I. Background
This HIPAA Policy (“Policy”) describes how Novocure Inc. (“Novocure” or “We”) complies with the requirements of the Health Insurance Portability and Accountability Act (“HIPAA”). Novocure is a health care provider of durable medical equipment (“DME”), and provides DME directly to patients. As a DME provider, Novocure has access to protected health information (“PHI”) and also submits claims for reimbursement. Therefore, Novocure is a covered entity as defined under HIPAA. This Policy describes how Novocure intends to comply with the various requirements of HIPAA. This Policy only applies to PHI (as defined below) of patients that reside in the United States.
II. Privacy
We are committed to ensuring protected health information about our patients (“PHI”) is used and disclosed in accordance with HIPAA. We are committed to creating a record of the products and services that we provide to our patients. We need this record to provide our patients with quality products and services used in their care and to comply with certain legal requirements. This Policy applies to all PHI of patients that we use and disclose in our role as a health care provider. If you have any questions regarding this Privacy Notice, please contact the Novocure Privacy Officer.
III. Our Legal Requirements
Pursuant to HIPAA, we are required, among other things, to:
IV. Who Will Follow Our Privacy Practices
This Policy describes Novocure’s HIPAA privacy practices and requires that of all Novocure employees, staff and business associates, as applicable, comply with it. All Novocure entities, sites and locations may share PHI with each other for treatment, payment and/or health care operations purposes as described in the Notice of Privacy Practices.
V. A Patient Has Rights Regarding Their Protected Health Information
A patient has the following rights regarding PHI we maintain about them:
To request this list or accounting of disclosures, a patient may contact 855-281-9301 orsupport@novocure.com. We may request that a patient submits the request in writing. A patient’s request must state a time period for which they are requesting an accounting of disclosures, which may not be longer than six years from the date of the request. A patient’s request should indicate in what form the patient want the list (i.e., paper or electronic). The first list a patient requests within a 12-month period will be free. For additional lists, we will charge the patient our reasonable costs for providing the list. We will notify the patient of the cost involved and the patient may choose to withdraw or modify their request at the time before any costs are incurred.
The following categories describe different ways that we are permitted to use and disclose PHI as a health care provider. Certain of these categories may not apply to our business and we may not actually use or disclose their PHI for such purposes. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted or required to use and disclosure PHI, without their authorization, will fall within one of the categories.
VI. Complaints
If a patient believes his/her privacy rights have been violated, a patient may file a complaint with us or with the Secretary of the Department of Health and Human Services at 200 Independence Avenue, S.W.; Washington, DC 20201, or reach the Secretary by phone at (202) 690-7000. To file a complaint with Novocure, a patient must submit the complaint in writing to Novocure, contact 855-281-9301 or support@novocure.com.
VII. Transactions and Code Sets
Novocure submits all transactions to healthcare payers using the transaction and code set standards described in HIPAA. Specifically, we submit claims for our products using unlisted HCPCS codes.
Effective Date: May 25, 2016