Access Genetics Notice of Protected Health Information Privacy Practices

This Notice applies to Access Genetics, LLC and all of its business units (collectively referred to as "Access Genetics" in this notice). Please read this important information carefully.

1. Access Genetics Protection of Protected Health Information (PHI)

   Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Access Genetics is required by law to maintain the privacy of health information that identifies you, called protected health information (PHI), and to provide you with notice of our legal duties and privacy practices regarding PHI. Access Genetics is committed to the protection of your PHI and will make reasonable efforts to ensure the confidentiality of your PHI, as required by statute and regulation. We take this commitment seriously and will work with you to comply with your right to receive certain information under HIPAA.

2. Access Genetics Use and Disclosure of PHI

   1) As permitted under HIPAA, the following categories explain some types of potential permitted uses and disclosures of PHI. In some cases, these may be limited or restricted by state laws or other legal requirements such as those of the Clinical Laboratory Improvement Amendments of 1988 (CLIA). Please contact our Privacy Officer, using the contact information provided at the end of this notice, for specific information regarding your state.

   • Treatment ‐ Access Genetics may use or disclose PHI for treatment purposes, including disclosure to physicians, nurses, medical students, pharmacies, and other health care professionals who provide you with health care services and/or are involved in the coordination of your care, such as providing your physician with your laboratory test results.
   • Payment ‐ Access Genetics may use or disclose PHI to bill and collect payment for laboratory or genetic counseling services we provide. For example, Access Genetics may provide PHI to your health plan to receive payment for the health care services provided to you.
   • Health Care Operations ‐ Access Genetics may use or disclose PHI for health care operations purposes. These uses and disclosures are necessary, for example, to evaluate the quality of our laboratory testing, accuracy of results, accreditation functions and for Access Genetics operation and management purposes. Access Genetics may also disclose PHI to other health care providers or health plans that are involved in your care for their health care operations. For example, Access Genetics may provide PHI to manage disease, or to coordinate health care or health benefits.
   • Others involved in your care or payment for your care ‐ Access Genetics may disclose PHI to a person who is involved in your care or helps pay for your care, such as a family member or friend. We also may notify your family about your location or general condition or disclose such information to an entity assisting in a disaster relief effort. As allowed by federal and state law, we may disclose the PHI of minors to their parents or legal guardians.
   • Business associates ‐ Access Genetics may disclose PHI to its business associates to perform certain business functions or provide certain business services to Access Genetics. For example, we may use another company to perform billing services on our behalf. All of our business associates are required to maintain the privacy and confidentiality of your PHI. In addition, at the request of your health care providers or health plan, Access Genetics may disclose PHI to their business associates for purposes of performing certain business functions or health care services on their behalf. For example, we may disclose PHI to a business associate of Medicare for purposes of medical necessity review and audit.
   • Disclosure for judicial and administrative proceedings ‐ Under certain circumstances, Access Genetics may disclose your PHI in the course of a judicial or administrative proceeding, including in response to a court or administrative order, subpoena, discovery request, or other lawful process.
   • When required by law ‐ Access Genetics must disclose your PHI if required to do so by federal, state, or local law.
   • Public Health ‐ Access Genetics may use or disclose PHI for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. This may include coroners, medical examiners and other agencies responsible for collecting this information.
   • Health Oversight ‐ Access Genetics may disclose PHI to a health care oversight agency for activities authorized by law such as audits, civil, administrative, or criminal investigations and proceedings/actions, inspections, licensure/disciplinary actions, or other activities necessary for appropriate oversight of the health care system, government benefit programs, and compliance with regulatory requirements and civil rights laws.
   • Law Enforcement ‐ We may disclose protected health information, so long as applicable legal requirements are met, for law enforcement purposes.
   • Criminal Activity ‐ Consistent with applicable federal and state laws, we may disclose your protected health information, if we believe that the use or disclosure is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public. We may also disclose protected health information if it is necessary for law enforcement authorities to identify or apprehend an individual.
   • Personal Representative ‐ Access Genetics may disclose PHI to your personal representative, as established under applicable law, or to an administrator, executor, or other authorized individual associated with your estate.
   • Research ‐ Access Genetics may use and disclose PHI for research purposes. Limited data or records may be viewed by researchers to identify patients who may qualify for their research project or for other similar purposes, so long as the researchers do not remove or copy any of the PHI. Before we use or disclose PHI for any other research activity, one of the following will happen: 1) a special committee will determine that the research activity poses minimal risk to privacy and that there is an adequate plan to safeguard PHI;

   2) if the PHI relates to deceased individuals, the researchers give us assurances that the PHI is necessary for the research and will be used only as part of the research; or 3) the researcher will be provided only with information that does not identify you directly.

   • National Security and Military Activity. When appropriate conditions apply, we may use or disclose protected health information of individuals who are armed forces personnel. We may also disclose your protected health information to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or others legally authorized.
   • Workers' compensation ‐ As authorized by applicable laws, Access Genetics may use or disclose PHI to comply with workers' compensation or other similar programs established to provide work‐related injury or illness benefits.
   • De‐identified Information and Limited Data Sets: Access Genetics may use and disclose health information that has been “de‐identified” by removing certain identifiers making it unlikely that you could be identified. Access Genetics also may disclose limited health information, contained in a “limited data set”. The limited data set does not contain any information that can directly identify you. For example, a limited data set may include your city, county and zip code, but not your name or street address.

3. Other Uses and Disclosures of PHI

   For purposes not described above, including uses and disclosures of PHI for marketing purposes and disclosures that would constitute a sale of PHI, Access Genetics will ask for patient authorization before using or disclosing PHI. If you signed an authorization form, you may revoke it, in writing, at any time, except to the extent that action has been taken in reliance on the authorization.

4. Specific Authorized Uses of PHI

   To the extent you have provided a written authorization for more expansive use of PHI than is contained in this Notice, Access Genetics may rely on this directive to guide PHI use and disclosure. This authorization shall continue indefinitely until and unless specifically revoked by a subsequent written document.

5. Information Breach Notification

   Access Genetics is required to provide patient notification if it discovers a breach of unsecured PHI unless there is a demonstration, based on a risk assessment, that there is a low probability that the PHI has been compromised. You will be notified without unreasonable delay and no later than 60 days after discovery of the breach. Such notification will include information about what happened and what can be done to mitigate any harm.

6. Patient Rights Regarding PHI

   Subject to certain exceptions, HIPAA establishes the following patient rights with respect to PHI:

   • Right to Receive a Copy of the Access Genetics Notice of Privacy Practices ‐ You have a right to receive a copy of the Access Genetics Notice of Privacy Practices at any time by contacting us at phisupport@access‐genetics.com, calling us at 855.202.6109 and asking for the Access Genetics PHI Support Group, or by sending a written request to: PHI Support Group, Access Genetics, 7400 Flying Cloud Drive, Suite 150, Eden Prairie, MN 55344. This notice is also posted on the Access Genetics internet site at: http://www.access‐genetics.com/resources/PrivacyPolicy.pdf
   • Right to Request Limits on Uses and Disclosures of your PHI ‐ You have the right to request that we limit: 1) how we use and disclose your PHI for treatment, payment, and health care operations activities; or 2) our disclosure of PHI to individuals involved in your care or payment for your care. Access Genetics will consider your request, but is not required to agree to it unless the requested restriction involves a disclosure that is not required by law to a health plan for payment or health care operations purposes and not for treatment, and you have paid for the service in full out of pocket. If we agree to a restriction on other types of disclosures, we will state the agreed restrictions in writing and will abide by them, except in emergency situations when the disclosure is for purposes of treatment.
   • Right to Request Confidential Communications ‐ You have the right to request that Access Genetics communicate with you about your PHI at an alternative address or by an alternative means. Access Genetics will accommodate reasonable requests.
   • Right to See and Receive Copies of Your PHI ‐ You and your personal representative have the right to access PHI consisting of your laboratory test results or reports ordered by your physician. Within 30 days after our receipt of your request, you will receive a copy of the completed laboratory report from Access Genetics unless an exception applies. Exceptions include a determination by a licensed health care professional that the access requested is reasonably likely to endanger the life or safety of you or another person, and our inability to provide access to the PHI within 30 days, in which case we may extend the response time for an additional 30 days if we provide you with a written statement of the reasons for the delay and the date by which access will be provided. You have the right to access and receive your PHI in an electronic format if it is readily producible in such a format. You also have the right to direct Access Genetics to transmit a copy to another person you designate, provided such request is in writing, signed by you, and clearly identifies the designated person and where to send the copy of your PHI.
   • Right to Receive an Accounting of Disclosures ‐ You have a right to receive a list of certain instances in which Access Genetics disclosed your PHI. This list will not include certain disclosures of PHI, such as (but not limited to) those made based on your written authorization or those made prior to the date on which Access Genetics was required to comply. If you request an accounting of disclosures of PHI that were made for purposes other than treatment, payment, or health care operations, the list will include disclosures made in the past six years, unless you request a shorter period of disclosures. If you request an accounting of disclosures of PHI that were made for purposes of treatment, payment, or health care operations, the list will include only those disclosures made in the past three years for which an accounting is required by law, unless you request a shorter period of disclosures.
   • Right to Correct or Update your PHI ‐ If you believe that your PHI contains a mistake, you may request, in writing, that Access Genetics correct the information. If your request is denied, we will provide an explanation of the reasoning for our denial.

7. How to obtain a copy of your PHI:
   • Ask for a courtesy copy at the time your specimen is collected at your ordering provider’s office.
   • Complete the Access Genetics Patient Protected Health Information Request Form.
   • Contact the PHI Support Group at 855.202.6109 or by e‐mail at phisupport@access‐genetics.com.
8. How to Exercise Your Rights

   To exercise any of your rights described in this notice, you must send a written request to: PHI Support Group, Access Genetics, 7400 Flying Cloud Drive, Eden Prairie, MN 55344. Except, patients may update insurance and/or billing information by contacting the Patient Billing Department using the phone number indicated on your billing statement.

9. How to Contact Us or File a Complaint

   If you have questions or comments regarding the Access Genetics Notice of Protected Health Information Privacy Practices, or have a complaint about our use or disclosure of your PHI or our privacy practices, please contact: phisupport@access‐genetics.com, call us at 855.202.6109 and ask for the PHI Support Group, or send a written request to: PHI Support Group, Access Genetics, 7400 Flying Cloud Drive, Eden Prairie, MN 55344. You also may file a complaint with the Secretary of the U.S. Department of Health and Human Services. Access Genetics will not take retaliatory action against you for filing a complaint about our privacy practices.

10. Changes to the Access Genetics Notice of Privacy Practices

    Access Genetics reserves the right to make changes to this notice and to our privacy policies from time to time. Changes adopted will apply to any PHI we maintain about you. Access Genetics is required to abide by the terms of our notice currently in effect. When changes are made, we will promptly update this notice and post the information on the Access Genetics website at: http://www.access‐genetics.com/resources/PrivacyPolicy.pdf

Please review this site periodically to ensure that you are aware of any updates.