HIPAA privacy information
Notice of Privacy Practices
Effective August 25, 2026
This notice describes how medical information about you may be used and disclosed, and how you can get access to it. Please review it carefully. It applies to protected health information maintained by WheelHouse Health, LLC.
Your rights
You may ask to inspect or receive an electronic or paper copy of your medical record and other health information we maintain about you. You may ask us to correct information you believe is inaccurate or incomplete; we may deny the request in some circumstances and will explain why in writing.
- Ask us to contact you in a specific way or at a specific location.
- Ask us to limit what we use or share for treatment, payment, or operations. We are not always required to agree, except for certain disclosures to a health plan when you paid in full out of pocket and the law permits the restriction.
- Request a list of certain disclosures made during the period allowed by law.
- Receive a paper copy of this notice, choose a personal representative, and file a privacy complaint without retaliation.
Your choices
When the law permits, you may tell us your preferences about sharing information with family, friends, or others involved in your care and for disaster-relief efforts. If you cannot tell us your preference, we may share information when we determine it is in your best interest and consistent with law.
We will obtain written authorization for uses and disclosures that require it, including most marketing, sale of protected health information, and most uses or disclosures of psychotherapy notes. You may revoke an authorization in writing, except to the extent we already relied on it.
How we use and share information
We may use and disclose protected health information to provide and coordinate treatment, operate the practice, and obtain payment. Examples include communicating with another clinician involved in your care, improving quality and safety, scheduling, billing, and eligibility or payment activities.
We may also use or disclose information when permitted or required for public health and safety, health oversight, workers’ compensation, organ and tissue donation, medical examiner or funeral director duties, law enforcement, judicial or administrative proceedings, and compliance with other laws. Additional legal protections may apply to substance-use-disorder, mental-health, genetic, reproductive-health, and other sensitive records.
Records protected by 42 CFR Part 2 will not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless authorized by your written consent or by a court order as permitted by law. If another law provides greater privacy protection, we follow that law.
Our responsibilities
We are required by law to maintain the privacy and security of protected health information, give you this notice of our legal duties and privacy practices, and notify affected individuals following a breach of unsecured protected health information when required. We will follow the notice currently in effect.
We may change this notice and make the revised terms effective for all information we maintain. The current version will be available on this website and from the practice on request.
Complaints and contact
Ask questions, request a copy, exercise a privacy right, or file a complaint with the WheelHouse Health Privacy Contact:
WheelHouse Health, LLC
Lake Ridge, VA 22192
(571) 402-2102
admin@wheelhh.com
You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.
Current signed clinical, consent, payment, and membership documents control where they address a specific service or plan. Contact the practice before relying on a website summary for an enrollment or care decision.
Health-information rights and practices
Notice of Privacy Practices
This page explains the elements expected in a healthcare provider’s Notice of Privacy Practices. A formally adopted WheelHouse Health notice identifies the covered practice, effective date, privacy contact, actual uses and disclosures, patient rights, and complaint process. It is separate from the Website Privacy Policy and does not replace consent or authorization.
Use the contents list to move directly to the question or decision that matters to you.
Read this first
This notice must describe the real practice before it takes effect
A Notice of Privacy Practices is not created simply by placing model language on a website. WheelHouse Health must first determine and document whether it is a HIPAA covered healthcare provider, identify the legal entity or entities covered by the notice, map actual uses and disclosures, designate the responsible privacy contact, complete required operational procedures, and formally adopt the approved text. The published notice must state an effective date.
Once adopted, the notice applies to protected health information maintained by the covered practice and operations identified in it. It should explain the legal duties and privacy practices that are actually followed. It does not govern every independent laboratory, pharmacy, hospital, specialist, insurer, portal provider, or other organization; those entities may provide their own notices. Applicable business-associate relationships and WheelHouse Health’s own responsibilities must still be addressed accurately.
- Confirm the correct legal entity name.
- Confirm covered-entity status and the practices covered.
- Insert the formally approved effective date.
- Publish a complete, monitored privacy contact and written-request method.
Use the formally adopted notice, not a general website summary, for the effective date, covered legal entity, privacy contact, mailing details, and approved rights-request workflow. Do not send records or identification to ordinary email.
Your rights
You may ask to inspect or receive a copy of your health information
You may ask to inspect or receive an electronic or paper copy of medical records and other health information about you that WheelHouse Health maintains in the record set covered by applicable law. The approved notice and request procedure should explain how to submit the request, verify identity, choose a format, identify where the copy should be sent, and ask for an accessible form. Do not send identity documents or clinical records to ordinary email unless the privacy office specifically approves that method.
WheelHouse Health generally must respond within the time required by applicable law. A reasonable, cost-based fee may apply in circumstances permitted by law, and the practice should explain the fee before fulfilling a chargeable request. Some information may be excluded or access may be denied in limited circumstances. When review rights apply, the response should explain how to request review of the denial.
A patient may ask for a paper copy of the current Notice of Privacy Practices even if the notice was provided electronically. A personal representative may exercise rights when legally authorized, subject to identity and authority verification and exceptions allowed by law.
Your rights
You may request correction, confidential communication, and certain restrictions
If you believe health information maintained by WheelHouse Health is incorrect or incomplete, you may ask the practice to amend it. The request process should identify the information and explain the requested change. WheelHouse Health may deny a request in circumstances allowed by law, such as when it did not create the information or determines that the record is accurate and complete. A denial should be explained in writing, with any applicable right to submit a statement of disagreement.
You may ask WheelHouse Health to contact you in a specific way or at a specific location, such as using a particular telephone number or mailing address. The practice should accommodate reasonable requests as required by law. A preference applies after it is received and implemented; it cannot undo a message already sent. Keep your contact information and communication preferences current through the approved process.
You may ask WheelHouse Health to limit certain uses or disclosures for treatment, payment, or healthcare operations. The practice is not always required to agree. One important exception may require the practice to honor a request not to disclose information about an item or service to a health plan when you paid for that item or service in full out of pocket and other legal conditions are met. The privacy office should explain the process before the restriction is relied upon.
Your rights
You may request an accounting, a notice copy, representation, or a complaint process
You may ask for a list, called an accounting, of certain disclosures of your protected health information made during the period allowed by law. The accounting does not include every disclosure; for example, disclosures for treatment, payment, and healthcare operations are commonly excluded under the HIPAA accounting rule. The privacy office should explain the covered period, exclusions, response timing, and any permitted fee for repeated requests.
You may complain to WheelHouse Health if you believe your privacy rights were violated. You may also complain to the U.S. Department of Health and Human Services Office for Civil Rights. WheelHouse Health will not retaliate against you for filing a complaint or exercising a privacy right. The adopted notice names the designated privacy contact and provides a working method for questions and complaints. An administrative inbox is not a substitute for that monitored privacy process.
Your choices
Some uses require your written authorization or a specific opportunity to agree or object
For certain uses and disclosures, WheelHouse Health must obtain your written authorization unless an exception applies. An authorization should identify the information, purpose, recipient, expiration, and other elements required by law. You may revoke an authorization in writing as permitted, but revocation does not undo action already taken in reliance on it. An authorization is different from consent to treatment, telehealth consent, an acknowledgment that you received this notice, or a request for confidential communication.
HIPAA generally requires authorization for most uses and disclosures of psychotherapy notes, most marketing uses involving protected health information, and the sale of protected health information, subject to defined exceptions. The practice must confirm which categories it actually maintains and which activities it performs before describing them. Do not add a broad marketing permission to a clinical intake or treat silence as consent.
In some situations, you may have an opportunity to agree or object, such as sharing relevant information with family, friends, or others involved in your care or payment. When you cannot express a preference, the practice may use professional judgment and applicable law to decide whether a limited disclosure is in your best interest. The final notice should describe the choices that match actual practice without promising absolute secrecy or unlimited family access.
How information may be used and shared
Treatment, payment, and healthcare operations support care and practice functions
When permitted by law, WheelHouse Health may use or disclose protected health information for treatment. Examples can include providing care, coordinating with another clinician, sending an order, reviewing a result, or sharing information needed for referral or continuity. The exact disclosure should be limited and appropriate to the purpose. A patient may still ask about confidential communication or restrictions, understanding that the practice is not always required to agree.
Payment activities may include determining eligibility or coverage, billing, collecting payment, supporting claims or reimbursement when applicable, and communicating with a person responsible for payment as permitted. WheelHouse Health’s public offer describes direct-pay and membership services, but outside laboratories, pharmacies, specialists, or facilities may have separate billing and insurance practices. The adopted notice reflects the transactions the practice actually performs.
Healthcare operations may include quality assessment, patient safety, credentialing, training, legal and compliance work, auditing, business planning, customer service, and administration. Information should not be used for an unrelated advertising profile merely because “operations” appears broad. Business associates that perform covered functions for WheelHouse Health must be identified and managed under applicable requirements.
How information may be used and shared
Law permits or requires disclosures in defined situations
WheelHouse Health may use or disclose protected health information when a law requires it and may make disclosures allowed by law for defined public-interest purposes. Depending on the facts and the practice’s activities, these can include public health reporting, preventing or reducing a serious threat to health or safety, health oversight, responding to abuse or neglect requirements, workers’ compensation, organ or tissue donation, and duties involving a medical examiner, coroner, or funeral director.
Other legally permitted disclosures may involve law enforcement, correctional institutions, judicial or administrative proceedings, subpoenas or court orders, specialized government functions, or research that meets applicable requirements. Each category has conditions; it is not permission to share a complete record whenever someone asks. WheelHouse Health should verify the requester’s authority, document the basis, apply required limitations, and consult counsel when appropriate.
The final notice should include only categories required by the HIPAA notice rules and explain them accurately in readable language. It must also account for Virginia law and other federal rules that may provide greater protection. Public-health or legal reporting should not be described as a routine business use, and a patient should be able to ask the privacy office how a category applies.
Additional protection
Some information is protected by stricter federal or Virginia rules
HIPAA is not the only privacy law that may apply. Virginia health-record law and federal or state rules may provide additional protection for certain information or people. Depending on the practice and records involved, this can include substance-use-disorder records, psychotherapy notes, reproductive-health information, genetic information, communicable-disease information, minor-consent services, or other sensitive categories. The correct rule depends on the record, source, purpose, recipient, and current law.
Some substance-use-disorder records may be subject to 42 CFR Part 2 when the regulation applies to the program or record. Applicability depends on the source and circumstances, so a general website page does not promise that every record falls under Part 2. When it applies, current federal requirements and limitations on use in legal proceedings also matter.
Virginia Code § 32.1-127.1:03, current federal reproductive-health privacy requirements, minors’ rights, and rules for specialty records may add protection beyond HIPAA. The adopted notice and related procedures should explain the protections that match the records the practice actually creates or receives, and WheelHouse Health follows more protective law when it applies.
Our responsibilities
The covered practice must protect information and follow the notice in effect
If WheelHouse Health is a covered provider, it must maintain the privacy and security of protected health information as required by law, give you a notice of its legal duties and privacy practices, and follow the notice currently in effect. Safeguards and policies must match the actual systems, workforce, vendors, and risks. Publishing a notice does not prove that a portal, email account, or telehealth platform is configured correctly.
When required, WheelHouse Health must notify affected individuals following a breach of unsecured protected health information. The practice needs a documented incident-reporting, investigation, mitigation, notification, and vendor-coordination process. A public promise such as “completely secure” would be inaccurate and could discourage reporting. Patients and workforce members should have a clear way to report a suspected privacy or security concern without sending additional sensitive information unnecessarily.
WheelHouse Health may change an adopted notice and make revised terms effective for information it already maintains when law allows. The current version should be available on the website and by request, with its effective date. The practice should retain prior versions and approval records. A provider with a service website may have posting duties, and a direct-treatment provider may have delivery and good-faith acknowledgment duties; the intake process must support them.
Contact and complaints
The adopted notice provides a complete, tested privacy contact
The final adopted notice must identify the name or title and telephone number of the person or office that can provide more information about the notice. WheelHouse Health should also provide an approved written-request method and a complete mailing address when written requests are accepted there. “Lake Ridge, VA 22192” is not a complete mailing address and must not be presented as one.
The website lists (571) 402-2102 and admin@wheelhh.com for administrative questions. Do not use ordinary email to send a privacy-rights request, record, complaint details, or identity document. Use the privacy contact and secure request method stated in WheelHouse Health’s formally adopted notice, or call and ask how to reach that process without first describing the underlying health information.
You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. WheelHouse Health will not retaliate for filing a complaint or exercising a privacy right. The adopted notice explains how to obtain a paper copy, make each request, request an accommodation, and contact the designated person or office.
A privacy request may require identity verification and a secure submission method. Follow the contact and instructions in the formally adopted notice rather than placing records or identity documents in ordinary email.