NOTICE OF PRIVACY PRACTICES
LENCO DIAGNOSTIC LABORATORIES, INC. (“Lenco”)
Effective Date: June 1, 2018
THIS NOTICE DESCRIBES HOW MEDICAL AND HEALTHCARE INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY
If you have any questions about this notice, please contact our Privacy Officer (his/her contact information is set forth at the very end of this notice).
Terms used, but not defined, in this notice have the meanings set forth in the Federal HIPAA Law.
WHO WILL FOLLOW THIS NOTICE
In accordance with the HIPAA law, this notice describes Lenco’s privacy practices and that of:
All of these follow the terms of this notice. In addition, they may share medical information with each other for treatment, payment or health care operations, and any other purposes described in this notice and/or allowed by applicable law.
OUR PRIVACY OBLIGATIONS REGARDING MEDICAL INFORMATION
Lenco understands that medical information about you and your health is personal, and Lenco is committed to protecting medical information about you and keeping it private. Lenco creates a record regarding your information as well as information regarding your diagnosis, treatment and services you receive from Lenco. Lenco needs this record to provide you with quality care and to comply with certain legal requirements. This notice applies to all of the medical information “protected health information” or “PHI” which Lenco creates or receives, whether made by Lenco personnel or received from another health care provider. Medical information includes information that can be used to identify you that is created or received about your past, present, or future health or condition, the provision of healthcare to you, or the payment for the health care. We are required by law to protect the privacy of this information. Be aware, however, that your other health care providers may have different policies or notices regarding their use and sharing of your medical information that they create or maintain.
This notice will tell you about the ways in which Lenco may use and share your medical information. This notice also describes your rights and certain obligations Lenco has regarding the use and sharing of medical information.
Lenco is required by law to:
HOW WE MAY USE AND SHARE YOUR MEDICAL INFORMATION
The following categories describe different ways that we are permitted to use and disclose/share your medical information. For the most typical uses and disclosures we make, we will explain what we mean and try to give some examples. Not every specific use or disclosure or type of use/disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories. In many of the instances briefly described below, we will additionally have to meet conditions before we can use or share your information for the purposes described. Any other uses and disclosures not described in this notice or otherwise not permitted by law without an authorization will not be made without your authorization.
To the extent that State law prohibits a disclosure under certain circumstances, we will abide by the State law unless otherwise trumped by Federal law.
DISCLOSURE OF TEST RESULTS
If we communicate your results to you in writing (by mail or electronically), know that, unless otherwise required by law:
HIGHLY SENSITIVE INFORMATION: SPECIAL AUTHORIZATION MAY BE REQUIRED
In some circumstances, your health information may be subject to restrictions that may limit or preclude some uses or disclosures described in this notice.
Our records received from third party providers or prepared by us may contain information regarding your mental health, substance abuse, sexually transmitted diseases, psychotherapy, HIV/AIDS, genetic information or other types of highly sensitive/protected information. Information of these types are typically protected by additional restrictions under state law, which we will comply with as applicable.
Government health benefit programs, such as state Medicaid programs, may also limit the sharing of beneficiary information for purposes unrelated to the program.
DISCLOSURES THAT GENERALLY REQUIRE HIPAA AUTHORIZATION (MARKETING AND SALE)
Under the HIPAA law, there are some circumstances where we can only use and share medical information if you have signed a HIPAA authorization/given us written permission.
For example, your authorization is required for most uses and sharing of your medical information for “Marketing” purposes, including subsidized treatment communications, or for disclosures that constitute the “Sale” of medical information. Please be aware, however, that HIPAA’s definitions of “Marketing” and “Sales”, and the restrictions related thereto, are technical, include exceptions, and do not apply to all situations that you may personally consider to be marketing or sales. We are permitted to use and/or share medical information for marketing or sales purposes in accordance with HIPAA and State law, which in many, but not all, situations requires your authorization or consent to do so. If your authorization is not required, and HIPAA/State law allows for a use that you may personally consider to be a use or sharing for marketing/sales purposes, we may utilize your information for such purposes without your consent (examples include, but are not limited to, face-to-face communications to you about a product or service, to provide reminders, research purposes, and the sale, transfer, merger or consolidation of all or part of Lenco).
SHARING AT YOUR REQUEST
We may disclose/share information when requested by you. This disclosure at your request may require a written authorization by you. Any authorizations that you give can be revoked at any time.
We may use and share medical information about you to provide you with testing and to share results with your ordering provider so that they may render medical treatment, healthcare, or other related services (including for care coordination purposes). Lenco may share medical information about you to doctors, nurses, assistants, technicians, health care students, or other personnel who are involved in testing, diagnosing or treating you. Lenco also may share medical information about you with people outside of Lenco who may be involved in your medical care, such as family members, facilities, and physicians or other practitioners. For example, an outside doctor treating you for a condition asks a Lenco representative about a particular test result, or we internally share medical information about you in order to coordinate the different things you need from us.
Additionally, we may share your medical information with physicians and other health care providers as a member of an Accountable Care Organization (“ACO”), Regional Health Information Organization (“RHIO”) or other Health Information Exchange (“HIE”). In some (but not all) cases, there may be an “opt out” right or other rights particular to an ACO, RHIO or HIE – please contact our Privacy Officer utilizing the information below (contact information is set forth at the very end of this notice) if you would like more information on “opt out” or other rights you may have, to the extent that we then-participate in these organizations.
We may use and share medical information about you so that the diagnosis, treatment and services you receive at or from Lenco may be billed to and payment may be collected from you, an insurance company, or a third party. Lenco may also share your medical information with another health care provider or payor of health care for the payment activities of that third pary. For example, we may need to give your health plan information about a test or diagnosis you received from us so your health plan will pay us or your provider or reimburse you for the test. We may also tell your health plan about a test you are going to receive to obtain prior approval, referrals, or to determine whether your plan will cover the testing. We may also provide basic information about you and your health plan, insurance company or other source of payment to practitioners outside Lenco who are involved in your care, to assist them in obtaining payment for services they provide to you. Lenco may also need to use and share your medical information in various appeals processes to defend the necessity of services offered in the past, and to pursue collections actions for services which we have rendered to you.
If you do not want us to share medical information about you with your health plan, you have the right to pay for all services and care out of pocket in full, and to inform us that you wish to restrict the information shared with your health plan. For more information on this limited restriction, see your rights listed below.
FOR HEALTH CARE OPERATIONS
Lenco may use and share your medical information for health care operations. These uses and disclosures are necessary to run Lenco and make sure that all of our patients receive competent, quality health care testing and result reporting, and to maintain and improve the quality of health care testing that Lenco provides. Lenco may additionally provide your medical information to various governmental or accreditation entities to maintain any license(s), permit(s) and/or accreditations we may have. For example, Lenco may use medical information to review our treatment and services and to evaluate the performance of our staff. Lenco may also combine medical information about many Lenco patients to decide what additional services Lenco should offer.
INCIDENTAL USES AND DISCLOSURES
We may occasionally inadvertently use or share your medical information when such use or disclosure is incident to another use or disclosure that is permitted or required by law. Please be assured, however, that as much as possible, Lenco has appropriate safeguards in place in an effort to avoid such situations or to otherwise limit the extent of the disclosure.
LIMITED DATA SETS
We are permitted to use or share certain parts of your medical information, called a “limited data set,” for purposes of research, public health reasons or for our health care operations, subject to certain conditions.
Lenco may use or share your medical information to create information that does not identify you in accordance with HIPAA. Once Lenco has de-identified your information, it can be used or shared in any way according to law.
CERTAIN DISCLOSURES BY MEMBERS OF WORKFORCE
In certain circumstances, members of Lenco’s workforce are permitted or even required to share your medical information with a health oversight agency, public health authority, law enforcement official, or health care accreditation organization or attorney hired by the workforce member.
SHARING WITHIN ORGANIZED HEALTH CARE ARRANGEMENT
We may share medical information with covered entities participating in any organized health care arrangement in which we participate, as necessary to carry out treatment, payment, or health care operations relating to the organized health care arrangement.
HEALTH-RELATED PRODUCTS AND SERVICES
So long as done in compliance with the HIPAA marketing/sale of PHI rules, we may use and share medical information to tell you about health-related products or services that may be of interest to you. If you do not wish us to contact you regarding health related-products and services, you must notify us in writing and state that you wish to be excluded from this activity.
TO INDIVIDUALS INVOLVED IN YOUR CARE OR PAYMENT FOR YOUR CARE (AND YOUR OPPORTUNITY TO OBJECT)
We may in certain circumstances release medical information about you to a friend or family member who is involved in your medical care, though you can object in whole or in part. We may also give information to someone who helps pay for your care.
Under certain circumstances, we are permitted to use and share medical information about you for research purposes. In some situations, your authorization is required in connection with research uses and disclosures.
TO COMPLY WITH THE LAW
We will share medical information about you when required to do so by federal, state or local law, including with the U.S. Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
TO AVERT A SERIOUS THREAT TO HEALTH OR SAFETY
We may in certain circumstances, and only if allowed by State law, use and share medical information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
THIRD PARTIES/BUSINESS ASSOCIATES
We may share your medical information to third parties (sometimes called Business Associates) with whom Lenco has contact to perform services on Lenco’s behalf. If we share your information with these entities, we will have a written agreement with them to safeguard your information.
WORKERS’ COMPENSATION; LAW ENFORCEMENT; OTHER GOVERNMENT REQUESTS
We may use or share medical information about you in certain circumstances for: (i) workers’ compensation or similar programs; (ii) law enforcement purposes or with law enforcement officials in certain circumstances; and (iii) special government functions such as military, national security, intelligence and protective services.
PUBLIC HEALTH AND SAFETY ISSUES
We may share medical information about you for certain public health and safety purposes, including, without limitation, the following: (i) preventing/controlling disease and its spread; (ii) to notify you regarding product recalls; (iii) to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and (iv) to notify emergency response personnel regarding possible exposure to HIV/AIDS, to the extent necessary to comply with State and federal laws.
HEALTH OVERSIGHT ACTIVITIES
We may share medical information with a health oversight agency for activities authorized by law.
LAWSUITS AND ADMINISTRATIVE PROCEEDINGS
In certain circumstances, we may share medical information about you in the course of judicial or administrative proceedings in response to a court or administrative order, or a subpoena, discovery request, or other lawful process.
CORONERS, MEDICAL EXAMINERS AND FUNERAL DIRECTORS
We may release medical information to a coroner, medical examiner, or funeral director when an individual dies.
YOUR RIGHTS REGARDING MEDICAL INFORMATION
In addition to any rights that you may have under State law, you have the following HIPAA rights regarding medical information that Lenco maintains about you.
GET AN ELECTRONIC OR PAPER COPY OF YOUR TEST RESULTS
You have the right to inspect and copy medical information that may be used to make decisions about your care.
To inspect and copy medical information, you must submit your request in writing to our Privacy Officer or his/her designee (contact information is set forth at the very end of this notice). If Lenco uses or maintains your medical information in an electronic health record (or to the extent that we maintain the information in an electronic form), you have the right to obtain an electronic copy of such information. When information is not readily producible in the electronic form and format you have requested, we will provide you the information in an alternative readable electronic format as we may mutually agree upon, only as readily possible. Furthermore, you have the right to direct Lenco to transmit such electronic copy directly to another entity or person that you designate. If you request a copy of the information, Lenco may charge a fee for the costs of copying and/or transmission. Lenco will follow State law with regard to approved copying and other associated costs.
We are advising you in this notice that if you request that information available in an electronic format be provided via email, that email is an unsecure medium for transmitting information and that there is some risk if medical information is emailed. Information transmitted via email is more likely to be intercepted by unauthorized third parties than more secure transmission channels. If we agree to email you information, you are accepting the risks we have notified you of, and you agree that we are not responsible for unauthorized access of such medical information while it is in transmission to you based on your request, or when the information is delivered to you.
AMEND YOUR MEDICAL INFORMATION
If you feel that your medical information is incorrect or incomplete, you have the right to request an amendment of the information for as long as the information is kept by or for Lenco. To request an amendment, your request must be made in writing and submitted to our Privacy Officer (contact information is set forth at the very end of this notice). We may deny your request for an amendment for a number of legally permissible reasons, but we will tell you why in writing within 60 days, and also give you the right to submit a written statement of disagreement with our decision. If you clearly indicate in writing that you want the statement of disagreement to be made part of your medical record, Lenco will attach it to your records and include it whenever Lenco makes a disclosure of the item or statement you believe to be incomplete or incorrect.
RECEIVE AN ACCOUNTING OF DISCLOSURES
You have the right to request an “accounting of disclosures.” This is a list of the disclosures Lenco made of medical information about you other than our own uses for diagnosis, treatment, payment and health care operations (as those functions are described above), and certain other disclosures. If, however, Lenco is using an electronic health record, Lenco will also account for treatment, payment and health care operations made using the electronic health record to the extent required by law.
To request this list or accounting of disclosures, you must submit your request in writing to our Privacy Officer (contact information is set forth at the very end of this notice). Your request must state a time period which may not be longer than six (6) years prior to the date you ask. Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a 12-month period will be free. For additional lists within a 12-month period, Lenco may charge you a reasonable, cost-based fee for providing the list.
REQUEST RESTRICTIONS ON WHAT WE USE OR SHARE
You have the right to request a restriction or limitation on the use and/or disclosure of your medical information in connection with treatment, payment or heath care operations. You also have the right to request a limit on the medical information Lenco shares about you to someone who is involved in your care or the payment for your care, like a family member or friend. Lenco is generally NOT, however, required to agree to your restriction request.
In one narrow instance, however, we are required to agree to the request, if all of the following apply: (i) you have requested that we restrict disclosure for payment or healthcare operations purposes; (ii) the disclosure would be made to a health plan/insurer (e.g., we are not precluded from making other allowable disclosures; only disclosures to the health plan/insurer); (iii) the disclosure is not otherwise required by law; and (iv) the medical information restricted pertains solely to a healthcare item or service for which you, or someone on your behalf, have paid us in full (excluding payments made by the health plan on your behalf) (i.e., you may not restrict the entirety of your record from being shared with a health plan/insurer – you may only restrict the portions of your record for those items or services which have been paid in full). You are hereby advised that, even if you utilize this required restriction request and meet the criteria set forth above, the required restriction is narrow. In particular, even if you have requested and received a required restriction, we may still share your information with others for other allowable purposes, such as your ordering physician. In the event that we make such allowable disclosures, the party to which we have permissibly shared the information with is not bound by the required restriction request that you made to us, and we are not obligated to relay your request to such party. The only way for you to guarantee that such third parties do not then share said information with your insurer/health plan is for you to make a required restriction request with the third party that meets all of the required restriction elements set forth above. We hereby advise you to do so if you desire. Note also that to the extent that you seek follow-up or other testing from us, and it is necessary for us to include previously restricted PHI when billing your insurer/ health plan for the follow-up treatment (e.g., you have not fully paid out-of-pocket for the service and requested a required restriction), we may share such previously restricted information, but only to the extent that including such PHI is required to support medical necessity of the follow-up testing and you do not request a new required restriction/pay out-of-pocket in full for the follow-up care.
If Lenco does agree to comply with non-required requests, Lenco will comply with your request unless (a) the information is needed to provide you emergency treatment, or (b) other legal exceptions apply.
To request restrictions, you must make your request in writing to our Privacy Officer (contact information is set forth at the very end of this notice). Lenco will not ask you the reason for your request. Lenco will attempt to accommodate all reasonable requests.
REQUEST CONFIDENTIAL COMMUNICATIONS
You have the right to request that Lenco communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that Lenco only contact you at work or by mail. Lenco will not ask you the reason for your request. We will say “yes” to all reasonable requests. To request confidential communications, you must make your request in writing to our Privacy Officer (contact information is set forth at the very end of this notice).
PAPER COPY OF THIS NOTICE
You have the right to a paper copy of this notice at any time, even if you have agreed to receive this notice electronically.
You may also obtain a copy of this notice at our website:
BE NOTIFIED IN THE EVENT OF A “BREACH OF UNSECURED PHI”
If, in any case, medical information is used or disclosed in violation of the law, we are required to notify you if the use/disclosure is a “Breach of Unsecured Protected Health Information” (as such terms are defined by the Federal HIPAA Law). We may also be required to notify you pursuant to any State law that may be applicable.
FILE A COMPLAINT IF YOU FEEL YOUR RIGHTS ARE VIOLATED
If you believe your privacy rights have been violated, you may file a complaint with Lenco or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with Lenco, contact our Privacy Officer in writing (contact information is set forth at the very end of this notice). We respectfully request that complaints be submitted in writing. You will not be penalized or retaliated against for filing a complaint.
CHANGES TO THE TERMS OF THIS NOTICE
Lenco reserves the right to change this notice and our privacy or security policies at any time, and the changes will apply to all information we already have about you. Lenco will post a copy of the current/changed notice on our website. The notice will contain the effective date and will be available upon request.
OTHER USES OF MEDICAL INFORMATION/PERMISSIONS/AUTHORIZATIONS
Other uses and disclosures of medical information not covered by this notice or the laws that apply to Lenco will be made only with your written permission/authorization. If you provide us permission to use or share medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, this will stop any further use or disclosure of your medical information for the purposes covered by your written authorization, except if Lenco has already acted in reliance on your permission. You understand that Lenco is unable to take back any disclosures Lenco has already made with your permission, and that Lenco is required to retain Lenco’s records of the testing that Lenco provided to you.
PRIVACY OFFICER CONTACT INFORMATION
If you have any questions about this notice, please contact our Privacy Officer utilizing the contact information set forth below.
Certain provisions of this notice and our related policies and procedures require that notice or other requests be in writing. Please follow our instructions for any such issue.
PRIVACY OFFICER CONTACT INFORMATION