HIPAA Notice of Privacy Practices

Your Information. Your Rights. Our Responsibilities.

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Effective date: October 21, 2026
Xylis Healthcare Services LLC, 2121 Eisenhower Ave, Alexandria, VA 22314
Privacy contact: Privacy Officer, Xylis Healthcare Services LLC, 2121 Eisenhower Ave, Alexandria, VA 22314, (240) 639-2059, xylishealthcare@outlook.com

This notice applies to the residential support services Xylis provides to individuals with developmental disabilities in Virginia. It also explains how Virginia law and the Virginia Department of Behavioral Health and Developmental Services (DBHDS) human rights regulations add protections for your information. For your other rights as a person receiving services, see Individual Rights & Complaints below.

Your Rights

When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you. If you have an authorized representative or legal guardian, that person may use these rights for you.

Get an electronic or paper copy of your record

You can ask to see or get an electronic or paper copy of your services record and other health information we have about you. Ask us how to do this.
We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee as allowed by federal and Virginia law.
We will help you read and understand your record, and ask for changes to it, at no charge.
In rare cases, Virginia law allows a physician or clinical psychologist to limit access if seeing the record would be reasonably likely to endanger your life or physical safety or another person’s. If this happens, we will tell you in writing, notify the human rights advocate, and explain how you can have the decision reviewed. You can also ask that a lawyer of your choice see the record.

Ask us to correct your record

You can ask us to correct or explain health information about you that you think is incorrect or incomplete. Ask us how to do this.
We may say “no” to your request, but we’ll tell you why in writing within 60 days. You may then send us a statement of disagreement, which we will keep with your record.

Request confidential communications

You can ask us to contact you in a specific way (for example, home or cell phone) or to send mail to a different address.
We will say “yes” to all reasonable requests.

Ask us to limit what we use or share

You can ask us not to use or share certain health information for treatment, payment or our operations. We are not required to agree, and we may say “no” if it could affect your care. If we agree, we may still share the information if you need emergency treatment.
If you pay for a service in full out of pocket, you can ask us not to share that information with your health plan for payment or our operations. We will say “yes” unless a law requires us to share it.

Get a list of those with whom we’ve shared information

You can ask for a list (accounting) of the times we’ve shared your health information for six years before the date you ask, who we shared it with, and why.
We will include all disclosures except those for treatment, payment and health care operations, and certain others (such as any you asked us to make). We’ll provide one accounting a year for free but may charge a reasonable, cost-based fee if you ask for another within 12 months.

Get a copy of this notice

You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically. We will give you a paper copy promptly.

Choose someone to act for you

If someone is your legal guardian, holds your medical power of attorney or is otherwise your authorized representative, that person can use your rights and make choices about your health information.
We will make sure the person has this authority before we take any action.

File a complaint if you feel your rights are violated

You can complain to us if you feel we have violated your rights. Contact the Privacy Officer, Xylis Healthcare Services LLC, 2121 Eisenhower Ave, Alexandria, VA 22314, at (240) 639-2059 or xylishealthcare@outlook.com.
You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/hipaa/filing-a-complaint.
You can also make a human rights complaint under Virginia’s DBHDS human rights regulations. See Individual Rights & Complaints below.
We will not retaliate against you for filing a complaint.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and the choice to tell us to:

Share information with your family, close friends or others involved in your care or payment for your care
Share information in a disaster relief situation

If you are not able to tell us your preference, for example in an emergency, we may share information that is directly relevant to that person’s involvement in your care if we believe it is in your best interest. We may also share information when needed to lessen a serious and imminent threat to health or safety.

In these cases we never share your information unless you give us written permission:

Marketing purposes
Sale of your information
Most sharing of psychotherapy notes

Our Uses and Disclosures

How do we typically use or share your health information?

Treat you. We can use your health information and share it with other professionals who are providing services to you. Example: We share information with your doctor about a change in your health.

Run our organization. We can use and share your health information to run our organization, improve your services and contact you when necessary. Example: We use information about you to develop and carry out your individual support plan.

Bill for your services. We can use and share your health information to bill and get payment from health plans or other entities, such as Virginia Medicaid (DMAS) and its managed care organizations. Example: We give information about you to Virginia Medicaid so it will pay for your services.

Coordinate your services. As allowed by Virginia’s DBHDS human rights regulations, we can share information needed to provide or get payment for your services with other providers, health plans, DBHDS, and your Community Services Board (CSB), including your support coordinator.

How else can we use or share your health information?

We are allowed or required to share your information in other ways, usually in ways that contribute to the public good, such as public health and safety. We have to meet many conditions in the law before we can share your information for these purposes.

Help with public health and safety issues, such as preventing disease, reporting adverse reactions to medications, reporting suspected abuse, neglect or exploitation as required by Virginia law, and preventing or reducing a serious threat to anyone’s health or safety.
Do research, only with your written consent or as otherwise permitted by federal and Virginia law.
Comply with the law, including sharing information with the U.S. Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
Health oversight and human rights, including DBHDS licensing and human rights staff, local and state human rights committees, and Virginia Medicaid, for oversight activities authorized by law.
Respond to organ and tissue donation requests, and work with a medical examiner or funeral director when an individual dies.
Address workers’ compensation, law enforcement and other government requests, as permitted by law, including for special government functions.
Respond to lawsuits and legal actions, such as in response to a court order or a properly issued subpoena, as allowed by Virginia law.

Virginia law gives you extra protection

Virginia law and the DBHDS human rights regulations generally require your written authorization (or your authorized representative’s) before we share information that identifies you, unless a specific state or federal law or regulation permits or requires the disclosure. When a disclosure is not required by law, we will strongly consider any objection you raise. When we share your information, we will tell the recipient that it may not be shared further without your authorization unless the law allows it.

Substance use disorder records

Xylis is not a federally assisted substance use disorder treatment program. If we ever receive substance use disorder treatment records about you that are protected by federal law (42 CFR Part 2), we will not use or share those records in civil, criminal, administrative or legislative investigations or proceedings against you without (1) your written consent or (2) a court order and a subpoena.

Our Responsibilities

We are required by law to maintain the privacy and security of your protected health information.
We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
We must follow the duties and privacy practices described in this notice and give you a copy of it.
We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

For more information, see HHS: Notice of Privacy Practices.

Changes to the Terms of This Notice

We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, at our office and on our website.

Questions

Privacy Officer
Xylis Healthcare Services LLC, 2121 Eisenhower Ave, Alexandria, VA 22314
Phone: (240) 639-2059 · Email: xylishealthcare@outlook.com

Individual Rights & Complaints

Virginia law (Va. Code § 37.2-400) and the DBHDS human rights regulations (12VAC35-115) protect the rights of people who receive developmental disability services. Xylis honors these rights for every person we support. They include the right to:

Keep your legal rights under state and federal law
Be treated with dignity and be free from abuse, neglect and exploitation
Receive services in the least restrictive way that fits your needs
Take part in developing your individualized services plan
Have your records kept confidential, and see and ask to correct your records
Send and receive sealed mail
Not be part of experimental research without your informed written consent
Have a person of your choice told about your general condition, location and any transfer
Have an impartial review of any violation of your rights, and access to a lawyer

When you begin services, we will give you and your authorized representative a written notice of your rights and how to make a complaint, explain it in the way that is easiest for you to understand, and give a complete copy of the regulations to anyone who asks.

How to make a complaint

If you think Xylis has violated your rights, you or anyone acting for you can make a complaint. You can complain to Xylis, to a DBHDS human rights advocate, or both. Under the DBHDS regulations:

The director or the director’s designee will contact you within 24 hours of receiving your complaint.
You can get help from a human rights advocate at any time.
You will be protected from retaliation and harm for making a complaint.
You will receive a written decision and action plan within 10 working days.
If you disagree with the decision, you can appeal to the Local Human Rights Committee (LHRC). We will tell you in writing how to do this.
You can also contact the protection and advocacy agency or use any other legal remedy.

Who to contact

Xylis Healthcare Services: our Director or their designee, (240) 639-2059, xylishealthcare@outlook.com
Your human rights advocate: Contact the DBHDS Office of Human Rights at 804-887-7405. You may also ask us at any time for the name and contact information of your assigned human rights advocate.
DBHDS Office of Human Rights: 804-887-7405 (DBHDS Office of Human Rights). Regional contacts are listed on the DBHDS Human Rights Manager contact map.
Local Human Rights Committee: You may appeal a decision to the Local Human Rights Committee affiliated with Xylis. We will give you its contact information and explain the appeal process in writing.
disAbility Law Center of Virginia (Virginia’s protection and advocacy agency): 1-800-552-3962 (toll-free), dlcv.org