HIPAA Statement

Please Read Carefully

This statement describes:

How Psomagen, as a business associate, uses and discloses protected health information
How requests relating to that information are handled

Our HIPAA Role

Psomagen, Inc. (“Psomagen”) performs sequencing and related testing services for hospitals, clinics, diagnostic companies and research institutions. Psomagen is not a covered entity under HIPAA because it does not conduct standard electronic transactions such as insurance claims. Where a customer sends a requisition form containing protected health information (“PHI”) with a specimen, Psomagen acts as a business associate of that customer, and its use of PHI is governed by HIPAA and by the Business Associate Agreement with that customer.

How Psomagen Protects Your Protected Health Information (PHI)

As a business associate, Psomagen safeguards the PHI it receives, uses and discloses it only as permitted by the applicable Business Associate Agreement or as required by law, imposes equivalent obligations on any subcontractor handling PHI, reports breaches to the customer, and returns or destroys PHI at the end of the engagement subject to its record retention obligations. Psomagen limits the PHI it receives to what customers include on requisition forms, returns results using coded specimen identifiers, and does not maintain patient identifiers in its laboratory information management system.

Disclosure of PHI

In accordance with HIPAA, the categories listed below explain the types of uses and disclosures of PHI that Psomagen may make. Some of the uses and disclosures described in the following may be limited or restricted by state laws or other legal requirements, such as the Clinical Laboratory Improvement Amendments of 1988 (CLIA). Please contact our Privacy Officer, using the contact information provided at the end of this notice, for specific information regarding your state.

Returning results— Psomagen reports test results to the hospital, clinic or diagnostic company that ordered the test, using coded specimen identifiers.
— Psomagen uses information relating to testing to evaluate the quality and accuracy of its testing and to meet CLIA and accreditation requirements.
— Where Psomagen engages a subcontractor that may handle PHI, Psomagen imposes the same restrictions that apply to Psomagen under the applicable Business Associate Agreement. PHI and specimens associated with CLIA-regulated clinical testing are processed in the United States only.
Disclosure for Judicial and Administrative Proceedings — Under certain circumstances, Psomagen may disclose HI in the course of a judicial or administrative proceeding, including in response to a court or administrative order, subpoena, discovery request, or other legal proceedings.
Law Enforcement — Psomagen may disclose PHI for law enforcement purposes, including to respond to a court order, warrant, subpoena or summons, or similar process authorized by law. We may also disclose PHI when the information is needed: 1) for identification or location of a suspect, fugitive, material witness, or missing person, 2) about a victim of a crime, 3) about an individual who has died, 4) in relation to criminal conduct on Psomagen premises, or 5) in emergency circumstances to report a crime, the location of the crime or victims, or the identity, description, or location of the person who committed the crime.
As Required By Law — Psomagen must disclose HI if required to do so by federal, state, or local law.
Public Health — Psomagen may disclose PHI for public health activities. These activities generally include 1) disclosures to a public health authority to report, prevent or control disease, injury, or disability; 2) disclosures to report births and deaths, or to report child abuse or neglect; 3) disclosures to a person subject to the jurisdiction of the Food and Drug Administration (FDA) for purposes related to the quality, safety or effectiveness of an FDA-regulated product or activity, including reporting reactions to medications or problems with products or notifying people of recalls of products they may be using; 4) disclosures to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition, and 5) disclosures to an employer about an employee to conduct medical surveillance in certain limited circumstances concerning work-place illness or injury.
Health Oversight Activities — Psomagen may disclose PHI to a health care oversight agency for activities authorized by law such as audits, civil, administrative, or criminal investigations and proceedings/actions, inspections, licensure/disciplinary actions, or other activities necessary for appropriate oversight of the health care system, government benefit programs, and compliance with regulatory requirements and civil rights laws.
Research — Psomagen does not use or disclose PHI for research. Psomagen may use de-identified information for method development and quality improvement.
De-identified Information and Limited Data Sets — Psomagen may use and disclose health information that has been “de-identified” by removing certain identifiers, making it unlikely that you could be identified. Psomagen also may disclose limited health information contained in a “limited data set.” The limited data set does not contain any information that can directly identify you. For example, a limited data set may include your city, county, and zip code but not your name or street address.

Other Uses and Disclosures of PHI

Psomagen shall ask for your authorization before using or disclosing PHI for all other uses and disclosures for purposes not described above. If you signed an authorization form, you may revoke it, in writing, at any time, except to the extent that action has been taken in reliance on your authorization.

Psomagen’s Notification In the Event of Information Breach

If Psomagen discovers a breach of unsecured PHI, it will notify the affected customer without unreasonable delay and in no case later than sixty (60) days after discovery, or within the shorter period required by the applicable Business Associate Agreement. The ordering institution is responsible for notifying affected individuals.

Record retention

For CLIA-regulated clinical orders, Psomagen retains CLIA records for ten (10) years from the date of data delivery. “CLIA records” means the test requisition and accompanying documentation, the final test report issued to the ordering institution, the analytic and quality-control records supporting that report, and the record of the procedure and instrument used. Psomagen retains raw data files (FASTQ and equivalent files from other sequencing platform) and sequencing quality-control tables for two (2) years from the date of data delivery. These periods meet or exceed the minimums required by 42 CFR § 493.1105. Where a Business Associate Agreement requires the return or destruction of PHI, that obligation is subject to these retention requirements, and the retained records remain protected under HIPAA until secure destruction.

Your Rights Regarding PHI

Because Psomagen is a business associate and does not have a direct relationship with patients, requests relating to PHI are handled by the healthcare provider that ordered the test. Patients should contact that provider. Under CLIA (42 CFR § 493.1291(l)) a patient may request completed test reports from the laboratory; because Psomagen receives specimens under coded identifiers and does not hold patient identifiers, it cannot verify a requester’s identity and will direct such requests to the ordering institution. Psomagen supports that institution in responding as required by HIPAA and the applicable Business Associate Agreement.

Right to See and Receive Copies of Your PHI — You and your personal representative have the right to access PHI consisting of your laboratory test results or reports ordered by your physician. Within 30 days after receiving your request, you will receive a copy of the completed laboratory report from Psomagen unless an exception applies. Exceptions include (1) a determination by a licensed health care professional that the access requested is reasonably likely to endanger the life or safety of you or another person, and (2) our inability to provide access to the PHI within 30 days, in which case we may extend the response time for an additional 30 days if we provide you with a written statement of the reasons for the delay and the date by which access will be provided. You have the right to access and receive your PHI in an electronic format if it is readily producible in such a format. You also have the right to direct Psomagen to transmit a copy to another person you designate, provided such request is in writing, signed by you, and clearly identifies the designated person and where to send the copy of your PHI. To request a copy of your PHI, contact the Privacy Officer by email at jwlee@psomagen.com

How to Exercise Your Rights

To exercise any of your rights described in this notice, you must send a written request to: Psomagen Privacy Officer, Psomagen Inc., 1330 Piccard Drive, Suite 103, Rockville, MD 20850.

How to Contact Us or File a Complaint

Questions or complaints regarding Psomagen’s handling of PHI may be directed to the HIPAA Privacy Officer, Dr. Ji Won Lee, Director of Quality and Compliance, at jwlee@psomagen.com, or in writing to Psomagen, Inc., ATTN: HIPAA Privacy Officer, 1330 Piccard Drive, Suite 103, Rockville, MD 20850. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Psomagen will not retaliate against anyone who files a complaint.

Changes to this Statement

Psomagen reserves the right to make changes to this notice and to our Privacy Statement from time to time. Changes apply to all PHI Psomagen maintains.Psomagen is required to abide by the terms of our notice currently in effect. When changes are made, we will promptly update this notice and post the information on the Psomagen website at www.psomagen.com. Please review this site periodically to ensure that you are aware of any such updates.