HIPAA Policy & Notice of Privacy Practices

Key terms used in this HIPAA policy

These plain-language definitions explain a few words used throughout this Notice of Privacy Practices.

• Protected health information (PHI) means information that identifies you and relates to your health, the care you receive, or payment for that care, such as your test requisition, sample, test report, and insurance claims.
• Covered entity means a health care provider, health plan, or clearinghouse that must follow HIPAA. RPh Labs is a covered health care provider.
• Business associate means a company that handles PHI on our behalf, such as a billing service or secure cloud host, under a written business associate agreement.
• Treatment, payment, and health care operations are the everyday activities for which HIPAA allows us to use PHI without asking for your written authorization.
• Authorization means your signed, written permission for a specific use or disclosure that this notice does not otherwise allow.
• Breach means an unauthorized use or disclosure that compromises the privacy or security of your PHI.
• Minimum necessary means we limit each use or disclosure to the least PHI needed for its purpose.

1. Who this HIPAA policy applies to

RPh Labs (“RPh Labs,” “we,” “us”) is a CLIA-licensed, COLA-accredited clinical laboratory in Dallas, Texas that performs pharmacogenomic testing. Because we bill health plans electronically, we are a covered health care provider under the Health Insurance Portability and Accountability Act (HIPAA).

This HIPAA policy applies to all protected health information we create or receive, whether your test was ordered by your own healthcare provider or placed through our website and reviewed by a clinician. It covers our laboratory staff, client services and billing teams, and the business associates who work on our behalf.

Information that is not PHI, such as general website visits, cookie data, and marketing preferences, is covered by our Privacy Policy. If the two documents differ for protected health information, this Notice of Privacy Practices governs.

2. Our duties under HIPAA

The law requires us to:

• Maintain the privacy and security of your protected health information.
• Give you this Notice of Privacy Practices describing our legal duties and privacy practices.
• Follow the terms of the notice that is currently in effect.
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
• Not use or share your information other than as described here unless you tell us in writing that we can. If you give us permission, you may change your mind at any time by letting us know in writing.

3. How we use and disclose protected health information

HIPAA allows us to use and disclose PHI without your written authorization for treatment, payment, and health care operations. For each, we share only the minimum necessary.

Treatment

We use your requisition, sample, and medication list to perform the test, and we send your results to the healthcare provider who ordered or is reviewing them. Example: we send your pharmacogenomic report to your physician so they can consider it when choosing a medication or dose.

Payment

We use and disclose PHI to bill and collect payment from you, your health plan, or another payer. Example: we give your health plan the information it needs to process a claim, verify eligibility, or decide on prior authorization for your test. See the insurance plans we accept.

Health care operations

We use PHI to run the laboratory and improve quality, including proficiency testing, accreditation reviews, staff training, audits, and customer service. Example: our quality team reviews a sample record to confirm a result was reported accurately and on time.

Results and service messages

We may contact you about your kit, sample status, or results by phone, email, text, or through your account. You can ask us to use a different method or address, as described in Section 7.

People involved in your care

Unless you object, we may share relevant information with a family member, friend, or other person you identify who is involved in your care or in paying for it. For a patient under 18, results go to the ordering provider and the parent or legal guardian who authorized the test.

Business associates

We may share PHI with business associates, such as billing, shipping, and secure hosting vendors, who perform services for us. Each signs a business associate agreement requiring it to protect your information as HIPAA requires.

4. Other disclosures allowed or required by law

In limited situations, the law allows or requires us to share PHI without your authorization. We share only what the law allows, and only when the conditions are met:

• As required by law, including to the U.S. Department of Health and Human Services when it wants to confirm we comply with HIPAA.
• Public health and safety, such as reporting to public health authorities, preventing or reducing a serious threat to someone’s health or safety, or reporting suspected abuse, neglect, or domestic violence.
• Health oversight, for audits, inspections, licensure, and accreditation of our laboratory by agencies such as CMS under CLIA.
• Lawsuits and legal actions, in response to a court or administrative order, or to a subpoena when legal requirements are met.
• Law enforcement, when required by law or in response to a valid warrant or court order. We do not voluntarily share genetic data with law enforcement.
• Medical examiners, coroners, and funeral directors, as permitted by law.
• Workers’ compensation claims, as authorized by state law.
• Specialized government functions, such as military, national security, and protective services, when the law requires it.

5. Uses that need your written authorization

We will not use or disclose your protected health information for the following without your signed authorization:

• Marketing of products or services other than our own testing services.
• Sale of PHI. We never sell your protected health information.
• Research. Consistent with our Privacy Policy, we use PHI or samples for research only with your separate, written authorization.
• Employers and life, disability, or long-term care insurers. We share your results with them only if you authorize it in writing.
• Any other use or disclosure not described in this HIPAA policy.

You may revoke an authorization at any time by writing to our Privacy Officer. Revoking stops future uses and disclosures, but it does not undo anything we already did in reliance on your authorization.

6. Genetic information and GINA

Your pharmacogenomic results are genetic information, and HIPAA treats them as protected health information. The Genetic Information Nondiscrimination Act (GINA) and the HIPAA Privacy Rule prohibit health plans from using or disclosing genetic information for underwriting, such as setting premiums or deciding eligibility.

We use your sample only for the testing you or your provider ordered. We do not perform whole-genome sequencing or test for conditions outside the ordered panel.

7. Your HIPAA privacy rights

You have the following rights over your protected health information. To use any of them, contact our Privacy Officer as described in Section 13; some requests must be made in writing.

Get a copy of your test report and records

You can ask to see or get an electronic or paper copy of your test report and other PHI we hold about you. Under HIPAA, you may request lab results directly from the laboratory. We will respond within 30 days, and may charge a reasonable, cost-based fee.

Ask us to correct your records

If you think information we hold is incorrect or incomplete, you can ask us to amend it. We may say no, but we will tell you why in writing within 60 days.

Request confidential communications

You can ask us to contact you in a specific way, such as a different phone number or mailing address. We will say yes to all reasonable requests.

Ask us to limit what we use or share

You can ask us not to use or share certain information for treatment, payment, or operations. We are not required to agree, and we may say no if it would affect your care. If you pay for a test out of pocket in full, you can ask us not to share that information with your health plan for payment or operations, and we will say yes unless the law requires us to share it.

Get a list of those we have shared information with

You can ask for an accounting of the times we shared your PHI in the six years before your request, who we shared it with, and why. It excludes disclosures for treatment, payment, and operations and some others. We provide one accounting a year for free.

Get a copy of this notice

You can ask for a paper copy of this Notice of Privacy Practices at any time, even if you agreed to receive it electronically.

Choose someone to act for you

If you have given someone medical power of attorney, or someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will confirm the person has this authority before we act.

8. Texas privacy law

Where Texas or another state’s law gives you more protection than HIPAA, we follow the more protective law. Under the Texas Medical Records Privacy Act:

• We train our workforce on state and federal privacy law.
• Your protected health information may be subject to electronic disclosure, for example when we send results to your provider or claims to your health plan. We do not electronically disclose PHI for purposes other than treatment, payment, health care operations, or as otherwise authorized or required by law without your authorization.
• If we maintain your records electronically and you make a written request, we will give you an electronic copy within 15 business days.

9. Breach notification

If a breach of unsecured protected health information affects you, we will notify you without unreasonable delay and no later than 60 days after we discover it. The notice will explain what happened, what information was involved, what we are doing about it, and steps you can take to protect yourself. We also report breaches to the U.S. Department of Health and Human Services and, when required, to the media.

10. How we protect your information

We use administrative, technical, and physical safeguards designed to protect PHI, including encryption in transit and at rest, role-based access limited to staff who need it, coded sample labels inside the laboratory, audit logs, and regular HIPAA and Texas privacy training for our workforce. Business associates must meet the same standard under written agreements.

11. Changes to this HIPAA policy

We can change the terms of this Notice of Privacy Practices, and the changes will apply to all information we have about you. The new notice will be posted on this page with a new effective date, and it will be available on request.

12. How to file a complaint

If you believe your HIPAA privacy rights have been violated, you can file a complaint with our Privacy Officer using the contact details below. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or filing online.

We will not retaliate against you for filing a complaint.

13. Contact our Privacy Officer

Questions about this HIPAA policy, or ready to make a request? Contact our Privacy Officer, or use our contact page. For how we handle website and marketing data, see our privacy FAQ.

RPh Labs results are intended to be interpreted with a licensed healthcare provider.