NOTICE OF PRIVACY PRACTICES
 

Forensic Medical Services of Central Virginia (FMS)
 

Effective Date: October 28, 2026
 

Your Information. Your Rights. Our Responsibilities.
 

This notice describes how medical information about you may be used and disclosed, and how you can access this information. Please review it carefully.
 

Our Commitment to Your Privacy
 

Forensic Medical Services of Central Virginia (FMS) is committed to protecting the privacy, dignity, and safety of every patient.
 

We recognize that individuals seeking forensic medical services may share highly sensitive information about sexual assault, domestic violence, strangulation, human trafficking, child abuse, elder abuse, or other forms of interpersonal violence.
 

We respect your right to make informed decisions about your care and will explain how your medical information and forensic evidence may be used or disclosed.
 

This notice describes your rights under the Health Insurance Portability and Accountability Act (HIPAA), our legal responsibilities, and the circumstances in which we may use or disclose your protected health information (PHI).
 

1. Your Rights
 

You have the following rights regarding your protected health information.
 

Access Your Medical Records
 

You may request an electronic or paper copy of your medical records and other health information we maintain about you.
 

We generally will provide a copy or summary within 30 days of your request, subject to applicable legal exceptions and extensions. We may charge a reasonable, cost-based fee as permitted by law.
 

Certain information, including information compiled in reasonable anticipation of or for use in legal proceedings, may be excluded from the HIPAA right of access.
 

Request Corrections
 

You may request that we correct information in your medical record that you believe is inaccurate or incomplete.
 

We may deny a request under certain circumstances but will provide a written explanation, generally within 60 days.
 

Request Confidential Communications
 

You may ask us to communicate with you using a particular telephone number, mailing address, email address, or other method.
 

We will accommodate reasonable requests.
 

We recognize that communication safety maybe especially important for individuals experiencing interpersonal violence.
 

Request Restrictions
 

You may request restrictions on certain uses or disclosures of your health information for treatment, payment, or healthcare operations.
 

We are not generally required to agree to every requested restriction.
 

If you pay in full out of pocket for a healthcare service, you may request that we not disclose information about that service to your health plan for payment or healthcare operations, unless disclosure is required by law.
 

Receive an Accounting of Disclosures
 

You may request an accounting of certain disclosures of your protected health information made during the preceding six years, subject to applicable exclusions.
 

Obtain a Copy of This Notice
 

You may request a paper copy of this notice at any time, even if you previously agreed to receive it electronically.
 

Designate a Personal Representative
 

A person legally authorized to act on your behalf may exercise your privacy rights, subject to applicable legal limitations.
 

We may decline to recognize a personal representative in certain circumstances involving suspected abuse, neglect, domestic violence, or endangerment, as permitted by law.
 

File a Privacy Complaint
 

You may file a complaint with FMS or the U.S. Department of Health and Human Services if you believe your privacy rights have been violated.
 

FMS will not retaliate against you for filing a complaint.
 

2. Your Choices
 

In certain situations, you may tell us whether and how to share your information.
 

These situations may include sharing information with family members, friends, or others involved in your care, or assisting with disaster-relief activities.
 

If you are unable to communicate your preferences, we may use professional judgment and applicable law to determine whether disclosure is appropriate.
 

We generally must obtain your written authorization before using or disclosing your information for purposes that require authorization under HIPAA, including most marketing activities, sale of protected health information, and most uses or disclosures of psychotherapy notes.
 

You may revoke a written authorization at any time by notifying us in writing. Revocation does not affect disclosures already made in reliance on your authorization.
 

3. How We May Use and Disclose Your Information
 

Treatment
 

We may use or disclose your health information to provide, coordinate, or manage your medical care.
 

This may include communicating with other healthcare professionals, laboratories, specialists, or facilities involved in your treatment.
 

Payment
 

We may use or disclose information necessary to obtain payment for services.
 

Depending on the circumstances, payment may involve applicable insurance coverage, Virginia's Sexual Assault Forensic Examination (SAFE) program, other state funding programs, or authorized third-party payors.
 

Healthcare Operations
 

We may use or disclose information for legitimate healthcare operations, including quality improvement, compliance, administrative activities, staff training, and management of clinical services.
 

Business Associates
 

We may share protected health information with contracted service providers who perform functions on our behalf when permitted by HIPAA and subject to required privacy and security agreements.
 

Public Health and Safety
 

We may disclose information for legally authorized public health activities, including certain disease reporting, preventing or controlling disease, and addressing serious threats to health or safety.
 

Health Oversight Activities
 

We may disclose information to authorized oversight agencies for legally permitted audits, investigations, inspections, licensing, and regulatory activities.
 

Judicial and Administrative Proceedings
 

We may disclose information in response to court orders, subpoenas, discovery requests, or other lawful processes when the applicable HIPAA and legal requirements have been satisfied.
 

A subpoena does not automatically authorize unrestricted disclosure of a patient's medical record.
 

Law Enforcement
 

We may disclose protected health information to law enforcement when authorized by the patient or when required or permitted by applicable law.
 

The scope of any disclosure will depend on the circumstances and applicable legal requirements.
 

Other Permitted Disclosures
 

HIPAA also permits certain disclosures under specific circumstances, including workers' compensation, medical examiner and coroner functions, certain research activities, and other legally authorized purposes.
 

We will comply with applicable conditions and limitations governing these disclosures.
 

4. Privacy During Forensic Medical Examinations
 

Forensic medical examinations may involve medical assessment, injury documentation, specialized photography, evidence collection, laboratory testing, and discussion of the circumstances surrounding an injury or assault.
 

FMS recognizes that medical records, forensic photographs, and physical evidence may contain highly sensitive information.
 

These materials are handled according to applicable privacy laws, patient authorizations, forensic procedures, and evidence-handling requirements.
 

Reported Examinations
 

When a patient chooses to report an assault or other incident to law enforcement, physical forensic evidence may be transferred to the investigating law enforcement agency.
 

With appropriate patient authorization, examination documentation and forensic photographs may also be released to the investigating agency.
 

Authorization for the release of forensic evidence and documentation is addressed during the examination consent process.
 

Information may also be disclosed without authorization when required or otherwise permitted by applicable law.
 

Anonymous Examinations
 

Eligible patients may choose to have forensic evidence collected and preserved without immediately reporting the incident to law enforcement.
 

For anonymous sexual assault examinations, physical evidence is transferred to Virginia's designated evidence storage agency according to applicable procedures.
 

FMS does not routinely release examination documentation or forensic photographs from anonymous examinations to law enforcement without authorization from the patient or their legally authorized representative, unless disclosure is required or otherwise permitted by law.
 

If a patient later chooses to report the incident, FMS ordinarily obtains an additional authorization before releasing previously withheld examination documentation and photographs.
 

Medical Records and Forensic Photographs
 

Medical records and forensic photographs are maintained as part of FMS's clinical documentation.
 

FMS does not routinely release these materials to law enforcement solely because an examination was performed.
 

Disclosure may occur with appropriate patient authorization or when required or permitted by applicable law.
 

Requests involving subpoenas, court orders, or other legal processes are reviewed according to applicable legal requirements.
 

Laboratory Testing
 

FMS contracts with University of Virginia laboratory services for clinical laboratory testing.

The laboratory may bill applicable insurance programs or the Virginia SAFE program independently, as appropriate.
 

FMS receives laboratory results for inclusion in the patient's medical record.
 

Laboratory results may be shared for treatment, payment, healthcare operations, or other purposes when authorized or permitted by law.
 

Evidence Handling and Chain of Custody
 

Physical forensic evidence is collected, documented, and transferred using procedures intended to preserve its integrity and maintain appropriate chain of custody.
 

When physical evidence must be temporarily retained by FMS, its handling, storage, and transfer will be documented through chain-of-custody records.
 

Patient Choice
 

Patients are informed about the purpose of evidence collection, available reporting options, and applicable confidentiality limitations.
 

Patients may decline individual components of evidence collection.
 

Receiving a forensic medical examination does not automatically require participation in a criminal investigation.
 

However, certain circumstances may requirereporting or disclosure under applicable law.
 

5. Mandatory Reporting and Limits of Confidentiality
 

FMS respects patient confidentiality and autonomy. However, confidentiality is not absolute.

Federal and Virginia laws require or permit certain disclosures without patient authorization.
 

Child Abuse and Neglect
 

Healthcare professionals are required to report suspected child abuse or neglect when the applicable legal reporting threshold is met.
 

HIPAA permits disclosures to authorities legally authorized to receive child abuse or neglect reports.
 

These disclosures do not require patient or parental authorization when permitted or required by law.
 

Additional information may be disclosed during authorized investigations when the applicable legal requirements are satisfied.
 

The obligation to report suspected child abuse or neglect does not automatically authorize unrestricted disclosure of every medical record or forensic photograph.
 

Abuse, Neglect, or Exploitation of Vulnerable Adults
 

Virginia law requires reporting of suspected abuse, neglect, or exploitation of adults covered by applicable Adult Protective Services laws.
 

HIPAA permits disclosures to legally authorized protective-services agencies or other government authorities under specified circumstances, including disclosures required by law.

Such disclosures are limited by applicable legal requirements.
 

Domestic Violence and Sexual Assault
 

For competent adult patients, experiencing domestic violence or sexual assault does not automatically require a report to law enforcement.
 

Patients may have options for forensic examination and evidence preservation without immediately participating in a criminal investigation.
 

However, certain injuries, circumstances, or other legal requirements may trigger mandatory reporting obligations.
 

Certain Injuries and Threats to Safety
 

FMS may be required to report certain wounds or injuries under Virginia law.
 

Information may also be disclosed when necessary to prevent or lessen a serious and imminent threat to health or safety, when the applicable legal requirements are met.
 

Notification of Reporting
 

When appropriate and legally permissible, FMS will explain reporting obligations and confidentiality limitations to patients.
 

In certain circumstances, informing a patient or personal representative about a disclosure may be delayed or withheld when permitted by law to protect safety.
 

6. Privacy Rights of Minors
 

The privacy rights of minors depend on their age, the type of medical care provided, applicable consent laws, and the circumstances of the examination.
 

Parents or legal guardians may have authority to make certain healthcare decisions and access certain medical information.
 

However, Virginia and federal laws recognize exceptions to parental access and disclosure in specific circumstances.
 

FMS evaluates consent, confidentiality, and disclosure requirements individually.
 

We may limit a personal representative's access or authority when permitted by law, including circumstances involving suspected abuse, neglect, or endangerment.
 

7. Substance Use Disorder Records
 

Certain substance use disorder treatment records receive additional confidentiality protections under federal law, including 42 CFR Part 2.
 

When FMS creates, receives, or maintains records subject to Part 2, those records will be handled according to applicable federal requirements.
 

Part 2 records may be used or disclosed for treatment, payment, and healthcare operations in accordance with applicable consent and disclosure rules.
 

Part 2 records generally may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against a patient without the patient's specific written consent or a qualifying court order accompanied by the required legal process.
 

Other restrictions may apply to redisclosure, fundraising communications, and uses of these records.
 

When more protective federal or state confidentiality requirements apply, FMS will follow those requirements.
 

8. Our Responsibilities
 

FMS is required by law to:
 

• Maintain the privacy and security of protected health information.

• Provide individuals with notice of our legal duties and privacy practices.

• Follow the terms of the Notice of Privacy Practices currently in effect.

• Notify affected individuals following a breach of unsecured protected health information when required by law.

• Obtain written authorization for uses or disclosures that require authorization.

• Comply with applicable federal and Virginia privacy requirements.
   

We reserve the right to change the terms of this notice and make revised provisions effective for all protected health information we maintain, including information created or received before the revision.
 

Revised notices will be available at our clinic, upon request, and on our website.
 

9. Questions, Requests, and Privacy Complaints
 

If you have questions about this notice, wish to exercise your privacy rights, or believe your privacy rights have been violated, please contact:
 

Matthew Johnson
HIPAA Privacy Officer
Forensic Medical Services of Central Virginia
1584 Tanbark Dr
Afton, VA 22920
Phone: 434-269-1100
 

You may also file a complaint with:
 

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, SW
Washington, DC 20201
Phone: 1-877-696-6775
Website: https://www.hhs.gov/hipaa/filing-a-complaint/
 

FMS will not retaliate against anyone for exercising their privacy rights or filing a privacy complaint.
 

Effective Date: October 28, 2026
 

Forensic Medical Services of Central Virginia
 

This notice applies to protected health information maintained by FMS in its capacity as a HIPAA-covered healthcare provider.