Notice of HIPAA Privacy Practices
Direct Laboratory Services, LLC
Effective Date: August 27, 2026
Your Information. Your Rights. Our Responsibilities.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This notice describes how Direct Laboratory Services, LLC (“DirectLabs®,” “DLS,” “we,” “us,” or “our”) may use and disclose your protected health information (“PHI”), your rights regarding that information, and our responsibilities with respect to your PHI.
This Notice applies to PHI maintained by Direct Laboratory Services, LLC in connection with laboratory testing, laboratory orders, laboratory results, patient accounts, customer service, the MyDLS® portal, and related healthcare services.
Some information collected through our website, online ordering systems, cookies, analytics technologies, advertising technologies, or other commercial activities may not constitute PHI under HIPAA and may instead be subject to our separate Website/Online Privacy Policy and applicable state consumer privacy laws. Where federal or state law provides greater privacy protection or additional rights than described in this Notice, DirectLabs will comply with the applicable legal requirements.
Your Rights
When it comes to your health information, you have certain rights.
Get an electronic or paper copy of your health information
You can ask to inspect or receive an electronic or paper copy of your health information that we maintain.
We will generally provide access within the time permitted by applicable federal and state law. Under HIPAA, we generally must act on an access request within 30 days, subject to permitted extensions and applicable exceptions. Some states provide shorter timeframes, and we will follow applicable state requirements when they apply.
You may be charged a reasonable, cost-based fee where permitted by applicable law.
Many laboratory orders and test results can also be accessed through your secure MyDLS® account at DirectLabs.com.
Ask us to correct your health information
You can ask us to correct health information about you that you believe is incorrect or incomplete.
We may deny your request in circumstances permitted by law. If we deny your request, we will provide you with a written explanation and information about how you may submit a statement of disagreement when applicable.
You can submit requests to our Privacy Official using the contact information at the end of this notice.
Request confidential communications
You can ask us to contact you in a specific way or at a specific location.
For example, you may request that we contact you by telephone rather than email, use a particular telephone number, or send correspondence to a different address.
We will accommodate reasonable requests as required by applicable law.
Ask us to limit what we use or disclose
You can ask us not to use or disclose certain PHI for treatment, payment, or healthcare operations.
We are not required to agree to every request. However, if you pay for a healthcare item or service completely out of pocket and request that we not disclose information concerning that item or service to your health plan for payment or healthcare operations, we will generally agree unless disclosure is required by law.
Some state and federal laws provide additional restrictions on the disclosure of particular types of health information, including genetic information, HIV-related information, reproductive or sexual health information, mental health information, substance use disorder records, and other specially protected information.
Get a list of certain disclosures
You can request an accounting of certain disclosures of your PHI made during the six years preceding the date of your request, subject to the exceptions and limitations provided by law.
The accounting does not include disclosures that are excluded from the accounting requirement, including certain disclosures for treatment, payment, and healthcare operations and certain other disclosures specified by law.
We will provide one accounting in any 12-month period without charge. We may charge a reasonable, cost-based fee for additional accountings requested during the same 12-month period, as permitted by law.
Get a copy of this privacy notice
You can request a paper copy of this notice at any time, even if you have agreed to receive the notice electronically.
You may also obtain a copy electronically through our website.
Choose someone to act for you
If you have given someone medical power of attorney or if someone is your legal guardian, that person may exercise your rights and make choices about your health information to the extent permitted by law.
We will verify the person’s authority before acting on the request.
File a complaint if you feel your rights are violated
If you believe your privacy rights have been violated, you may file a complaint with DirectLabs using the contact information at the end of this notice.
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (“OCR”).
We will not retaliate against you for filing a complaint.
Your Choices
For certain uses and disclosures of your PHI, you may have the opportunity to agree or object before we share information.
When applicable, you may ask us to:
- Share information with your family members, close friends, or other persons involved in your care or payment for your care.
- Share information in a disaster-relief situation.
- Contact you in a particular manner or at a particular location.
If you are unable to communicate your preference, we may share information when permitted by law if we determine that doing so is in your best interest.
We may also use or disclose information when permitted by law to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
Marketing and Sale of PHI
We will not use or disclose your PHI for marketing purposes when HIPAA requires your written authorization.
DirectLabs does not sell your PHI.
Where your written authorization is required for a use or disclosure, you may revoke that authorization in writing at any time to the extent permitted by law. Revocation will not affect uses or disclosures already made in reliance on the authorization.
Our Uses and Disclosures
We may use or disclose your PHI for the following purposes when permitted or required by law.
Treat you
We can use your health information and share it with other professionals who are treating you.
Example: We may share your laboratory test results with the healthcare provider who ordered your tests or with another healthcare professional involved in your care.
Run our organization
We may use and disclose PHI as necessary to operate our organization, improve the quality of our services, maintain our laboratory-testing processes, perform quality assurance, conduct compliance activities, provide customer service, maintain patient accounts, and perform other healthcare operations permitted by law.
Bill for your services
DirectLabs generally provides direct-pay laboratory services and does not submit claims to health insurance plans on behalf of patients.
We may use and disclose PHI as necessary to obtain payment for services we provide, including processing payments, maintaining accounts, and communicating with persons or entities responsible for payment.
Work with laboratories and service providers
We may disclose PHI to laboratories, specimen-collection facilities, healthcare providers, technology providers, and other vendors that perform services on our behalf when permitted by HIPAA and applicable state law.
Where a service provider qualifies as a HIPAA business associate, we require an appropriate Business Associate Agreement.
For at-home collection kits and specialty laboratory services, the laboratory actually performing the testing may receive information and specimens necessary to perform, process, interpret, and report the ordered testing.
Depending on the services and applicable law, that laboratory may operate as a separate covered entity, business associate, service provider, or other legally regulated entity and may have its own privacy notice and obligations.
Help with public health and safety issues
We may use or disclose your PHI when permitted or required by law for public health and safety purposes, including when necessary to:
- Report certain diseases, conditions, or other information as required by law.
- Assist public health authorities with disease prevention, surveillance, or investigations.
- Prevent or reduce a serious threat to the health or safety of a person or the public.
- Report suspected abuse, neglect, or domestic violence when required or permitted by law.
Health oversight activities
We may disclose PHI to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, licensure activities, disciplinary proceedings, or other lawful oversight of the healthcare system or entities subject to government regulation.
Comply with the law
We may use or disclose PHI when federal, state, or other applicable law requires the disclosure.
We will comply with applicable legal restrictions that provide greater privacy protection than HIPAA.
Respond to legal requests
We may disclose PHI in response to a court order, administrative order, subpoena, discovery request, or other lawful process when the requirements of applicable federal and state law are satisfied.
Where applicable law requires additional protections before PHI may be disclosed, we will follow those requirements.
Law enforcement and government requests
We may disclose PHI to law enforcement or government agencies when permitted or required by applicable law and when the applicable requirements for the disclosure have been satisfied.
We will not disclose PHI merely because a government agency requests it when applicable law requires additional legal process, authorization, or other conditions.
Work with a medical examiner, coroner, or funeral director
We may disclose PHI to a coroner, medical examiner, or funeral director when permitted or required by law.
Organ and tissue donation
We may disclose PHI to organizations involved in organ, eye, or tissue donation and transplantation when permitted or required by law.
Workers’ compensation
We may disclose PHI for workers’ compensation or similar programs when permitted or required by law.
Lawsuits and legal actions
We may use or disclose PHI in connection with judicial or administrative proceedings when permitted or required by applicable law.
Information Subject to Additional Protections
Certain types of health information may be subject to additional protections under federal or state law.
These protections may apply to information such as genetic information, HIV or sexually transmitted disease information, reproductive or sexual health information, substance use disorder records, information concerning minors, and other specially protected health information.
When applicable, we will comply with the additional requirements governing the use and disclosure of such information.
Substance Use Disorder Records
DirectLabs is not a federally assisted substance use disorder treatment program and does not currently operate as a program subject to 42 CFR Part 2.
To the extent DirectLabs creates, receives, maintains, or otherwise handles records that are subject to 42 CFR Part 2, DirectLabs will handle those records in accordance with applicable Part 2 requirements and other applicable federal and state law.
Part 2 records may be subject to confidentiality requirements that are more protective than HIPAA.
State Privacy Laws
DirectLabs serves patients in multiple states and may be subject to federal, state, and local privacy laws governing protected health information, medical information, genetic information, consumer health information, and other sensitive information.
State laws may provide greater privacy protections or additional rights than federal law, including HIPAA. When a state or other applicable law provides greater privacy protection or imposes additional requirements that apply to DirectLabs’ handling of your information, we will comply with the applicable requirement.
Nothing in this Notice is intended to limit any privacy right or protection you may have under applicable federal or state law.
If a state law requires a different use or disclosure of your information than described in this Notice, DirectLabs will follow the applicable law.
At-Home Collection Kits and Specialty Laboratories
DirectLabs offers certain at-home collection kits that may be processed by third-party specialty laboratories.
When you purchase an at-home collection kit, DirectLabs may provide the specialty laboratory with information and biological specimens necessary to fulfill the testing service.
The specialty laboratory may independently be subject to HIPAA, CLIA, state medical-record laws, genetic privacy laws, consumer privacy laws, or other applicable requirements.
Where DirectLabs is acting as a business associate or service provider to another covered entity, or where a laboratory is acting as DirectLabs’ business associate, the parties will maintain appropriate contractual arrangements as required by applicable law.
If the specialty laboratory provides its own privacy notice, that notice may contain additional information concerning the laboratory’s handling of your specimen, information, and results.
Online Portal
You may access certain laboratory orders, results, account information, and related documents securely through our online portal, MyDLS®.
You may also use the portal to submit certain HIPAA authorization or release requests.
Optional AI Analysis of Results
DirectLabs offers an optional AI-powered analysis of certain test results, powered by Grok.
This feature is voluntary and is available as a general overview and, in greater detail, for certain biohacking panels.
When you choose to generate an analysis, DirectLabs may transmit information necessary to provide the requested analysis. As currently configured, this may include your sex, age, test-result information, and information you voluntarily enter in the notes section of the questionnaire.
DirectLabs does not intentionally transmit your name, contact information, or other unnecessary direct identifiers to the AI service through this feature.
You control what, if anything, you include in the notes field.
DirectLabs will configure and use AI services in a manner consistent with applicable HIPAA and state privacy requirements. If information submitted to an AI service constitutes PHI, DirectLabs will use the service only where applicable HIPAA requirements, including any required Business Associate Agreement and applicable security requirements, have been satisfied.
Where possible, DirectLabs will minimize the information transmitted to the AI service and will not intentionally transmit unnecessary identifiers.
Our Responsibilities
We are required by law to:
- Maintain the privacy of your PHI.
- Provide you with this notice describing our legal duties and privacy practices with respect to your PHI.
- Follow the terms of the notice currently in effect.
- Notify you as required by law following a breach of unsecured PHI.
- Provide you with access to your information as required by applicable law.
- Follow applicable federal and state privacy requirements.
- Comply with state laws that provide greater privacy protections than HIPAA when those laws apply.
We will not use or disclose your PHI other than as described in this notice or otherwise permitted or required by law unless you provide written authorization when authorization is required.
If you authorize a use or disclosure, you may revoke that authorization in writing as permitted by law. Revocation will not affect uses or disclosures already made in reliance on the authorization.
Website, Cookies, Analytics, and Non-PHI Information
Our website may collect information through cookies, analytics technologies, advertising technologies, security technologies, and similar tools.
Information collected through our website that is not PHI may be governed by our separate Website/Online Privacy Policy and applicable state consumer privacy laws.
Because some pages of our website relate to health conditions, laboratory testing, and health services, DirectLabs evaluates website analytics, advertising, cookies, and other tracking technologies for compliance with HIPAA and applicable state laws.
Where applicable law prohibits the transmission of health or consumer-health information to an analytics, advertising, or other third-party service, DirectLabs will implement appropriate controls or obtain the consent required by law.
Changes to This Notice
We may change the terms of this notice.
Any revised notice will apply to PHI that we maintain, except where applicable law requires otherwise.
When required by HIPAA or state law, we will make the revised notice available and provide notice of the change.
The current version of this notice will be available upon request and will be posted prominently on our website.
Questions and Complaints
If you have questions about this notice or would like to exercise any of your rights, including rights concerning access, amendment, confidential communications, restrictions, or accounting of disclosures, please contact our Privacy Official.
Direct Laboratory Services, LLC
Attn: Christi Harrison, Privacy Official
71192 Hwy 21, Ste 210-Ofc 007
Covington, LA 70433
Email: charrison@directlabs.net
Phone: 800-908-0000
You may also contact:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Phone: 1-877-696-6775
You may file a complaint with the Office for Civil Rights concerning your federal health-information privacy rights.
We will not retaliate against you for filing a privacy complaint.
