LANES Privacy Policy
Effective date and last updated date: 10/14/2026
The privacy and security of your protected health information is very important to LANES. We are committed to safeguarding your information. Los Angeles Network for Enhanced Services (LANES) operates a health information exchange that helps authorized organizations share information to support care. This policy explains how we handle information exchanged through LANES and information you choose to provide when contacting us. Your provider’s Notice of Privacy Practices explains that provider’s responsibilities and your rights in more detail.
SECURITY & PRIVACY
Security and privacy are at our core at LANES. LANES maintains administrative, technical, and physical safeguards designed to protect health information. Our program addresses applicable requirements of the HIPAA Privacy Rule, HIPAA Security Rule, HIPAA Breach Notification Rule, HITECH Act, California medical confidentiality laws, and 42 CFR Part 2 where relevant. We review patient consent and confidentiality requirements with appropriate privacy, security, and legal advisers.
LEADERSHIP
LANES maintains a managed IT and security infrastructure which includes an internal IT team, an internal security team, and a managed service provider.
LANES has designated a Chief Information Security Officer (CISO) and a Chief Privacy Officer (CPO) to oversee a comprehensive information security and privacy program, including a robust risk management program.
The Security and Privacy Advisory Committee provides guidance on LANES privacy and security policies.
PRIVACY
Collection: Participating providers, health plans, and other authorized organizations may send LANES health and related information. Depending on the participating source, this may include identifying and contact information, visits, diagnoses, medications, allergies, laboratory results, care plans, and other records needed for authorized services. Information available through LANES may not include your complete medical record. We also receive information needed to manage authorized user accounts, verify identity or access authority, record consent and disclosure preferences, and investigate privacy or security concerns. When you contact LANES, we receive the information you choose to submit.
Permitted Uses: LANES supports legally permitted treatment, payment, and health care operations, including care coordination and case management. We also use information to operate and protect the exchange and fulfill our obligations to participating organizations. When we act as a business associate, our uses and disclosures must also comply with the applicable business associate agreement.
Sharing: Information may be made available to authorized participating providers, health plans, and other organizations, or exchanged through approved connections with other health information exchanges and networks. The information released depends on the recipient, purpose, applicable law, agreements, consent, and other restrictions. An organization’s connection to LANES does not give every user access to every record.
Other Disclosures: Other disclosures, including public health reporting or a response to legal process, may occur only when the applicable legal and contractual conditions are satisfied. We review government inquiries and legal demands for applicable confidentiality restrictions; a request alone does not authorize disclosure.
Consent: LANES uses an opt-out model for general health information that may lawfully be exchanged without a separate patient authorization. You may ask your participating provider how to opt out or change a previous choice. The provider communicates your choice to LANES through the applicable process. Contact LANES if you need help identifying the right process or following up on a request.
Once an opt-out takes effect, LANES restricts future exchange within the scope of that choice, subject to applicable legal requirements. We can help you understand whether a choice applies to one provider’s records, particular information, or broader exchange. Opting out does not erase your provider’s records or undo information already lawfully disclosed. Providers may still share information through other lawful channels.
Remaining in the general exchange is not consent to every disclosure of specially protected information. When a particular disclosure requires written consent or authorization, that requirement must be met. You may revoke a consent or authorization as permitted by law, subject to actions already taken in reliance on it.
Sensitive and Restricted Information
Some records have additional protections. These may include substance use disorder program records, certain mental health or developmental services records, psychotherapy notes, HIV test results, genetic test information, reproductive or gender-affirming care information, and records of services a minor consented to independently. The applicable protections depend on the record, its source, the person requesting it, and the purpose of the request.
Sensitive information may be received, accessed, or shared only through an approved lawful process that satisfies the applicable conditions. Information available to an authorized LANES participant may be excluded from exchange with another network. California protections may also restrict access, processing, or disclosure outside California. Your participation choice or authorization does not override a legal prohibition.
For records subject to 42 CFR Part 2, a valid consent may authorize future treatment, payment, and health care operations disclosures. HIPAA covered entities and business associates receiving records under that consent may further disclose them as HIPAA permits, subject to Part 2 restrictions and applicable state law. Use or disclosure in proceedings against a patient requires the separate legal authority prescribed by Part 2. Separately maintained SUD counseling notes generally require their own consent, subject to limited exceptions.
Rights: Applicable rights and obligations arise under HIPAA, California medical confidentiality laws, and 42 CFR Part 2 where relevant. Your rights depend on the information and the organization responsible for the record. LANES works with participating organizations to support valid requests and meet applicable requirements:
- Access and copies. You may request access to your medical records from your provider. Eligible adults can also use the patient access service linked from the LANES For Patients page, subject to identity verification and the records available through that service. Contact LANES if you need help with information maintained by LANES or cannot use the online service. Requests involving minors or representatives require review of the person’s legal authority and the record’s confidentiality protections.
- Record retention. HIPAA does not provide a general right to delete medical records. Opting out does not automatically require deletion. LANES retains information according to applicable law, agreements, retention policies, and legal holds.
- We do not sell your personal information.
- Complaints. You may contact the LANES Privacy Officer about a privacy concern. You may also complain to your provider or the appropriate regulator, including the U.S. Department of Health and Human Services Office for Civil Rights for matters within its jurisdiction. LANES will not retaliate against you for raising a privacy concern or exercising a lawful right.
- Amendments and corrections. If you believe medical information is inaccurate or incomplete, ask the provider or organization that created it to consider an amendment. LANES can help coordinate correction of exchange records or patient matching information, as appropriate.
- Accounting of disclosures. You may request an accounting of disclosures covered by applicable law. An accounting is not a list of every internal record view. HIPAA generally excludes disclosures for treatment, payment, and health care operations and certain other disclosures. LANES can help route your request and coordinate the response with the responsible organization.
- Restrictions and confidential communications. You may ask your provider about restrictions on certain uses or disclosures and about receiving communications by an alternative method or location. Some requests must be honored by law; others are subject to review. Tell LANES if a restriction communicated to us appears not to have been applied.
- To request access or a copy, contact your health care provider or use the applicable LANES patient-access process. We may need to verify identity and legal authority. Requests involving minors or representatives require review of the record’s confidentiality protections; a parent or guardian is not automatically entitled to every record.
Internal Access: LANES limits access according to authorized roles and purposes and uses access logging and review to identify inappropriate activity. An additional acknowledgment or “Break the Glass” step may support accountability. It does not replace required consent or authorization and does not allow users to bypass legal restrictions.
Breach Notification: LANES investigates suspected unauthorized access, use, or disclosure and takes appropriate steps to contain and address incidents. If a breach requires notification, LANES provides the notices required for its role and coordinates with participating organizations and other responsible parties. Individual notices may be issued by LANES or the responsible provider, as applicable, within the required time frames.
Privileged Account Management – Privileged accounts are secured and managed with MFA.
SECURITY
Data Security: LANES maintains administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, or loss. Our safeguards include:
Role-based access control applying the principle of least privilege.
Network controls designed to limit unauthorized access to sensitive information.
Authentication controls, including multi-factor authentication for interactive access.
Logging and monitoring.
Data Backup & Recovery: LANES maintains backup and recovery processes designed to support the availability and integrity of information and protect backups against unauthorized access, alteration, or destruction.
Encryption: We use encryption to protect sensitive information in transit and at rest.
Authentication: We use authentication controls designed to limit access to authorized users, including multi-factor authentication. Email security controls support protection against phishing and malicious content.
Phishing Security: LANES provides workforce security awareness training, including training on phishing, and uses awareness activities to reinforce secure practices.
Endpoint & Network Security: LANES uses endpoint and network security controls to detect and address unauthorized access and malicious activity, including controls for remote access.
Protection: We review and test security controls according to our risk management program.
Integrity: We use monitoring, logging, and audit processes to help protect the integrity and security of information.
Disaster Recovery: We maintain disaster recovery and business continuity procedures to support restoration of services and information when needed.
Vulnerability Management Program: We assess vulnerabilities and prioritize remediation according to risk.
Patch Management Program: We maintain a patch management policy and procedure to mitigate identified vulnerabilities.
REGULATORY COMPLIANCE AND INDUSTRY BEST PRACTICES
HIPAA: Our privacy and security program addresses the HIPAA Privacy, Security, and Breach Notification Rules applicable to LANES and its role.
California and Federal Requirements: Our handling of health information is subject to applicable California medical confidentiality laws, including the CMIA, and applicable federal requirements, including HIPAA and 42 CFR Part 2 where relevant.
Risk Management: We use a risk-informed decision-making process to manage privacy and security risk to you, to your data and for our systems.
Key Performance Indicators (KPIs): LANES measures and manages progress against a series of Key Performance Indicators that track progress toward safeguarding systems and data.
Continuous Monitoring Program: We monitor privacy and security controls against applicable requirements, organizational policies, and risk management objectives.
VENDOR MANAGEMENT
LANES uses service providers to support authorized functions.
When service providers handle protected health information on our behalf, they must be subject to the agreements and safeguards required for their role, including business associate agreements where applicable. They may use or disclose information only as allowed by the governing agreement and applicable law.
The LANES CISO maintains a security-based risk management approach to working with vendors and third parties. The LANES Privacy Officer examines relationships with vendors and third parties through the lens of data protection and privacy.
LANES reviews service providers’ privacy and security practices and coordinates with them to address identified risks and concerns.
Website Information and Inquiries
If you use our contact form, we receive the name, email address, phone number, message, and other information you provide. We use this information to respond and handle the request. Please do not include medical records, diagnoses, Social Security numbers, or other sensitive information in a general website inquiry. Ask us for an appropriate secure method when needed.
Links to services operated by other organizations may have separate privacy notices. Review those notices to understand how those organizations handle information you provide directly to them.
Contact the LANES Privacy Officer
Telephone: (310) 667-7617 — ask to be connected to the Privacy Officer.
Mail: LANES Privacy Officer, 11400 W. Olympic Blvd., Suite 200, Los Angeles, CA 90064.
General contact page: https://lanesla.org/contact-us/
Please provide enough information to describe your request without sending sensitive records through an unsecured channel. We may need to verify identity and authority before providing records or making requested changes.
Changes to This Policy
We will post revisions on this page with an updated date and provide any additional notice required by law. A change to this policy does not replace a consent or authorization required for a particular use or disclosure.
V2.0