NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (“Notice”) describes how Madison Core Laboratories, LLC may use and disclose Protected Health Information to carry out treatment, payment, and health care operations and for other purposes that are permitted or required by law. It also describes your rights regarding your Protected Health Information.

Our Obligations. We are required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) to maintain the privacy and security of Protected Health Information and to provide individuals with notice of our personal duties and privacy practices concerning Protected Health Information. We are required to abide by the terms of this Notice so long as it remains in effect. 

Revisions. We reserve the right to change the terms of this Notice as necessary and to make the new Notice effective for all Protected Health Information maintained by us. We will promptly distribute any updates whenever there is a material change to the uses or disclosures of PHI, your rights, our personal duties, or other privacy practices stated in the Notice. The new notice will be effective for all PHI that we maintain at the time as well as any information we receive in the future. You can obtain any revised notice by contacting our Privacy Officer. This Notice is also available on our website and in our facilities.

Contact Information. You may contact our Privacy Officer by telephone at (256) 850-0075 or by mail at Madison Core Laboratories, Attn: Privacy Officer, 2705 Artie Street SW, Suite 30 Building 400, Huntsville, Alabama 35805.  

DEFINITIONS

Protected Health Information or PHI means individually identifiable health information, as defined by HIPAA, that is created or received by us and that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and that identifies the individual or for which there is a reasonable basis to believe the information can be used to identify the individual. PHI includes information of persons living or deceased.

USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION

The following examples describe different ways that we use and disclose PHI. For each category of uses and disclosures, we will explain what we mean and, where appropriate, provide examples for illustrative purposes. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted or required to use and disclose PHI will fall within one of the categories.

For Treatment. We will use and disclose PHI to provide our laboratory services and other related health care services and, if applicable, to recommend different treatment or testing options. PHI may be disclosed to doctors, interns, nurses, technicians, volunteers, students, and others involved in your care. We may also disclose PHI to unaffiliated physicians who may be treating you. For example, your PHI may be provided to a physician to ensure that the physician has the necessary information to diagnose or treat you. In addition, we may disclose your PHI from time to time to another health care provider who, at the request of your physician, becomes involved in your care by providing assistance with your health care diagnosis or treatment.

For Payment. We may make requests, uses, and disclosures of your PHI as necessary for payment purposes. For example, we may use information regarding your medical testing to bill and process claims. For example, a bill may be sent to you or to your insurance company. This may also include certain activities that your health insurance plan may undertake before it approves or pays for the health care services, such as making a determination of eligibility or coverage for insurance benefits, reviewing services provided to you for medical necessity, and undertaking utilization review activities. We may also disclose your PHI for the payment purposes of a health care provider or a health plan. Please also see the “Your Rights Regarding PHI” section of this Notice.

For Health Care Operations. We may use and disclose your PHI as necessary for health care operations purposes. These uses and disclosures help us make sure that all of our patients receive quality care and for our operation and management purposes. This includes using and disclosing PHI to conduct quality assessments; for credentialing, licensure, certification, and accreditation; to improve our care and services; to train and evaluate our staff; to do an audit; to budget and plan; to learn how to improve our facilities and services; and for general administrative activities. For example, we may use your PHI to review the services you receive to check on the performance of our staff. We may also disclose information to doctors, nurses, technicians, medical students, and other personnel for educational and learning purposes.

For Health Information Exchanges (HIEs). We will send your PHI to any of the HIEs in which we participate. An HIE is an electronic system that helps health care providers and other entities, such as health plans and insurers, manage care and treat patients. Your PHI, including information about your medical care, medical conditions, and medications, is available to us and other unaffiliated health care providers who participate in the HIE. You have the right to opt-out of the HIE. However, even if you do, some of your health information will remain available to certain health care entities as permitted by law. If you have questions or would like to opt-out of any of the HIEs, contact our Privacy Officer.

Family and Friends Involved in Your Care. If you are available and do not object, we may disclose your PHI to your family, close friends, and others who are involved in your care or payment of a claim, or any other person you identify. If you are unavailable or incapacitated and we determine that a limited disclosure is in your best interest, we may share limited PHI with such individuals. Only the PHI that directly relates to that person’s involvement in your health care will be shared. We may use or disclose PHI to notify or assist in notifying (including identifying and locating) a family member, personal representative, or any other person that is responsible for your care about your location, general condition, or death.

Business Associates. We may disclose your PHI to our business associates that perform functions on our behalf or provide us with services if the information is necessary for such functions or services. Examples of these outside persons and organizations might include vendors that help us process claims. At times it may be necessary for us to provide certain of your PHI to one or more of these outside persons or organizations. All of our business associates are obligated, under contract with us, to protect the privacy of your information and are not allowed to use or disclose any information other than as specified in our contract.

Appointment Reminders/Treatment Alternatives/Health-Related Benefits and Services. We may use and disclose your PHI to contact you to remind you that you have an appointment for treatment or medical care, or to contact you to tell you about possible treatment options or alternatives or health-related benefits and services that may be of interest to you.

To You or Your Personal Representative.  We may disclose your PHI to you, or a representative appointed by you or designated by applicable law.

Disaster Relief Organizations. We may use or disclose your PHI to an authorized public or private entity to assist in disaster relief efforts for the purpose of coordinating uses and disclosures to family or other individuals involved in your health care.

Required by Law. We may use or disclose your PHI to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, to the extent required by law, of any such uses or disclosures.

Judicial and Administrative Proceedings. We may disclose your PHI to respond to a court or administrative order, a subpoena, discovery requests, or other lawful process in accordance with applicable law.

Public Health. We may use or disclose your PHI for public health activities and purposes. This includes disclosures to a public health authority that is permitted by law to collect or receive the information for the purposes of preventing or controlling disease, injury or disability (including reporting births, deaths, and certain injuries or illnesses) or conducting public health surveillance, public health investigations, and public health interventions. In addition, if directed by the public health authority, we may disclose PHI to a foreign government agency that is collaborating with the public health authority. We may also report reactions to medications or problems with products.

Abuse and Neglect. We may use or disclose your PHI to a public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect. We may also disclose PHI about an individual whom we reasonably believe to be a victim of abuse, neglect, or domestic violence to a government authority (including a social service or protective services agency) authorized by law to receive reports of such abuse, neglect, or domestic violence. We may do this when required by law, if you agree to the disclosure, or when authorized by law and we believe the disclosure is necessary to prevent serious harm to the individual or other potential victims.

Communicable Diseases. We may disclose your PHI, if authorized by law, to a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading the disease or condition.

Health Oversight. We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits; investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other similar activities involving the oversight of the health care system or government programs. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs, and civil rights laws.

Food and Drug Administration. We may disclose your PHI to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations; to track products to enable product recalls; to make repairs or replacements; or to conduct post-marketing surveillance, as required by law.

Coroners, Funeral Directors, and Medical Examiners. We may disclose certain PHI to a coroner, medical examiner, or funeral director, as authorized by law, in order to permit them to carry out their duties.

Organ Donation. If you are an organ or tissue donor, PHI may be used and disclosed to organ procurement organizations, tissue banks and eye banks and, upon request, to the person or entity that you designated to be the recipient, as necessary to facilitate organ or tissue donation and transplantation, including cadaveric organ, eye or tissue donation purposes.

Research. We may use and disclose your PHI for research purposes when the research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your PHI. We also may disclose health information about you to people preparing to conduct a research project (for example, to help them look for patients with specific medical needs), so long as the health information they review does not leave our organization.

To Avert a Serious Threat to Health and Safety. Consistent with applicable federal and state laws, we may disclose your PHI, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. 

Law Enforcement. We may also disclose your PHI if it is necessary for law enforcement authorities when required by law, including to report certain types of injuries, or in response to subpoenas, warrants, or summons; to identify or locate a suspect, fugitive, material witness, or missing person; to respond to requests about individuals who is or is suspected to be a victim of a crime; to alert law enforcement about a death; to report suspected criminal conduct committed at our facilities; or to alert law enforcement about a crime in certain emergency circumstances.

Military Activity. If you are a member of the armed forces, we may use or disclose PHI to your commanding officer or other command authority so that your fitness for duty or for a particular mission may be determined, to comply with military health surveillance requirements, for activities deemed necessary by appropriate military command authorities, or for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits. If you are a member of a foreign military service, we may release PHI about you to the appropriate foreign military authority.

For National Security and Intelligence Activities. We may disclose PHI to authorized federal officials for conducting national security, intelligence, and counterintelligence activities. PHI may also be disclosed to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state, or conduct special investigations.

Workers’ Compensation. If you seek treatment for a work-related illness or injury, we may disclose your PHI related to that injury or illness to workers’ compensation agencies for your workers’ compensation benefit determination or as authorized to comply with workers’ compensation laws and other similar personally established programs.

Inmates. If you are an inmate or under the custody of a law enforcement official, we may disclose PHI to the correctional institutions or law enforcement officials.

Required Uses and Disclosures. We will, if required by law, release your PHI to the Secretary of the Department of Health and Human Services for enforcement of HIPAA.

Uses and Disclosures of PHI that Require Your Written Authorization

Except as outlined above, we will not use or disclose your PHI unless you have signed a form authorizing the use or disclosure. Uses and disclosures of your PHI that involve the release of psychotherapy notes (if any), marketing, sale of your PHI, or other uses or disclosures not described in this Notice will be made only with your written authorization. You may revoke an authorization at any time, in writing, except to the extent we have taken an action in reliance on the use or disclosure indicated in the authorization. We are unable to take back any disclosures we have already made with your permission.

Special Protections for HIV, Alcohol and Substance Abuse, Mental Health and Genetic Information

Certain federal and state laws may require special privacy protections that restrict the use and disclosure of certain health information, including HIV-related information, alcohol and substance abuse information, mental health information, and genetic information. For this type of information, we may be required to get your written permission before disclosing it to others, and we may seek that permission if permitted by law. If you have any questions about this, you may contact our Privacy Officer for more information. In the event applicable law, other than HIPAA, prohibits or materially limits our uses and disclosures of PHI, as described above, we will restrict our uses or disclosure of your PHI in accordance with the more stringent standard.

RIGHTS THAT YOU HAVE REGARDING PHI

The following describes your rights with respect to your PHI and how you may exercise these rights. All requests must be submitted in writing to the Privacy Officer.  Please contact the Privacy Officer if you need additional information regarding any of these rights.

Access to Your PHI. With certain exceptions, you have the right of access to copy and/or inspect your PHI that we maintain in designated record sets. If we maintain the requested information in an electronic health record, you have the right to request that we send a copy in an electronic format. A “designated record set” contains medical and billing records and any other records that we use for making decisions about you. Under federal law, however, you may not inspect or copy psychotherapy notes or information compiled in reasonable anticipation of, or use in, a civil, criminal, or administrative action or proceeding. Certain requests for access to your PHI must be in writing, must state that you want access to your PHI and must be signed by you or your representative. Access request forms are available from us at the address below. We may charge you a reasonable fee for copying and postage. Depending on the circumstances, we may deny your request to inspect and/or copy your PHI. A decision to deny access may be reviewable, and we will inform you of your rights. Please contact the Privacy Officer if you have any questions about access to your PHI.

Restrictions on Use and Disclosure of Your PHI. You have the right to request restrictions on certain of our uses and disclosures of your PHI. This means that you may ask us not to make uses or disclosures of your PHI for treatment, payment, or health care operations purposes; disclosures to persons involved in your care; and disclosures for disaster relief purposes. For example, you may request that we not disclose your PHI to your spouse. Your request must describe in detail the restriction you are requesting.

We are not required to agree to your request but will attempt to accommodate reasonable requests when appropriate. If we agree to the requested restriction, we will not use or disclose your PHI in violation of that restriction unless it is needed to provide emergency treatment or otherwise required by law. With this in mind, please discuss any restriction you wish to request with your physician. You may request a restriction by contacting our Privacy Officer. Your request must state the specific restriction requested and to whom you want the restriction to apply.

We will honor requests to restrict the disclosure of PHI by us to a health plan for payment or health care operations when the information you wish to restrict pertains solely to a health care item or service for which you paid us out-of-pocket in full. For this purpose, “in full” means the amount we charge for the service, not your copay, coinsurance, or deductible responsibility when your health plan or insurer pays for your care. If you think you may wish to restrict the disclosure of your health information for a certain service, please let us know as early in your visit as possible by asking to speak with the Privacy Officer.

Request for Confidential Communications. You have the right to request that communications regarding your PHI be made by alternative means or at alternative locations. For example, you may request that messages not be left on voicemail or sent to a particular address. We are required to accommodate reasonable requests, but we may condition an accommodation by asking you for information as to how payment will be handled or specification of an alternative address or other method of contact. Requests for confidential communications must be in writing, signed by you or your representative, and sent to us at the address below. Your request must specify how or where you wish to be contacted, but we will not request an explanation from you as to the basis for the request. Please make this request in writing to our Privacy Officer.

Amendments to Your PHI. You have the right to request that PHI that we maintain about you be amended or corrected. If you feel that PHI is incorrect or incomplete, you may request an amendment of PHI about you in your designated record set for as long as we maintain this information. We are not obligated to make all requested amendments but will give each request careful consideration. If we deny your request for amendment, you have the right to file a statement of disagreement with us and we may prepare a rebuttal to your statement and will provide you with a copy of the rebuttal. To be considered, your amendment request must be in writing, must be signed by you or your representative, and must state the reasons for the amendment/correction request. Please be specific about the information that you believe is incorrect or incomplete. Amendment request forms are available from us at the address below. Please contact our Privacy Officer if you have questions about amending your medical record.

Accounting for Disclosures of Your PHI. You have the right to receive an accounting of certain disclosures made by us of your PHI. This right only applies to disclosures made by us during the last six years, and it does not include all types of disclosures. Examples of disclosures that we are required to account for include those to state insurance departments, pursuant to valid personal process, or for law enforcement purposes. However, the accounting will not include disclosures we may have made for treatment, payment, or healthcare operations; to you; pursuant to an authorization; for a facility directory; to family members or friends involved in your care, or for notification purposes. The right to receive this information is also subject to certain exceptions, restrictions, and limitations. If you submit a request, you must state the time period for which you want this listing (for example, six months). To be considered, your accounting requests must be in writing and signed by you or your representative. Accounting request forms are available from us at the address below. The first accounting in any 12-month period is free; however, we may charge you a fee for each subsequent accounting you request within the same 12-month period.

You have the right to receive notice of a data breach. We are required to notify affected individuals following a breach of unsecured PHI, as defined under HIPAA. If your PHI is affected by a breach, we will notify you in accordance with applicable law.

Right to a Copy of the Notice. You have the right to a paper copy of this Notice upon request by contacting us at the telephone number or address below. We will provide you with a paper copy of this Notice even if you have agreed to accept this Notice electronically.

QUESTIONS OR CONCERNS

Complaints. If you have any questions or complaints or believe your privacy rights have been violated, you can file a complaint with us in writing to our Privacy Officer at the address below. You may also file a complaint in writing with the Secretary of the U.S. Department of Health and Human Services in Washington, D.C. To submit a complaint to the Department of Health and Human Services, you may contact the Office for Civil Rights of the Department of Health and Human Services, Hubert H. Humphrey Building, 200 Independence Avenue, SW, Room 509F, Washington, D.C. 20201. Some states may allow you to file a complaint with Attorney General, Office of Consumer Affairs, or other agencies as specified by applicable law. There will be no retaliation for filing a complaint.

Contact Information. If you have questions or need further assistance regarding this Notice, you may contact us by writing to:

Madison Core Laboratories, LLC
Attn: Privacy Officer

2705 Artie Street SW,
Suite 30 Building 400
Huntsville, AL 35805

Phone: 256-850-0075 Fax: 256-850-3186

E-mail: [email protected]

EFFECTIVE DATE: This Notice is effective March 1, 2022.