VERACYTE HIPAA Notice of Privacy Practices (“NOTICE”)

Under HIPAA, we are permitted to use and disclose your PHI without obtaining your authorization, for treatment, payment, and healthcare operations purposes, and for other purposes permitted or required by law as explained below:

Treatment: We may use and disclose PHI to provide you with healthcare services. For example, we may disclose laboratory results to your healthcare provider.

Payment: We may use and disclose your PHI so that we or other entities involved in your care may obtain payment from you, an insurance company, or a third party for services you receive. For example, we may submit a claim to you or your health plan/insurer that includes your PHI.

Healthcare Operations: We may disclose your information as part of our internal operations and to maintain the quality of our laboratory services. For example, we may use or disclose PHI, for example, to review the qualifications of laboratory professionals, conduct training, de-identify your PHI, or to perform administrative functions.

Health-Related Benefits and Services: We may use and disclose your PHI to tell you about health-related benefits, products or services.

As Required by Law: We may use or disclose PHI if required to do so by state or federal law.

Disclosures to Your Representative and/or Individuals Involved in Your Care: We may disclose PHI to your family member or close personal friend who are involved in your care, including those who are responsible for paying for your care. We may also disclose PHI to your personal representative, as established under applicable law, or to an administrator or authorized individual associated with your estate. As permitted by federal and state law, we may disclose PHI about minors to their parents or guardians.

Disclosures to Business Associates: We may disclose your PHI to certain of our service providers that have agreed to maintain the privacy and security thereof in accordance with HIPAA.

Public Health and Health Oversight Activities: We may disclose PHI to public health authorities and other entities charged with preventing or controlling disease, injury, or disability. We may also disclose PHI for health oversight activities, including but not limited to audits, investigations, examinations, inspections, and licensure.

Abuse, Neglect, or Domestic Violence: We may disclose PHI in certain cases to proper government authorities if we reasonably believe that you have been a victim of domestic violence, abuse, or neglect.

Research: Under certain circumstances, we may use and disclose PHI for research purposes. We can use or share your PHI with your signed authorization or approval from an Institutional Review Board or Privacy Board to conduct the research without your express authorization. We can also use your PHI without your signed authorization to prepare for research, such as to prepare a research protocol, or share your PHI for those purposes. We may also disclose information about descendants to researchers under certain circumstances.

Deidentified Information: We may use your PHI to create deidentified information by removing certain identifiers. There are specific rules under HIPAA about the types of identifiers that need to be removed before information is considered deidentified. Once information has been deidentified in accordance with the standards in HIPAA, it is no longer subject to this Notice.

Organ procurement organizations: We may disclose PHI consistent with applicable law to organ procurement organizations or other entities for the purposes of tissue donation and transplant.

Coroners, Medical Examiners, Funeral Directors: We may disclose PHI to a coroner or medical examiner to identify a deceased person and determine the cause of death or to funeral directors, as authorized by law, so that they may carry out their jobs.

Food and Drug Administration (FDA): We may disclose PHI to a person subject to the jurisdiction of the FDA for public health purposes related to the quality, safety or effectiveness of FDA- regulated products or activities such as adverse events with respect to product defects or post-marketing surveillance information to enable product recalls, repairs, or replacement.

Workers’ compensation: We may disclose PHI to the extent authorized by, and necessary to comply with, laws relating to workers compensation or other similar programs established by law.

Correctional institution: If you are or become an inmate of a correctional institution or under the custody of law enforcement official, we may disclose PHI to the institution or agents thereof necessary for your health and safety, and that of other individuals.

To Avert a Serious Threat to Health or Safety: We may disclose PHI to a person able to help prevent a serious threat to your health and safety or the health and safety of the public or another person.

To Sponsors of Group Health Plans: We may disclose PHI to the sponsor of a self-funded group health plan. We may also give your employer information on whether you are enrolled in or have dis-enrolled from a health plan offered by your employer.

Law enforcement: We may disclose PHI for law enforcement purposes as required by law or in response to a valid subpoena, court order, subpoena, warrant, summons or similar process. We may also disclose PHI to appropriate agencies if we believe there is the possibility of criminal conduct, abuse, neglect, or domestic violence.

Judicial proceedings: We may disclose PHI in response to a court or administrative order, a discovery request, or other lawful process when certain requirements are met.

National Security; Intelligence Activities; Protective Service: We may disclose PHI to federal officials for intelligence, counterintelligence, and other national security activities authorized by law, including activities related to the protection of the President, other authorized persons or foreign heads of state, or related to the conduct of special investigations.

Other Uses and Discloses of Your Personal Information

We may not use or disclose your PHI other than as described in this notice without your written authorization, including for marketing purposes and disclosures that would constitute the sale of PHI, and then we use or disclose it only in a manner consistent with the terms of that authorization. You may revoke the authorization to use or disclose any PHI at any time by writing to the contact person listed in this Notice or as provided in the authorization.

Under HIPAA, you have certain rights regarding your PHI, which include:

Right to Receive this Notice of Privacy Practices: You the right to request and receive a free copy of this Notice in printed or electronic form by writing or calling the contact person listed in this Notice, even if you have previously agreed to receive this notice electronically.

Right to Inspect and Request a Copy of Protected Health Information: You have the right to inspect and request a copy of your PHI we maintain about you in a designated record set. You must submit your request to us in writing. You have a right to obtain a paper or electronic copy. You may also request where the PHI is to be sent. If you request a copy of the PHI, we may charge a fee for the costs of copying, mailing or other supplies associated with your request. We may deny your request to inspect and copy in certain very limited circumstances.

Right to Receive Protected Health Information via Confidential Communications: You have the right to request that we communicate with you about your PHI in a certain way or at a certain location. For example, you can ask that we contact you at work or by mail. To request confidential communications, you may make your request in writing. We will not ask you the reason for your request, and we will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to Request Restrictions on Use or Disclosure: You have the right to request to request additional restrictions on our use or disclosure of certain of your PHI for treatment, payment, or healthcare operations or to individuals involved in your care. We are not required to agree with the request unless the requested restriction involves a disclosure to a health plan for purposes of payment or health care operations and you have paid for the applicable services in full out of pocket (unless such disclosure is required by applicable law). You must make your request in writing. In your request, you must tell us (1) what information you want to limit; (2) whether you want to limit our use, disclosure or both; and (3) to whom you want the limits to apply. If we do agree, we will not violate that restriction except in certain emergency situations.

Right to Amend Protected Health Information: You can request that we amend the PHI we maintain about you in a designated record set. You have the right to request an amendment for as long as the PHI is kept by or for us. Your request must be made in writing, and you must provide details on what information you seek to amend and the reasons that supports your request. We can deny the request for amendment under certain circumstances and will notify you of any denial in writing.

Right to Receive An Accounting of Disclosures of Protected Health Information: You have the right to a written accounting of all of our disclosures of your PHI, except for disclosures we made: (1) for treatment, payment, or healthcare operations; (2) to you or based on a signed authorization; and (3) for certain other purposes. Your request must be in writing and state the time period, which may not be longer that six years earlier than the date of the request. You may make one request for accounting and no charge per year. For additional requests for accounting, we may charge you a reasonable fee. We will notify you of the fee and you may choose to withdraw or modify your request at that time before any costs are incurred.

We are required to:

• maintain the privacy and security of your health information in accordance with applicable law;
• provide you with this notice of our legal duties and privacy practices with respect to your health information;
• notify you if a breach occurs that may have compromised the privacy or security of your health information; and;
• adhere to the duties and privacy practices described in this notice and give you a paper copy of the notice upon your request.

We reserve the right to revise or amend this Notice at any time and make such changes effective for all PHI we may already maintain about you. We will post the revised version of this Notice on our website, at www.veracyte.com.

If you believe your privacy rights have been violated, you can file a complaint by writing or calling the contact person set forth below.

You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling +1-877-696-6775, or visiting https://www.hhs.gov/ocr/privacy/hipaa/complaints/

We will not retaliate against you for complaining to us or filing a complaint.

If you have any questions about our privacy practices, this Notice, or your rights with respect to our use and disclosure of your PHI, please contact us. Send questions or requests, or complaints to:

Veracyte, Inc.
Attn: HIPAA Privacy Officer
6000 Shoreline Court, Suite 300
South San Francisco, CA 94080
Phone: 888-224-2193
Email: [email protected]