HIPAA

PGxHealth LLC
Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE REVIEW IT CAREFULLY.

Effective October 29, 2007

Background
PGxHealth is committed to maintaining the privacy of your protected health information (“PHI”) that is provided to us.  PHI is health information that can individually identify you.  We are required by law to maintain the privacy of your PHI.  This document specifies our privacy policy and practices, including how we use and/or disclose your PHI.  This Notice describes our efforts to maintain your trust by developing and adhering to these standards for patient privacy and confidentiality.  We are required to abide by the terms of this Notice of Privacy Practices.  We reserve the right to change this notice at any time.  The current Notice will be displayed on our website, as well as available in hard copy upon request.

Your Protected Health Information
In order to provide you with laboratory services, we receive health information from your healthcare provider or another laboratory that asked us to test your sample.  We are committed to protecting the privacy of information we gather about you while providing you with laboratory services.  Some examples of protected health information are:

• information about your laboratory test results;
• information about your health condition; or
• information about the payment for your laboratory tests;

when combined with:

• demographic information (such as your name, address, or insurance status);
• unique numbers that may identify you (such as your Social Security Number, telephone number or driver’s license number); or
• other types of information that may identify who you are.

How We May Use and Disclose Your Protected Health Information
We may use or disclose your protected health information for treatment, payment, or healthcare operations purposes, as well as other purposes required or permitted by law, as described in this Notice below.  We will obtain your written authorization before using or disclosing your PHI for any other purpose.Except as otherwise permitted or required, we do not use or disclose your PHI without your written authorization and then we use or disclose it only in a manner consistent with the terms of that authorization.  You may revoke the authorization to use or disclose any PHI at any time, by writing to the contact person listed in this Notice, except to the extent that we have already relied upon it or taken action to do what you asked us to do.

Special Protections for Certain Types of Protected Health Information
Many state laws afford special privacy protections to some types of health information, including genetic information, HIV test information, alcohol and substance abuse treatment information, and mental health information.  Some parts of this general Notice of Privacy Practices may not apply to these types of information, including the laboratory results of any genetic tests that we offer. 

Uses and Disclosures for Treatment, Payment and Healthcare Operations
We are permitted to receive, use, and disclose your PHI without obtaining your authorization for treatment, payment, and healthcare operations purposes.  The majority of our routine uses and disclosures of your PHI fall into one of these categories, each of which is explained below.

Treatment:  We may use and disclose your PHI for treatment purposes.  For example, when we receive a request to conduct laboratory services requested by your healthcare provider or a referring laboratory, it contains your name, age, and other identifiable health information.  However, the disclosure of this information to us for conducting such services is considered to be part of your treatment, as is our disclosure of the laboratory results to the referring laboratory or healthcare provider, and therefore is permitted without your authorization.

Payment:  We may use and disclose your health information for payment purposes without your authorization.  For example, we may send your health information to health plans, other payers or to a billing service to file claims for reimbursement.  In some cases, we may contact you directly to obtain information related to billing.

Healthcare operations:  We may use or disclose your health information as necessary for our healthcare operations without your authorization.  For example, we may use or disclose PHI to assure quality, accreditation and certification, licensing, or credentialing activities, and for administration purposes.

Other Uses and Disclosures When an Authorization is Not Required
There are other circumstances where we may use or disclose PHI without your authorization.

As required by law:  We may disclose your PHI when we are required to do so by federal, state, or local law.  For example, we may disclose your PHI to the Secretary of the United States Department of Health and Human Services upon request.

For public health activities:  We may disclose your PHI to public health or legal authorities and other entities charged with preventing or controlling disease, injury, or disability.  For example, we may share your PHI with government officials that are responsible for controlling disease, injury, or disability.

For health oversight activities:  We may disclose your PHI to a health oversight agency for activities authorized by law, including audits, investigations, inspections, and licensure.  For example, we may disclose your PHI to the government agencies that monitor the operation of the health care system or oversee government benefit programs such as Medicare and Medicaid.

Workers compensation:  We may disclose your PHI to the extent authorized by, and necessary to comply with, laws relating to workers compensation or other similar programs established by law.

Correctional institutions:  If you are an inmate of a correctional institution, we may disclose your PHI to a correctional institution or a law enforcement official who has lawful custody over you, as long as the disclosure is necessary: (i) for the institution to provide you with health care; (ii) to protect your health and safety or the health and safety of others; or (iii) for the safety and security of the correctional institution.

For judicial and administrative proceedings:  We may disclose your PHI to courts or administrative agencies in response to a court or administrative order.  We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process, but only if we are satisfied that you have been given notice of the request and have not objected, or the party seeking the information has obtained a qualified protective order.

For law enforcement purposes:  We may disclose your PHI for certain law enforcement purposes including to comply with a court order, subpoena, warrant, summons, or other process; to identify or locate a suspect, fugitive, or material witness; to comply with requests for information pertaining to a victim of a crime in certain limited circumstances; to report crimes on the premises; or in emergency circumstances to report a crime, the location of the crime or the identity of the person who committed the crime.

Incidental to an otherwise permissible or required use or disclosure:  While we will take reasonable steps to safeguard the privacy of your health information, certain disclosures of your PHI may occur during or as an unavoidable consequence of an otherwise permitted or required use or disclosure.

Disclosures to Business Associates.  We may disclose your health information to our contractors, agents and other business associates who need the information in order to assist us with obtaining payment or carrying out our business operations.  For example, we may share your health information with a billing company that helps us to obtain payment from your insurance company, or with a law firm or accounting firm that provides professional advice to us about how to improve our health care services and comply with the law.  If we do disclose your health information to a business associate, we will have a written contract to ensure that our business associate also protects the privacy of your health information.

Your Rights With Respect to Your Protected Health Information
Under federal law, you have certain rights with respect to your PHI.  PGxHealth does not, as a matter of practice, deal directly with patients.  We generally receive your health information from your healthcare provider or another clinical laboratory.  There may be unique circumstances in which we respond directly to patients, but these circumstances are limited.  For example, we might contact you with regard to a question about billing or to discuss your insurance information.

In our provision of laboratory tests, we must also abide by state laws restricting our ability to disclose laboratory test results.  For example, Connecticut, where one of the laboratories performing our tests is located, requires that we disclose laboratory test results to the referring physician who ordered the test, and permits us to disclose these test results to other treating physicians who are authorized under law to order the test and to lay persons but only upon the specific written request of the referring physician.  Because of these restrictions, and to the extent possible and appropriate, you should contact your healthcare provider to exercise the rights listed in this Notice.  We will try to accommodate requests from healthcare providers, if legally permissible, and clinically appropriate to respond to your exercise of these rights, which include:

Right to Inspect and Copy Protected Health Information:  Under federal law, you have the right to request a copy of your PHI that is contained in a designated record set (that is, a group of records that includes PHI and contains medical and billing records or is used to make decisions about individuals).  In certain situation, however, you may not be allowed to inspect or copy your PHI.  For example, the Clinical Laboratory Improvement Amendments (“CLIA”) only permit authorized persons, as defined by state law, to receive clinical laboratory test records and results.  As a result, we cannot disclose your clinical laboratory test results directly to you to the extent you are not an authorized person under state law to receive the results.  You may ask your healthcare provider for a copy of your test results.  If you request other PHI maintained in a designated record set and to which we are required to provide access, we may provide a summary of such information and will inform you in advance of any charges associated with such summary.  Under certain circumstances, we may deny your request to inspect or obtain a copy of your information. 

Right to Receive Protected Health Information via Confidential Communications:  You have the right to request that you receive PHI by alternate means or at alternate locations.  Since this information is generally directed to you from your healthcare provider, you should make such request of your provider. 

Right to Receive This Notice of Privacy Practices:  You can request and receive a free copy of this Notice of Privacy Practices in printed or electronic form by writing or calling the contact person listed in this Notice.

Right to Request Restrictions on Use or Disclosure:  You can request restrictions on certain uses and disclosures of your PHI, however, we are not required to agree with the request.  If we do agree, we will not violate that restriction except in certain emergency situations.  You may ask your healthcare provider to request that PGxHealth restrict the disclosure of your test results.

Right to Amend Protected Health Information:  You can request that we amend your PHI or your clinical record.  We can deny the request for amendment under certain circumstances, such as when we reasonably believe your clinical record is accurate and complete.  If we do deny your request to amend, we will explain the reason to you.  You also may ask your healthcare provider to request that PGxHealth amend your PHI.

Right to Receive an Accounting of Disclosures of Protected Health Information:  You have the right to receive a written accounting of certain of our disclosures of your PHI for the past six years.  This accounting of disclosures does not include disclosures for treatment, payment, or healthcare operations, for disclosures based on a signed authorization, disclosures made to you, or certain other disclosures.  You may ask your healthcare provider to request that PGxHealth provide an accounting of all such disclosures of your PHI.

How to Exercise Your Individual Rights.  If you would like to exercise any of the individual rights described in this Notice, please write to us, using the contact information below.  For most requests, we have a template request form that is available by contacting us at the number or address below.

We are committed to complying with the privacy practices described in this Notice of Privacy Practices.  If you believe that we have violated any of them, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services.  To file a complaint, please send a letter to the Privacy Official at the address listed in this notice.  We will not retaliate in any way if you file a complaint with us.

Amendments to this Notice of Privacy Practices
We can revise or amend this Notice of Privacy Practices at any time and make the revisions effective for all PHI we receive and maintain, including any we created or received before the effective date of the revision or amendment.  We will post any revised Notice of Privacy Practices on our website:  http://www.pgxhealth.com.

Access to Our Notice of Privacy Practices
You may request a copy of our current Notice of Privacy Practices, by writing to the privacy official at the address listed in this notice.  You may also obtain a current copy from our website:  http://www.pgxhealth.com.

Contacting Us Regarding our Privacy Practices
If you have any questions about our privacy practices or your PHI, please contact us.  Send questions, requests, or complaints to:

PGxHealth LLC
Attn: Privacy Official
5 Science Park
New Haven, CT 06511

Phone 877-274-9432
Fax 203-786-3418

Complaints
If you believe your privacy rights have been violated, you may file a complaint with the U.S. Department of Health and Human Services (“DHHS”).  If you work in Connecticut and would like to file a complaint with DHHS, send your complaint to Office for Civil Rights, U.S. Department of Health & Human Services, JFK Federal Building - Room 1875, Boston, MA 02203, (617) 565-1340; (617) 565-1343 (TDD); (617) 565-3809 (FAX).  If you work in another location, check the website at www.hhs.gov/ocr/hipaa to determine where your complaint should be sent.  You must submit all complaints in writing.