HIPAA Notice of Privacy Practices

This Notice of Privacy Practices describes how NextGen PGx may use and disclose your protected health information (PHI) for treatment, payment, and health care operations, and about the rights you have under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its regulations.

NextGen PGx provides services to you as a direct-to-consumer laboratory service. Where we act as a covered entity or business associate under HIPAA, we are required by law to maintain the privacy of your PHI, to give you this Notice of our legal duties and practices, and to abide by the terms currently in effect.

We will not use or disclose your genetic information for marketing purposes, and we will not sell your PHI, without your written authorization. Uses and disclosures not described in this Notice require your written authorization, which you may revoke in writing at any time.

• Treatment: to carry out testing you have ordered and to support your healthcare providers in reviewing your results (only when you authorize sharing).
• Payment: to bill and collect payment for the services you ordered, including confirming eligibility and processing refunds.
• Health care operations: to run our business, including quality assurance, customer support for your orders and kits, audit controls, and fraud prevention.
• As required by law: for public health activities, health oversight agencies, law-enforcement requests that meet legal requirements, and to avert a serious threat to health or safety.
• Business associates: to contractors and laboratory partners who perform services for us, under written agreements requiring them to protect your PHI.
• De-identified data: information that has been de-identified according to federal standards may be used or disclosed without restriction.

• Right to access: you may request to inspect or obtain an electronic or paper copy of your PHI, including your test results. We will act on requests within 30 days (with one possible 30-day extension as allowed by law).
• Right to amend: you may request that we amend PHI you believe is inaccurate or incomplete. We may deny a request for reasons allowed by law and will explain the denial.
• Right to an accounting of disclosures: you may request a list of certain disclosures we made of your PHI (up to six years prior), excluding disclosures for treatment, payment, operations, and other excluded categories.
• Right to request restrictions: you may request limits on how we use or disclose your PHI for treatment, payment, or operations. We are not required to agree except where disclosure to a health plan is restricted and the services were paid in full out-of-pocket.
• Right to confidential communications: you may request that we contact you only in a certain way (for example, a specific email or phone number).
• Right to a paper copy: you may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

• We maintain the privacy and security of PHI as required by HIPAA.
• We restrict access to patient data with role-based permissions, so staff see only the minimum information necessary for their role, and we record access in a tamper-resistant audit log.
• We will notify you if a breach of your unsecured PHI occurs, as required by law.
• We will not retaliate against you for filing a complaint, exercising your rights, or participating in an investigation.

If you believe your privacy rights have been violated, you may file a complaint with us by writing to the NextGen PGx Privacy Office at privacy@nextgenpgx.com. We will investigate and respond and will not retaliate against you.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints.

We reserve the right to change this Notice and to make the new terms effective for all PHI we maintain. The current Notice is available on our website and from us on request, and each version shows its effective date.

NextGen PGx Privacy Office · Email: privacy@nextgenpgx.com · Or reach us through the Support section of your patient portal.