Notice of Privacy Practices


If you have any questions about this Notice of Privacy Practices, please ask a member of the staff where you receive healthcare services.  You may also contact the WVU Hospitals Chief Privacy Officer at 304-598-4109 or West Virginia University at 304-293-7286.

For medical information, contact the WVU Hospitals Health Information Management Department, P.O. Box 8049, Morgantown, WV 26506-8049 or call 304-598-4109.

For hospital billing information, contact WVU Hospitals Patient Accounting, P.O. Box 8031, Morgantown, WV 26505 or call 1-800-368-6362.

For physician billing information, contact WVU Medical Corporation Billing Department, P.O. Box 897, Morgantown, WV 26507 or call 1-800-541-4009.

We are committed to your privacy. We keep information about you to help us provide your care and to meet legal requirements.  We also understand that your health information is private.  The law requires us to protect your health information, give you this Notice, and follow the terms of the Notice.

This Notice of Privacy Practices describes how West Virginia University Hospitals (WVUH); University Health Associates (UHA); West Virginia University and its healthcare components (WVU); and each of their affiliates, may use and disclose your health information to carry out treatment, payment, or healthcare operations and for other purposes that are permitted or required by law.  It also describes your rights to access and control your protected health information.


“Protected Health Information” (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related healthcare services.   Each time you visit a hospital, outpatient facility, physician, or other healthcare provider, a record of your visit is made.  Typically, this health record contains your medical history, symptoms, examination and test results, diagnosis, treatment, care plan, insurance, billing, and employment information.   This health information serves as a basis for planning care and treatment and is a vital means of communication among the many healthcare professionals who contribute to your healthcare.  Your health information is also used by insurance companies and other third party payers to verify the appropriateness of billed services.  Health information is not considered PHI after the patient is deceased more than fifty years.

There are special protections for HIV, Alcohol and Substance Abuse, Mental Health and Genetic Information.

Psychotherapy notes are notes by a mental health professional that document or analyze the contents of a conversation during a private counseling session – or during a group, joint, or family counseling session.  If these notes are maintained separately from the rest of your medical records, psychotherapy notes may not be used or disclosed without your written authorization, except in some very specific circumstances such as if required by law or in a public health emergency.

1. Our responsibilities to you regarding your health information

Healthcare organizations are required by law to (1) maintain the privacy of your health information; (2) provide you with an additional copy of the Notice of Privacy Practices upon request; (3) abide by the terms of the current Notice; and (4) communicate any changes to the Notice to you.

We reserve the right to change this Notice of Privacy Practices at any time in the future. We reserve the right to make the revised or changed notice effective for health information we already have about you as well as any information we receive in the future.

You may request a copy of the Notice of Privacy Practices by asking for one at your next visit to our organization or via our website at

A copy of the current Notice is available at certain designated registration areas throughout our hospitals, outpatient facilities, and other programs.

2. How we may use and share information about you

This Notice is followed by WVUH, UHA, WVU, and each of their affiliates.  This includes the medical staff; employed healthcare professionals, including physicians, nurses, other employees; trainees and students; volunteers; and business associates. WVUH, UHA, WVU, and each of their affiliates use electronic record systems to more efficiently and safely coordinate your care across many individuals and locations.  Physical and technical safeguards are used to protect the information in these systems, and we also use policies and training to restrict the use of your health information to only those who need it to do their job.

Hospitals, outpatient facilities, physicians, and other caregivers, programs, and services may share your health information with each other for treatment, payment, and healthcare operations purposes.  We describe the general ways that we can use and share your information below.  We cannot list all uses, but have given examples under each general category.

Examples of Using Health Information for Treatment, Payment and Healthcare Operations

We will use and disclose your health information for treatment purposes at WVUH, UHA, WVU, and each of their affiliates.

For example, a doctor treating you for a broken leg may need to know if you have diabetes because diabetes may slow the healing process.  In addition, the doctor may need to tell the dietitian if you have diabetes so we can arrange for appropriate meals.  Different departments of our organization also may share protected health information about you in order to coordinate the different things you need, such as prescriptions, lab work, and x-rays.

We may provide access to your protected health information and disclose your health information to doctors and other medical providers outside of our organization who are involved in your medical care and to other persons with whom our organization has made arrangements to provide healthcare services to you.

For example, your family doctor/primary care physician may want to be informed of your admission to our hospital, the treatment that you received while you were a patient at our facilities, and the result of your treatment so that (s)he may provide the appropriate follow-up care after you are discharged.  These persons may add information to your medical record based on the care they provide.

We will use and disclose your health information for payment purposes.

For example, a bill may be sent to you or to a third party payer or insurance company. The information on the bill may include information that identifies you, as well as your diagnosis, procedures, and supplies used for your care.  We may disclose health information about you to other qualified parties for their payment purposes.  For example, if you are brought in by ambulance, we may disclose your health information to the ambulance company for its billing purposes.

We will use and disclose your health information for healthcare operations.

For example, members of the medical staff, risk management, or quality improvement management may use information in your health record to assess the care and outcomes in your case and others like it.  This information is used in efforts to continually improve the quality and effectiveness of healthcare we provide. In some cases, we will furnish your health information to other qualified parties for their healthcare operations, or for other activities such as audits, investigations, oversight or staff performance reviews, training of students, licensing, and conducting or arranging for other healthcare-related activities.

Teaching Activities

Because we are a teaching institution, we may also disclose information to doctors, nurses, technicians, students, other healthcare personnel, and other hospital or clinic personnel for research studies and learning purposes. We will remove information that identifies you from this set of medical information so others may use it to study medical care and medical care delivery without learning who you are.

Health Information Exchange

We may make your protected health information available electronically through a state, regional, or national information exchange service to other healthcare providers, health plans, and healthcare clearinghouses that request your information for treatment or payment for that treatment.  Participation in health information exchange services also provides that we may see information about you from other participants.

A patient’s participation in a Health Information Exchange (HIE) is voluntary and subject to a patient’s right to opt-out.  Where possible, the patient may be provided with educational information prior to the enrollment of the participating organization.   More information on any HIE in which our organization participates can be found at our website,

3. Other uses and disclosures of your heath information


We may use or disclose health information regarding your location and general medical condition to notify or assist in notifying a family member, personal representative, or another person responsible for your care.

Communication with Family Members, Friends, and Others Involved in Your Care or Responsible for Payment for Your Care

We may share information with a family member, friend, or other person involved in your care or responsible for payment for your care.  We may only disclose the information if you agree, if you are given the opportunity to object and do not, or if, in our professional judgment, it would be in your best interest to allow the person to receive the information or act on your behalf.

Appointment Reminders

We may contact you as a reminder that you have an appointment for treatment or medical care.

Treatment Alternatives

We may contact you about treatment alternatives or other healthcare-related benefits and services that may be of interest to you.

Facility Directory

Unless you notify us that you object, or we are otherwise prohibited by law, we may use your name, location in our facility, general condition (e.g., fair, stable), and religious affiliation for facility directory purposes.  This information may be provided to members of the clergy and, except for religious affiliation, to other people who ask for you by name.

Business Associates

There are some services that we and our affiliates provide through contracts with business associates who are performing work on our behalf.  When these services are contracted, we may disclose the minimum amount of your health information necessary to our business associates so that they can perform such services.  Business associates and their subcontractors are also required to appropriately safeguard your information.


We may use demographic information about you, including information about your age, date of birth and gender, home address, phone number, type of insurance you have, and limited clinical information including dates you received treatment, department and physician that provided you with services, and outcomes information to contact you through mailings, telephone calls or personal visits in an effort to raise money for clinical programs, research, and education.

The West Virginia University Foundation (WVU Foundation) is responsible for fundraising for the West Virginia University Hospitals, West Virginia University Children’s Hospital, Mary Babb Randolph Cancer Center, the Eye Institute and the West Virginia University schools and programs at the Robert C. Byrd Health Sciences Center. Money raised by the WVU Foundation is used to expand and improve services and programs we provide to the community.

If you choose not to have the WVU Foundation contact you for fundraising purposes, you may opt out of any future telephone calls, mailings or personal visits by making your request to WVU Foundation at P.O. Box 9008, Morgantown, WV 26506-9008 or by calling 304-293-7086/877-766-4438 toll free, or via email to


We will not use or disclose your protected health information for marketing communications that are intended to promote purchase or use of a third party’s products or services until we obtain your written authorization. We do not provide or sell your protected health information to any outside marketing firms or agencies without your authorization.


Research is conducted under strict Institutional Review Board (IRB) guidelines designed to protect the subjects of research. Health information about you may be disclosed to researchers preparing to conduct a research project. For example, it may be necessary for researchers to look for patients with specific medical characteristics or treatments. We may combine conditioned and unconditioned authorizations for research, but we will always explain the difference. We will obtain your authorization prior to using your health information in research studies if information that directly identifies you is disclosed.

The only exception would be granted under rare circumstances when the IRB is permitted by federal regulations to grant a waiver of authorization.

We will ask for your specific permission if the research involves treatment. If you are asked for such permission, you have the right to refuse.

Public Health

We may disclose health information about you for public health activities. These activities may include:

  • disclosures to a public health authority authorized by law to collect or receive information for the purpose of preventing or controlling disease, injury, or disability;
  • reporting events such as births and deaths;
  • notifying people of recalls of products they may be using;
  • notifying appropriate authorities authorized to receive reports of abuse, neglect, or domestic violence;
  • reporting to FDA-regulated entities for purposes of monitoring or reporting the quality, safety, or effectiveness of FDA-regulated products; or
  • notifying a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition.

Workers Compensation

We may disclose health information to the extent authorized and necessary to comply with laws relating to workers’ compensation or other similar programs established by law.

Military and Veterans

If you are a member of the armed forces, we may share your health information with the military as authorized or required by law.

Law Enforcement

We may disclose health information if asked to do so by a law enforcement official as required or permitted by law. Following are examples:

  • identifying or locating a suspect, fugitive, material witness, or missing person;
  • in response to a court order, subpoena, warrant, summons, or similar process;
  • about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person’s agreement;
  • about a death we believe may be the result of criminal conduct;
  • involving criminal conduct at the hospital; and
  • in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.

Health Oversight Activities

We may disclose your health information to health oversight agencies during the course of audits, investigations, inspections, licensure, and other proceedings required by the government to monitor the healthcare system, government programs, and compliance with civil rights laws.

Legal Proceedings

If you are involved in a lawsuit or a dispute, we may disclose your health information in response to a court or administrative order. We may also disclose your health information in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.

As Required by Law

We will use or disclose your health information as required by federal, state, or local law.

By law, we must make disclosures to you and, when required, to the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of the Health Insurance Portability and Accountability Act of 1996 and subsequent regulations.

We may share your information with

  • Coroners, medical examiners, and funeral directors so they can carry out their duties;
  • Federal officials for national security and intelligence activities;
  • Federal officials who provide protective services for the President and others such as foreign heads of state, or to conduct special investigations;
  • A correctional institution if you are an inmate;
  • A law enforcement official if you are under the custody of the police or other law enforcement official.

Incidental Uses and Disclosures

There are certain incidental uses or disclosures of your health information that occur while we are providing services to you or conducting our business. For example, after surgery, the nurse or physician may need to use your name to identify family members that may be waiting for you in a waiting area. Others may hear your name called.  We will make reasonable efforts to limit these incidental uses and disclosures.

Change of Ownership

In the event that West Virginia University Hospitals, University Health Associates, and/or West Virginia University and its healthcare components is sold or merged with another organization, your medical information/record will become the property of the new owner.

4. Your rights regarding your health information

You have the following rights regarding your health information

For more information about these rights or to request copies, amendments, or restrictions of your records, contact the WVU Hospitals Health Information Management Department, P.O. Box 8049, Morgantown, WV 26506-8049 or call 304-598-4109.

Notification of Breach

You have the right to be notified when your PHI has been disclosed to or accessed by a person who was not authorized to receive the information. We will notify you of any breach of your protected information within 60 days of our becoming aware of the breach.

Right to Inspect and Copy Your Records

You may request to look at your medical and billing records and obtain a copy. Your health information is contained in a designated record set for as long as we maintain the health information. A “designated record set” contains medical and billing records and any other records that your healthcare provider or hospital use for making treatment decisions about you, except for psychotherapy notes.

If you request a copy of your records, we may charge you a copying fee plus postage. If you request a copy of your electronic health records, you have the right to request your copy in electronic format if it is feasible for the Hospital to do so. If you wish other parties to receive copies of your records, you must designate the individual(s) by signing an authorization or submitting a signed request, including information regarding the designated recipient and where to send the copy.

Right to Request Amendment

You may request that your health information be amended if you feel that the information is not correct.  Your request must be in writing and provide rationale for the amendment. We will consider your request and will make amendments based on the medical opinion of the healthcare provider who originated the entry.  However, if the healthcare provider believes the entry should not be amended, we are not required to make the amendment. We will inform you about the denial and how you can disagree with the denial.

Right to Request Restrictions

You may request restrictions on how your health information is used for treatment, payment, or healthcare operations, or to certain family members, or others who are involved in your care. We may deny your request with one exception as listed below. If we agree to a restriction, the restriction may be lifted if use of the information is necessary to provide emergency treatment.

To request a restriction, you must send a written request to the Health Information Department, specifying what information you wish to restrict, to whom the restriction applies, and an expiration date. You will receive a written response to your request.

If the healthcare provider believes it is in your best interest to permit use and disclosure of your health information, then it will not be restricted. If your healthcare provider does agree to the requested restriction, we may not use or disclose your health information in violation of that restriction unless it is needed to provide emergency treatment. With this in mind, please discuss any restriction you wish to request with your healthcare provider.

Exception: We must approve your request for restriction to your health insurer if you have paid out-of-pocket in full for all expenses for a particular item or service.

To request a restriction to your health insurer, you must make arrangements with your healthcare provider’s financial counselor prior to service being rendered.

Right to Request and Receive Private Communications

You may request that we communicate with you in a certain way in a certain location. For example, you can ask that we only contact you at work or by mail. You must make your request in writing to the Health Information Management Department and explain how or where you wish to be contacted.

Right to an Accounting of Disclosures

You may request an accounting of certain disclosures of your health information showing with whom your health information has been shared (This does not apply to disclosures to you, disclosures made with your authorization; disclosures for treatment, payment, or healthcare operations; and disclosures in certain other cases).

To request an accounting of disclosures, contact the Health Information Management Department, as indicated above.

Right to Receive a Paper Copy of this Notice

You may request an additional paper copy of this Notice at any time from any patient registration area.  You may also obtain a copy of this Notice on our website at You may request to receive an electronic copy of this Notice via email.

5. Other uses of your health information

We will not use or share your health information for reasons other than those described above without your written consent. You may revoke the approval, in writing, at any time, but we cannot take back any health information that has already been shared with your approval.

A verbal authorization is sufficient to disclose proof of immunization to a school where state law requires such information prior to admitting the student.

6. For more information or to report a problem

If you have questions or would like additional information, you may contact the WVU Hospitals Chief Privacy Officer at 304-598-4109 or West Virginia University at 304-293-7286.

If you believe your privacy rights have been violated, you may file a complaint with the Office for Civil Rights. We will provide you with the address to file your complaint with OCR upon request. Information may also be found at OCR’s web site at

We support your right to protect the privacy of your medical information. You will not be treated differently or penalized for filing a complaint. We will not retaliate in any way if you choose to file a complaint with us or with the Office for Civil Rights.

Effective Date:  September 23, 2013

Click to download a PDF version of this document.