HIPAA & Healthcare Data Statement

1. Our Approach to Healthcare Data

Healthcare organizations depend on technology providers that understand the importance of protecting sensitive information.

Lablytics is designed around principles that support responsible healthcare data handling, including:

• Data protection.
• Access control.
• Confidentiality.
• Secure system design.
• Responsible information processing.
• Operational transparency.

Our approach is focused on helping laboratories improve operational consistency while maintaining appropriate safeguards around information processed through the platform.

2. HIPAA and Lablytics

The Health Insurance Portability and Accountability Act (HIPAA) establishes requirements for protecting Protected Health Information (PHI) when handled by covered entities and their business associates.

Whether information processed through Lablytics constitutes PHI depends on:

• The information entered into the platform.
• How the customer uses the platform.
• The customer's role under HIPAA.
• The applicable healthcare workflow.

Lablytics does not independently determine whether information constitutes PHI. Customers remain responsible for determining their HIPAA obligations and ensuring appropriate use of the platform within their compliance programs.

3. Business Associate Agreements

When a customer relationship involves the processing of Protected Health Information on behalf of a covered entity or business associate, SAAS for Healthcare LLC may enter into a Business Associate Agreement ("BAA") as required by applicable law.

A BAA establishes:

• Permitted uses and disclosures of PHI.
• Responsibilities of each party.
• Security obligations.
• Breach notification requirements.
• Required safeguards.

BAAs are executed directly with applicable customers as part of the contractual relationship and are not a substitute for a customer's own compliance responsibilities.

4. Security Practices

Lablytics is designed with security practices intended to protect information processed through the platform. Security practices may include:

• Encryption protections.
• Secure application architecture.
• Authentication controls.
• Access management.
• Monitoring and logging.
• Backup procedures.
• Vulnerability management practices.
• Incident response procedures.

Security practices evolve as technology, threats, and industry standards change. Additional details are available in the Security Policy and Overview.

5. Customer Responsibilities

Healthcare organizations using Lablytics remain responsible for:

• Determining appropriate use of the platform.
• Managing authorized users.
• Maintaining internal privacy policies.
• Following applicable healthcare regulations.
• Ensuring appropriate handling of patient and laboratory information.
• Maintaining required administrative safeguards.

Lablytics provides technology designed to support laboratory operations; it does not replace a customer's compliance program.

6. Laboratory Operations and Compliance

Lablytics is designed to support operational activities within clinical laboratories. The platform may assist organizations with areas such as:

• Workflow visibility.
• Documentation organization.
• Operational tracking.
• Inventory management.
• Communication.
• Process consistency.

However, use of Lablytics does not independently establish compliance with:

• HIPAA.
• CLIA.
• CAP requirements.
• State regulations.
• Accreditation standards.
• Organizational policies.

Compliance remains the responsibility of the laboratory organization.

7. Data Protection Principles

Lablytics follows principles designed to support responsible handling of healthcare-related information:

Least Privilege Access

Users and systems should only receive access necessary for authorized functions.

Data Minimization

Organizations should only provide information necessary for intended operational purposes.

Confidentiality

Information should be protected from unauthorized access or disclosure.

Integrity

Information should be protected from unauthorized alteration.

Availability

Systems should be designed to support reliable access for authorized users.

8. Transparency and Continuous Improvement

Healthcare technology requires ongoing attention to security, privacy, and operational practices. SAAS for Healthcare LLC continues to evaluate and improve:

• Security practices.
• Platform architecture.
• Privacy processes.
• Operational safeguards.
• Documentation.

As Lablytics grows, additional assessments, controls, and documentation may be introduced to support evolving customer requirements.

9. Security and Privacy Documentation

Additional information regarding Lablytics privacy and security practices is available through:

• Privacy Policy
• Security Policy and Overview
• Data Processing Addendum
• Acceptable Use Policy

10. Contact Information

Questions regarding healthcare data, privacy, or security practices may be directed to:

SAAS for Healthcare LLC

Email: policies@lablytics.org