HIPAA Notice of Privacy Practices
Version 2026-07-31 · Effective July 31, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. This Notice applies only to clinical and diagnostic services — specimen collection, phlebotomy, screening and DNA collection. It does not apply to notarial or document-only services.
Our role
When FieldFlow coordinates a specimen collection on behalf of a laboratory, ordering provider or employer program, FieldFlow acts as a business associate of that covered entity. The professional who performs the collection handles protected health information (PHI) under this Notice and under the covered entity's own privacy practices.
Uses and disclosures without your separate authorization
We may use and disclose your PHI to:
- Treatment — provide the collection to you and transmit the specimen and requisition to the designated laboratory or provider.
- Payment — bill and collect for the service, including through your payment method or sponsoring program.
- Health care operations — quality assurance, credential verification, chain-of-custody audits and training.
- As required by law — public health reporting, court orders, subpoenas and health oversight activities.
Uses that always require your written authorization
Marketing, sale of PHI and most uses of psychotherapy notes require your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.
Minimum necessary
We disclose only the minimum information necessary. Your record is visible to the single professional assigned to your appointment, never to the general dispatch pool, and is enforced technically by row-level security.
Your rights
You have the right to:
- Inspect and obtain a copy of your record, including an electronic copy.
- Request an amendment to information you believe is incorrect.
- Receive an accounting of certain disclosures.
- Request confidential communications at an alternate address or number.
- Request restrictions on certain uses and disclosures.
- Be notified in the event of a breach of unsecured PHI.
- Obtain a paper copy of this Notice on request.
Safeguards and breach notification
PHI is encrypted in transit and at rest, access is logged, and workforce access is restricted by role. If unsecured PHI is breached, affected individuals are notified without unreasonable delay and no later than 60 days after discovery.
Complaints
You may complain to us at recruiting@fieldflowlab.com or to the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.
