How HIPAA Applies to Filia
Effective 2026-09-16 · version 2026-09-16
The physician who orders your tests and the laboratory that runs them are covered by HIPAA. Filia is not a healthcare provider and is not a HIPAA covered entity, so what protects the results and health information we hold is our Privacy Policy, federal consumer-protection law and state health-privacy law. Here is what that means for you.
1.The short answer
The Health Insurance Portability and Accountability Act (HIPAA) governs healthcare providers, health plans and clearinghouses, and the companies that work for them. Filia, operated by Vanguard Performance LLC, is a website through which you buy testing; it does not provide healthcare and does not bill insurance, so it is not a HIPAA covered entity. Where a contract with a covered entity makes us its business associate for a particular purpose, we follow HIPAA’s rules for that purpose. In every case, we protect your health information with the safeguards described in the Privacy Policy, which are the safeguards HIPAA’s Security Rule describes, and we never sell it or share it with advertisers.
2.Who is covered by HIPAA in your testing
- The ordering physician’s medical group
- The independent physician who authorizes your order practises through a medical group arranged by Junction; that group is a covered entity and holds your order and results under its own notice of privacy practices, which is shown to you at checkout together with the HIPAA Authorization described below.
- Quest Diagnostics
- Quest Diagnostics Incorporated is a covered entity. Its Notice of Privacy Practices governs your specimen and results while they are with the laboratory, and you can exercise your HIPAA rights, such as requesting your records or an accounting of disclosures, directly with it.
- Junction
- Adept Labs, Inc., doing business as Junction, states that it is not a covered entity and acts as a business associate of the medical groups it works with. Its privacy policy is at junction.com/privacy.
- A telehealth practice, if you ever use one through Filia
- Would be a covered entity with its own notice of privacy practices, shown to you before any care. No such service is offered today; see the Telehealth Informed Consent.
3.How your results reach Filia
Because Filia is not your healthcare provider, the physician and the laboratory cannot simply send us your results. At checkout you sign a HIPAA Authorization, written by Junction, that permits them to release your order and results to Filia so that we can show them to you and coordinate your testing. Once information is with us it is no longer covered by HIPAA; it is covered by the Privacy Policy, by the Federal Trade Commission’s rules on health data and breach notification, and by the health-privacy laws of your state, several of which give you rights HIPAA does not.
You can revoke the authorization at any time by writing to Junction at the address in it. Revoking it stops further releases to Filia; it does not recall what has already been shared, and it means we can no longer show you new results, though the laboratory and the physician still hold them and you can obtain them from them under HIPAA.
4.Your rights, and where to exercise them
| You want to | Under HIPAA, ask | Under our Privacy Policy, ask Filia |
|---|---|---|
| See or get a copy of your results | Quest Diagnostics or the ordering physician’s group | Download them from your account at any time |
| Correct a record | The party that holds the record | Correct your account and health history in Settings |
| Delete your information | HIPAA does not require a provider to delete a medical record | Delete your account and everything in it; see your rights |
| Know who your information was disclosed to | Request an accounting of disclosures from the covered entity | The Privacy Policy lists every category of recipient, and the Consumer Health Data Privacy Notice lets you request the list |
| Complain | The covered entity’s privacy officer, or the U.S. Department of Health and Human Services Office for Civil Rights | info@myfilia.com, your state attorney general, or the Federal Trade Commission |
5.Why we do not put a “HIPAA compliant” badge on the site
A badge implies a status that the law does not confer on a company like ours, and a company that claims HIPAA protection it does not have can be held to have deceived you. We would rather tell you exactly which parties HIPAA covers, exactly what protects your data with us, and exactly where to go with a complaint. If our status changes, for example because a contract makes us a business associate for more of what we do, this page changes with it.