status or any other status protected by law.

For additional information, please see https://www.whitman-walker.org/disclaimers/nondiscrimination-notice.

XI. CHANGES TO THIS NOTICE OF PRIVACY PRACTICES

We reserve the right to change this Notice and WWH privacy practices. We further reserve the right to make the revised or changed Notice effective for information that we already have about you, as well as any information that we receive in the future.

We will post a copy of the current Notice on the WWH website at Whitman-Walker.org/disclaimers/hipaa.

The Notice will specify the effective date of the Notice. Each time you visit our website you will see a link to the current Notice in effect.

The original effective date of this Notice is April 14, 2003. This Notice was most recently updated on November 3, 2025, and replaces all earlier versions.

By signing your General Consent form, you acknowledge WWH provided you with a copy of, or access to, this Notice