HIPAA Notice of Privacy Practices

This Notice of Privacy Practices (“Notice”) describes how Victory Healthcare Services, LLC (“VHCS,” “we,” “us,” or “our”) may use and disclose your Protected Health Information (“PHI”) to carry out treatment, payment, and healthcare operations and for other purposes permitted or required by law. It also describes your rights regarding your PHI and how you may exercise those rights.

We are required by law to: (1) maintain the privacy of your PHI; (2) provide you with this Notice of our legal duties and privacy practices regarding PHI; (3) notify you following a breach of your unsecured PHI; and (4) abide by the terms of this Notice currently in effect.

 

1. What Is Protected Health Information (PHI)?

Protected Health Information means individually identifiable health information — including demographic data — that relates to: (a) your past, present, or future physical or mental health or condition; (b) the provision of health care to you; or (c) the past, present, or future payment for the provision of healthcare to you — and that identifies you or for which there is a reasonable basis to believe it could be used to identify you.

PHI includes information about your mental health diagnoses, treatment records, session notes (with applicable restrictions), medications, billing records, and any other health-related information maintained by VHCS.

 

2. Psychotherapy Notes — Special Protections

Maryland law and HIPAA provide additional protections for psychotherapy notes — the mental health professional’s private notes about your therapy sessions kept separate from your general medical record. We will obtain your separate written authorization before using or disclosing psychotherapy notes for any purpose other than the following limited exceptions:

• Training our mental health professionals
• Defending a legal action brought by you against us
• Required by law (e.g., mandatory reporting, court order)
• Health oversight of the mental health professional who created the notes
• Averting a serious and imminent threat to health or safety

 

3. How We May Use and Disclose Your PHI

3.1  Without Your Authorization

We may use or disclose your PHI without your written authorization for the following purposes:

A. Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and any related services. For example, we may disclose your PHI to your primary care physician, psychiatrist, case manager, or other treatment providers involved in your care.

B. Payment

We may use and disclose your PHI to obtain payment for services we provide to you. For example, we may submit billing information to your Medicaid plan or other insurer.

C. Healthcare Operations

We may use and disclose your PHI to carry out the healthcare operations of our practice, including:

• Quality improvement and performance assessment
• Staff training, supervision, and credentialing
• Reviewing the qualifications of treatment providers
• Conducting or arranging for audits and legal reviews
• Business management and general administrative activities

D. Mandatory Reporting — Maryland Law

Maryland law imposes specific mandatory reporting obligations on behavioral health providers. We are required to report without your consent in the following circumstances:

• Child abuse or neglect: Pursuant to Md. Code, Family Law § 5-704, we are mandatory reporters. We must immediately notify the Maryland Department of Human Services and law enforcement if we have reason to believe a child under 18 is or has been subjected to abuse or neglect.
• Vulnerable adult abuse or neglect: Under Md. Code, Family Law § 14-302, we must report suspected abuse, neglect, or exploitation of vulnerable adults.
• Duty to warn (Tarasoff obligation): If you communicate a credible, specific threat of imminent serious harm to an identifiable third party, Maryland law (Md. Code, Health-General § 4-307) may permit or require us to warn the intended victim and/or notify law enforcement.
• Court orders and subpoenas: We may be required to disclose PHI in response to a valid court order, warrant, or subpoena, subject to the protections afforded under applicable law.

E. Public Health Activities

We may disclose PHI to public health authorities authorized to collect information for the purpose of preventing or controlling disease, injury, or disability, including reporting communicable diseases as required by the Maryland Department of Health.

F. Health Oversight Activities

We may disclose PHI to government agencies authorized by law to conduct audits, investigations, inspections, and oversight activities related to the healthcare system — including the Maryland Behavioral Health Administration (BHA), the Maryland Board of Social Work Examiners, and the U.S. Department of Health and Human Services.

G. Law Enforcement

We may disclose limited PHI to law enforcement officials for specific law enforcement purposes as permitted by HIPAA and applicable Maryland law, such as to identify or locate a suspect, witness, or missing person, or to report certain types of wounds or injuries.

H. Judicial and Administrative Proceedings

We may disclose your PHI in response to a court or administrative order. We may also disclose PHI in response to a subpoena, discovery request, or other lawful process (subject to applicable privileges and protective orders).

I. Decedents

We may disclose PHI to a coroner, medical examiner, or funeral director as authorized by law.

J. Serious Threat to Health or Safety

We may use or disclose PHI to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with applicable law and ethical standards.

K. Workers’ Compensation

We may disclose PHI to the extent authorized by and necessary to comply with Maryland workers’ compensation laws.

L. Correctional Institutions

If you are in the custody of a correctional institution, we may disclose PHI necessary for your healthcare or for the health and safety of other inmates and staff.

3.2  Uses and Disclosures Requiring Your Written Authorization

Other uses and disclosures of your PHI not described above will be made only with your written authorization, including:

• Most disclosures of psychotherapy notes (see Section 2)
• Use or disclosure of PHI for marketing purposes
• Sale of your PHI
• Disclosure to family members, friends, or other persons you identify (unless you are incapacitated, emergency circumstances exist, or as otherwise provided by law)
• Any other use or disclosure not permitted by HIPAA or Maryland law without authorization

You may revoke any authorization you have given at any time by submitting a written request to our Privacy Officer. Revocation will be effective going forward but will not affect disclosures already made in reliance on the authorization.

 

4. Maryland-Specific Privacy Protections

Maryland law provides additional protections for certain categories of health information beyond those required by federal HIPAA. These include:

HIV/AIDS Information	Md. Code, Health-General §§ 18-336 et seq. — HIV test results and related information may only be disclosed with written authorization or as specifically required by law.
Alcohol & Drug Treatment Records	42 C.F.R. Part 2 (federal) and Md. Code, Health-General § 8-601 et seq. apply additional confidentiality protections to records related to substance use disorder treatment. These records may not be disclosed without your written consent except in limited circumstances.
Mental Health Records	Md. Code, Health-General §§ 4-301 through 4-310 govern the confidentiality of mental health records and provide specific rules regarding disclosure.
Genetic Information	Maryland Genetic Information Privacy Act, Md. Code, Health-General §§ 14-1301 et seq. — Genetic information may not be disclosed without specific written authorization.
Minor Consent	For certain services (substance use treatment, mental health services for minors 12+, STI treatment), Maryland law may permit minors to consent independently, which affects parental access rights. We will advise accordingly.

 

5. Your Rights Regarding Your Protected Health Information

5.1  Right to Access and Receive a Copy of Your PHI

You have the right to inspect and receive a copy of PHI maintained in a designated record set (which generally includes your treatment records and billing records). We may charge a reasonable cost-based fee for copies. We will provide access within 30 days of your request (or 60 days if the records are maintained off-site), with one 30-day extension if necessary.

Under Maryland Health-General § 4-304, patients generally have the right to inspect their own medical records, subject to limited exceptions where disclosure could cause serious harm.

5.2  Right to Request Amendment

If you believe PHI in your record is inaccurate or incomplete, you may request that we amend it. We may deny your request for specific reasons (e.g., the information was not created by us, or the record is accurate and complete). If we deny your request, you have the right to submit a written statement of disagreement.

5.3  Right to an Accounting of Disclosures

You may request a list (accounting) of certain disclosures we have made of your PHI in the prior six years. The accounting does not include disclosures for treatment, payment, or healthcare operations, or disclosures you authorized.

5.4  Right to Request Restrictions

You may request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to restrictions except in one circumstance: if you pay out-of-pocket in full for a service and request that we not disclose the information to your health plan, we must agree to that restriction.

5.5  Right to Request Confidential Communications

You may request that we communicate with you about PHI at an alternative location or by alternative means (e.g., by calling you only at a specific phone number or sending correspondence to a P.O. Box). We will accommodate reasonable requests.

5.6  Right to Be Notified of a Breach

If there is a breach of your unsecured PHI, we will notify you as required by the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400-414) and the Maryland Personal Information Protection Act.

5.7  Right to Receive a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you have received it electronically. Please contact our Privacy Officer to request a paper copy.

How to Exercise Your Rights

All requests must be made in writing and submitted to:

Privacy Officer	Victory Healthcare Services, LLC
Address	4925 Belair Rd., Baltimore, Maryland 21206
Phone	443-529-9099
Fax	410-617-8478
Email	inquiry@vhcsllc.com

 

6. Our Duties

We are required by law to:

• Maintain the privacy and security of your Protected Health Information
• Provide you with this Notice of our privacy practices
• Follow the terms of this Notice currently in effect
• Notify you if we are unable to agree to a requested restriction
• Accommodate reasonable requests to communicate PHI by alternative means or locations

We reserve the right to change our privacy practices and this Notice at any time, provided such changes are permitted by applicable law. Changes will apply to all PHI we maintain, including information created or received before the change. The revised Notice will be made available on our website, posted in our office, and provided to you upon request.

 

7. Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint with us or directly with:

U.S. Dept. of Health & Human Services — Office for Civil Rights	200 Independence Avenue SW, Washington, DC 20201 | Phone: 1-800-368-1019 | TTY: 1-800-537-7697 | Website: hhs.gov/ocr
Maryland Attorney General — Health Education & Advocacy Unit	200 St. Paul Place, Baltimore, MD 21202 | Phone: 410-528-1840 | Website: oag.state.md.us/Health

We will not retaliate against you for filing a complaint. You may also file a complaint with our Privacy Officer at the address above.