THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Genalyte’s Protection of Protected Health Information (PHI)

Under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and related amendments to both HIPAA and HITECH, Genalyte, Inc. (“Genalyte”) is required by law to maintain the privacy of your individually identifiable health information, called protected health information (“PHI”), and to provide you with notice of our legal duties and privacy practices with respect to your PHI. This protection applies to any PHI whether in oral, written or electronic format.  Genalyte is committed to the protection of your PHI in compliance with all local, state and federal laws and regulations and will make reasonable efforts to ensure the confidentiality of your PHI.  We take this commitment seriously and we strongly urge you to read this notice carefully.

Genalyte’s Use and Disclosure of PHI

Genalyte collects your PHI to the extent necessary to provide services and obtain payment for these services.  If a breach occurs that compromises the privacy or security of your information, we will let you know promptly.  When it comes to your health information, you have certain rights.  While we cannot list every possible use or disclosure, all of the ways we use or disclose your PHI will fall into one of the following categories.

• FOR TREATMENT – Genalyte will use your PHI to provide your medical care, and we disclose PHI to physicians, nurses, pharmacies, and other health care professionals who provide you with health care services and/or are involved in the coordination of your care, such as providing your physician with your laboratory test results.  We may also disclose your PHI to another laboratory if we are unable to perform the testing ourselves.
• FOR PAYMENT – Genalyte will use or disclose PHI to obtain payment for laboratory services we provide.  For example, we may provide PHI to a third-party billing company or your health plan to receive payment for the health care services provided to you.
• FOR HEALTH CARE OPERATIONS – Genalyte will use or disclose your PHI for health care operations purposes.  Genalyte may also disclose PHI to other health care providers or health plans that are involved in your care for their health care operations. For example, we use health information about you to manage your treatment and services.
• FOR PERSONS INVOLVED IN YOUR CARE – Genalyte may disclose PHI to individuals, such as family members or others who are involved with your care or assist you in paying for your care. We also may disclose such information to an entity assisting in a disaster relief effort. To the extent allowed by federal and state law, we may disclose the PHI of minors to their parents or legal guardians.
• FOR BUSINESS ASSOCIATES – We may also disclose PHI to our business associates, such as our billing service, that perform administrative services for us.  We have written agreements with each of our business associates that outlines the protection of your confidentiality.

Other Uses and Disclosures: We are permitted and/or required by law to disclose your PHI without your consent, subject to conditions specified by law.

• To comply with the law.  We will share information about you if state and federal laws require it, including the U.S. Department of Health and Human Services if they want to see that we are complying with federal privacy law.
• In response to a court or administrative order, subpoena, discovery request, or other lawful process, including but not limited to the following:

• For law enforcement purposes, including reporting of certain types of wounds or physical injuries or in response to a court order, warrant, subpoena or summons, or similar process authorized by law;
• For identification or location of a suspect, fugitive, material witness or missing person;
• If we believe you to be a victim of a crime we may release your PHI to certain governmental agencies;
• To medical examiners or coroners for the purpose of identifying a deceased person, determining the cause of death, or another purpose authorized by law and to funeral directors as necessary to carry out their duties with respect to the deceased consistent with applicable law;
• In relation to criminal conduct on Genalyte premises;
• To law enforcement officials to identify or locate suspects, fugitives, witnesses, victims of crimes, or any other allowable law enforcement purpose;
• As required by law to a government oversight agency conducting audits, investigations, inspections, oversight functions, and to prevent a serious and imminent threat to an individual or the public;
• For public health activities such as required public health investigations as well as reporting of disease, injury, and death;
• To the U.S. Food and Drug Administration for the purpose of reporting adverse events, product defects, and participation in product recall;
• In relation to your worker’s compensation benefits;
• To a personal representative who administers or executes your estate as established under applicable law;
• To researchers conducting research with respect to which your written consent is not required as approved by an Institutional Review Board in compliance with governing law so long as researchers do not remove or copy any of the PHI;
• If you are a member of the military, to include military personnel, veterans, and the U.S. Armed Forces for activities set forth by certain military command authorities required by armed forces services.  This also includes authorization for, if necessary, national security, intelligence, or protective services activities compliant with U.S. Law;
• De-identified Information and Limited Data Sets may be used or disclosed.  Health information that has been de-identified does not contain any information that can directly identify you.  Both de-identified information and limited data sets do not contain any information that could directly identify you.  For example, a limited data set may include your city, but not your street address or name.