Notice of HIPAA Practices

Privacy practices outlined in this Notice pertain only to individuals about whom Genomic Health has received individually identifiable health information.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

I. WHO WE ARE

This Notice describes the privacy practices of Genomic Health, its employees, and other personnel ("Genomic Health," "we" or "us").
As a healthcare provider who provides laboratory testing to ordering physicians, Genomic Health is committed to protecting the privacy of your personal information, laboratory test results, and other protected health information.

II. OUR PRIVACY OBLIGATIONS
We are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to maintain the privacy of health information about you ("Protected Health Information") and to provide you with this Notice of our legal duties and privacy practices with respect to your Protected Health Information. When we use or disclose your Protected Health Information, we are required to abide by the terms of this Notice (or other notice in effect at the time of the use or disclosure).

III. USES AND DISCLOSURES OF HEALTH INFORMATION
Your Protected Health Information may be used and disclosed for treatment, payment, healthcare operations, and other purposes permitted or required by law. We may use and disclose your Protected Health Information for the following purposes:

A. Treatment. We may use or disclose your Protected Health Information for treatment purposes. For example, we may use your Protected Health Information to perform our testing services and disclose your Protected Health Information, including laboratory test results, to physicians and other healthcare providers involved in your care.

B. Payment. We may use or disclose your Protected Health Information to obtain payment for healthcare services we provide. For example, we may disclose your information to your health plan to receive payment for the services provided to you.

C. Healthcare Operations. We may use and disclose your Protected Health Information for our healthcare operations. These activities include, for example, monitoring the quality of our testing services, reviewing the competence or qualifications of laboratory professionals, conducting training programs, performing accreditation, certification, licensing and credentialing activities, and other administrative functions.

D. Personal Representatives. We may disclose Protected Health Information about you to your authorized personal representative, as defined by applicable law, or to an administrator, executor, or other authorized person responsible for your estate.

E. Minors' Protected Health Information. As permitted by federal and state law, we may disclose Protected Health Information about minors to their parents or guardians.

F. Persons Involved in Your Care or Payment for Your Care. We may disclose your Protected Health Information to a person involved in your care or payment for your care, such as a family member or close friend. We may use or disclose your Protected Health Information for disaster relief efforts, or to notify a family member or close friend of your location or general condition. If you do not want us to use or disclose your Protected Health Information in these ways, you must notify our Privacy Office using the contact information at the end of this Notice.

G. Communications About Our Products and Services. We may use and disclose your Protected Health Information to contact you about our products and services which we believe may be of interest to you where you have signed an authorization which permits use of medical information.

H. Disclosures to Business Associates. We may disclose your Protected Health Information to other companies or individuals, known as "business associates," who need your information to provide services to us. For example, we may use another company to perform billing services on our behalf. Our business associates are required to protect the privacy of your Protected Health Information.

I. As Required by Law. We must disclose your Protected Health Information when required to do so by any applicable federal, state, or local law.

J. Public Health Activities. We may disclose your Protected Health Information for public health-related activities. Examples of these activities include: reporting diseases to authorized public health authorities; if authorized by law as part of a public health investigation, notifying individuals that they may be at risk of contracting a disease; and notifying a manufacturer of a product regulated by the U.S. Food and Drug Administration of a possible problem encountered when using the product in our testing process.

K. Health Oversight Activities. We may disclose your Protected Health Information to a healthcare oversight agency for activities that are authorized by law, such as audits, investigations, inspections, and licensure activities. For example, we may disclose your Protected Health Information to agencies responsible for ensuring compliance with the rules of government health programs such as Medicare or Medicaid.

L. Research. Under certain conditions, we may use or disclose Protected Health Information for research purposes. We may allow researchers to look at Protected Health Information to develop a study, identify prospective research participants, or for similar purposes, provided that the information is not removed from our premises. We will not allow Protected Health Information to be used or disclosed for any other research activity unless: (1) a special committee reviews the planned research and decides that the research poses little risk to privacy and that there is an adequate plan to safeguard the Protected Health Information; (2) the researcher will only be given information that does not identify individuals; or (3) where the information concerns deceased individuals, the researcher gives us assurances that the information is necessary for the research and will be used solely for the research.

M. Organ or Tissue Procurement. We may disclose Protected Health Information to organ procurement organizations or related entities for the purpose of facilitating organ or tissue donation and transplantation.

N. Disclosures to Coroners, Medical Examiners, and Funeral Directors. We may disclose Protected Health Information to coroners or medical examiners for the purpose of identifying an individual, determining cause of death, or other duty authorized by law.

O. Judicial and Administrative Proceedings. Under certain circumstances, we may disclose your Protected Health Information in the course of a judicial or administrative proceeding in response to a court order, subpoena, or other lawful process.

P. Law Enforcement. We may disclose your Protected Health Information to the police or other law enforcement officials as required by law or in compliance with a court order, warrant, subpoena, summons, or similar process authorized by law. Under certain circumstances, we may also disclose Protected Health Information to law enforcement officials when the information is needed to: identify or locate a missing person, suspect, fugitive, or material witness; determine whether an individual has been a victim of a crime; determine if a death resulted from criminal conduct; or investigate suspected criminal activity on our premises.

Q. Serious Threats to Health or Safety. We may disclose Protected Health Information if necessary to prevent or reduce the risk of a serious and imminent threat to the health or safety of an individual or the general public.

R. Victims of Abuse, Neglect, or Domestic Violence. If required or authorized by law, we may disclose Protected Health Information to a government agency, such as social services or a protective services agency, if we reasonably believe that an individual is the victim of abuse, neglect, or domestic violence.

S. Specialized Government Functions. Under certain circumstances, we may disclose your Protected Health Information to units of the government with special functions, such as the U.S. Military or the U.S. Department of State, in response to requests.

T. Workers' Compensation. We may disclose your Protected Health Information as necessary to comply with requirements of workers' compensation or similar programs that provide benefits for work-related injuries or illness without regard to fault.

U. All Other Uses and Disclosures of Protected Health Information. We will ask for your written authorization before using or disclosing your Protected Health Information for any purpose not described above. You may revoke your authorization, in writing, at any time, except that a revocation will not affect any use or disclosures we have made in reliance on your authorization.

IV. YOUR RIGHTS
You have the following rights with respect to your Protected Health Information. To exercise any of these rights, please contact our Privacy Office using the contact information provided at the end of this Notice.

A. Access to Protected Health Information. You or your authorized or designated personal representative have the right to inspect and copy your Protected Health Information and billing information maintained by us. We may deny access to certain information for specific reasons, for example, where state law prohibits such patient access. Please note that federal and state laws regulating laboratories generally prohibit us from disclosing test results directly to a patient.

B. Restrictions on Uses and Disclosures. You have the right to request restrictions on our use and disclosure of your Protected Health Information. While we will consider all requests for additional restrictions carefully, we are not required to agree to a requested restriction. If we do agree to a requested restriction, we will notify you in writing.

C. Confidential Communications. You have the right to request that we communicate with you about your Protected Health Information by alternative means or to an alternative address. Your request must be in writing and must specify the alternative means or location. We will accommodate reasonable requests for confidential communications.

D. Correct or Update Information. If you believe the Protected Health Information or billing information we maintain about you contains an error, you may request that we correct or update your information. Your request must be in writing and must explain why the information should be corrected or updated. We may deny your request under certain circumstances. If we deny your request, we will provide you with a written explanation for the denial.

E. Accounting of Disclosures. You may request a list, or accounting, of certain disclosures of your Protected Health Information made by us or our business associates for purposes other than treatment, payment, healthcare operations, and certain other activities. The request must be in writing. Unless you designate a shorter time period, the list will include disclosures made within the prior six years, but not before April 14, 2003.

F. Paper Copy of Notice. Upon request, you may obtain a paper copy of this Notice.

V. QUESTIONS AND COMPLAINTS

If you want more information about our privacy practices, or have general questions or concerns, please contact our Privacy Office using the contact information listed at the end of this Notice.

If you are concerned that we may have violated your privacy rights, you may submit a complaint to our Privacy Office using the contact information listed below. You also may submit a written complaint to the U.S. Department of Health and Human Services. We will provide you with the address to file your complaint with the U.S. Department of Health and Human Services upon request.

We support your right to the privacy of your health information. We will not retaliate against you in any way if you choose to file a complaint with us or with the U.S. Department of Health and Human Services.

VI. CHANGES TO OUR NOTICE OF HIPAA PRIVACY PRACTICES

We reserve the right to change our privacy practices and the terms of this Notice at any time, provided such changes are permitted by applicable law. If we change this Notice, we may make the new Notice terms effective for all Protected Health Information that we maintain, including any information created or received prior to issuing the new Notice.

If we make changes to this Notice, we will promptly post a copy of the updated Notice on www.MyBreastCancerTreatment.org. Please review this Web site periodically to ensure that you are aware of any updates. You may also request a copy of the current Notice by contacting our Privacy Office using the contact information provided below.

VII. CONTACT INFORMATION
When communicating with us regarding this Notice, our privacy practices, or your rights with respect to our use and disclosure of your Protected Health Information, please use the following contact information:

Genomic Health, Inc.
Attention: Privacy Officer
301 Penobscot Drive
Redwood City, CA 94063

EFFECTIVE DATE OF NOTICE:

For more information about Genomic Health privacy practices and privacy contact information, visit http://www.genomichealth.com/privacy.