Innovative Gx Holding LLC
HIPAA Notice of Privacy Practices

Policy

Innovative Gx Holding LLC, and its subsidiaries—Innovative Genomics, LLC (a Texas LLC) and Innovative Gx Florida, Inc (a Florida corporation) (collectively, “IGX” or the “Company)— is committed to maintaining and protecting the confidentiality of an individual’s PHI. IGX is required by federal and state law, including the Health Insurance Portability and Accountability Act (“HIPAA”), to protect an individual’s PHI and other personal information. IGX is required to provide the individual with this Notice of Privacy Practices about IGX’ policies, safeguards, and Practices. When IGX uses or discloses an individual’s PHI, IGX is bound by the terms of this Notice of Privacy Practices, or the revised notice of Privacy Practices, if applicable. IGX is required by law to:

  • Maintain the privacy of PHI (with certain exceptions)
  • Give the individual this notice of the IGX legal duties and privacy practices regarding health information about the individual.
  • Follow the terms of the IGX notice of Privacy Company that is currently in effect

Procedures

The following describes the ways IGX may use and disclose PHI. Except for the purposes described below, IGX will use and disclose PHI only with the individual’s written permission. The individual may revoke such permission at any time by writing to IGX’s HIPAA Compliance Officer:

  • For Treatment. IGX may use and disclose PHI for the individual’s services. For example, IGX may disclose PHI to doctors, nurses, technicians, or other personnel, including people outside IGX, who are involved in the individual’s medical care as related to an IGX product, and need the information to provide the individual with medical care.

  • For Payment. IGX nay use and disclose PHI so that IGX or others may bill and receive payment from the individual, an insurance company or third party for the treatment and services the individual received.

  • For Health Care Operations. IGX may use and disclose PHI for health care operation purposes. For example, IGX may share information with doctors, residents, nurses, technicians, clerks, and other personnel for quality assurance and educational purposes. IGX also may share information with other entities that have a relationship with the individual (for example, the individual’s insurance company and anyone other than the individual who pays for the individual’s services) for the individual’s health care operation activities.

  • Third Parties Involved in an Individual’s Care or Payment for an Individual’s Care. When appropriate, IGX may share PHI with a person who is involved in the individual’s medical care or payment for the individual’s care, such as the individual’s family or a close friend. IGX also may notify the individual’s family about the individual’s location or general condition or disclose such information to an entity (such as Red Cross) assisting in a disaster relief effort.

  • Research. Under certain circumstances, IGX may use and disclose PHI for research. Limited data or records may be viewed by researchers to identify patients who may qualify for their research project or similar purposes, so long as researchers do not remove or copy any PHI. IGX will generally ask for the individual’s written authorization before using the individual’s PHI or sharing it with others to conduct research. Under limited circumstances, IGX may use and disclose PHI for research purposes without the individual’s permission. Before IGX uses or discloses PHI for research without the individual’s permission, the project will go through a special approval process to ensure that research conducted poses minimal risk to the individual’s privacy. The individual’s information will be de-identified. Researchers may contact the individual to see if the individual is interested in or eligible to participate in a study.

  • Laboratory Services. Under certain circumstances, IGX may contact an individual regarding services that are offered by the laboratory.

Special Situations

  • As Required by Law. IGX will disclose PHI when required to do so by international, federal, state or local law.

  • To Avert a Serious Threat to Health or Safety. IGX may use and disclose PHI when necessary to prevent a serious threat to the individual’s health and safety or the health and safety of others. Disclosures, however, will be made only to someone who may be able to help prevent or respond to the threat, such as law enforcement or a potential victim. For example, IGX may need to disclose information to law enforcement when a patient reveals participation in a violent crime.

  • Business Associates. IGX may disclose PHI to IGX’s business associates that perform functions on IGX’ behalf or provide IGX with services if the information is necessary for such functions or services. For example, IGX may use another company to perform billing services on IGX’ behalf. All of IGX’ business associates are obligated to protect the privacy of the individual’s information and are not allowed to use or disclose any information other than as specified in our contract.

  • Lawsuits and Disputes If an individual is involved in a lawsuit or a dispute, IGX may disclose PHI in response to a court or administrative order. IGX also may disclose PHI in response to a subpoena, discovery request, or other lawful request by someone else involved in the request or to allow the individual to obtain an order protecting the information requested.

  • Law Enforcement IGX may release PHI if asked by a law enforcement official if the information is: (1) in response to a court order, subpoena, warrant, summons or similar process; (2) limited to information to identify or locate a suspect, fugitive, material witness, or missing person; (3) about the victim of a crime even if, under certain very limited circumstances, IGX is unable to obtain the individual’s agreement; (4) about a death that IGX believes may be the result of criminal conduct; (5) about criminal conduct on IGX’ premises; and (6) in an emergency to report a crime, the location of the crime or victims, or the identity, description or location of the person who committed the crime.

Uses and disclosures that require IGx to give the individual an opportunity to object/opt out:

  • Third Parties involved in the Individual’s Care or Payment for Individual’s Care. Unless the individual objects, IGX may disclose to a member of the individual’s family, a relative, a close friend or any other person the individual identifies, the individual’s PHI that directly relates to that third party’s involvement in the individual’s health care. If the individual is unable to agree or object to such a disclosure, IGX may disclose such information as necessary if IGX determines that it is in the individual’s best interest based on IGX’s professional judgment.

Individual’s rights regarding PHI:

The following uses and disclosures of the individual’s PHI will be made only with the individual’s written authorization:

  1. Uses and disclosures of PHI for marketing purposes;

  2. Disclosures that constitute a sale of the individual’s PHI; and

  3. Disclosures of psychotherapy notes.

Other uses and disclosures of PHI not covered by this Notice of Privacy Practices or the laws that apply to IGX will be made only with the individual’s written authorization. If the individual gives us authorization, the individual may revoke it at any time by submitting a written revocation to the IGX Compliance Office and we will no longer disclose PHI under the authorization. But disclosure that IGX made in reliance on an individual’s authorization before the individual revoked it will not be affected by the revocation.

Individual’s rights regarding PHI:

  • Right to Inspect and Copy. The individual has a right to inspect and copy PHI that may be used to make decisions about the individual’s care or payment for the individual’s care. This includes medical and billing records, other than psychotherapy notes. To inspect and copy the individual’s PHI, the individual must make their request, in writing, to the Department in which their care was provided.

  • IGX has up to 30 days to make the individual PHI available to the individual and IGX may charge the individual a reasonable fee for the costs of copying, mailing or other supplies associated with the individual’s request. IGX may not charge the individual a fee if the individual needs the information for a claim for benefits under the Social Security Act or any other state or federal needs-based benefit program. IGX may deny the individual’s request in certain limited circumstances. If IGX does deny the individual’s request, the individual has the right to have the denial reviewed by a licensed healthcare professional that was not directly involved in the denial of the individual’s request, and IGX will comply with the outcome of the review.

  • Right to Get Notice of a Breach. IGX is committed to safeguarding the individual’s PHI. If a breach of the individual’s PHI occurs, IGX will notify the individual in accordance with state and federal law.

  • Right to Amend, Correct or Add an Addendum. If the individual feels that the PHI IGX has is incorrect, incomplete, or the individual wishes to add an addendum to the individual’s records, the individual has the right to make such request for as long as the information is kept by or for the IGX office. The individual must make their request in writing to the Department that is in possession of the individual’s records. In the case of claims that the information is incorrect, incomplete, or if the record was not created by IGX, IGX may deny the individual’s request. However, if IGX denies any part of the individual’s request, IGX will provide the individual with a written explanation of the reasons for doing so within 60 days of the individual’s request.

  • Right to an Accounting of Disclosures. Individuals have the right to request a list of certain disclosures IGX made of PHI for purposes other than treatment, payment, health care operations, and certain other purposes consistent with law, or for which the individual provided written authorization. To request an accounting of disclosures, individuals must make their request, in writing, to the Department that is in possession of the individual’s records. The individual may request an accounting of disclosures for up to the previous six years of services provided before the date of the individual’s request. If more than one request is made during a 12-month period, IGX may charge a cost-based fee.

  • Right to Request Restrictions. Individuals have the right to request a restriction or limitation on the PHI IGX uses or discloses for treatment, payment, or health care operations. Individuals also have the right to request a limit on the PHI we disclose to someone involved in the individual’s care or the payment for the individual’s care, like a family member or friend. For example, the individual could ask that IGX not share information about a particular diagnosis or treatment with the individual’s spouse. To request a restriction, the individual must make their request, in writing, to the Department that is in possession of the individual’s records.

  • Right to Request Confidential Communications. Individuals have the right to request that IGX communicate with them about medical matters in a certain way or at a certain location. For example, the individual can ask that IGX only contact individuals by mail or at work. To request confidential communications, individuals must make their request, in writing, to the Department that is in possession of the individual’s records. The individual’s request must specify how or where the individual wishes to be contacted. IGX will accommodate reasonable requests.

  • Right to Choose Someone to Act for the Individual. If the individual gives someone medical power of attorney or if someone is the individual’s legal guardian, that person can exercise the individual’s rights and make choices about the individual’s PHI. IGX will use our best efforts to verify that person has authority to act for the individual before IGX takes any action.

  • Right to a Paper Copy of This Notice of Privacy Practices. Individuals have the right to a paper copy of this Notice of Privacy Practices. Individuals may ask IGX to give the individual a copy of this Notice of Privacy Practices at any time.

Individual Contact Information

IGX may provide PHI to individuals using the personal contact information directly provided to IGX by the individual or authorized representative.

Changes to this Notice of Privacy Practices:

IGX reserves the right to change this Notice of Privacy Practices and make the new Notice of Privacy Practices apply to PHI IGX already has as well as any information IGX receives in the future. IGX will post a copy of IGX’s current Notice of Privacy Company at our office. The Notice of Privacy Practices will contain the effective date on the first page, in the top right-hand corner. Individuals will be sent information regarding the changes via email or via mail on how they can obtain a new copy. Individuals will be asked to sign off on the new Notice of Privacy Practices at the individual’s next scheduled appointment.