Health Information Privacy

Ask Aesthetica Medspa VA about medical-record privacy, applicable patient rights, and sharing sensitive information.

Last updated: October 26, 2026

About This Page

This page explains general health-information privacy rights and how to contact Aesthetica Medspa VA. It is not the practice’s complete clinical Notice of Privacy Practices. Ask the practice which notice and procedures apply to your care. HIPAA applies to covered entities; other federal and Virginia protections may also apply.

Website Forms and Sensitive Information

Use website forms for general consultation requests. Do not send medical records, insurance details, payment information, or identity documents. Call the practice to discuss an appropriate way to share sensitive information. The website Privacy Policy explains website data handling.

Medical Records and Your Rights

Where HIPAA applies, patient rights include:

Access to records: Request inspection or copies of medical, billing, and other records used to make decisions about you, subject to legal exceptions. Specify the information and preferred format. HIPAA generally requires action within 30 days; any permitted extension requires written notice. Copying charges must follow applicable law.
Corrections: Ask for an amendment if information is inaccurate or incomplete. A covered provider generally has 60 days to act, with a limited extension. A denial must explain the reason and how to submit a disagreement.
Confidential communications: Request a reasonable alternative way or place to receive communications, such as a different telephone number or mailing address.
Restrictions: Ask for limits on use or sharing. Not every request must be accepted. If you pay for a service out of pocket in full, a covered provider must honor a request to withhold the related information from your health plan for payment or operations unless disclosure is required by law.
Disclosure history: Request an accounting of certain disclosures from the preceding six years. Treatment, payment, operations, authorized disclosures, and other exceptions are excluded. The first accounting in a 12-month period is free.
Notice and representation: Request a paper privacy notice and use a legally authorized personal representative, subject to verification and applicable exceptions.

Contact the practice below to ask how to submit a request. Identity or authority verification may be necessary. Records, circumstances, and applicable law determine the available rights and review procedures.

How Health Information May Be Used

HIPAA permits covered providers to use or share information for treatment, payment, and health care operations, subject to applicable limits. Examples include coordinating care with another treating clinician, billing for services, and reviewing care quality.

Other disclosures may be permitted or required for public health, safety reporting, oversight, qualifying research, organ donation, death investigations, workers’ compensation, and specified legal or government purposes. Each category has conditions; a request for information does not automatically authorize release. Stronger privacy laws may restrict disclosure.

Your Choices and Authorization

You may express preferences about sharing relevant information with people involved in your care or payment. If you cannot make a choice, limited sharing may be permitted based on professional judgment and your best interests.

Written authorization is generally required for marketing involving protected information, sales of protected information, most sharing of separately maintained psychotherapy notes, and uses not otherwise permitted by law. Treatment consent is not permission to publish identifiable treatment photos. An authorization can generally be revoked in writing for future use; revocation does not undo actions already taken in reliance on it.

Additional Protections

Substance-use-disorder records covered by 42 CFR Part 2 have special safeguards. Use or disclosure of those records or related testimony in investigations or proceedings against a patient requires specific written consent or a qualifying court order together with a subpoena. This does not mean the practice operates a substance-use treatment program.

Covered providers must also explain applicable fundraising choices. If Part 2 records are used for fundraising, advance notice and a choice about receiving those communications are required. Virginia law may impose additional record protections.

Privacy Duties and Complaints

Covered providers must safeguard protected information, follow their applicable notice, and provide legally required notifications after a breach of unsecured protected health information. Website wording alone does not establish compliance.

Contact the practice with privacy questions, records requests, or concerns. You can also file a complaint with the HHS Office for Civil Rights about an alleged HIPAA or Part 2 violation. You do not need to complain to the practice first. HIPAA prohibits retaliation for exercising protected rights.

For further information, read HHS guidance on privacy notices.