Effective Date: April 22, 2026

Introduction

Autism Diagnostics Lab is committed to protecting the privacy and security of your Protected Health Information (PHI). This Notice of Privacy Practices describes our legal obligations and your rights regarding your health information under the Health Insurance Portability and Accountability Act (HIPAA) and other applicable privacy laws.

We are required by law to:

• Maintain the privacy and security of your Protected Health Information
• Provide you with this Notice of our legal duties and privacy practices
• Follow the terms of the Notice currently in effect
• Notify you if we are unable to agree to a requested restriction
• Accommodate reasonable requests you may have to communicate health information by alternative means or at alternative locations

What is Protected Health Information (PHI)?

Protected Health Information includes any individually identifiable health information we collect, create, receive, maintain, or transmit. This includes but is not limited to:

• Your name, address, date of birth, and contact information
• Test orders and requisition forms
• Biological samples and test results
• Medical history and health information you provide
• Payment and billing information
• Correspondence regarding your care
• Any other health information that can identify you

How We May Use and Disclose Your PHI

We may use and disclose your Protected Health Information for the following purposes without your written authorization:

For Treatment:

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes:

• Performing laboratory testing on your samples
• Providing test results to your healthcare provider
• Communicating with your healthcare provider about your test results
• Coordinating care with other healthcare providers when appropriate
• Conducting quality assurance and quality control activities

For Payment:

We may use and disclose your PHI to obtain payment for services we provide, including:

• Billing you or your insurance company for testing services
• Verifying insurance coverage and benefits
• Processing payment transactions
• Collection activities for outstanding balances
• Disclosures to credit card companies and payment processors

For Healthcare Operations:

We may use and disclose your PHI for our business operations, including:

• Quality improvement and assurance programs
• Training staff and students
• Certification, and licensing activities
• Business planning and development
• Customer service and complaint resolution
• Internal audits and compliance programs
• Creating de-identified or aggregated data for research and analysis

To Business Associates:

We may disclose your PHI to third-party service providers (Business Associates) who perform services on our behalf. These may include:

• Laboratory information system vendors
• Billing and payment processing companies
• IT service providers and cloud storage vendors
• Shipping and courier services
• Legal and accounting firms
• Consultants and contractors

All Business Associates are required to sign Business Associate Agreements that obligate them to protect your PHI and use it only for the purposes we specify.

As Required by Law:

We will disclose your PHI when required to do so by federal, state, or local law, including:

• Reporting to public health authorities
• Responding to lawful court orders and subpoenas
• Cooperating with law enforcement investigations
• Reporting suspected abuse, neglect, or domestic violence
• Complying with workers' compensation laws

Uses and Disclosures Requiring Your Authorization

For uses and disclosures beyond treatment, payment, and healthcare operations, we will obtain your written authorization. This includes:

• Marketing purposes (we do not sell patient information for marketing)
• Sale of Protected Health Information
• Most uses of psychotherapy notes (if applicable)
• Research purposes (except where waived by an IRB or Privacy Board)
• Any other purposes not described in this Notice

You have the right to revoke any authorization in writing at any time, except to the extent we have already acted in reliance on your authorization.

How We Protect Your PHI

Autism Diagnostics Lab implements comprehensive administrative, physical, and technical safeguards to protect your Protected Health Information:

Administrative Safeguards:

• HIPAA Privacy Officer: Designated privacy officer responsible for developing and implementing privacy policies
• Workforce Training: All employees receive HIPAA training and sign confidentiality agreements
• Access Controls: PHI access is limited to employees who need it to perform their job duties
• Business Associate Agreements: All vendors with PHI access sign legally binding agreements
• Incident Response: Formal procedures for investigating and responding to privacy incidents
• Regular Audits: Periodic reviews of our privacy and security practices

Physical Safeguards:

• Secure facilities with restricted access and surveillance
• Locked filing cabinets and secure storage areas for physical records
• Secure disposal of PHI (shredding, incineration, data destruction)
• Clean desk policies and visitor management protocols
• Environmental controls to protect equipment and data

Technical Safeguards:

• Encryption: All PHI is encrypted both in transit (TLS/SSL) and at rest (AES-256)
• Access Authentication: Multi-factor authentication and strong password requirements
• Audit Logs: Comprehensive logging of all PHI access and modifications
• Firewalls and Intrusion Detection: Network security monitoring and protection
• Data Backup: Regular encrypted backups with disaster recovery procedures
• Secure Transmission: Encrypted email and secure portal for results delivery
• Automatic Logoff: Systems automatically log out inactive users

Business Associate Agreements

Before disclosing your PHI to any Business Associate, we require them to sign a HIPAA-compliant Business Associate Agreement (BAA) that:

• Requires the Business Associate to safeguard your PHI
• Prohibits unauthorized use or disclosure of PHI
• Requires the Business Associate to report any breaches
• Obligates subcontractors to the same privacy protections
• Grants us the right to audit their compliance
• Requires return or destruction of PHI at contract termination

Breach Notification Procedures

In the unlikely event of a breach of your unsecured Protected Health Information, we will notify you in accordance with HIPAA Breach Notification requirements:

What Constitutes a Breach:

A breach is an unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of the information. Not all incidents are reportable breaches, we conduct risk assessments to determine if notification is required.

Notification Timeline:

• Individual Notification: Within 60 days of discovering the breach, we will notify affected individuals by first-class mail (or email if you've agreed to electronic notice)
• Media Notification: For breaches affecting 500+ individuals in a state/jurisdiction, we will notify prominent media outlets
• HHS Notification: We will notify the U.S. Department of Health and Human Services as required

Breach Notification Contents:

Our breach notification will include:

• Description of what happened and when the breach occurred
• Types of PHI involved in the breach
• Steps you should take to protect yourself
• What we are doing to investigate, mitigate harm, and prevent future breaches
• Contact information for you to ask questions

Your Rights Regarding Your PHI

Under HIPAA, you have the following rights regarding your Protected Health Information:

Right to Access Your Medical Records:

You have the right to inspect and obtain a copy of your PHI that we maintain, including:

• Test results and laboratory reports
• Billing and payment records
• Other health information in our designated record set

To request access, submit a written request to our HIPAA Privacy Officer. We will respond within 30 days (with one 30-day extension if needed). We may charge a reasonable, cost-based fee for copying and mailing. In limited circumstances, we may deny access, and you may have the right to request a review of the denial.

Right to Amend Your Records:

If you believe your PHI is incorrect or incomplete, you may request an amendment. We will respond within 60 days. We may deny your request if:

• The information was not created by us
• The information is not part of our designated record set
• The information is accurate and complete
• You would not be permitted to inspect the information

If we deny your request, you have the right to submit a statement of disagreement that will be included with your records.

Right to an Accounting of Disclosures:

You have the right to request a list of certain disclosures we have made of your PHI. This does not include disclosures for treatment, payment, healthcare operations, or disclosures made with your authorization. We will provide one accounting per year free of charge; subsequent requests may incur a reasonable fee.

Right to Request Restrictions:

You have the right to request restrictions on how we use or disclose your PHI. We are not required to agree to your request except in one situation: if you pay out-of-pocket in full for a service, you can request that we not disclose information about that service to your health plan, and we must agree.

Right to Request Confidential Communications:

You have the right to request that we communicate with you in a specific way or at a specific location (e.g., by mail instead of phone, at work instead of home). We will accommodate reasonable requests.

Right to a Paper Copy of This Notice:

You have the right to a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

Right to Be Notified of a Breach:

You have the right to be notified if there is a breach of your unsecured PHI.

Contact Information for HIPAA Privacy Officer

Complaint Procedures

If you believe your privacy rights have been violated, you have the right to file a complaint. You will not be retaliated against for filing a complaint.

File a Complaint with Us:

Submit a written complaint to our HIPAA Privacy Officer at the address above. Include:

• Your name and contact information
• Description of the privacy concern
• When the incident occurred
• Any supporting documentation

File a Complaint with the U.S. Government:

You may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

• Online: https://www.hhs.gov/hipaa/filing-a-complaint/index.html
• Mail: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201
• Phone: 1-877-696-6775

Changes to This Notice

We reserve the right to change the terms of this Notice at any time. Changes will apply to all PHI we maintain. When we make material changes, we will:

• Post the revised Notice on our website
• Make the revised Notice available at our facilities
• Provide you with a copy upon request

The effective date of the current Notice is listed at the top of this page.

State Law

Some state laws provide additional privacy protections beyond HIPAA. Where state law is more stringent than HIPAA, we will comply with state law. If you have questions about state-specific privacy protections, please contact our Privacy Officer.