EFFECTIVE January 1, 2011

PRINCIPAL LAB SYSTEMS^™ - NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY

Principal Lab Systems values you as a customer, and protection of your privacy is very important to us. PrincipalLabSystems.com does not collect protected health information (PHI). For our Privacy Statement regarding this website, visit our Privacy Policy page.

In conducting our business, we will create and maintain records that contain PHI about you and the healthcare provided to you.

Protected health information is information about you—including information about where you live—that can reasonably be used to identify you and that relates to your past, present, or future health or condition; the provision of healthcare to you; or the payment for that care.

We protect your privacy by:

• limiting who may see your PHI,
• limiting how we may use or disclose your PHI,
• informing you of our legal duties with respect to your PHI,
• explaining our privacy policies, and
• adhering to the policies currently in effect

This notice describes our privacy practices, which include how we may use, disclose, collect, handle, and protect our members’ PHI. We are required by certain federal and state laws to maintain the privacy of your PHI. We also are required by the federal Health Insurance Portability and Accountability Act (or “HIPAA”) Privacy Rule to give you this notice about our privacy practices, our legal duties, and your rights concerning your PHI.

This notice takes effect on January 1, 2011, and will remain in effect until we replace or modify it.

Copies of this Notice

You may request a copy of our notice at any time. If you want more information about our privacy practices or have questions or concerns, please contact Member Services by calling the telephone number on the back of your Member Identification Card, or contact us using the contact information at the end of this notice.

Changes to this Notice

The terms of this notice apply to all records that are created or retained by us that contain your PHI. We reserve the right to revise or amend the terms of this notice. A revised or amended notice will be effective for all of the PHI that we already have about you, as well as for any PHI we may create or receive in the future. We are required by law to comply with whatever privacy notice is currently in effect. When changes are made, we will promptly update this notice. Please review this site periodically to ensure that you are aware of any such updates.

Potential Impact of State Law

The HIPAA Privacy Rule generally does not “preempt” (or take precedence over) state privacy or other applicable laws that provide individuals greater privacy protections. As a result, to the extent state law applies, the privacy laws of a particular state, or other federal laws, rather than the HIPAA Privacy Rule, might impose a privacy standard under which we will be required to operate. For example, where such laws have been enacted, we will follow more stringent state privacy laws that relate to uses and disclosures of the PHI concerning HIV or AIDS, mental health, substance abuse/chemical dependency, genetic testing, reproductive rights, etc.

How We May Use and Disclose Your Protected Health Information

In order to administer our laboratory services effectively, we will collect, use, and disclose PHI for certain activities, including payment performance of laboratory services, collection of laboratory samples, reporting of laboratory results, and billing and payment of accounts. The following categories describe the different ways in which we may use and disclose your PHI. Please note that every permitted use or disclosure of your PHI is not listed below. However, the different ways we will, or might, use or disclose your PHI do fall within one of the permitted categories described below.

Treatment: We may use or disclose PHI for treatment purposes, including disclosure to physicians, nurses, medical students, pharmacies, and other healthcare professionals who provide you with healthcare services and/or are involved in the coordination of your care, such as providing your physician with your laboratory test results.

Payment: We may use and disclose your PHI for all payment activities, including, but not limited to, collecting payments for services. This may include coordinating benefits with healthcare programs and insurance carriers, as well as Medicare and Medicaid. For example, we may use and disclose your PHI to bill for services provided to you that are covered by your health plan(s), or to determine if requested services are covered under your health plan. We may also use and disclose your PHI to conduct business with Principal Lab Systems' affiliate companies.

Laboratory Operations: We may use or disclose PHI for healthcare operations purposes. These uses and disclosures are necessary, for example, to evaluate the quality of our laboratory testing, the accuracy of results, accreditation functions, and for operation and management purposes. We may also disclose PHI to other healthcare providers or health plans that are involved in your care for their healthcare operations. For example, Principal Lab Systems may provide PHI to manage a disease or to coordinate healthcare or health benefits. We may also use and disclose your PHI to offer you one of our value-added programs or health-related services, to provide you with information about one of our disease-management programs, or to provide you with information on our other health products and health services. We may also use and disclose your PHI to inform you of treatment alternatives and/or health-related benefits and services that may be of interest to you.

Appointment reminders and health-related benefits and services:  We may use and disclose PHI to contact you as a reminder that you have an appointment with us or our contracted providers and may use and disclose PHI to tell you about health-related benefits and services that may be of interest to you.  For example, Principal Lab may contact you about a new laboratory for specimen collection in your area or about new testing services available at Principal Lab Systems.

Marketing: We may use your PHI to inform you of educational opportunities or opportunities to participate in Principal Lab Systems-sponsored events, activities, and products.

Research: We may use or disclose your PHI for research purposes if certain conditions are met. Before we disclose your PHI for research purposes without your written permission, an Institutional Review Board (a board responsible under federal law for reviewing and approving research involving human subjects) or a Privacy Board reviews the research proposal to ensure that the privacy of your PHI is protected.

De-identified information and limited data sets: We may use and disclose health information that has been “de-identified” by removing certain identifiers, making it unlikely that you could be identified. We also may disclose limited health information contained in a “limited data set.” The limited data set does not contain any information that can directly identify you. For example, a limited data set may include your city, county, and ZIP code, but not your name or street address.

Required by Law: We may disclose your PHI when required to do so by applicable law. For example, the law requires us to disclose your PHI:

• When required by the Secretary of the U.S. Department of Health and Human Services to investigate our compliance efforts, and
  
  
• To health oversight agencies, to allow them to conduct audits and investigations of the healthcare system, to determine eligibility for government programs, to determine compliance with government program standards, and for certain civil rights enforcement actions.

Public Health Activities: We may disclose your PHI to public health agencies for public health activities that are permitted or required by law, such as to:

• prevent or control disease, injury, or disability;
• maintain vital records, such as births and deaths;
• report child abuse and neglect;
• notify a person about potential exposure to a communicable disease;
• notify a person about a potential risk for spreading or contracting a disease or condition;
• report reactions to drugs or problems with products or devices;
• notify individuals if a product or device they may be using has been recalled; and
• notify appropriate government agency(ies) and authority(ies) about the potential abuse or neglect of an adult patient, including domestic violence.

Health Oversight Activities: We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, licensure, or disciplinary actions, or for civil, administrative, or criminal proceedings or actions. Health oversight agencies seeking this information include government agencies that oversee: (i) the healthcare system, (ii) government benefit programs, (iii) other government regulatory programs, and (iv) compliance with civil rights laws.

Lawsuits and Other Legal Disputes: We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process once we have met all administrative requirements of the HIPAA Privacy Rule.

Law Enforcement: We may disclose your PHI to law enforcement officials under certain conditions. For example, we may disclose PHI:

• to permit identification and location of witnesses, victims, and fugitives;
• in response to a search warrant or court order;
• as necessary to report a crime on our premises;
• to report a death that we believe may be the result of criminal conduct; or
• in an emergency, to report a crime.

Coroners, Medical Examiners, or Funeral Directors: We may release PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or to determine the cause of death. We also may disclose, as authorized by law, information to funeral directors so that they may carry out their duties.

Organ and Tissue Donation: We may use or disclose your PHI to organizations that handle organ and tissue donation and distribution, banking, or transplantation.

To Prevent a Serious Threat to Health or Safety: As permitted by law, we may disclose your PHI if we believe that the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

Military and National Security: We may disclose to military authorities the PHI of Armed Forces personnel under certain circumstances. We may disclose to authorized federal officials PHI required for lawful intelligence, counterintelligence, and other national security activities.

Inmates: If you are a prison inmate, we may disclose your PHI to the prison or to a law enforcement official for: (1) the prison to provide healthcare to you; (2) your health and safety, and the health and safety of others; or (3) the safety and security of the prison.

Workers’ Compensation: As part of your workers’ compensation claim, we may have to disclose your PHI to a workers' compensation carrier.

To You: When you ask us to, we will disclose to you your PHI.

To Your Personal Representative: If you tell us to, we will disclose your PHI to someone who is qualified to act as your personal representative according to any relevant state laws. In order for us to disclose your PHI to your personal representative, you must send us a completed Principal Lab Systems Personal Representative Designation Form or documentation that supports the person’s qualification according to state law (such as a power of attorney or guardianship). To request the Principal Lab Personal Representative Designation Form, please contact Customer Support at the telephone number listed on our website and at the end of this notice, or write to us at the address at the end of this notice. However, the HIPAA Privacy Rule permits us to choose not to treat that person as your personal representative when we have a reasonable belief that: (i) you have been, or may be, subjected to domestic violence, abuse, or neglect by the person; (ii) treating the person as your personal representative could endanger you; or (iii) in our professional judgment, it is not in your best interest to treat the person as your personal representative.

To Family and Friends: Unless you object, we may disclose your PHI to a friend or family member who has been identified as being involved in your healthcare. We also may disclose your PHI to an entity assisting in a disaster relief effort, so that your family can be notified about your condition, status, and location. If you are not present or able to agree to these disclosures of your PHI, then we may, using our professional judgment, determine whether the disclosure is in your best interest.

Parents as Personal Representatives of Minors: In most cases, we may disclose your child’s PHI to you. However, we may be required to deny a parent’s access to a minor’s PHI according to applicable state law.

Right to Provide an Authorization for Other Uses and Disclosures

• Other uses and disclosures of your PHI that are not described above will be made only with your written authorization.
  
  
• You may give us written authorization permitting us to use your PHI or disclose it to anyone for any purpose.
  
  
• We will obtain your written authorization for uses and disclosures of your PHI that are not identified by this notice, or are not otherwise permitted by applicable law.

Any authorization that you provide to us regarding the use and disclosure of your PHI may be revoked by you in writing at any time. After you revoke your authorization, we will no longer use or disclose your PHI for the reasons described in the authorization. Of course, we are unable to take back any disclosures that we have already made with your authorization. We may also be required to disclose PHI as necessary for purposes of payment for services received by you prior to the date when you revoke your authorization.

Your authorization must be in writing and contain certain elements to be considered a valid authorization. For your convenience, you may use our approved Principal Lab Authorization Form. To request the Principal Lab Systems Authorization Form, please contact Customer Service at the telephone number listed at the end of this notice, or write to us at the address at the end of this notice.

Your Privacy Rights Concerning Your Protected Health Information

You have the following rights regarding the PHI that we maintain about you. Requests to exercise your rights as listed below must be in writing. For your convenience, you may use our approved Principal Lab Systems form(s). To request a form, please contact Customer Service at the telephone number listed at the end of this notice, or write to us at the address at the end of this notice.

Right to Access Your PHI: You have the right to inspect or get copies of your PHI. You may request that we provide copies of your PHI in a format other than photocopies. We will use the format you request unless we cannot practicably do so. We may charge a reasonable fee for copies of PHI (based on our costs), for postage, and for a custom summary or explanation of PHI. You will receive notification of any fee(s) to be charged before we release your PHI, and you will have the opportunity to modify your request in order to avoid or reduce the fee. In certain situations, we may deny your request for access to your PHI. If we do, we will tell you our reasons in writing and explain your right to have the denial reviewed.

Right to Amend Your PHI: You have the right to request that we amend your PHI if you believe there is a mistake in your PHI or that important information is missing. Approved amendments made to your PHI will also be sent to those who need to know, including (where appropriate) Principal Lab Systems vendors (known as "Business Associates"). We may deny your request if, for instance, we did not create the information you want to amend. If we deny your request to amend your PHI, we will tell you our reasons in writing and explain your right to file a written statement of disagreement.

Right to an Accounting of Certain Disclosures: You may request, in writing, that we tell you when we or our Business Associates have disclosed your PHI (an “Accounting”). Any accounting of disclosures will not include those we made:

• for payment, or laboratory services or operations;
• to you or individuals involved in your care;
• with your authorization;
• for national security purposes;
• to correctional institution personnel; or
• before January 1, 2011.

The first accounting in any 12-month period is without charge. We may charge you a reasonable fee (based on our cost) for each subsequent accounting request within a 12-month period. If a subsequent request is received, we will notify you of any fee to be charged, and we will give you an opportunity to withdraw or modify your request in order to avoid or reduce the fee.

Right to Request Restrictions: You have the right to request, in writing, that we place additional restrictions on our use or disclosure of your PHI. We are not required to agree to your request. However, if we do agree, we will be bound by our agreement except when required by law, in emergencies, or when information is necessary to treat you. An approved restriction continues until you revoke it in writing, or until we tell you that we are terminating our agreement to a restriction.

Right to Request Confidential Communications: You have the right to request, in writing, that we use alternate means or an alternative location to communicate with you in confidence about your PHI. For instance, you may ask that we contact you by mail, rather than by telephone, or at work, rather than at home. Your written request must clearly state that the disclosure of all or part of your PHI at your current address or method of contact we have on record could be an endangerment to you. We will require that you provide a reasonable alternate address or other method of contact for the confidential communications. In assessing reasonableness, we will consider our ability to receive payment and conduct healthcare operations effectively, as well as the subscriber’s right to payment information. We may exclude certain communications that are commonly provided to all patients from confidential communications.

Right to a Paper Copy of This Notice: You have the right to receive a paper copy of our Notice of Privacy Practices. You can request a copy at any time, even if you have agreed to receive this notice electronically. To request a paper copy of this notice, please contact Customer Service at the telephone number listed at the end of this notice or write to us at the address at the end of this notice.

Your Right to File a Privacy Complaint

If you believe your privacy rights have been violated, or if you are dissatisfied with Principal Lab Systems' privacy practices or procedures, you may file a complaint with Principal Lab Systems and with the Secretary of the U.S. Department of Health and Human Services. You will not be penalized for filing a complaint. To file a privacy complaint with us, you may contact Customer Service at the telephone number listed at the end of this notice or write to us at the address at the end of this notice.