HUDSONALPHA CLINICAL SERVICES LAB, LLC

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.  PLEASE REVIEW THIS NOTICE CAREFULLY.

HudsonAlpha Clinical Services Lab, LLC (“Lab”) is committed to protecting the privacy of your protected health information (“PHI”). This includes laboratory test orders and test results as well as invoices for the healthcare services we provide. As a reference laboratory and educational firm, Lab collects PHI about you and stores it electronically on a computer. This is your medical record. The medical record is the property of Lab, but the information in the medical record belongs to you.

Should you have any questions about this Notice or our privacy practices, please contact our Privacy Officer by email info@clinicallab.org, or you may write us at:

HudsonAlpha Clinical Services Lab, LLC, 601 Genome Way, Rm. 3023, Huntsville, AL 35806

Our Responsibilities

Lab is required by law to maintain the privacy of your PHI.  We are also required to provide you with this Notice upon request.   It describes our legal duties, privacy practices and your patient rights as determined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended from time to time. We follow the terms of this Notice.

How We May Use or Disclose Your Health Information

We use your PHI for treatment, payment, or healthcare operations purposes and for other purposes permitted or required by law. Not every use or disclosure is listed in this Notice, but all of our uses or disclosures of your PHI will fall into one of the categories listed below.

We need your written authorization to use or disclose your PHI for any purpose not covered by one of the categories below. Any authorization you provide may be revoked at any time. If you revoke your authorization, we will no longer use or disclose your PHI for the reasons stated in your authorization except to the extent we have already taken action based on your authorization.

The law permits us to use or disclose your PHI for the following purposes without your specific authorization:

Treatment

Lab provides laboratory testing for physicians and other healthcare professionals and we use your information in our testing process. We disclose your PHI to authorized healthcare professionals who order tests or need access to your test results for treatment purposes.

Payment

Lab will use your PHI as part of our billing process and may send it to insurance companies or other appropriate parties, including to you, to obtain payment for our services. If you are insured under another person’s health insurance policy (for example, parent, spouse, domestic partner or a former spouse), we may also send invoices to the subscriber whose policy covers your health services.

Healthcare Operations

Lab may use or disclose your PHI for activities necessary to support our healthcare operations, such as performing quality checks on our testing, internal audits, or developing reference ranges for our tests.

Disclosure to Relatives, Close Friends and Other Caregivers 

Your PHI may be disclosed to a family member, other relative, a close personal friend or any other person identified by you who is involved in your health care or helps pay for your care. If you are not present, or the opportunity to agree or object to a use or disclosure cannot practicably be provided because of your incapacity or an emergency circumstance, the Lab may exercise professional judgment to determine whether a disclosure is in your best interests. If information is disclosed to a family member, other relative or a close personal friend, the Lab would disclose only information believed to be directly relevant to the person’s involvement with your health care or payment related to your health care.

 Business Associates

We may provide your PHI to other companies or individuals to assist us in providing specific services requiring the use and disclosure of PHI. These other entities, known as “business associates,” are required to maintain the privacy and security of PHI. Our business associates must only use your PHI for the services they perform on our behalf. For example, we may provide information to companies that assist us with billing of our services. As of February 17, 2010, business associates have independent HIPAA compliance obligations.

As Required by Law

In certain circumstances, federal or state laws may require that we provide your PHI to organizations such as:

  • Public Health Authorities
  • The Food and Drug Administration
  • Health Oversight Agencies
  • Military Command Authorities
  • National Security and Intelligence Organizations
  • Correctional Institutions
  • Organ and Tissue Donation Organizations
  • Coroners, Medical Examiners and Funeral Directors
  • Workers Compensation Agents

Law Enforcement Activities and Legal Proceedings

We may use or disclose your PHI if necessary, to prevent or lessen a serious threat to your health and safety or that of another person. We may also provide PHI to law enforcement officials, for example, in response to a warrant, investigative demand or similar legal process, or for officials to identify or locate a suspect, fugitive, material witness, or missing person. We may also disclose PHI to appropriate agencies if we reasonably believe an individual to be a victim of abuse, neglect or domestic violence.

We may disclose your PHI as required to comply with a court or administrative order. Finally, we may provide your PHI in response to a subpoena, discovery request or other legal process in the course of a judicial or administrative proceeding, but only if efforts have been made to tell you about the request or to obtain an order of protection for the requested information.

Uses and Disclosures of Your Highly Confidential Information

Federal and state law require special privacy protections for certain highly confidential information about you, including the subset of your PHI that: (1) is maintained in psychotherapy notes; (2) is about mental illness, mental retardation and developmental disabilities; (3) is about alcohol or drug abuse or addiction; (4) is about HIV/AIDS testing, diagnosis or treatment; (5) is about communicable disease(s), including venereal disease(s); (6) is about genetic testing; (7) is about child abuse and neglect; (8) is about domestic abuse of an adult; or (9) is about sexual assault. In order for your highly confidential information to be disclosed for a purpose other than those permitted by law, your written authorization is required.

Research

Lab may disclose PHI for research purposes when an Institutional Review Board or privacy board has reviewed the research proposal and established protocols to ensure the privacy of your PHI and determined that the researcher does not need to obtain your authorization prior to using your PHI for research purposes. We may also disclose information about decedents to researchers under certain circumstances.  We may also review your information to determine if you are a candidate for research. However we will not enroll you in any clinical research without your written authorization. We may from time to time use laboratory samples for research that have been de-identified and do not contain any identification connecting the sample to you.

De-Identified Health Information

Lab may use and disclose health information that has been “de-identified” by removing certain identifiers, making it unlikely that you could be identified. We may also disclose limited health information contained in a “limited data set.” The limited data set does not contain any information that can directly identify you. For example, a limited data set may include your city, county, and Zip code but not your name or street address.

Marketing

We may provide information to you regarding testing services or other health-related benefits offered by Lab that may be of interest to you, but we must receive written authorization to use your PHI for other marketing purposes.

Sale of PHI

We are prohibited from selling your PHI without your prior authorization.

Note Regarding State Law

For all of the above purposes, when state law is more restrictive than federal law, we are required to follow the more restrictive state law.

Your Patient Rights 

Receive Test Information

You have the right to receive a copy of your PHI that we have created, including completed test reports, test orders, ordering provider information, billing information, insurance information, etc. You may request a paper copy of your PHI or an electronic copy of your PHI that we maintain electronically and you may also request that we transmit the information to you or to another individual or third party. Your request should be in writing addressed to the HudsonAlpha Clinical Services Lab, LLC at the address above, Attention:  Test Reports.  (You may download a Request Form Here)  We have thirty (30) days to act upon your request.  If another person requests access to your PHI on your behalf, we have the obligation to verify the identity and authority of any person requesting access to your PHI as your personal representative.  We may charge you a reasonable, cost-based fee for providing these copies.  We may deny your access to the clinical laboratory results we have unless they have been first received by the ordering or requesting physician. 

Amend Health Information

You may request changes to your PHI and we will accommodate them if we can. However, we are not required to make the requested changes. If we deny your written request to change your PHI we will provide you, within sixty (60) days of receipt of a request for amendment, with a written explanation of the reason for the denial and additional information regarding further actions that you may take.

Accounting of Disclosures

You have the right to receive a list of certain disclosures of your PHI made by Lab in the past six years from the date of your written request. Under the law, this does not include disclosures made upon your request or for purposes of treatment, payment, or healthcare operations except for certain disclosures made through an electronic health record. We’ll provide one free accounting of disclosures for every 12 month period, but we will charge a reasonable, cost-based fee if you ask for another accounting in the same 12 month period.

Get a Copy of this Privacy Notice

You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper company promptly.

Request Restrictions

You may request restrictions on the use and disclosure of your PHI for treatment, payment and health care operations as well as to individuals (such as a family member, other relative, close personal friend or any other person identified by you) involved with your care or with payment related to your care, but we are not required to agree to your request, with the following exception. 

Choose Someone to Act for You

If you have given someone medical power of attorney or if someone is your legal guardian, the person can exercise your rights and make choices about your PHI. Before we take any action requested by any individual that is not you, we will make sure the requesting individual has the proper legal authority and can legally act on your behalf.

Request Confidential Communications

You have the right to request that we send your PHI by alternative means or to an alternative address, and we will accommodate reasonable requests.

Right to Pay Out-of-Pocket

You have the right to pay out-of-pocket for our services. You have the right to ask us to restrict the disclosure of PHI to your health plan for a service we provide to you where you have directly paid us (out of pocket, in full) for that service, in which case we must honor your request.

How to Exercise Your Rights

You may write to us at the address at the beginning of this Notice with your specific request.

Lab will consider your request and provide you a response within a reasonable timeframe.

Receive Notice in the Event of a Breach.

In the event of a breach of your PHI that has not been secured in accordance with federal standards (such as encrypted), you have the right to be notified of the breach and to be provided, to the extent available, with a description of the breach, a description of the types of information involved in the breach, the steps you should take to protect yourself from potential harm, a brief description of what we are doing to investigate the breach, mitigate harm, and prevent further breaches, as well as contact information for questions or concerns regarding the breach.

Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint with us. You also have the right to file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. Upon request, Lab will provide you with the correct address for the Director

To file a complaint with us, write to us at the following address: HudsonAlpha Clinical Services Lab, LLC, 601 Genome Way, Rm. 3023, Huntsville, AL 35806

Lab will not retaliate against any individual for filing a complaint.

Note

We reserve the right to amend the terms of this Notice to reflect changes in our privacy practices, and to make the new terms and practices applicable to all PHI that we maintain about you, including PHI created or received prior to the effective date of the Notice revision. Our Notice is displayed on our website www.clinicallab.org and a copy is available upon request.

Effective Date of this Notice: November 3, 2015

Updated: May 12, 2020