HIPAA Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed, and how you may access your information. Please review it carefully.

TriCore Reference Laboratories (“TriCore,” “we,” “our,” “us”) is committed to protecting the privacy of your health information as required by law. This information is known as protected health information or “PHI.”

TriCore provides this notice to you to describe the ways we may use and share your PHI, including how we may use your PHI within TriCore and how under certain circumstances we may disclose it to others outside TriCore. This notice also describes the rights you have concerning your own PHI. Please review it carefully. If you have questions about any part of this privacy notice, or if you want more information about the privacy practices of TriCore, please contact the privacy officer listed at the end of this notice.

How We May Use and Disclose Your PHI

The law permits TriCore to use your protected health information to provide services to you, to bill for the services, and for healthcare operations, as explained below. Not every use or disclosure is listed in this Notice, but all of our uses or disclosures of your health information will fall into one of the categories listed below.

  • Treatment — We will use your health information to provide you with the best laboratory service possible. This may include communication with your health care provider (e.g., doctor, nurse, pharmacy) to clarify a laboratory test order or to provide test results.
  • Payment — We will use and disclose your PHI for purposes of billing and payment. For example, we give PHI to your health insurance plan so they will pay for our services.
    Note: If you pay in full out of pocket for a TriCore service, you are permitted to request that the test and its results not be communicated to your insurance provider. If you do not want a claim for payment sent to your insurer, (a) do not present your insurance card at the time of specimen collection, and (b) ask that TriCore bill you for the tests. Your action to restrict a claim from being submitted to your insurer will also be considered an HIE opt-out per sections, “HIE Opt-Out” and “Restrictions,” below.
  • Operations — Your health information may be used within TriCore and also shared with appropriate regulatory agencies as part of our ongoing quality assurance and quality improvement activities. We may also disclose protected health information to outside companies to support administrative functions, such as data analysis or accounting or legal services, but we will only do so after they have signed an agreement stating that they will abide by our privacy policy.
  • Incidental Disclosures — These disclosures occur during the course of providing laboratory services and cannot reasonably be prevented. They may also occur as a result of a permitted use or disclosure. For example, TriCore may use sign-in sheets in patient waiting areas; however, we have implemented reasonable safeguards to protect your personal information.
  • Emergencies — TriCore employees will use professional judgment to decide whether sharing your health information is in your best interest during a health emergency.
  • Law Enforcement — State or federal law may permit the disclosure of very limited health information to law enforcement for certain purposes including, in limited circumstances, to assist law enforcement in the event that you are the victim of a crime or you are accused of criminal activity. TriCore may also be required to release PHI in compliance with a court order, judicial subpoena, court warrants, and other investigative demands or procedures.
  • Public Health — TriCore may be required to disclose to federal or state officials, military authorities, or foreign government agencies health information necessary to complete an investigation related to public health or national security. Such information is sometimes needed for the control or prevention of an epidemic, product recall or to increase understanding of the side effects of a drug treatment.
  • Organ and Tissue Donation — If you are an organ or tissue donor, your health information may be shared with organizations that obtain, store or transplant human organs and tissues.
  • Correctional Institutions — If you are an inmate, your health information may be shared with correctional institutions or law enforcement officials in order to protect your health or the health and safety of others.
  • Health Oversight Agencies — We may disclose your health information to a health oversight agency for authorized government review of the health care system, civil rights and privacy laws, and compliance with government programs. Health oversight agencies include the Secretary of the U.S. Department of Health and Human Services (HHS), the Centers for Medicare and Medicaid Services (CMS), and the New Mexico Human Services Department (HSD).
  • Abuse or Neglect — TriCore will notify government authorities if we believe that a patient is the victim of abuse, neglect or domestic violence. We will make this disclosure only when compelled to do so by our ethical judgment or when we believe we are specifically required or authorized by law to do so.
  • Medical Examiner or Funeral director — TriCore can share health information with a coroner, medical examiner, or funeral director when an individual dies.
  • Research — Any information being provided by TriCore for research purposes, assay validation or other appropriate uses under the law will be ‘de-identified.’ That is, information that identifies you will be removed.
  • Communication with Family Members and Friends — TriCore may disclose to family members and friends health information directly relevant to your care, payment for your care, service location, general condition, or death. See Note below.
  • Communication with Other Persons — TriCore may disclose to other persons that you have asked to be involved in your healthcare health information related to that person’s involvement in the care or payment for the care. See Note below.
  • Note: In communicating with family or others, TriCore may attempt to obtain your agreement or objection orally, but TriCore may also be required to exercise professional judgment in this regard based on whether disclosure of PHI is determined to be in your best interest.

TriCore will only use and disclose your PHI after obtaining your written authorization for the following:

  • New Mexico Workers’ Compensation Complaints
  • Marketing
  • Sale of PHI
  • Other uses and disclosures not described in this notice

Other uses and disclosures of your PHI not covered by this Notice or the laws that apply to us will be made only with your written authorization (Authorization form is available at www.tricore.org/patients). You may cancel that authorization at any time by sending a written request to our Privacy Officer (contact information is on the last page of this notice). Note that we are unable to take back any disclosures we have already made with your authorization.

Information with Additional Protections

Certain types of protected health information may have additional protection under federal or state law. For example, protected health information about mental health, HIV, sexually transmitted diseases, and genetic testing results is treated differently than other types of protected health information under certain state laws. Additionally, federally assisted alcohol and drug abuse programs are subject to certain special restrictions on the use and disclosure of alcohol and drug abuse treatment information. To the extent applicable, TriCore would need to get your written permission before disclosing that information to others in many circumstances.

Your Patient Rights

  • Access — Adult patients have the right to request a copy of their health information and billing records in either paper or electronic form. Before releasing the information, TriCore will require an appropriately signed release and proof of your identity. You may request that the information be transmitted to someone other than yourself. By law, TriCore has 30 days to respond to your request. We may charge a reasonable, cost-based fee.
    Note: Generally, a parent or legal guardian has the right of access to a minor’s health information. However, in New Mexico some healthcare services can be provided to a minor without consent of a parent or guardian. In these cases the minor has the rights described in this Notice for health information related to the services.
  • HIE Opt-Out – TriCore participates in an electronic health information exchange (“HIE”). An HIE is an electronic connection that participating health care providers and health plans can use to share your PHI for purposes of working together to provide higher quality and more efficient care. The information sharing is limited to that of individuals who are shared patients of the health care providers or members of the health plans. E.g., If you have a primary care physician and are also being treated by one/more specialists, all who participate in the HIE can access your TriCore lab results (subject to the additional protections provided by law as described in “Information with Additional Protections,” above). Or, if your health plan participates in the HIE, it can access your TriCore lab results of tests for which it has been asked to pay.
    You may choose not to allow HIE access to your PHI held by TriCore except to the extent that access is permitted in emergency situations as described in “How We May Use and Disclose Your PHI,” above. You may do this by completing and submitting to TriCore a form that is available at the Web site www.tricore.org/optout or by phoning 505-938-8922. (Note that your treating providers and health plans will continue to have access to your PHI through methods other than the HIE for purposes of treatment, payment and operations.) You may opt out of the HIE at any time; however the opt-out will not apply to information accessed by participants of the HIE prior to your opt-out. You may also revoke your opt-out at any time by completing and submitting a form.
  • Restrictions — You have the right to submit a written request that TriCore restrict or limit its use or disclosure of your PHI for treatment, payment or health care operations. While we will consider your written request, we are not required by law to agree to such a restriction or limitation. Note however that if you make a restriction request we will not make PHI available through the HIE; we will treat the request as an HIE opt-out. A request to restrict a claim for payment from being submitted to your insurer per section “Payment,” above, is a restriction and will be treated as an HIE opt-out.
  • Confidential Communications — You have the right to request that TriCore communicates with you in a specific way (for example, home or office phone) or to send mail to a different address as long as the request is reasonable.
  • Choose Someone To Act For You — If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information.
  • Amend — You have the right to ask TriCore to amend, update or modify your health information during the time it is being retained by TriCore if you believe your health information is incorrect or incomplete. You must provide your detailed request in writing. Your request may be denied if the health information record was not created by TriCore or if the existing health information is determined to be accurate and complete.
  • Disclosures — You can ask for a list of the times TriCore has shared your health information during a period no longer than six years prior to the date you ask, with whom it was shared, and why. We will include all the disclosures except for those for treatment, payment, and health care operations, and certain other disclosures, such as any you asked us to make. TriCore will provide one accounting per year for free but will charge a reasonable, cost-based fee if you ask for another accounting within 12 months.
  • Receive a Copy of TriCore’s Notice of Privacy Practices — You can ask for a paper copy of this notice at any time.
  • Notification of Breach — Although TriCore makes every effort to ensure its practices protect your information, breaches may occur. A breach is any unauthorized acquisition, access, use, or disclosure of certain categories of health information that compromises the security or privacy of the information. We will let you know promptly if a breach of your information occurs.
  • Questions or Complaints — If you have any question about this notice or believe your rights have been violated, you may contact the TriCore Privacy Officer in writing either on paper or electronically to:

    TriCore Privacy Officer
    1001 Woodward Place NE
    Albuquerque, NM 87102
    compliance@tricore.org

    If we cannot resolve your complaint you may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1877-696-6775 or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/

    TriCore will not retaliate against you for filing a complaint.

Changes to the Terms of this Notice
TriCore may change the terms of this notice, and the changes will apply to all of your health information maintained by TriCore. The new notice will available upon request at any TriCore facility, and on the TriCore Web site, www.tricore.org.

Effective 10/12/15