Phase2Labs (Phase2) HIPAA Notice of Privacy Practices
Protection of Protected Health Information
Phase2 Labs is a premier CLIA Certified® and CAP Accredited® clinical laboratory that specializes in molecular infectious disease and toxicology testing. Phase2 follows approved protocols for High Complexity CLIA certified labs and/or by the FDA, and the Center for Disease Control. This notice is to inform you of how medical information about you may be used or disclosed and to identify how you may access to these records.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA),
Under HIPAA, Phase2 is required by law to maintain the privacy of health information that identifies you, called protected health information (PHI), and to provide you with notice of our legal duties and privacy practices regarding PHI. Phase2 is committed to the protection of your PHI and will make reasonable efforts to ensure the confidentiality of your PHI, as required by statute and regulation. We take this commitment seriously and will work with you to comply with your right to receive certain information under HIPAA.
Phase2's Use and Disclosure of PHI
As permitted under HIPAA, these categories explain the uses and disclosures of PHI that Phase2 may make. Some uses and disclosures described may be limited or restricted by state laws or other legal requirements, for example, the Clinical Laboratory Improvement Amendments of 1988 (CLIA). Please contact our Privacy Officer, using the contact information provided at the end of this notice, for specific information regarding your state.
For treatment - Phase2 may use or disclose PHI for treatment, including disclosure to physicians, nurses, medical students, pharmacies, and other health care professionals who provide you with health care services and/or are involved in the coordination of your care, such as providing your physician with your laboratory test results.
For payment - Phase2 may use or disclose PHI to bill and collect payment for laboratory or genetic counseling services we provide. For example, Phase2 may provide PHI to your health plan to receive payment for the health care services provided to you.
For health care operations - Phase2 may use or disclose PHI for health care operations purposes. These uses and disclosures are necessary, for example, to evaluate the quality of our laboratory testing, accuracy of results, accreditation functions and for Phase2's operation and management purposes. Phase2 may also disclose PHI to other health care providers or health plans involved in your care for their health care operations. For example, Phase2 may provide PHI to manage disease, or to coordinate health care or health benefits.
Appointment reminders and health-related benefits and services - Phase2 may use and disclose PHI to contact you as a reminder you have an appointment with us and may use and disclose PHI to tell you about health-related benefits and services that may interest you. For example, Phase2 may contact you about a new patient service center in your area or about new testing services available at Phase2 based on services ordered by your physician.
Individuals involved in your care or payment for your care - Phase2 may disclose PHI to a person involved in your care or helps pay for your care, such as a family member or friend. We also may notify your family about your location or general condition or disclose such information to an entity assisting in a disaster relief effort. As allowed by federal and state law, we may disclose the PHI of minors to their parents or legal guardians.
Business associates - Phase2 may disclose PHI to its business associates to perform certain business functions or provide certain business services to Phase2. For example, we may use another company to perform billing services on our behalf. All of our business associates must maintain the privacy and confidentiality of your PHI. In addition, at the request of your health care providers or health plan, Phase2 may disclose PHI to their business associates to perform certain business functions or health care services on their behalf. For example, we may disclose PHI to a business associate of Medicare for medical necessity review and audit.
Disclosure for judicial and administrative proceedings - Under certain circumstances, Phase2 may disclose your PHI in the course of a judicial or administrative proceeding, including in response to a court or administrative order, subpoena, discovery request, or other lawful process.
Law enforcement - Phase2 may disclose PHI for law enforcement purposes, including reporting of certain types of wounds or physical injuries or in response to a court order, warrant, subpoena or summons, or similar process authorized by law. We may also disclose PHI when the information is needed: 1) for identification or location of a suspect, fugitive, material witness or missing person, 2) about a victim of a crime, 3) about an individual who has died, 4) in relation to criminal conduct on Phase2 premises, or 5) in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.
As required by law - Phase2 must disclose your PHI if required to do so by federal, state, or local law.
Public Health - Phase2 may disclose PHI for public health activities. These activities generally include: 1) disclosures to a public health authority to report, prevent or control disease, injury, or disability; 2) disclosures to report births and deaths, or to report child abuse or neglect; 3) disclosures to a person subject to the jurisdiction of the Food and Drug Administration ("FDA") for purposes related to the quality, safety or effectiveness of an FDA-regulated product or activity, including reporting reactions to medications or problems with products or notifying people of recalls of products they may be using; 4) disclosures to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; and 5) disclosures to an employer about an employee to conduct medical surveillance in certain limited circumstances about work-place illness or injury.
Disclosure about victims of abuse, neglect, or domestic violence - Phase2 may disclose PHI about an individual to a government authority, including social services, if we reasonably believe an individual is a victim of abuse, neglect, or domestic violence.
Health oversight activities - Phase2 may disclose PHI to a health care oversight agency for activities authorized by law such as audits, civil, administrative, or criminal investigations and proceedings/actions, inspections, licensure/disciplinary actions, or other activities for appropriate oversight of the health care system, government benefit programs, and compliance with regulatory requirements and civil rights laws.
Coroners, medical examiners, and funeral directors - Phase2 may disclose PHI to a coroner, medical examiner, or funeral director to identify a deceased person, determining cause of death, or for performing some other duty authorized by law.
Personal Representative - Phase2 may disclose PHI to your personal representative, as established under law, or to an administrator, executor, or other authorized individual associated with your estate.
Correctional institution - Phase2 may disclose the PHI of an inmate or other individual when requested by a correctional institution or law enforcement official for health, safety, and security purposes.
Serious threat to health or safety - Phase2 may disclose PHI if necessary to prevent or lessen a serious and/or imminent threat to health or safety to a person or the public or for law enforcement authorities to identify or apprehend an individual.
Research - Phase2 may use and disclose PHI for research. Limited data or records may be viewed by researchers to identify patients who may qualify for their research project or for other similar purposes, so long as the researchers do not remove or copy the PHI. Before we use or disclose PHI for any other research activity, one of the following will happen: 1) a special committee will determine that the research activity poses minimal risk to privacy and there is an adequate plan to safeguard PHI; 2) if the PHI relates to deceased individuals, the researchers give us assurances that the PHI is necessary for the research and will be used only as part of the research; or 3) the researcher will be provided only with information that does not identify you directly.
Government functions - In certain situations, Phase2 may disclose the PHI of military personnel and veterans, including Armed Forces personnel, as required by military command authorities. And we may disclose PHI to authorized officials for national security purposes, such as protecting the President of the United States, conducting intelligence, counter-intelligence, other national security activities, and when requested by foreign military authorities. Disclosures will be made only in compliance with U.S. Law.
Workers' compensation - As authorized by applicable laws, Phase2 may use or disclose PHI to comply with workers' compensation or other similar programs established to provide work-related injury or illness benefits.
De-identified Information and Limited Data Sets - Phase2 may use and disclose health information that has been “de-identified” by removing certain identifiers making it unlikely that you could be identified. Phase2 also may disclose limited health information, contained in a “limited data set”. The limited data set contains no information that can directly identify you. For example, a limited data set may include your city, county and zip code, but not your name or street address.
Other Uses and Disclosures of PHI - For purposes not described above, including uses and disclosures of PHI for marketing and disclosures that would constitute a sale of PHI, Phase2 will ask for patient authorization before using or disclosing PHI. If you signed an authorization form, you may revoke it, in writing except if action has been taken in reliance on the authorization.
Information Breach Notification - Phase2 must provide patient notification if it discovers a breach of unsecured PHI unless there is a demonstration, based on a risk assessment, that there is a low probability that the PHI has been compromised. You will be notified without unreasonable delay and within 60 days after discovery of the breach. Such notification will include information about what happened and what can be done to mitigate any harm.
Patient Rights Regarding PHI - Subject to certain exceptions, HIPAA establishes the following patient rights regarding PHI:
Right to Receive a Copy of the Phase2 Notice of Privacy Practices
You may receive a copy of the Phase2 Notice of Privacy Practices at any time by contacting us at clientservices@phase2laboratories.com calling us at 615.367.5014 and asking for the Phase2 HIPAA Privacy Officer, or by sending a written request to: HIPAA Privacy Officer, Phase2 Labs, 5225 Harding Pl., Nashville, TN 37217. This Notice will also be posted on the Phase2 internet site at www.phase2laboratories.com/privacynotice.
Right to Request Limits on Uses and Disclosures of your PHI
You may request that we limit: 1) how we use and disclose your PHI for treatment, payment, and health care operations activities; or 2) our disclosure of PHI to individuals involved in your care or payment for your care. Phase2 will consider your request but does not have to agree to it unless the requested restriction involves a disclosure not required by law to a health plan for payment or health care operations purposes and not for treatment, and you have paid for the service in full out of pocket. If we agree to a restriction on other types of disclosures, we will state the agreed restrictions in writing and will abide by them, except in emergency situations when the disclosure is for treatment.
Right to Request Confidential Communications
You may request that Phase2 communicate with you about your PHI at an alternative address or by an alternative means. Phase2 will accommodate reasonable requests.
Right to See and Receive Copies of Your PHI
You and your personal representative may access PHI consisting of your laboratory test results or reports ordered by your physician. Within 30 days after our receipt of your request, you will receive a copy of the completed laboratory report from Phase2 unless an exception applies. Exceptions include a determination by a licensed health care professional that the access requested is reasonably likely to endanger the life or safety of you or another person, and our inability to provide access to the PHI within 30 days, in which case we may extend the response time for an additional 30 days if we provide you with a written statement of the reasons for the delay and the date by which access will be provided. You may access and receive your PHI in an electronic format if it is readily producible in such a format. You may also direct Phase2 to transmit a copy to another person you designate, provided such request is in writing, signed by you, and clearly identifies the designated person and where to send the copy of your PHI. To request a copy of your PHI:
Contact the Privacy Officer by email at clientservices@phase2laboratories.com
Right to Receive an Accounting of Disclosures
You may receive a list of certain instances in which Phase2 disclosed your PHI. This list will not include certain disclosures of PHI, such as (but not limited to) those made based on your written authorization. If you request an accounting of disclosures of PHI made for purposes other than treatment, payment, or health care operations, the list will include disclosures made in the past six years, unless you request a shorter period of disclosures. If you request an accounting of disclosures of PHI made for treatment, payment, or health care operations, the list will include only those disclosures made in the past three years for which an accounting is required by law, unless you request a shorter period of disclosures.
Right to Correct or Update your PHI
If you believe that your PHI contains a mistake, you may request, in writing, that Phase2 correct the information. If your request is denied, we will explain the reasoning for our denial.
How to Exercise Your Rights - To exercise any of your rights described in this notice, you must send a written request to: HIPAA Privacy Officer, Phase2 Labs, 5225 Harding Pl., Nashville, TN 37217.
How to Contact Us or File a Complaint - If you have questions regarding the Phase2 Notice of Privacy Practices, or have a complaint about our use or disclosure of your PHI or our privacy practices, please contact: Privacy Officer by calling us at 615.367.1208 and ask for the Phase2 HIPAA Privacy Officer, or send a written request to: HIPAA Privacy Officer, Phase2 Labs, 5225 Harding Pl., Nashville, TN 37217. You also may file a complaint with the Secretary of the U.S. Department of Health and Human Services. Phase2 will not take retaliatory action against you for filing a complaint about our privacy practices.
Changes to the Phase2 Notice of Privacy Practices - Phase2 reserves the right to change this notice and to our privacy policies occasionally. Changes adopted will apply to any PHI we maintain about you. Phase2 must abide by the terms of our notice in effect. When changes are made, we will promptly update this notice and post the information on the Phase2 website at www.Phase2laboratories.com. Please review this site periodically to ensure that you know any such updates.
Effective Date of Notice: 03/2021