Notice of Privacy Practices

Summit Pathology – a Colorado General Partnership (SP) is committed to protecting the privacy of your protected health information or PHI. This includes laboratory test orders and test results as well as invoices for the healthcare services we provide. As a reference laboratory Summit Pathology collects PHI about you and stores it electronically on a computer. This is your medical record. The medical record is the property of Summit Pathology but the information in the medical record belongs to you.

Should you have any questions about this Notice or our privacy practices, please contact our Compliance Committee by email at compliance@summitpathology.com, you may write us at: Summit Pathology: 5802 Wright Drive, Loveland, CO 80538, utilize the Summit Pathology anonymous helpline at 833-836-6812, or file a concern at https://secure.ethicspoint.com/domain/media/en/gui/94514/index.html.

Our Responsibilities

Summit Pathology is required by law to maintain the privacy of your PHI. We are also required to provide you with this Notice upon request. It describes our legal duties, privacy practices and your patient rights as determined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended from time to time. We follow the terms of this Notice.

How We May Use or Disclose Your Health Information

We use your PHI for treatment, payment, or healthcare operations purposes and for other purposes permitted or required by law. Not every use or disclosure is listed in this Notice, but all of our uses or disclosures of your health information will fall into one of the categories listed below. We need your written authorization to use or disclose your health information for any purpose not covered by one of the categories below. Any authorization you provide may be revoked at any time. If you revoke your authorization, we will no longer use or disclose your health information for the reasons stated in your authorization except to the extent we have already acted based on your authorization. The law permits us to use or disclose your health information for the following purposes without your specific authorization:

Treatment

Summit Pathology provides laboratory testing for physicians and other healthcare professionals, and we use your information in our testing process. We disclose your health information to authorized healthcare professionals who order tests or need access to your test results for treatment purposes.

Payment

Summit Pathology will use your PHI as part of our billing process and may send it to insurance companies or other appropriate parties, including to you, to obtain payment for our services. If you are insured under another person’s health insurance policy (for example, parent, spouse, domestic partner, or a former spouse), we may also send invoices to the subscriber whose policy covers your health services.

Healthcare Operations

Summit Pathology may use or disclose your PHI for activities necessary to support our healthcare operations, such as performing quality checks on our testing, internal audits, or developing reference ranges for our tests.

Business Associates

We may provide your PHI to other companies or individuals to assist us in providing specific services requiring the use and disclosure of PHI. These other entities, known as “business associates,” are required to maintain the privacy and security of PHI. Our business associates must only use your health information for the services they perform on our behalf. For example, we may provide information to companies that assist us with billing of our services.

As Required by Law

In certain circumstances, federal or state laws may require that we provide your health information to organizations such as:

• Public Health Authorities
• The Food and Drug Administration
• Health Oversight Agencies
• Military Command Authorities
• National Security and Intelligence Organizations
• Correctional Institutions
• Organ and Tissue Donation Organizations
• Coroners, Medical Examiners and Funeral Directors
• Workers Compensation Agents

Law Enforcement Activities and Legal Proceedings

We may use or disclose your PHI, if necessary, to prevent or lessen a serious threat to your health and safety or that of another person. We may also provide PHI to law enforcement officials, for example, in response to a warrant, investigative demand or similar legal process, or for officials to identify or locate a suspect, fugitive, material witness, or missing person. We may also disclose PHI to appropriate agencies if we reasonably believe an individual to be a victim of abuse, neglect, or domestic violence.

We may disclose your PHI as required to comply with a court or administrative order. Finally, we may provide your PHI in response to a subpoena, discovery request or other legal process in the course of a judicial or administrative proceeding, but only if efforts have been made to tell you about the request or to obtain an order of protection for the requested information.

De-Identified Health Information

Summit Pathology may use and disclose health information that has been “de-identified” by removing certain identifiers, making it unlikely that you could be identified. We may also disclose limited health information contained in a “limited data set.” The limited data set does not contain any information that can directly identify you. For example, a limited data set may include your city, county, and Zip code but not your name or street address.

Marketing

We may provide information to you regarding treatment alternatives or other health-related benefits that may be of interest to you, but we must abide by strict limitations on third-party funding for such communications.

Sale of PHI

We are prohibited from selling your PHI without your prior authorization.

Note Regarding State Law

For all of the above purposes, when state law is more restrictive than federal law, we are required to follow the more restrictive state law.

Your Patient Rights

Receive Test Information

You have the right to receive a copy of your PHI that we have created, including completed test reports, test orders, ordering provider information, billing information, insurance information, etc. You may request a paper copy of your PHI or an electronic copy of your PHI that we maintain electronically, and you may also request that we transmit the information to you or to another individual or third party. Your request should be in writing addressed to Summit Pathology, 5802 Wright Drive, Loveland, CO, 80538 — Attention: Compliance Committee. We have thirty (30) days to act upon your request. Hard copy reports will be sent via Fed Ex and require a signature from the recipient. If another person requests access to your PHI on your behalf, we have the obligation to verify the identity and authority of any person requesting access to your PHI as your personal representative.

Reproductive Health Care Privacy¹

Summit Pathology prohibits the use and disclosure of protected health information (PHI), as a covered entity and business associates from the following:

• To conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing or facilitating reproductive health care, where such health care is lawful under the circumstance in which it is provided.
• The identification of any person for the purpose of conducting such investigation or imposing such liability.
• Under the Final Rule, the prohibition applies where Summit Pathology (covered entity) or business associate has reasonably determined that one or more of the following conditions exist:
  • The reproductive health care is lawful under the law of the state in which such health care is provided under circumstances in which it is provided.
  • The reproductive health care is protected, required, or authorized by Federal law, including the U.S. Constitution regardless of the state in which health care is provided.
  • The reproductive health care was provided by a person other than the covered health care provider, health plan, or health care clearinghouse (or business associate) that receives the request for PHI and the presumption described below.
    • The covered health care provider, health plan, or clearinghouse (or business associate) has actual knowledge that the reproductive health care was not lawful under the circumstances in which it was provided.
    • The covered health care provider, health plan, or health care clearinghouse (or business associate) receives factual information from the person making the request for the use or disclosure of PHI that demonstrates a substantial factual basis that the reproductive health care was not lawful under the circumstances in which it was provided.
• Summit Pathology will be required to obtain a signed attestation when it receives a request for PHI potentially related to reproductive health care that is not for a prohibited purpose. This attestation requirement applies when the request is for PHI for any of the following:
  • Health oversight activities
  • Judicial and administrative proceedings
  • Law enforcement purposes
  • Disclosures to coroners and medical examiners
• The requirement to obtain a signed attestation gives Summit Pathology (or business associate) a way of obtaining written representations from persons requesting PHI that their requests are not for a prohibited purpose. Additionally, it puts persons making requests for the use or disclosure of PHI on notice of the potential criminal penalties for those who knowingly and in violation of HIPAA, obtain individually identifiable health information (IIHI) relating to an individual or disclose IIHI to another person.

We may charge you a reasonable, cost-based fee for providing these copies. We may deny your access to the clinical laboratory results we have unless they have been first received by the ordering or requesting physician.

Amend Health Information

You may request changes to your PHI, and we will accommodate them if we can. However, we are not required to make the requested changes. If we deny your written request to change your PHI, we will provide you with a written explanation of the reason for the denial and additional information regarding further actions that you may take.

Accounting of Disclosures

You have the right to receive a list of certain disclosures of your health information made by Summit Pathology in the past six years from the date of your written request. Under the law, this does not include disclosures made for purposes of treatment, payment, or healthcare operations except for certain disclosures made through an electronic health record.

Request Restrictions

You may request that we agree to restrictions on certain uses and disclosures of your health information, but we are not required to agree to your request, with the following exception. You have the right to ask us to restrict the disclosure of health information to your health plan for a service we provide to you where you have directly paid us (out-of-pocket, in full) for that service, in which case we must honor your request.

Request Confidential Communications

You have the right to request that we send your health information by alternative means or to an alternative address, and we will accommodate reasonable requests.

Right to Pay Out-of-Pocket

You have the right to pay out-of-pocket for our services, and if you do so, you have the right to require that we not submit your Protected Health Information to your health plan.

How to Exercise Your Rights

You may write to us at the address at the beginning of this Notice with your specific request. Summit Pathology will consider your request and provide you a response within a reasonable period.

Receive Notice in the Event of a Breach

In the event of a breach of your PHI that has not been secured in accordance with federal standards (such as encrypted), you have the right to be notified of the breach and to be provided, to the extent available, with a description of the breach, a description of the types of information involved in the breach, the steps you should take to protect yourself from potential harm, a brief description of what we are doing to investigate the breach, mitigate harm, and prevent further breaches, as well as contact information for questions or concerns regarding the breach.

Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint with us. You also have the right to file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. Summit Pathology will not retaliate against any individual for filing a complaint. To file a complaint, write to us at 5802 Wright Drive, Loveland, CO, 80538 — Attention: Compliance Committee, utilize the Summit Pathology anonymous helpline at 833-836-6812, email at compliance@summitpathology.com or file a concern at https://secure.ethicspoint.com/domain/media/en/gui/94514/index.html.

Note

We reserve the right to amend the terms of this Notice to reflect changes in our privacy practices, and to make the new terms and practices applicable to all PHI that we maintain about you, including PHI created or received prior to the effective date of the Notice revision. Our Notice is displayed on our website www.summitpathology.com and a copy is available upon request.

¹ HHS.gov – Reproductive Health