Notice of Privacy Practices

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

The Pharmacy is required by law to maintain the privacy of the health information it maintains about its customers (also known as “Protected Health Information” or “PHI”) and to provide its customers with notice of our legal duties and privacy practices with respect to PHI. PHI is information that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services. This Notice of Privacy Practices (“Notice”) describes how we may use and disclose PHI to carry out treatment, obtain payment or perform our health care operations and for other specified purposes that are permitted or required by law. This Notice also describes your rights with respect to PHI about you.

The Pharmacy will follow the practices described in this Notice. Except as described in this Notice, we will not use or disclose PHI about you without your written authorization. We reserve the right to change our practices and this Notice. In the event that we revise this Notice, the new Notice provisions will be effective for all PHI we maintain. We will provide you with a revised Notice upon request.

EXAMPLES OF HOW WE MAY USE AND DISCLOSE YOUR PHI

The following categories describe different ways that we may use and disclose your PHI. Examples of such uses or disclosures are provided for each category. These are provided for illustrative purposes only and not every use or disclosure within each category is listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories below.

We may use and disclose your PHI for treatment. Information obtained from your physician may be used to dispense prescription medications to you.

We may use and disclose your PHI for payment. We may contact your insurer to determine whether it will pay for your prescription and the amount of your co- payment. We will bill you or a third-party payor for the cost of prescription medications dispensed to you. Alternatively, we may disclose your PHI to the pharmacy benefits managers retained by your insurer for those same payment purposes.

We may use and disclose your PHI for health care operations. We may use your PHI to review and assess the quality of the services we provide to you. We also may disclose your PHI to our attorneys and auditors for assistance with legal compliance and financial reporting requirements. We also may use or disclose your PHI for limited operations purposes of certain other health care providers, clearinghouses or health plans. The persons or entities to which the Pharmacy personnel may disclose your PHI must have or have had a relationship with you, and the PHI disclosed must pertain to that relationship. The operations purposes for which we may disclose your PHI include, but are not limited to, various quality assessment and improvement activities, credentialing and training activities, and health care fraud and abuse detection or compliance activities.

In addition, we may use or disclose your PHI for the following purposes.

Business associates. Certain of the services we provide may be delegated to contractors, known as business associates. We may provide your PHI to those of our contractors who require the information to perform certain services on our behalf. For example, we may provide PHI to a claims submission service that ensures that our claims are submitted in the appropriate form to the appropriate payors. To protect you, we require the business associate to appropriately safeguard the PHI.

Communication with individuals involved in your care or payment for your care. We may disclose to a person involved in your care or payment for your care PHI relevant to that person’s involvement in your care or payment.

Food and Drug Administration (FDA). We may disclose to the FDA, or persons under the jurisdiction of the FDA, PHI relative to adverse events with respect to drugs, foods, supplements, products and product defects, or post-marketing surveillance information to enable product recalls, repairs, or replacement.

Refill reminders. We may contact you to provide refill reminders or communicate with you about a drug or biologic that is currently prescribed to you so long as any payment we receive for making the communication is reasonably related to our cost of making the communication.

Workers compensation. We may disclose PHI about you as authorized by and as necessary to comply with laws relating to workers’ compensation or similar programs established by law.

Public health. We may disclose PHI about you to public health or legal authorities charged with preventing or controlling disease, injury or disability.

Law enforcement. We may disclose PHI about you for law enforcement purposes as required by law or in response to a valid subpoena or other legal process.

As required by law. We must disclose PHI about you when required to do so by law.

Health oversight activities. We may disclose PHI about you to an oversight agency for activities authorized by law such as state boards of pharmacy or the U.S. Drug Enforcement Administration (DEA). These oversight activities include audits, investigations, and inspections, as necessary for our licensure and for the government to monitor the health care system, government programs, and compliance with laws.

Judicial and administrative proceedings. If you are involved in a lawsuit or a dispute, we may disclose PHI about you in response to a court administrative order. We may also disclose PHI about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made by the requesting party to tell you about the request or to obtain an order protecting the requested PHI.

Finally, we may use or disclose PHI about you for the following purposes:

Notification. We may use or disclose PHI about you to notify or assist in notifying a family member, personal representative or another person responsible for your care, of information regarding your location and your general condition.

To avert a serious threat to your health or safety. We may use and disclose PHI about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.

Victims of abuse, neglect or domestic violence. We may disclose PHI about you to a government authority, such as a social service or protective services agency, if we reasonably believe you are a victim of abuse, neglect or domestic violence. We will only disclose this type of information to the extent required by law, if you agree to the disclosure or if the disclosure is allowed by law and we believe it is necessary to prevent serious harm to you or someone else, or the law enforcement or public official that is to receive the report represents that it is necessary and will not be used against you.

OTHER USES AND DISCLOSURES OF PHI

The Pharmacy must obtain your written authorization before using or disclosing PHI about you for purposes other than those provided for above or as otherwise permitted or required by law.

For example, in limited circumstances, state or federal law (that provides special privacy protections for certain types of highly sensitive health information) may require the Pharmacy to obtain your authorization to use or disclose sensitive health information.

We may also use or disclose your PHI for marketing activities if we obtain from you prior written authorization. For this purpose, “marketing” activities generally include communications to you that encourage you to purchase or use a product or service and potentially, communications to you in the context of treatment and health care operations where we receive remuneration (monies) from a third party for making the communications.

You may revoke an authorization in writing at any time. Upon receipt of a written revocation, we will stop using or disclosing PHI about you, except to the extent that we already have taken action in reliance on the authorization.

 

YOUR HEALTH INFORMATION RIGHTS

You have the following rights with respect to your PHI that we maintain:

Obtain a paper copy of the Notice upon request. You may request a copy of this notice at any time. To obtain a paper copy of this Notice, please contact us through our website, in person or by mail addressed to our pharmacy location and directed to “Attention: HIPAA Privacy Official”.

Request a restriction on certain uses and disclosures of PHI. You have the right to request certain restrictions on our use or disclosure of your PHI that we maintain. To request such a restriction, please provide a written request in person or by mail addressed to our pharmacy location and directed to “Attention: HIPAA Privacy Official”. We are not required to agree to accept your requested restrictions unless the disclosure is to a health plan for purposes of carrying out payment or health care operations and the information pertains solely to a health care item or service for which you have paid the Pharmacy out of pocket in full. In the event that we do grant your request, however, we will abide by the restriction as it related to your PHI on a going forward basis.

Inspect and obtain a copy of PHI. You have the right to inspect or obtain a copy of PHI about you that is contained in a “designated record set” for as long as the Pharmacy maintains your PHI in the designated record set. The designated record sets we maintain include your customer contact information, records about drugs and services provided to you, and billing records. To inspect or copy PHI about you, you must send a written request in person or by mail addressed to our pharmacy location and directed to “Attention: HIPAA Privacy Official”. We may charge you a fee for the costs of copying, mailing and supplies that are necessary to fulfill your request. We may deny your request in certain limited circumstances. If you are denied access to your PHI, you may request that the denial be reviewed.

Request an amendment of PHI. If you feel that PHI we maintain about you is incomplete or incorrect, you may request that we amend it. You may request an amendment for as long as we maintain the PHI in a designated record set. To request an amendment, you must send a written request in person or by mail addressed to our pharmacy location and directed to “Attention: HIPAA Privacy Official”. You must include a reason that supports your request for amendment. In certain cases, we may deny your request for amendment. If we deny your request for amendment, you have the right to file a statement of disagreement with the decision and we may provide a rebuttal to your statement.

Receive an accounting of disclosures of PHI. You have the right to receive an accounting of certain disclosures we have made of PHI about you for most purposes. However, disclosures of your PHI for treatment, payment, or health care operations purposes are not required to be included in the accounting unless the disclosures are made through an electronic health record. The accounting will exclude certain other disclosures, such as those made directly to you, disclosures you authorize, disclosures to friends or family members involved in your care, and disclosures for notification purposes. The right to receive an accounting is subject to certain other exceptions, restrictions and limitations. To request an accounting, you must submit a written request in person or by mail addressed to our pharmacy location and directed to “Attention: HIPAA Privacy Official”. Your request must specify the time period for which the accounting is requested, which may not be longer than six years. The first accounting you request within a twelve month period will be provided free of charge, but you may be charged for the cost of providing additional accountings. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time.

Request communications of PHI by alternative means or at alternative locations. You may request that we contact you concerning your PHI by alternative means and/or at alternative locations. For example, you may request that we contact you about medical matters only in writing or at a different residence. To request to receive communications of your PHI by alternative means or at alternative locations, you must submit a written request to in person or by mail addressed to our pharmacy location and directed to “Attention: HIPAA Privacy Official”. Your request must state how or where you would like to be contacted. We must accommodate all reasonable requests. We will not ask you to provide a reason for your request.

RIGHT TO CHANGE TERMS OF THIS NOTICE

We may change the terms of this Notice at any time. If we change this Notice, we may make the new notice terms effective for all your PHI that we maintain, including any information created or received prior to issuing the new notice. If we change this Notice, we will post the new notice on our website. You also may obtain any new notice by contacting us through our website, in person or by mail addressed to our pharmacy location and directed to “Attention: HIPAA Privacy Official”.

 

FOR MORE INFORMATION OR TO REPORT A PROBLEM

If you believe your privacy rights have been violated, you can file a complaint with the Privacy Official at the above address. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.

There will be no retaliation for filing such a complaint.