Under HIPAA, Panda must maintain the privacy of your confidential and private information. Your private, confidential healthcare information is referred to as “Protected Health Information” (“PHI”). HIPAA requires that Panda notify you of Panda’s PHI privacy practices. Panda is committed to, and follows HIPAA, to protect your PHI and its confidentiality. Our HIPAA mandate requires that Panda establish policies and procedures to ensure Panda’s compliance under this (and other federal and state) privacy law. Nonetheless, Panda complies with all legal requirements that allow for, among other things, your access to your information under HIPAA.

Pursuant to HIPAA’s standards, please see below the circumstances under which Panda may make use of or disclose your PHI. We note that additional requirements under separate federal or state laws and regulations may limit Panda from the uses and disclosures described.

IF YOU HAVE ANY QUESTIONS, CONCERN, COMPLAINTS OR REQUESTS, PLEASE SEE THIS PAGE FOR THE RELEVANT PANDA CONTACT INFORMATION. WE REMAIN COMMITTED TO FOLLOWING HIPAA AND RESPECTING ALL LAWS THAT GOVERN YOUR RIGHTS TO YOUR INFORMATION.

1.0Your Healthcare Treatment

Panda may use or disclose your PHI as it pertains to your treatment—including, disclosure to your physician or other relevant healthcare provider. For example, Panda may disclose your PHI to a relevant healthcare professional that provides or coordinates your healthcare services, treatment, products, or prescriptions.

2.0Reimbursement/Payment For Services

Panda may use or disclose your PHI relevant to Panda’s claims submission and reimbursement for the services Panda provides. In short, Panda must communicate directly or indirectly with payor for the services that we provide.

3.0Panda’s Health Care Operations

Panda may use or disclose your PHI relevant to Panda’s health care operations. For example, as relevant to necessary evaluations of our testing services, their accuracy, and certain accreditation, management or operations matters. As consistent with all laws, such PHI disclosures may also include for healthcare operations of providers or plans/programs related to your healthcare (e.g., coordination of healthcare/benefits, disease management).

4.0Your Appointments and Other Reminders

Panda may use or disclose your PHI relevant to your appointments/reminders and other such healthcare relevant benefits or services. For example, Panda may contact you regarding testing services as ordered by your healthcare professional.

5.0Judical and Other Proceedings

Panda may use or disclose your PHI relevant under specific judicial or other proceedings. For example, in its response to proper demands pursuant to court or other proceeding order, subpoenas, discovery requests or any other proper and legal process.

6.0A Serious Threat To Health Or Safety

Panda may use or disclose your PHI in circumstances where the disclosure is necessary to mitigate or prevent imminent and serious threats to the health or safety of a person, the public or in the course of law enforcement’s acts to identify or arrest individuals.

7.0Research

Panda may use or disclose your PHI for research purposes. What are known as “Limited Data or Records,” can be seen by researchers in their efforts to identify patients that may be important in research activities, for example, but noting that such researchers may not copy or take possession of any PHI. Prior to any such PHI disclosure, Panda expect that one of the following will occur: (1) a “special committee” will be tasked with determining that the relevant research activity will not post a risk to privacy, including the existence of adequate safeguards in place for any PHI; (2) for PHI of the deceased, assurances are in place that PHI use is limited to the research; or (3) PHI provided shall not directly identify you.

8.0Certain Government Functions

Panda may use or disclose PHI of military personnel/ veterans (in certain circumstances) and as may be required by authorized, appropriate government authorities. Similarly, Panda may disclose PHI to authorized, appropriate government officials as may be relevant to national security purposes. Examples include, the protection of the President, in the conduct of intelligence or counter-intelligence gathering or other national security activities. If ever relevant, Panda shall only make such a disclosure as required and in compliance with laws and regulations.

9.0Workers’ Compensation

Panda may use or disclose your PHI as otherwise authorized by laws and regulations, for example, in relation to workers’ compensation programs that regulate work injury or illness benefits.

10Public Health Matters

Panda may use or disclose your PHI relevant to public health. Public health activity disclosures may relate to: (a) a public health authority; for example, relevant to reporting, preventing or controlling injuries, diseases, or disabilities; (b) relevant to reporting births/deaths, child abuse/neglect; (c) the Food and Drug Administration (“FDA”); for example, as relevant to the quality, safety, effectiveness of regulated activities or products — this may include, notifying people of recalled or problems with FDA-regulated products or adverse medication reactions; (d) a person that may have been or is at risk of having been exposed to a disease or condition, and/or may be at risk of transmitting a disease or condition; and, (e) an employer in certain limited circumstances of workplace injury or illness, but all subject to all federal and state laws and regulations.

11Abuse, Neglect Or Domestic Violence Victims

Panda may be required to use or disclose PHI relevant to abuse, neglect, or domestic violence victims. Pursuant to applicable law and regulation, Panda may disclose PHI to a government agency, authority or function, for example, social services, if Panda reasonably believes that a person is an abuse, neglect, or domestic violence victim.

12Regarding Healthcare Services Oversight

Panda may be required to use or disclose PHI to healthcare services oversight activities; for example, for a government agency’s oversight authorized by law which may include civil, criminal or administrative investigations, proceedings, prosecutions or action, including disciplinary, licensure, audits, inspections, audits, licensure/disciplinary actions, or other activities necessary for appropriate oversight of the health care system, government benefit programs, and compliance with regulatory requirements and civil rights laws.

1.0Those Involved In Your Helathcare Or Its Payment

Panda may use or disclose your PHI relevant to such persons that are part of your receipt of healthcare or that pay for your healthcare; for example, a family member. Also, Panda may use or disclose your PHI in certain circumstances; for example, relevant to disaster relief efforts. Further, Panda may use or disclose PHI of minors or incapacitated persons to their parents or legal guardian — subject to all federal and state law standards and requirements.

2.0Business Associates (as Defined By Law)

Panda may use or disclose your PHI to Panda’s Business Associates as required to perform its operations, for example, when such operations are supported by the Business Associate’s services to Panda. Panda requires that its Business Associates secure the confidentiality and privacy of your PHI in the same way as Panda. Similarly, if properly requested by a healthcare provider or health plan/program, Panda may disclose PHI to its Business Associates relevant to the performance of health care services – e.g., Medicare business associate needs relevant to medical necessity audits.

3.0Law and Law Enforcement

Panda may be required to use or disclose your PHI as otherwise required by federal, state, or local law. Further, Panda may use or disclose your PHI for law enforcement purposes. For example, in response to court orders, warrants, subpoenas/summons, or other proper authorized by law. Similarly, Panda may use or disclose your PHI when it is required as authorized by law, relevant to: (a) the location/identification of suspects, fugitives, material witnesses or missing persons; (b) crime victims; (c) a deceased person; (d) criminal conduct at a Panda facility; or (e) emergencies involving a crime, including reporting and location of same or its victims, or the location, identity, description of the perpetrator.

4.0Coroners, Medical Examiners, and Funeral Directors

Panda may be required to use or disclose your PHI as otherwise required by federal, state, or local law germane to a medical examiner/coroner or funeral director. For example, when such disclosure is required for the identification of a decedent, to determine cause of death, or relevant to performing such other duties authorized by laws and regulations.

5.0Presonal Representative

Panda may be required to use or disclose your PHI as otherwise required, established or allowed by federal, state, or local law to a personal representative, an administrator, executor, or other authorized individual that may be associated with you and your estate.

6.0A Correctional Institution

Panda may be required to use or disclose the PHI as otherwise required, established or allowed by federal, state, or local law of an inmate or other individual, as may be requested by law enforcement or correctional institution officials and as relevant to health, safety, and security purposes.

Panda may use/disclose “de-identified” healthcare information. Information that has been “de-identified” constitutes information that has been edited in such a manner that certain identifiers that may have identified you; that is, in a manner that makes it unlikely that the person could be identified from the information. Similarly, Panda may disclose “limited health information” which may be contained in a “limited data set.” A “limited data set” contains no information that may directly identify you, such as, your state, city, county or zip code, but certainly not your name, age, phone number or address.

Panda explicitly states that pursuant to any purpose not set out above, Panda will not use or transfer PHI without your explicit authorization; for example, use or disclosure of your PHI by Panda for marketing purposes. In such an example, Panda will not “sell” your PHI; any use or disclosure not allowed for under the law requires your authorization. We note that if you ever have given your authorization for such a use, you retain sole and absolute discretion to revoke such authorization, except as may be relevant to a prior Panda use or disclosure in reliance on your prior consent.

If Panda ever discovers that a breach of unsecured PHI has occurred, Panda is required to notify you of same except in the case that the circumstances of same demonstrates (for example, based on a risk assessment) that the breach presents with a low probability that such PHI has been actually compromised. Nonetheless, a notification will be made without delay, but not later than sixty days subsequent to the breach discovery. The notification includes the facts relevant to the breach and information on mitigating harm.

The HIPAA establishes the following in regards to your PHI rights:

A. YOUR RIGHT TO RECEIVE A COPY OF PANDA’S PRIVACY PRACTICES NOTICE. You have a right to receive Panda’s Privacy Practices Notice. You may request the Notice at any time and through Panda’s Privacy Officer at Panda Conservation Group, LLC – ATTN. Privacy Officer, (844) 485-1277/compliance@pandahealthcorp.com. Panda’s notice is nonetheless posted on its website at [DEV: Insert Slug and make hotlink].

B. YOUR RIGHT TO REQUEST THAT PANDA LIMIT THEUSE AND DISCLOSURE OF YOUR PHI. Under the law, you can request that Panda limit: (1) how Panda uses or discloses PHI relevant to any health care operations activity, including regarding treatment or payment; or 2) whether Panda disclosed your PHI to persons involved in your healthcare or for its payment. We note that pursuant to your request, Panda will follow the law and consider your request, but you must understand that Panda may in some cases not be required to agree to your request if it is not allowed under the law in the case your request involves disclosure to a health payment program regarding payment or health care operations (and not for treatment) and you have paid for Panda’s services in full and out of pocket. In cases where Panda has agreed to your request, Panda will memorialize agreed-upon restrictions in writing and will comply with our agreement – we further note, that Panda may not so abide under emergency circumstances when such a disclosure is for treatment purposes.

C. YOUR RIGHT TO REQUEST CONFIDENTIAL COMMUNICATIONS. You retain the right to request that Panda communicate with you relevant to PHI, for example, via a different address or by a certain communication means. Panda will accommodate any reasonable request to change the mode or address through which we communicate with you.

D. YOUR RIGHT TO INSPECT AND RECEIVE A COPY OF YOUR PHI. You or your personal representative have a right to access your Panda relevant PHI, for example, your reports ordered by your physician. If you so request, and unless an exception applies, your will receive (within 30 days after Panda’s receipt of your request) a copy of your Panda held documentation. An exception may apply when a licensed health care professional determines that such access requested may endanger your or another person life or safety of you or another person. In such a case, Panda may extend our response time for an additional 30 days (but you can expect to be provided in writing, the reason(s) for the delay, and when you will have access). You retain the right to your PHI in electronic format if same is reasonably reproducible in such a format. Nonetheless, you retain the right to instruct Panda to send your data to such other person as you may designate in a writing that has your signature and through which you explicitly designate such person. PHI requests may be made: (1) when you visit a Panda relevant facility; (2) by completing Panda’s request form; (3) by contacting Panda’s Privacy Officer, (844) 485-1277/compliance@pandahealthcorp.com.

E. YOUR RIGHT TO RECEIVE A DISCLOSURE ACCOUNTING. You have the right to receive and accounting of the instances that Panda has disclosed your PHI. Please note that such an accounting may not include all PHI disclosures, for example, for those disclosures made in writing by you or regarding disclosures prior a date on which Panda was required to comply. Your accounting request for PHI disclosures made for purposes other than treatment, payment, or health care operations, will include such disclosures made in the past six years; except in the case your request is for a shorter period. An accounting request for PHI disclosures made for purposes of treatment, payment, or health care operations, will include disclosures made in the past three years; except in the case your request is for a shorter period.

F. YOUR RIGHT TO CORRECT OR UPDATE. At any time that you conclude that your PHI includes a mistake, you retain the right to request that Panda correct such mistake. If Panda denies your request to correct or update, Panda will provide to you an explanation in writing setting out the reason(s) for Panda’s decision to deny your request to correct or update.

To access your rights under HIPAA/this Notice, send your request in writing to:

Panda Conservation Group, LLC – ATTN. Privacy Officer, at privacy@pandahealthcorp.com.

Nonetheless, if you wish to contact Panda regarding any billing, claims, or other insurance matter, please contact us at the number or department contact information set out in the documentation you have received from or relevant to Panda.

HOW TO FILE A COMPLAINT – CONTACTING PANDA

If you want to file a complaint, or have any questions, either as relevant to Panda’s processing, use or disclosure of your medical information, the preceding information, or our privacy practices, you are encouraged to reach out to compliance@pandahealthcorp.com or reach out to us at (844) 485-1277. Separately and additionally, you may send to us any written request, complaint or question at:

Panda Conservation Group, LLC – ATTN. Privacy Officer, at privacy@pandahealthcorp.com.

Nonetheless, you retain your right to file any complaint with the U.S. Department of Health and Human Services. Panda has a zero-tolerance policy against retaliation for anyone, including you, filing a complaint regarding medical information privacy matters or practices or any other matter.

CHANGES TO THIS PRIVACY PRACTICES NOTICE

Panda may change this notice or its privacy policies in the future. If so, such changes may relate to your medical information/PHI that Panda may maintain. At all times, Panda shall act consistent with our notice to you and our privacy policies in effect. If changes to our notice(s) to you or our privacy policies occur, Panda will update this Notice on this Website. For your most current information, please periodically review this Website for any relevant changes.

THE EFFECTIVE DATE OF THIS NOTICE/PUBLISHED ON: 30-Nov-2020.