Biodesix

Although we don’t anticipate receiving any through this Website, this policy describes how we may use and disclose protected health information. We may have other websites that do collect protected health information and those other websites’ privacy policies should be consulted as appropriate. Protected health information means any health information about a patient that identifies a patient or that could be used to identify a patient. In this policy, we call protected health information “medical information.” In addition, it explains how patients can complain if they believe we have violated their privacy rights.

Who Will Follow This Policy

This policy describes how Biodesix, Inc. and its agents and employees (collectively, the “Company” or “we”) use and disclosure a patient’s medical information to the extent we receive any, which we do not anticipate or encourage the disclosure of.

Our Pledge Regarding Medical Information

The Company understands that medical information about patients’ health is personal. We are committed to protecting their medical information. We are required by law to:

• Make sure that medical information that identifies a patient is kept private; and
• Follow the terms of the policy that is currently in effect.

How We May Use and Disclose Medical Information About a Patient Without a Patient’s Prior Written Agreement

The following categories describe different ways that we use and disclose a patient’s medical information. Not every use or disclosure in a category will be listed. All of the ways we are permitted to use and disclose information will fall into one of the categories.

For Treatment

We may use medical information about a patient to provide, coordinate or manage health care and related services.

For Payment

We may use and disclose medical information about a patient so we can be paid for the services we provide to the patient.

For Health Care Operations

We may use and disclose medical information about a patient for our own health care operations.

How We Will Contact a Patient

We will typically only contact a patient through a physician ordering ordering our products or our services.

Individuals Involved in a Patient’s Care or Payment for a Patient’s Care

In extreme circumstances, we may release medical information about a patient to a friend, relative, or family member or any other person involved in a patient’s medical care. We may also give information to someone who helps pay for a patient’s care.

Required by Law

We may use or disclose medical information about a patient when we are required to do so by federal, state or local law.

Health Oversight Activities

We may disclose medical information to a health oversight agency for activities authorized by law. These activities are necessary for the government to monitor the health care system, government programs, our compliance with civil rights laws, and to make sure we are complying with various government regulations.

Judicial and Administrative Proceedings, Lawsuits and Disputes

We may disclose medical information about a patient in the course of any judicial or administrative proceeding in response to an order of the court or administrative tribunal. We also may disclose medical information about a patient in response to a subpoena, discovery request, or other legal process, but only if efforts have been made to tell the patient about the request or to obtain an order protecting the information from being disclosed.

Law Enforcement

We may release medical information if required to do so by a law enforcement official; In response to a court, grand jury or administrative order, a subpoena, a warrant, a summons or similar process; To identify or locate a suspect, fugitive, material witness, or missing person; About an actual or suspected victim of a crime and that person agrees to the disclosure. If we are unable to obtain that person’s agreement, in limited circumstances, the information may still be disclosed; About a death we believe may be the result of criminal conduct; About criminal conduct at any of our facilities; In emergency circumstances to report a crime; the location of the crime or victims; or the identity, description or location of the person who committed the crime; or, As required by law.

Coroners, Medical Examiners and Funeral Directors

We may release medical information to a coroner, funeral director or medical examiner as necessary for them to carry out their duties.

To Avert A Serious Threat to Health or Safety

We may use or disclose medical information about a patient if we believe the use or disclosure is necessary to prevent or lessen a serious or imminent threat to the health or safety of a person or the public. Any disclosure would only be to someone able to help prevent the threat. We also may release information about a patient if we believe the disclosure is necessary for law enforcement authorities to identify or apprehend an individual who admitted participation in a violent crime or who is an escapee from a correctional institution or from lawful custody.

National Security and Intelligence

We may disclose medical information about a patient to authorized federal officials for the conduct of intelligence, counter-intelligence, and other national security activities authorized by law.

Protective Services for the President and Others

We may disclose medical information about a patient to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state or conduct special investigations.

Inmates and Persons in Custody

If a patient is an inmate of a correctional institution or under the custody of a law enforcement official, we may release medical information about the patient to the correctional institution or law enforcement official having custody of the patient. This release will be made if it is necessary (1) for the institution to provide the patient with health care; (2) to protect the patient’s health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Workers Compensation

We may disclose medical information about the patient to the extent necessary to comply with workers’ compensation and similar laws that provide benefits for work-related injuries or illness.

Food and Drug Administration (FDA)

We may disclose to the FDA health information relative to adverse events related to our products or services.

Other Uses and Disclosures

Other uses and disclosures of medical information not covered by this policy or the laws that apply to us will be made only with the patient’s written permission. If a patient provides us permission to use or disclose medical information about the patient, the patient may revoke that permission, except to the extent disclosures have already been made, in writing, at any time by writing to the Department of Legal and Regulatory Affairs, Biodesix, Inc., 520 Zang Street, Suite 213, Broomfield, CO, 80021 (the “Privacy Officer”).

Patient’s Rights With Respect to Medical Information About Such Patient

Right to Request Restrictions

A patient has the right to request a restriction or limitation on the medical information we use or disclose about the patient for treatment, payment or health care operations. The patient also has the right to request that we restrict the uses or disclosures we make to: (a) a family member, other relative, a close personal friend or any other person identified by the patient; or, (b) to public or private entities for disaster relief efforts. To request restrictions, the patient must make its request in writing to the Department of Legal and Regulatory Affairs, Biodesix, Inc., 520 Zang Street, Suite 213, Broomfield, CO 80021. In the request, the patient must tell us (1) what information they want to limit; (2) whether they want to limit our use, disclosure or both; and (3) to whom the patient want the limits to apply.

Right to Inspect and Copy

A patient has the right to inspect and copy medical information that may be used to make decisions about a patient’s care. Usually, this includes medical and billing records. To inspect or copy medical information about a patient, they should make a request in writing to the Department of Legal and Regulatory Affairs, Biodesix, Inc., 520 Zang Street, Suite 213, Broomfield, CO 80021. We may deny the request to inspect and copy medical information if the medical information involved is: Information compiled in anticipation of, or use in, a civil, criminal or administrative action or proceeding; Restricted by the Clinical Laboratory Improvements Amendments of 1988 (CLIA); or Information that is not part of the record set we use to make decisions about the patient’s care and treatment; Part of a research trial. If we deny the patient’s request, we will inform the patient of the basis for the denial, how the patient may have our denial reviewed, and how the patient may complain. If the patient requests a review of our denial, it will be conducted by a licensed health care professional designated by us who was not directly involved in the denial. We will comply with the outcome of that review.

Right to Request Amendments

A patient has the right to ask us to amend medical information about the patient if the patient feels the information we have about them is incorrect or incomplete. To request an amendment of a record held by the Company, the patient must submit the request in writing to Department of Legal and Regulatory Affairs, Biodesix, Inc., 520 Zang Street, Suite 213, Broomfield, CO 80021. The request must state the amendment desired and provide a reason in support of that amendment. We will act on the request within sixty (60) calendar days after we receive the request. If we grant the request, in whole or in part, we will inform the patient of our acceptance of the request. If we grant the request, in whole or in part, we will need the patient to identify others we need to notify about the change. If we deny the request, we will inform the patient of the basis for the denial. The patient will have the right to submit a statement disagreeing with our denial. We may prepare a response to that statement. The request for amendment, our denial of the request, the statement of disagreement, if any, and our rebuttal, if any, may then be appended to the medical information involved or otherwise linked to it. The Department of Legal and Regulatory Affairs should be notified of the request to have any of this information added to the medical record. Information that is added will then be included with any subsequent disclosure of the information, or, at our election, we may include a summary of any of that information. A patient also will have the right to complain to the Office of Civil Rights about our denial of the request.

Right to Copy of this Policy

A patient has the right to obtain a paper copy of our Privacy Policy.

Our Right to Change Our of Privacy Practices

We reserve the right to change this policy. We reserve the right to make the revised or changed policy effective for medical information we already have about a patient as well as any information we receive in the future.

Complaints

A patient may complain to us and to the United States Secretary of Health and Human Services if the patient believes we have violated its privacy rights. These complaints must be in writing and must be filed within 180 days of when the patient learned of or should have known about the violation. To complain to the Secretary of the Department of Health and Human Services contact: Region VIII, Office for Civil Rights, U.S. Department of Health and Human Services, 1961 Stout Street, Room 1185 FOB, Denver, CO 80294-3538. Fax: (303) 844-2025. A patient will not be retaliated against or penalized for filing a complaint. We will not take any action against a patient.

Questions and Information

If a patient has any questions or want more information concerning this Privacy Policy, please contact Department of Legal and Regulatory Affairs, Biodesix, Inc., 520 Zang Street, Suite 213, Broomfield, CO 80021.