LABREQS.COM HEALTH INFORMATION PRIVACY POLICY
Initial Effective Date: March 23, 2015

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN OBTAIN THIS INFORMATION. PLEASE REVIEW THIS INFORMATION CAREFULLY.

Introduction

LabReqs.com respects that you have entrusted us with your health data, and we are committed to safeguarding all the information you supply—including all personal information, the results of biometric screening tests, and the information in your health assessment risk profile.

This Privacy Policy sets forth LabReqs.com's obligations and your rights in accordance with the Health Insurance Portability & Accountability Act and amendments thereto (HIPAA), the Health Information Technology for Economic and Clinical Health Act and amendments thereto (HITECH), and the regulations promulgated under these Acts, but does not imply that LabReqs.com is necessarily acting as a Covered Entity as defined by HIPAA. In most instances, LabReqs.com receives and shares your "Protected Health Information" (PHI) as a Business Associate and in accordance with a Business Associate Agreement. If you participate in a wellness program or disease management program (Program) as a member of a Health Plan, the Health Plan's Notice of Privacy Practices is also applicable to your PHI. When you receive health care services from a third-party, such as laboratory testing services, the laboratory's Notice of Privacy Practices may apply to your PHI. In all situations, your PHI is obtained, maintained and shared in a private and secure manner consistent with HIPAA requirements by each of these entities. All capitalized terms not otherwise defined shall have the meanings assigned to them under HIPAA. References to "us", "we" and "our" refer to LabReqs.com.

I. OUR COMMITMENT TO PROTECTING HEALTH INFORMATION ABOUT YOU
LabReqs.com has policies and procedures in place to protect the privacy and security of your personal information including your PHI. To the extent LabReqs.com is providing services for or on behalf of a HIPAA Covered Entity, LabReqs.com is required by law to maintain the privacy of PHI and to notify the Covered Entity of any breach of unsecured PHI.
LabReqs.com keeps your PHI safe through the use of a combination of physical, electronic, and procedural safeguards in accordance with applicable Federal and State laws. To use the LabReqs.com wellness/disease management website or mobile applications, you will create your own password protected account and you can change your contact information and password information on the site or the mobile application. Lost passwords are authenticated with security questions upon enrollment. Data transfer, storage, and integrity are secured and transmitted via secure encryption technology, regular data backups, and key code authentication. LabReqs.com also limits access to your PHI to employees, contractors and agents who need the data to do their jobs or provide their services.
Also, where required by law or in accordance with a Business Associate Agreement, third-party wellness and disease management program partners must protect the privacy of data LabReqs.com shares with them and they are required to keep your information private and secure.
LabReqs.com reserves the right to make changes to this notice and to make such changes effective for all PHI we may already have about you. If and when this notice is changed, we will post this information on our website and provide you with a copy of the revised notice upon your request or as otherwise required by law. It is your responsibility to check our website periodically for updates or changes to our policy.

II. HOW LABREQS.COM MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION ABOUT YOU
A. USES AND DISCLOSURES FOR TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS

LabReqs.com is permitted to use and disclose PHI for treatment, payment, and health care operations and, when applicable, in accordance with a Business Associate Agreement (BAA) as required by HIPAA. The following examples are illustrative and do not list every type of use or disclosure that may fall within that category.
Treatment: LabReqs.com may use and disclose your PHI in connection with your participation in a Program. Your Program may involve, at your option, completing a health risk assessment form, obtaining laboratory biometric screenings for various health risks, discussing your health with health care coaches or others associated with your Program. LabReqs.com provides you with online viewing of your forms, explanations of laboratory test results and other health care information that may be relevant to you. LabReqs.com's internet technology platform will facilitate the disclosure of laboratory test results to the ordering physician and to other healthcare professionals who may become involved in your participation in the Program. LabReqs.com may disclose PHI to third-parties designated by the sponsoring health plan for use in your participation in the Program.
Payment: LabReqs.com is allowed to use and disclose PHI so that we can bill and collect payment for our services, if applicable, or to assist your health plan with their claims payment processes.
Health Care Operations: LabReqs.com is permitted to use and disclose your PHI in performing business operations that are called health care operations. These include conducting quality improvement activities, auditing functions, cost management analysis and customer service. An example of this would be an internal assessment of the quality of our customer service operations. LabReqs.com may use and disclose your PHI to provide training to new employees who work with PHI within the scope of their employment at LabReqs.com. LabReqs.com employees received training on the importance of maintaining the privacy of your PHI. LabReqs.com may also share your PHI with your sponsoring health plan as part of their health care operations. Plan sponsors that receive PHI are required by law to keep it from being used for reasons that are not proper and are required to keep it secure.
Health Related Services: LabReqs.com may contact you to provide you with information about changes to your Program or other health-related benefits and services that may be of interest to you as we view such information as part of the treatment you receive under your Program, and as directed by you or your sponsoring health plan our contracted third-party vendors may conduct you directly with such Program information.
To You: In accordance with HIPAA and applicable Business Associate Agreements, LabReqs.com will provide access to you of your health care information.

B. OTHER USES AND DISCLOSURES YOU AUTHORIZE LABREQS.COM TO MAKE
By participating in the wellness/disease management program and/or by using LabReqs.com's online health web portal you agree that LabReqs.com can make the following uses and disclosures of your PHI. You will be provided with the opportunity to authorize these disclosures and your signature will be required with that authorization when you use the web portal, when you use an At-Home lab test kit, when you participate in on-site services (wellness clinics, lab testing, vaccinations, etc.) Each authorization will contain an expiration date, your signature and date. This Privacy Policy sets forth your rights to revoke or make changes to your agreement (see Section II.D. below).
Business Associates: In accordance with the above Treatment and/or Health Care Operations permitted uses and disclosures, we may provide your PHI to other companies or individuals to assist us in providing you with health and wellness services in conjunction with your Program or that perform various activities on our behalf. These other entities are referred to under HIPAA as Business Associates. LabReqs.com is required by HIPAA to have written Business Associate Agreements with these entities whenever we will share your PHI with the Business Associate. Likewise, we may receive your PHI by virtue of providing Business Associate services to your sponsoring health plan or Covered Entity. Business Associates are required by HIPAA to maintain the privacy and security of your PHI and to only use and disclose your PHI in accordance with HIPAA. For example, we may share your personal health information with a wellness coach with whom we have a Business Associate Agreement to assist you with the goals you have set under your Program.
Mobile Applications: LabReqs.com provides a technology platform through which you can access information connected with your Program, including access to your PHI. Although LabReqs.com has procedures in place to ensure the security of your information that is contained on our LabReqs.com webportal, when using mobile applications, you recognize and assume the risk, that such data may be subject telecommunication and other laws that govern your mobile device provider and which are outside the control of LabReqs.com.
Security Procedures: LabReqs.com may use your PHI to authenticate the security and integrity of our website. (For details regarding website usage, please see our website "Terms and Conditions Use").
Website Experience: LabReqs.com may use personally identifiable information collected through our website to tailor your use and experience on the website.
C. USES AND DISCLOSURES REQUIRED BY LAW
LabReqs.com may use and disclose your PHI as allowed or required by law. PHI can be shared for public health oversight activities. It can also be shared for judicial or administrative proceedings, with public health authorities, for law enforcement reasons, and with coroners or medical examiners. PHI can also be shared with organ donation groups for certain reasons, for research (in accordance with HIPAA restrictions), and to avoid a serious threat to health or safety. It can be shared for special government functions, for Workers' Compensation, to respond to requests from the U.S. Department of Health and Human Services, and to alert proper authorities if we reasonably believe that you may be a victim of abuse, neglect, domestic violence or other crimes. PHI can also be shared in any other manner required by law.
D. OTHER USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION REQUIRE YOUR AUTHORIZATION
Other uses and disclosures of PHI about you will be made only with your written authorization. If you have authorized us to use or disclose PHI about you, you may revoke your authorization at any time, except to the extent we have taken action based on the authorization. You may make such revocation by providing written notice to the address provided below. Information disclosed pursuant to your authorization may be subject to redisclosure by the recipient and no longer be protected under HIPAA. However, LabReqs.com executes Business Associate Agreements with any wellness/disease management providers whereunder they agree to maintain the privacy and security of your information.
III. YOUR RIGHTS REGARDING PROTECTED HEALTH INFORMATION ABOUT YOU
Right to Request Restrictions: You have the right to request additional restrictions on the PHI that LabReqs.com may use for treatment, payment, and health care operations. You may also request additional restrictions on our disclosure of PHI to certain individuals involved in your care or benefit coverage that otherwise are permitted by HIPAA. LabReqs.com is not required to agree to your request. If we do agree to your request, we are required to comply with our agreement except in certain cases, including where the information is needed to treat you or verify coverage in the case of an emergency. To request restrictions, you must make your request in writing to the Covered Entity (your sponsoring health plan), or in accordance with any Business Associate responsibilities assumed by us, to our Security Officer. In your request, please include (1) the information that you want to restrict, (2) how you want to restrict the information (for example, restricting use to this office, restricting disclosure only to persons outside this office, or restricting both), and (3) to whom you want those restrictions to apply.
Right to Receive Confidential Communications: You have the right to request that you receive communications regarding PHI in a certain manner or at a certain location. For example, you may request that LabReqs.com contacts you at home, rather than at work. You must make your request in writing to our Security Officer. You must specify how you would like to be contacted (for example, by regular mail to your post office box and not your home). We may be required via the provisions of a Business Associate Agreement to accommodate reasonable requests and, regardless, we will do our best to facilitate reasonable requests.
Right to Inspect and Copy: You have the right to request the opportunity to inspect and receive a copy of PHI about you from the Covered Entity and perhaps in certain records that LabReqs.com maintains as a Business Associate. Such records may include your insurance and billing records but does not include information gathered or prepared for a civil, criminal, or administrative proceeding. We may deny your request to inspect and copy PHI only in limited circumstances. To inspect and copy PHI, contact our Security Officer. If you request a copy of PHI about you, we may charge you a reasonable fee for the copying, postage, labor, and supplies used to meet your request.
Right to Amend: You have the right to request that the Covered Entity and perhaps in certain instances that we amend PHI about you as long as such information is kept by or for our office. To make this type of request of us, you must submit your request in writing to our Security Officer. You must also give us a reason for your request. We may deny your request in certain cases, including if it is not in writing or if you do not give us a reason for the request or if we are not the proper entity under HIPAA to perform such amendments.
Right to Receive an Accounting of Disclosures: You have the right to receive a list of certain disclosures of your PHI in the past six years other than disclosures made for treatment, payment or health care operations. You may exercise this right by contacting the Covered Entity and LabReqs.com will work closely with the Covered Entity to provide any accounting of disclosures in accordance with HIPAA.
Right to Breach Notification: Under HIPAA, a Covered Entity must provide notification to you upon any Breach of your PHI. LabReqs.com will work closely with the Covered Entity to provide any information necessary as required of a Business Associate in accordance with HIPAA.
Right to a Paper Copy of this Notice: You have a right to receive a paper copy of this notice at any time, even if you have previously agreed to receive this notice electronically. To obtain a paper copy of this notice, contact the Security Officer.
Questions/Complaints: If you want further information about matters covered in this notice, or believe that your privacy rights have been violated, or disagree with a decision made about access to your personal and health information, you can contact our Security Officer. You may also submit a complaint to the office of the Secretary of Health and Human Services. We want to hear your concerns and you will not be retaliated against if you file a complaint.

Contact Information:
LabReqs.com
Attention: Security Officer
11014 East 51st Street
Tulsa,Ok
support@LabReqs.com.com
©2015 LabReqs.com

The content posted on these pages is designed for informational purposes only. It is not intended to be a substitute for professional medical advice, diagnosis, or treatment. Please consult your physician or other qualified health care provider if you suspect you have a medical condition.
LabReqs.com, a separate company that provides services on behalf of your health plan, is responsible for this site, including all privacy practices and legal terms that govern its use.