NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW THIS NOTICE CAREFULLY.

The HudsonAlpha Clinical Services Lab, LLC (“Lab”) is committed to protecting the privacy of your protected health information or PHI. This includes laboratory test orders and test results as well as invoices for the healthcare services we provide. As a reference laboratory and educational firm, Lab collects PHI about you and stores it electronically on a computer. This is your medical record. The medical record is the property of Lab, but the information in the medical record belongs to you. Should you have any questions about this Notice or our privacy practices, please contact our Privacy

Officer by email tepps@clinicallab.org, or you may write us at:

The HudsonAlpha Clinical Services Lab, LLC, 601 Genome Way, Rm. 3023, Huntsville, AL 35806

Our Responsibilities

HudsonAlpha Clinical Services Lab, LLC is required by law to maintain the privacy of your PHI. We are also required to provide you with this. Notice upon request. It describes our legal duties, privacy practices and your patient rights as determined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended from time to time. We follow the terms of this Notice.

How We May Use or Disclose Your Health Information

We use your PHI for treatment, payment, or healthcare operations purposes and for other purposes permitted or required by law. Not every use or disclosure is listed in this Notice, but all of our uses or disclosures of your health information will fall into one of the categories listed below. We need your written authorization to use or disclose your health information for any purpose not covered by one of the categories below. Any authorization you provide may be revoked at any time. If you revoke your authorization, we will no longer use or disclose your health information for the reasons stated in your authorization except to the extent we have already taken action based on your authorization. The law permits us to use or disclose your health information for the following purposes without your specific authorization:

Treatment

Lab provides laboratory testing for physicians and other healthcare professionals and we use your information in our testing process. We disclose your health information to authorized healthcare professionals who order tests or need access to your test results for treatment purposes.

Payment

Lab will use your PHI as part of our billing process and may send it to insurance companies or other appropriate parties, including to you, to obtain payment for our services. If you are insured under another person’s health insurance policy (for example, parent, spouse, domestic partner or a former spouse), we may also send invoices to the subscriber whose policy covers your health services.

Healthcare Operations

HudsonAlpha Clinical Services Lab, LLC may use or disclose your PHI for activities necessary to support our healthcare operations, such as performing quality checks on our testing, internal audits, or developing reference ranges for our tests.

Business Associates

We may provide your PHI to other companies or individuals to assist us in providing specific services requiring the use and disclosure of PHI. These other entities, known as “business associates,” are required to maintain the privacy and security of PHI. Our business associates must only use your health information for the services they perform on our behalf. For example, we may provide information to companies that assist us with billing of our services. As of February 17, 2010, business associates have independent HIPAA compliance obligations.

As Required by Law

In certain circumstances, federal or state laws may require that we provide your health information to organizations such as:

• Public Health Authorities

• The Food and Drug Administration

• Health Oversight Agencies

• Military Command Authorities

• National Security and Intelligence Organizations

• Correctional Institutions

• Organ and Tissue Donation Organizations

• Coroners, Medical Examiners and Funeral Directors

• Workers Compensation Agents

Law Enforcement Activities and Legal Proceedings

We may use or disclose your PHI if necessary, to prevent or lessen a serious threat to your health and safety or that of another person. We may also provide PHI to law enforcement officials, for example, in response to a warrant, investigative demand or similar legal process, or for officials to identify or locate a suspect, fugitive, material witness, or missing person. We may also disclose PHI to appropriate agencies

if we reasonably believe an individual to be a victim of abuse, neglect or domestic violence. We may disclose your PHI as required to comply with a court or administrative order. Finally, we may provide your PHI in response to a subpoena, discovery request or other legal process in the course of a judicial or administrative proceeding, but only if efforts have been made to tell you about the request or to obtain an order of protection for the requested information.

Research

Lab may disclose health information for research purposes when an Institutional Review Board or privacy board has reviewed the research proposal and established protocols to ensure the privacy of your PHI and determined that the researcher does not need to obtain your authorization prior to using your PHI for research purposes. We may also disclose information about decedents to researchers under certain circumstances. We may also review your information to determine if you are a candidate for research.

However we will not enroll you in any clinical research without your written authorization. We may from time to time use laboratory samples for research that have been de-identified and do not contain any identification connecting the sample to you.

De-Identified Health Information

Lab may use and disclose health information that has been “de-identified” by removing certain identifiers, making it unlikely that you could be identified. We may also disclose limited health information contained in a “limited data set.” The limited data set does not contain any information that can directly identify you. For example, a limited data set may include your city, county, and Zip code but not your name or street address.

Marketing

We may provide information to you regarding treatment alternatives or other health-related benefits that may be of interest to you, but we must abide by strict limitations on third-party funding for such communications.

Sale of PHI

We are prohibited from selling your PHI without your prior authorization.

Note Regarding State Law

For all of the above purposes, when state law is more restrictive than federal law, we are required to follow the more restrictive state law.

Your Patient Rights

Receive Test Information

You have the right to receive a copy of your PHI that we have created, including completed test reports, test orders, ordering provider information, billing information, insurance information, etc. You may request a paper copy of your PHI or an electronic copy of your PHI that we maintain electronically and you may also request that we transmit the information to you or to another individual or third party. Your request should be in writing addressed to the HudsonAlpha Clinical Services Lab, LLC at the address above, Attention: Test Reports. (Download a Request Form Here)  We have thirty (30) days to act upon your request. If another person requests access to your PHI on your behalf, we have the obligation to verify the identity and authority of any person requesting access to your PHI as your personal representative. We may charge you a reasonable, cost-based fee for providing these copies. We may deny your access to the clinical laboratory results we have unless they have been first received by the ordering or requesting physician.

Amend Health Information

You may request changes to your PHI and we will accommodate them if we can. However, we are not required to make the requested changes. If we deny your written request to change your PHI we will provide you with a written explanation of the reason for the denial and additional information regarding further actions that you may take.

Accounting of Disclosures

You have the right to receive a list of certain disclosures of your health information made by Lab in the past six years from the date of your written request. Under the law, this does not include disclosures made for purposes of treatment, payment, or healthcare operations except for certain disclosures made through an electronic health record.

Request Restrictions

You may request that we agree to restrictions on certain uses and disclosures of your health information, but we are not required to agree to your request, with the following exception. You have the right to ask us to restrict the disclosure of health information to your health plan for a service we provide to you where you have directly paid us (out of pocket, in full) for that service, in which case we must honor your request.

Request Confidential Communications

You have the right to request that we send your health information by alternative means or to an alternative address, and we will accommodate reasonable requests.

Right to Pay Out-of-Pocket

You have the right to pay out-of-pocket for our services, and if you do so, you have the right to require that we not submit your Protected Health Information to your health plan.

How to Exercise Your Rights

You may write to us at the address at the beginning of this Notice with your specific request. Lab will consider your request and provide you a response within a reasonable timeframe.

Receive Notice in the Event of a Breach

In the event of a breach of your PHI that has not been secured in accordance with federal standards (such as encrypted), you have the right to be notified of the breach and to be provided, to the extent available, with a description of the breach, a description of the types of information involved in the breach, the steps you should take to protect yourself from potential harm, a brief description of what we are doing to

investigate the breach, mitigate harm, and prevent further breaches, as well as contact information for questions or concerns regarding the breach.

Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint with us. You also have the right to file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. Lab will not retaliate against any individual for filing a complaint.To file a complaint with us, write to us at the following address: HudsonAlpha Clinical Services Lab, LLC, 601 Genome Way, Rm. 3023, Huntsville, AL 35806

Note

We reserve the right to amend the terms of this Notice to reflect changes in our privacy practices, and to make the new terms and practices applicable to all PHI that we maintain about you, including PHI created or received prior to the effective date of the Notice revision. Our Notice is displayed on our website www.clinicallab.org and a copy is available upon request.

Effective Date of this Notice: November 3, 2015