HIPAA Notice of Privacy Practices
This Notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully.
TriCore Reference Laboratories (TriCore, we, our, us) is required by law to maintain the privacy of your protected health information (PHI), provide notice of our legal duties and privacy practices with respect to PHI and to notify affected individuals following a breach of unsecured PHI. TriCore is further required to abide by the terms of the Notice currently in effect.
TriCore provides this Notice to you to describe the ways we may use and disclose your PHI, including how we may use your PHI within TriCore and how, under certain circumstances, we may disclose it to others outside TriCore. This Notice also describes the rights you have concerning your own PHI. Please review it carefully. If you have questions about any part of this Notice, or if you want more information about the privacy practices of TriCore, please contact the privacy officer listed at the end of this Notice.
How We May Use and Disclose Your PHI
The law permits TriCore to use your PHI to provide services to you, to bill for services, and for healthcare operations, as explained below. Not every use or disclosure is listed in this Notice, but all of our uses or disclosures of your PHI will fall into one of the categories listed below.
- Treatment — We will use your PHI to provide you with the best laboratory service possible. This may include communication with your health care provider (e.g., doctor, nurse, pharmacy) to clarify a laboratory test order or to provide test results.
- Payment — We will use and disclose your PHI for purposes of billing and payment. For example, we give PHI to your health insurance plan so they will pay for our services.
Note: If you do not want a claim for payment sent to your insurer:
- do not present your insurance card at the time of specimen collection, and
- ask that TriCore bill you for the tests.
- This process only applies when TriCore performs the billing for your lab services. If your tests were ordered by the University of New Mexico Hospital system, Lovelace Hospitals, Presbyterian Hospitals, or Presbyterian Medical Group, you may ask your ordering provider for your options.
- Operations — We may use or disclose PHI for healthcare operations. These uses and disclosures may include the evaluation of the quality of our testing, the accuracy of results, securing accreditations, and for the operations and management of the lab. We may also disclose PHI to other healthcare providers or health plans involved in your care for their own operations, including coordination of care and benefits.
- Incidental Disclosures — These disclosures occur during the course of providing laboratory services and cannot reasonably be prevented. They may also occur as a result of a permitted use or disclosure. For example, when TriCore uses sign-in sheets in patient waiting areas, we will implement reasonable safeguards to protect your PHI.
- Emergencies — TriCore workforce members will use professional judgment to decide whether sharing your PHI is in your best interest during a health emergency.
- Law Enforcement — State or federal law may permit the disclosure of very limited PHI to law enforcement for certain purposes including, in limited circumstances, to assist law enforcement in the event that you are the victim of a crime, or you are accused of criminal activity. TriCore may also be required to release PHI in compliance with a court order, judicial subpoena, court warrants, and other investigative demands or procedures.
- Public Health — TriCore may be required to disclose to federal or state officials, military authorities, or foreign government agencies PHI necessary to complete an investigation related to public health or national security. Such information is sometimes needed for the control or prevention of an epidemic, product recall or to increase understanding of the side effects of a drug treatment.
- Organ and Tissue Donation — If you are an organ or tissue donor, your PHI may be shared with organizations that obtain, store or transplant human organs and tissues.
- Correctional Institutions — If you are an inmate, your PHI may be shared with correctional institutions or law enforcement officials in order to protect your health or the health and safety of others.
- Health Oversight Agencies — We may disclose your PHI to health oversight agencies for authorized government review of the health care system, civil rights and privacy laws, and compliance with government programs. Health oversight agencies include the Secretary of the U.S. Department of Health and Human Services (HHS), the Centers for Medicare and Medicaid Services (CMS), and the New Mexico Human Services Department (HSD).
- Abuse or Neglect — TriCore will notify government authorities if we believe that a patient is the victim of abuse, neglect, or domestic violence. We will make this disclosure only when compelled to do so by our ethical judgment or when we believe we are specifically required or authorized by law to do so.
- Medical Examiner or Funeral director — TriCore can share PHI with a coroner, medical examiner, or funeral director when an individual dies.
- Research — Any information being provided by TriCore for research purposes, assay validation or other appropriate uses under the law will be ‘de-identified.’ That is, information that identifies you will be removed.
- Communication with Other Persons — TriCore may disclose to family members, caregivers, or others the PHI related to that person’s involvement in your care or payment for your care.
Note: In communicating with others, TriCore will attempt to obtain your agreement or objection. TriCore may, in certain circumstances, exercise professional judgment and disclose PHI without your agreement if the disclosure is determined to be in your best interest.
TriCore will only use and disclose your PHI after obtaining your written authorization for the following:
- New Mexico Workers’ Compensation Complaints
- Sale of PHI
- Other uses and disclosures not described in this Notice
Other uses and disclosures of your PHI not covered by this Notice or the laws that apply to us will be made only with your written authorization (Authorization form is available at www.tricore.org/patients). You may cancel that authorization at any time by sending a written request to our Privacy Officer using the contact information is on the last page of this Notice. Note that we are unable to take back any disclosures we have already made with your authorization.
Information with Additional Protections
Certain types of PHI may have additional protection under federal or state law. For example, PHI about mental health, HIV, sexually transmitted diseases, and genetic testing results is treated differently than other types of PHI under certain state laws. Additionally, federally assisted (Part 2) alcohol and drug abuse programs are subject to certain special restrictions on the use and disclosure of alcohol and drug abuse treatment information. When required, TriCore will obtain your written permission before disclosing this information to others.
Your Patient Rights
- Waiver of Rights— You will never be asked to waive your rights in order to access treatment.
- Access — Patients have the right to request a copy of their PHI and billing records in either paper or electronic form. Before releasing the information, TriCore will require proof of your identity and, in some situations, an appropriately signed release. You may request that the information be transmitted to someone other than yourself. By law, TriCore has 30 days to respond to your request. We may charge a reasonable, cost-based fee.
TriCore does not have a patient portal for the electronic access of records. Records can be provided via mail, fax, or email by:
- Completing a request form at any TriCore location
- Contacting the Client Engagement Center at 505.938.8922
- Personal Representatives — TriCore may disclose PHI to your personal representative, as established by applicable law, or to an administrator, executor, or other authorized individual associated with your estate.
- New Mexico HIE Opt-Out — TriCore participates in New Mexico’s electronic PHI exchange (HIE). An HIE is a platform for the secure exchange of PHI among different healthcare organizations and health plans. To opt out of the HIE, follow the instructions here: https://www.syncronys.org/resources/#for-patients
- TriCore’s Provider Portal – TriCore hosts a web-based portal that allows healthcare providers involved in your care to access your lab PHI. To opt out of TriCore’s Provide Portal, call 505.938.8922 or electronically submit the opt-out form, available here: www.tricore.org/optout
You may opt out at any time, but the opt-out will not apply to PHI accessed prior to opting-out. You may also reverse your opt-out at any time by completing and submitting a form.
Note: Your treating providers will continue to have access to your PHI through methods other than the Provider Portal for purposes of treatment, payment, and operations.
- TriCore’s Payer Portal –TriCore hosts a web-based portal so health plans may access your PHI for operational purposes such as quality measure adherence, care coordination, and treatment authorization. This portal is restricted to the insurance responsible for your coverage and/or the provider responsible for your care. When you pay for lab services in cash, you will be opted out of TriCore’s Payer Portal.
Note: Your health plan may continue to have access to your PHI through methods other than the Payer Portal for purposes of treatment, payment, and operations.
- Restrictions — You have the right to submit a written request that TriCore restrict or limit its use or disclosure of your PHI for treatment, payment, or health care operations. While we will consider your written request, we are not required by law to agree to such a restriction or limitation.
- Confidential Communications — You have the right to request that TriCore communicates with you in a specific way (for example, home or office phone) or to send mail to a different address, as long as the request is reasonable.
- Choose Someone to Act for You — If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI.
- Amend — You have the right to ask TriCore to amend, update or modify your PHI during the time it is being retained by TriCore if you believe your PHI is incorrect or incomplete. You must provide your detailed request in writing. Your request may be denied if the PHI record was not created by TriCore or if the existing PHI is determined to be accurate and complete.
- Disclosures — You can ask for an accounting of disclosures (a list of the times TriCore has shared your health information) for a period no longer than six years prior to the date you request, with whom it was shared, and why. We will include all the disclosures except for those for treatment, payment, and health care operations, and certain other disclosures, such as any you asked us to make. TriCore will provide one accounting per year for free but will charge a reasonable, cost-based fee if you ask for another accounting within 12 months.
- Receive a Copy of TriCore’s Notice of Privacy Practices — You can ask for a paper copy of this Notice at any time.
- Inspect or Copy – You can request access to inspect or to obtain a copy of the PHI TriCore maintains about you. TriCore may require you request for access in writing, provided that it informs individuals of such a requirement.
- Notification of Breach — Although TriCore makes every effort to ensure its practices protect your PHI, breaches may occur. A breach is any unauthorized access, use, or disclosure of PHI that compromises the security or privacy of the information. We will let you know promptly if a breach of your information occurs.
- Questions, Concerns, or Complaints — If you have any question about this Notice or believe your rights have been violated, you may contact the TriCore Privacy Officer in writing either on paper or electronically to:
TriCore Privacy Officer
1001 Woodward Place NE
Albuquerque, NM 87102
or to firstname.lastname@example.org or 505.938.8330.
If we cannot resolve your complaint, you may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to:
200 Independence Avenue, SW
Washington, DC 20201
or calling 1.877.696.6775 or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.
TriCore will not retaliate against you for filing a complaint.
Changes to the Terms of this Notice
TriCore reserves the right to change the terms of this Notice and apply the changes to all of your PHI maintained by TriCore. The new Notice will available upon request at any TriCore facility, and on the TriCore website, www.tricore.org.
Effective: January 11, 2022