Notice of Privacy Practices

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

About Us
In this Notice, we use terms like “we,” “us” or “our” to refer to Ambry Genetics Corporation (“Ambry”). We are a College of American Pathologists-accredited and Clinical Laboratory Improvement Amendments (CLIA)-certified commercial clinical laboratory with headquarters in Aliso Viejo, Orange County, California. Ambry is a leader in providing genetic services focused on clinical diagnostics and genomic services, particularly in sequencing and array services. We have established a reputation for unparalleled service, and for over a decade we have been at the forefront of applying new technologies to the clinical molecular diagnostics market and the advancement of disease research.

This Notice applies to Ambry, including its scientists, clinical directors, genetic counselors and administrative employees. Our health care delivery sites include the laboratory facilities listed on our website at www.ambrygen.com. We share your protected health information to provide you with our genetic testing services, to seek payment for our services and to conduct our business operations. Ambry provides genetic test results only to your ordering health care provider or authorized healthcare professional.

What is “Protected Health Information” or “PHI”? 
“Protected health information,” or “PHI,” is information that identifies who you are and relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or past, present, or future payment for the provision of health care to you. Your PHI includes your genetic information. PHI does not include information about you that does not identify who you are.

Purpose of this Notice
As a health care provider, we gather, maintain and disclose PHI about our patients for purposes of our patients’ treatment, payment, or overall healthcare operations. We respect the privacy of your PHI and understand the importance of keeping this information confidential and secure. We are required by law to maintain the privacy of your PHI by implementing reasonable and appropriate safeguards. We are also required to explain to you by this Notice our legal duties and privacy practices with respect to PHI. We are also required by law to notify affected individuals following a breach of unsecured PHI. Ambry has only five business days after discovering a breach of medical information to report it to all affected patients. (Cal. Health & Safety Code §1280.15(b)(2)) In the event that your information is breached, Ambry is required, by California law, to notify you or any affected party within five business days after discovering a breach of medical information. The notice must include a general description of the incident, type of information breached, date and time of the breach, and toll-free telephone numbers and addresses of the major credit reporting agencies in California. In addition, Ambry must send an electronic copy of the notice to the Attorney General if a single breach affects more than 500 Californians. Under California law, you have the right to sue either Ambry or the person responsible for a breach of medical information. However, proof of actual monetary damage is required.

How We Protect Your PHI
We restrict access to your PHI to those employees who need access in order for Ambry to provide genetic services and conduct its business operations. We have established and maintain physical, technical and administrative safeguards to protect your PHI against unauthorized use or disclosure.

Types of Use and Disclosure of PHI We May Make Without Your Authorization

Treatment, Payment and Health Care Operations
Federal and state law allow us to use and disclose your PHI in order to provide health care services to you, as well as to bill and collect payment for the health care services provided to you. For example, information obtained from your health care provider or genetic counselor will be recorded in your record and used to conduct genetic testing, analyze and report the test results to the health care provider who ordered the test.

We may also disclose your PHI (excluding the results of genetic tests) to health plans or other responsible parties to receive payment for the services we provide on your behalf.

Federal and state laws also allow us to use and disclose your PHI as necessary in connection with our health care operations. Members of our laboratory staff or quality improvement team may use the PHI in your health record to assess the quality of the genetic testing services we provide. We may also disclose your PHI to our business associates, who must also agree to safeguard your PHI as required by law.

Other Types of Use and Disclosures (No Authorization Required)
Federal law permits health care providers who are governed by HIPAA, including Ambry, to use and disclose PHI without authorization for the following purposes:

  1. When required by law – In some circumstances, we are required by federal or state laws to disclose certain PHI to others, such as public agencies for various reasons;
  2. For public health activities – Such as reports about genetic disease profiles;
  3. Reports about child and other types of abuse or neglect, or domestic violence;
  4. For health oversight activities – Such as reports to governmental agencies that are responsible for licensing or disciplinary action against physicians or other health care providers;
  5. For lawsuits and other proceedings – In connection with court proceedings or proceedings before administrative agencies;
  6. For law enforcement purposes – In response to a warrant, or to report a crime;
  7. Reports to coroners, medical examiners, or funeral directors – To assist them in performance of their legal duties;
  8. For tissue or organ donations – To organ procurement or transplant organizations to assist them;
  9. For research – We may use and disclose your PHI for research purposes. We specifically may allow researchers to review your PHI for purposes of preparing a research protocol or similar purposes preparatory to research, so long as a special committee determines that the research activity poses a minimal risk to individual privacy, there is an adequate plan to safeguard the PHI, the research could not practicably be conducted without access to and use of the PHI, and the researchers do not remove any PHI from our facility while they review it. If the research requires PHI relating to a deceased individual, the researchers must provide us with assurances that the PHI is necessary for the research and will be used only as part of the research. If these requirements are not satisfied, we may disclose health information to the researchers that does not identify you (see “Use and Disclosure of ‘De-Identified’ PHI, below);
  10. To avert a serious threat to the health or safety of you or other members of the public;
  11. For specialized government functions and activities (e.g., military and veterans’ activities); and
  12. In connection with services provided under workers’ compensation laws.

Uses and Disclosures Requiring You to Have the Opportunity to Agree or Object
Before we make certain uses and disclosures of your PHI without your written authorization, we must provide you with an opportunity to agree or object. We may disclose your PHI to your family members or other persons if they are involved in your care or payment for that care. We will provide you with the opportunity to agree or object prior to these disclosures.

Use and Disclosure of “De-Identified” PHI
We may disclose “de-identified” health information about you without your authorization if we first remove all numbers, characteristics, codes and other identifiers that reasonably could identify you.

Special Rules for Parental Access to PHI of Minor Children 
You, as a parent, can generally control your minor child’s PHI. In some cases, however, we are permitted or even required by law to deny your access to your child’s PHI, such as when your child can legally consent to medical services without your permission.

Uses and Disclosures Requiring Your Authorization
We must obtain your written authorization prior to the following uses and disclosures of your PHI:

  1. Marketing Activities – We must obtain your written authorization in order to use your PHI to send you marketing materials. No authorization is required for marketing information provided to you during a face-to-face communication, or for promotional gifts of nominal value.
  2. Sale of PHI – We must obtain your written authorization prior to any sale of your PHI. You should not infer that Ambry has any plans to sell your PHI. 

All other uses and disclosures of your PHI that are not described in this Notice require your written authorization.
If you need an authorization form, we will send you one for you or your personal representative to complete. When you receive the form, please fill it out and send it to the following address:

Ambry Genetics Corporation
15 Argonaut
Aliso Viejo, CA 92656
Attention: Director of Compliance

You may revoke or modify your authorization at any time by writing to us at the same address. Please note that your revocation or modification may not be effective in some circumstances, such as when we have already taken action relying on your authorization.

Your Rights Regarding Your PHI

Access to Your PHI
Any adult patient or any minor patient who by law can consent to medical treatment (or certain patient representatives), is entitled to inspect patient records upon written request to a Ambry and upon payment of reasonable clerical costs to make such records available.

Ambry is required to provide you access to or a legible copy of the requested medical and billing records, for as long as we maintain such records. If you wish to access your PHI, please provide a detailed written description of the PHI you wish to review at the address given above. If you would like a copy of the information we have, your request should be made in writing and sent to the same address. You may also receive copies of your records within 30 days of your written request.

We will respond to your request and tell you when and where you can review your PHI in our possession within our normal business hours. We must then permit you to view your records during business hours within five (5) working days after receipt of the written request. You or your representative may be accompanied by one other person of your choosing. Prior to inspection or copying of records, Ambry may require reasonable verification of identity, so long as this is not used oppressively or discriminatorily to frustrate or delay compliance with this law. If we provide you with a copy of your PHI, we may charge a reasonable administrative fee for copying your PHI to the extent permitted by applicable law. If we don’t have your PHI, but know who does, we will tell you whom to contact.

In limited circumstances, we may deny your request to inspect or obtain copies of your PHI. We will explain in writing the reason for our denial, and you will have the opportunity, unless limited exceptions apply, to request review of the denial. We will comply with the outcome of the review. In addition, federal law does not entitle individuals to have access to certain kinds of PHI, including (1) information compiled in reasonable anticipation of, or use in, legal proceedings, and (2) other PHI to which access is prohibited by federal law.

Right to Amend Your PHI 
You have the right to request amendments to your PHI for so long as the information is maintained in our medical and billing records. If you wish to have your PHI corrected or updated, please write to us and tell us what you want changed and why. We will respond to you in writing, either accepting or denying your request. If we deny your request, we will explain why. You may also send us an addendum that is no longer than 250 words in length for each item you believe is incorrect. Please clearly indicate that you want the addendum to be included in your PHI. If we accept your request, we will attach your addendum to the record(s) of your PHI. Your amended PHI will be available for your review upon request.

Right to Receive an Accounting of Disclosures of Your PHI
You have the right to request an accounting of certain disclosures that we make of your PHI. An accounting lists disclosures we have made prior to the date of your request. You can request an accounting by writing to us. We will respond to your request within a reasonable period of time, but no later than 60 days after we receive your written request. Please note that certain disclosures need not be included in the accounting we provide to you, such as disclosures made for treatment, payment or health care operations, and disclosures made more than 6 years prior to the date of your request.

Right to Receive a Copy of This Notice
You have the right to request and receive a paper copy of this Notice, even if you have agreed to receive the Notice electronically. You may contact our Aliso Viejo office for a copy, and one will be provided to you at no charge. The Notice is also available on our website at www.ambrygen.com.

Right to Request Restrictions
You have the right to request restrictions on how we use and disclose your PHI for treatment, payment, and health care operations. All requests must be made in writing. Upon receipt, we will review your request and notify you whether we have accepted or denied your request. If we agree to your request, we will comply with the restriction unless a disclosure is required in order to provide you with emergency treatment. Please note that we are not required to accept your request for restrictions, except that we are required, based on your written request, to restrict disclosure of your PHI to a health plan if (1) the purpose of the disclosure is to carry out payment or health care operations, (2) the disclosure is not otherwise required by law, and (3) the PHI pertains solely to a health care item or service for which you or someone other than the health plan has paid in full without any contribution from your health plan.

Your PHI is critical for providing you with quality health care. We believe we have taken appropriate safeguards and internal restrictions to protect your PHI, and that additional restrictions may be harmful to your care.

Right to Confidential Communications
You have the right to request that we provide your PHI to you in a confidential manner. For example, you may request that we send your PHI by an alternate means (e.g., sending by a sealed envelope, rather than a post card) or to an alternate address (e.g., calling you at a different telephone number, or sending a letter to you at your office address rather than your home address). We will accommodate any reasonable request, unless it is administratively too burdensome, or prohibited by law.

Right to Complain
We must follow the privacy practices set forth in this Notice while in effect. If you have any questions about this Notice, wish to exercise your rights, or submit a complaint; please direct your inquiries to:

Ambry Genetics Corporation
15 Argonaut
Aliso Viejo, CA 92656
Attention: Director of Compliance
(866) 262-7943

You may contact your Health Plan with your concerns as well. You also have the right to directly complain to the Secretary of the United States Department of Health and Human Service. We will not retaliate against you for filing a complaint against us.

Rights Reserved by Ambry
We may use and disclose your PHI to the fullest extent authorized by law. We reserve the rights as expressed in this Notice. We reserve the right to revise our privacy practices consistent with law and make them applicable to your entire PHI that we maintain, regardless of when it was received or created. If we make material or important changes to our privacy practices, we will promptly revise our Notice. Unless the changes are required by law, we will not implement material changes to our privacy practices before we revise our Notice.

The effective date of this Notice is September 23, 2013.

Click here for official document.