You Have the Right to:

• Obtain a copy of your paper or electronic health record
• Ask us to limit the information we share
• Request confidential communication
• Amend your health record
• Obtain a list of those with whom we've shared your information
• Obtain a copy of this privacy notice
• File a complaint if you believe your privacy rights have been violated
• Notification by AEL Labs of any changes to our health information practices

We May Use and Share Your Information to:

• Assist in treating you
• Bill for services provided
• Manage our organization
• Comply with the law
• Help with public health and safety issues

We are Required to:

• Maintain the privacy and security of your health information
• Inform you if a breach occurs that may have compromised the privacy or security of your information
• Provide you with a notice of our legal duties and privacy practices regarding the information we collect and maintain about you
• Abide by the terms of this notice
• Notify you by mail, upon your request, if AEL's health information practices change
• Obtain your written authorization for any uses or disclosures of your health information not described in this notice. You may revoke the authorization at any time, except to the extent that action has already been taken.

Obtain a copy of your paper or electronic health record

• You can ask to see or obtain an electronic or paper copy of your laboratory record. Click the link on this website that will direct you to the form you will need to submit to obtain your record.
• We will provide a copy of your laboratory record in the timeframe required by law. You will be informed in writing if the delivery of your record will be delayed.

Ask us to limit the information we share

• We are allowed to use your health information for treatment, payment and healthcare operations without your consent. You can ask us to limit or not use your information for these purposes, but we are not required by law to agree to your request.
• If you pay for laboratory services out-of-pocket in full, you can ask us not to share that information with your health insurer. We will say yes to your request unless a law requires us to share that information.
• If you would like us to limit the information that we share about you, contact AEL's Privacy Officer by calling 901.844.8638 or email to [email protected].

Request confidential communication

• You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address than we have on record for you. We will say yes to all reasonable requests.
• If you have a request for confidential communication, contact AEL's Privacy Officer by calling 901.844.8638 or email to [email protected].

Amend your health record

• You can ask us to amend health information about you that you think is incorrect or incomplete, but we are not required to agree to your request. You will be notified in writing within 60 days of your request if we do not agree to your request.
• If you have a request to amend your health information, contact AEL's Customer Service Department at 800.423.0504.

Obtain a list of those with whom we've shared your information

• You can ask us to prepare a list for you of the people with whom we have shared your health information within the past six years of your request.
• We will provide you with a description of the information that we shared, who we shared it with, and why we shared it.
• Under the law, we are not required to include in the list the occasions that we shared your health information for the purposes of treatment, payment or healthcare operations.
• If you would like to obtain a list of those with whom we've shared your information, contact AEL's Privacy Officer by calling 901.844.8638 or email to [email protected].

Obtain a copy of this privacy notice

• You may obtain a copy of this privacy notice by accessing AEL Labs' website at www.AEL.com. Click the "About Us" tab and select Privacy Policy. Click the print icon.
• If you wish to have a copy of this privacy notice mailed to you, contact AEL's Privacy Officer by calling 901.844.8638 or email to [email protected].

How to contact us or file a complaint

• If you have questions or comments regarding AEL Labs's Notice of Privacy Practices, or have a complaint about our use or disclosure of you Protected Health Information or our privacy practices, please contact AEL's Privacy Officer by calling 901.844.8638 or email to [email protected].

• You may file a complaint directly with the Secretary of Health and Human Services. There will be no retaliation by AEL Labs for you filing a complaint.

• If you have questions or comments regarding AEL's Notice of Privacy Practices, or have a complaint about our use or disclosure of your Protected Health Information or our privacy practices, please contact AEL's Privacy Officer by calling 901.844.8638 or email to [email protected].

You may file a complaint directly with the Secretary of Health and Human Services. There will be no retaliation by AEL for you filing a complaint.

• Assist in your treatment: for example, we will report the results of your laboratory test(s) to the healthcare practitioner who requested the test(s).
• Bill for services rendered to you: for example, a bill may be sent to you or a third-party payer. The bill may include information that identifies you and the tests that were performed.
• Manage our organization: for example, we may use information about you to assess the timely reporting of the results of your test(s); this information will then be used in an effort to continually improve the quality and effectiveness of the service we provide.
• We may provide your PHI to other companies or individuals that need the information to provide services to us. These other entities, known as "business associates," are required to maintain the privacy and security of PHI. For example, we may provide information to companies that assist us with billing of our services. We may also use an outside collection agency to obtain payment when necessary.
• Comply with the law; for example:

• We may disclose your health information to public health or legal authorities charged with preventing or controlling disease, injury, or disability or to avert a serious threat to the health or safety of a person or the public.
• To comply with laws relating to workers' compensation or other similar programs established by law.
• We may disclose your health information for law enforcement purposes as required by law or in response to a valid subpoena.

Maintain the privacy and security of your health information

• Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), AEL is required by law to maintain the privacy of health information that identifies you, called protected health information or "PHI." AEL will make reasonable efforts to ensure the confidentiality of your PHI, as required by statute and regulation.

Inform you if a breach occurs that may have compromised the privacy or security of your information

• AEL is required to provide patient notification if it discovers a breach of unsecured PHI unless there is a demonstration, based on a risk assessment, that there is a low probability that the PHI has been compromised. You will be notified without unreasonable delay and no later than 60 days after discovery of the breach.

Provide you with a notice of our legal duties and privacy practices regarding the information we collect and maintain about you

• AEL is required to provide you with this notice of our legal duties and privacy practices. A copy of our privacy practices is available on our website, www.AEL.com. You may also request that a printed copy be mailed to you (see below).

Abide by the terms of this notice

• AEL is required by law to maintain the privacy of your PHI and to abide by all of the terms of this notice.

Notify you by mail, upon your request, if AEL's health information practices change

• AEL may change the content of this notice of privacy practices at any time because of operational or regulatory requirements. The changes will apply to all information AEL has about you. Whenever changes are made to this notice of privacy practices, they will be posted on AEL's website at www.AELlab.com. If you request, you may be notified by mail whenever these changes occur. If you wish to have a copy of the changed notice of privacy practices mailed to you, contact AEL's Privacy Officer by calling 901.844.8638 or email to [email protected].

Obtain your written authorization for any uses or disclosures of your health information not described in this notice. You may revoke the authorization at any time, except to the extent that action has already been taken

• For purposes not described above, AEL will ask for your authorization before using or disclosing your PHI. If you signed an authorization form, you may revoke it, in writing, at any time, except to the extent that AEL has already acted on any prior uses or disclosures previously authorized by you.

This notice becomes effective on Oct 6th, 2014.

Memphis, TN—July 12, 2019

American Esoteric Laboratories (“AEL”) has been informed by Retrieval Masters Creditors Bureau d/b/a American Medical Collection Agency (“AMCA”) of a data security incident involving the AMCA payment website. AMCA is an independent collection agency that AEL and many other entities used for debt collection. The incident is limited to AMCA’s systems. The security of AEL’s systems was not affected by this incident.

According to AMCA, on March 21, 2019, AMCA became aware of facts indicating there had been a data security incident. After conducting an investigation, in May of 2019, AMCA notified AEL about the incident and informed AEL that an AMCA database containing information for some AEL patients had been affected. However, at the time of AMCA’s initial notification, AMCA did not provide AEL with enough information for AEL to identify potentially affected patients or confirm the nature of patient information potentially involved in the incident, and AEL’s investigation is on-going. Based on the information provided by AMCA, the following information belonging to AEL patients may have been affected by the incident: patient names, addresses, phone numbers, dates of birth, dates of service, balance information, credit card or banking information and treatment provider information. AMCA has advised AEL that its patients’ social security numbers were not involved in the incident. AEL does not provide AMCA healthcare records such as laboratory results and clinical history. The impact of this incident is limited to patients whose accounts were referred for debt collection and who reside in the United States.

Individuals with questions about this incident or questions about precautionary steps they can take may call 833.297.6408 or visit https://ide.myidcare.com/AEL for additional information.

AEL takes the security of its patients’ information very seriously, including the security of data handled by vendors. The privacy and protection of patient information is a top priority. As a result of the investigation, AEL is no longer using AMCA for collection efforts.

AEL greatly appreciates the patience and loyalty of its patients as it works to respond to this incident.

While we are unaware of the misuse of any patient’s information, we are providing the following information to help those wanting to know more about steps they can take to protect themselves:

What steps can I take to protect my personal information?

• If you detect any suspicious activity on any of your accounts, you should promptly notify the financial institution or company with which the account is maintained. You should also promptly report any fraudulent activity or any suspected incidents of identity theft to proper law enforcement authorities.

• Obtain a copy of your credit report, free of charge, directly from each of the three nationwide credit reporting agencies.  To do so, free of charge once every 12 months, please visit www.annualcreditreport.com or call toll free at 877.322.8228. Contact information for the three nationwide credit reporting agencies is listed at the bottom of this page.

• Please notify your financial institution immediately of any unauthorized transactions made or new accounts opened in your name.

• You can take steps recommended by the Federal Trade Commission to protect yourself from identify theft. The FTC’s website offers helpful information at www.ftc.gov/idtheft.

• Additional information on what you can do to better protect yourself is included in your notification letter.
   

What should I do to protect myself from payment card/credit card fraud?

We suggest you review your debit and credit card statements carefully for any unusual activity.  If you see anything you do not understand or that looks suspicious, you should contact the issuer of the debit or credit card immediately.

How do I obtain a copy of my credit report?

You can obtain a copy of your credit report, free of charge, directly from each of the three nationwide credit reporting agencies. To order your credit report, free of charge once every 12 months, please visit www.annualcreditreport.com or call toll free at  877.322.8228. Contact information for the three nationwide credit reporting agencies is included in the e-mail and letter, and is also listed at the bottom of this page:

How do I put a fraud alert on my account?

You may consider placing a fraud alert on your credit report. This fraud alert statement informs creditors to possible fraudulent activity within your report and requests that your creditor contact you prior to establishing any accounts in your name. To place a fraud alert on your credit report, contact Equifax, Experian or TransUnion and follow the Fraud Victims instructions. To place a fraud alert on your credit accounts, contact your financial institution or credit provider. Contact information for the three nationwide credit reporting agencies is included in the letter and is also listed at the bottom of this page.

Contact information for the three nationwide credit reporting agencies is as follows: