HIPAA Notice of Privacy Practices
(This Notice of Privacy Practices is effective as of 12/05/2019)
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
One Health Laboratories (“OHL”) is a full-service, clinical reference laboratory serving clients and their patients. At OHL, we pledge to give you the highest quality health care and to have a relationship with you built on trust. This trust includes our commitment to respecting the privacy and confidentiality of a patient’s protected health information, or PHI. Your PHI is information about you, including demographic information, that can be used to identify you and that relates to your past, present, or future physical or mental health or condition or the provision of health care services to you. The PHI that OHL typically processes begins with the personal identifying and medical history information (such as your name, address, date of birth, test ordered, test result, etc.) that we obtain from your physician, health plan, or other sources. In addition to safeguarding that patient data, we are also committed to protecting the confidentiality of an individual’s new PHI as generated by OHL, such as the laboratory test results that we collect, create, or communicate as part of our diagnostic testing activities completed on your behalf.
OHL is committed to gathering, processing, maintaining, and disclosing PHI only in a manner that is fully in compliance with all applicable local, state, and federal laws and regulations seeking to protect patient confidentiality. OHL is and shall be in compliance with all applicable federal, state, and local laws and regulations regarding the use and disclosure of PHI.
Under the federal Health Insurance Portability and Accountability Act of 1986 (“HIPAA”) and its regulations related to patient privacy (the “Privacy Rule”), OHL is required to provide you with this Notice of Privacy Practices (“NOTICE”) to inform you, the patient, ahead of time about: how OHL will work with your PHI, OHL’s legal duties related to your PHI, and your own rights with respect to your PHI. OHL is also required to abide by the terms of the NOTICE currently in effect. Your other health care provider(s) may have different notices regarding the use and disclosure of your PHI maintained by them.
OHL reserves the right to change the terms of this notice, in which case, the new revised notice will be available upon request or on our website. We urge you to read this NOTICE carefully so that you will understand our commitment to the privacy and protection of your confidential health care information, and learn how you can involve yourself in the protection of this information.
If you have any questions about this NOTICE you can write us at the following address:
One Health Laboratories, LLC
401 North Broad St, STE 222
Philadelphia, PA 19108
Attn: Compliance Officer
Permissible Uses and Disclosures of Your PHI that OHL Can Make Without Your Authorization
Your PHI will be used or disclosed for treatment, payment, or healthcare operations purposes related to the care provided to you and for other purposes as permitted or required by law. While we cannot list every possible use or disclosure, all of the ways we may use or disclose your PHI without your authorization will fall into one of the categories listed below.
If we want or need to use or disclose your PHI for purposes that do not fall into these general categories, we will first have to obtain your written authorization. In the event you have issued us an authorization, you have the right to withdraw your authorization in writing at any time, except if we have relied on the authorization before you inform us of your withdrawal.
OHL does not need your authorization of permission to use or disclose your PHI for the following purposes:
- Treatment: OHL, as a health care provider that provides physicians with clinical laboratory testing for their patients, uses the PHI it receives from your physicians as part of its testing processes (to identify and enter your specimens and tests into our system). Additionally, after completing the testing, OHL reports your results, as new PHI, back to your physicians and/or other authorized health care professionals who are treating you based on those results. In addition to your treating physician, we may provide your PHI to a consulting specialist physician. In those instances, because we are not local to you and your physician, we will need to confirm this type of request, so we will ask that you forward us an authorization from your physician’s office, informing us of your desired disclosure to a specialist. We may also disclose your PHI to another testing laboratory if we are unable to perform the testing ourselves and need to refer your specimen to that laboratory to perform the requested testing.
- Payment: Our OHL billing department will use and disclose your PHI to the insurance companies, health plans, hospitals, and other providers for any necessary payment purposes. For example, we will send your name, date of service, test performed, diagnosis code, and other information to the health plan you are a member of so that the plan will pay us for the services we have provided you. This right of use extends to third parties/agencies we may need to use to assist us in collecting payment for our services.
- Health Care Operations: Your PHI will be used in the course of activities required to support OHL’s health care operations, such as tracking our utilization of resources, detecting fraud, reviewing our billing and claims processing efficiencies, or for performing quality checks on our information systems. This information will be used internally in an effort to continually improve the quality and effectiveness of the healthcare services we provide. We may also disclose your PHI to other health care providers or payers for their health care operations, but only if they already have a relationship with you and only if the purpose is for quality assurance activities, peer review activities, detecting fraud, or for other limited purposes.
- Disclosures to Business Associates: OHL may disclose your PHI to other companies or individuals who need your PHI in order to provide specific services to us. Because these entities are not normally providing services related to the type we are providing you, they are called “Business Associates.” They must comply with the specific terms of a contract, or “Business Associate Agreement,” designed to ensure that they will use and maintain the privacy and security of your PHI in the same manner that we do. Additionally, in compliance with the Privacy Rule and its own policies, OHL will make every effort possible to ensure that whatever disclosure is made of your PHI, it will be limited to the minimum necessary for the support services to be provided. For example, your PHI may be disclosed to couriers we use to transport specimens to us. We will only provide the couriers with just the piece of PHI they need to perform their services.
OHL may also use or disclose your PHI without your authorization for the following purposes, as permitted or required by law:
- When required by law: in order to comply with federal or state laws, the order of the court, or the orders of a governmental agency.
- Public health: to public health authorities for preventing or controlling disease, injury, or disability, such as reporting vital, communicable, or sexually transmitted disease information.
- Health oversight activities: to health oversight agencies for oversight activities authorized by law (for example, as part of mandated laboratory inspection of our facilities by state regulators).
- Judicial and administrative proceedings: to courts, parties to a lawsuit, or government agencies as may be required during the course of a judicial or administrative proceeding.
- Law enforcement: to law enforcement officials relating to crimes and other law enforcement purposes.
- Coroners/ Medical Examiners: to coroners, medical examiners, or funeral directors for the purpose of identification or determining the cause of death, or for other duties authorized by law.
- Cadaveric organ, eye, or tissue donation purposes: to organizations regarding organ, eye, or tissue donation at death.
- Research: to researchers when the individual’s waiver or alteration of authorization and the researcher’s proposed research and established research protocols have been approved by either an institutional review board or a privacy board to ensure the privacy of PHI.
- Threat to health or safety: consistent with law, to prevent a serious threat to personal health or safety to others (for example, an agency’s investigation of a physician’s license).
- Specialized government functions: to military command authorities, veterans’ administration, and national security and intelligence officials for activities deemed necessary to carry out their respective missions, or to law enforcement officials having custody of an inmate.
- Workers compensation: to the extent authorized by and to the extent necessary to comply with laws relating to workers’ compensation or similar programs.
Your Rights Concerning the Privacy and Confidentiality of Your PHI
You have the right to look at, and get a copy of, your PHI. You must ask for this in writing. We will respond within thirty (30) days of receipt of your request. If your request is denied, we must explain the reasons why in writing and tell you what rights you have. If we do not have the information you seek but we do know where it is, we must inform you of that.
- You have the right to ask us to change your PHI related to your treatment and bills if you think there has been a mistake or that information is missing.
- You must make your request in writing and give the reason for the request. OHL has sixty (60) days to respond to the request.
- If we are unable to act on the request within the 60 days, we will notify you that we are extending the response time by 30 days.
- If we extend the response time, we will explain the delay to you in writing and give you a new date of when to expect a response.
- We may deny your request.
- If we deny your request, we must give you a written statement with the reasons for your denial and what other steps are available to you.
- If we grant your request, we will ask you to tell us the persons you want to receive the changes. You need to agree to have us notify them along with any other(s) who received the previous information before the changes were made and who may have relied on that information to treat you.
You have the right to get a record of the times your health information has been shared. You must make your request in writing. You may request this as far back as six years. The listing you get will include the date, name, and address (if known) of the person or organization receiving your information. It will also include a brief explanation of the information given and the reasons for the disclosure. The following exceptions apply:
- sharing your PHI for the purposes of treatment, payment, or health care operations
- sharing your PHI if you gave permission in writing (signed an authorization form)
- sharing your information in our data systems
- sharing your information with persons involved in your care
- sharing your information to communicate with you about your health condition
OHL has sixty (60) days to respond to the request. If we are unable to act on the request within the 60 days, we will notify you that we are extending the response time by 30 days. If we extend the response time, we will explain the delay to you in writing and give you a new date of when to expect a response. Your first request for a record in any 12-month period is free. Subsequent requests will be at a cost. We will notify you of the fee before we do the work so that you may stop the request if you do not wish to pay the fee.
You have the right to ask for restrictions on the uses of your health information for treatment, payment, or health care operations. OHL is not required to agree to your request. You may not ask us to restrict uses and disclosures that we are legally required to make.
5. Confidential Communications:
You have the right to request how and where OHL is to send your PHI or communicate with you regarding any PHI, including billing information. It is your responsibility to provide us with contact information we can use to contact you. We may ask that you put your request in writing, but we do not have the right to ask you the reason for this.
6. Notice of Privacy Practices:
You have the right to receive a paper copy of this NOTICE upon request, even if you previously agreed to receive this NOTICE electronically.
How to exercise your rights
To exercise any of your privacy rights, please write to us at the address at the beginning of this NOTICE with your specific written request. Be sure to include sufficient information for us to identify all of your records. For additional details, or for instructions regarding how to exercise these rights, please contact us.
How to file a complaint
If you believe your privacy rights have been violated, you have the right to register a complaint with OHL, the Office for Civil Rights, U.S. Department of Health & Human Services, 26 Federal Plaza – Suite 3313, New York, NY 10278, (212) 264-3313 (TEL), (212) 264-2355 (TDD), (212) 264-3039 (FAX), or e-mail your complaint to OCRComplaint@hhs.gov. OHL will not retaliate against any individual for filing a complaint. You may file a complaint by writing to us at the address at the beginning of this NOTICE.