HIPAA Notice of Privacy Practices

HOW WE MAY USE AND DISCLOSE YOUR PHARMACY INFORMATION

A. Typical Uses and Disclosures (without specific patient authorization)

3 Primary ways we may use or disclose your PHARMACY INFORMATION

1 Treatment Purposes

• Fill your script or administer vaccines
• Provide you info about health services or offerings (e.g., Health Journey Programs)
• Share it with other professionals who are treating you (e.g., your prescriber)

2 Payment Purposes

• Check for eligible insurance coverage
• Bill health plans and insurance
• Process payments for scripts and other pharmacy services

3 Healthcare Operation Purposes

• Send you communications about things like your scripts, appointments, and ways to enhance your health journey
• General business operations and administrative activities (e.g., to operate our pharmacies)
• Evaluate performance of our pharmacies and staff (e.g., quality assurance)

The above graphic describes the primary ways we may use and disclose your pharmacy information. Not every use or disclosure will be listed, but hope it gives you an idea of the everyday uses and disclosures “behind the scenes” that are essential to the care you receive from us.

Health Information Exchange. As a pharmacy, we may share pharmacy information with other healthcare providers, as permitted by law, through Health Information Exchanges (HIEs) for treatment and healthcare operation purposes. HIE networks allow us to share pharmacy information with other healthcare providers involved in your treatment, such as your prescribers, so they can have access to the most up-to-date information about your health status and medication history. HIE networks help improve the quality of patient care, timely and accurate medication dispensing, and avoid medication errors. Under HIPAA, we are allowed to disclose your pharmacy information to HIE networks for treatment and healthcare operations purposes without obtaining written authorization from you. We participate in the SureScripts HIE. You can opt-out of the HIE by contacting optout@Surescripts.com. As a participant pharmacy, we are unable to opt-out on your behalf. Even if you opt-out of SureScripts HIE, public health reporting including Controlled Substances information may still be available to providers as part of the State Prescriptions Drug Monitoring Program (PDMP).

Reproductive Health Information. The HIPAA Privacy Rule to Support Reproductive Health Care Privacy includes additional protections for reproductive health information. This new Rule prohibits pharmacy information from being used or disclosed to investigate or impose liability on someone for the mere act of seeking, obtaining, providing, or facilitating legal reproductive healthcare. Pursuant to the new Rule, if we receive a request for pharmacy information from someone other than your or your representative, we ask the requestor to provide a signed attestation that states the requested use or disclosure of pharmacy information is not for the following prohibited purposes:

(1) to conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive healthcare;

(2) impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive healthcare; or

(3) to identity any person for any purpose described in (1) and (2).

For example, if a government agency requested pharmacy information related to miscarriage treatment as part of health oversight activities, we would ask the requestor to provide a signed attestation that they are not seeking reproductive health information for prohibited purposes, including investigations into legal healthcare.

B. Other Uses and Disclosures (without specific patient authorization)

In certain situations, we may use or disclose your pharmacy information without your authorization (permission) for other purposes permitted or required by law, including:

• Health-related offers. To tell you about, or recommend, health-related products, benefits, and services we may provide.
• Required by Law. As required by state and federal law, including the Secretary of Health and Human Services to investigate or determine our compliance with HIPAA.
• Public Health. For public health activities, such as disclosures to state Prescription Drug Monitoring Programs (PDMP) and the Food and Drug Administration.
• Abuse or Neglect. If you have been a victim of abuse, neglect, or domestic violence, we may disclose your pharmacy information to the government agency authorized to receive such information.
• Health Oversight. To a health oversight agency for activities authorized by law, such as: civil or criminal investigations; inspections; licensure or disciplinary actions; or other activities necessary for appropriate oversight of retail pharmacies, governmental health benefit programs, or compliance with laws.
• Our Partners. To third parties referred to as “business associates” that provide services on our behalf, such as billing, software maintenance, and sending communications. We may use third party Business Associates to perform the operations described above. In those instances where we disclose your pharmacy information to a third party acting on our behalf, we protect your pharmacy information through an appropriate privacy agreement, referred to as a Business Associate Agreement. In addition to these contractual obligations, as of February 17, 2010, our Business Associates also have independent HIPAA compliance obligations designed to further protect the privacy of pharmacy information.
• Judicial and Administrative Proceedings. In response to a court or agency order, and in some cases, in response to a subpoena or other lawful process not accompanied by a court order.
• Law Enforcement. To law enforcement officials as authorized or required by law, such as providing information to the police about the victim of a crime.
• Coroners and Funeral Directors. To coroners, medical examiners, and funeral directors, as authorized or required by law as necessary for them to carry out their duties.
• Research. To researchers when the research is being conducted under established protocols to ensure the privacy of your information.
• Serious Threat to Health or Safety. To prevent or lessen a serious and imminent threat to your health and safety or the health and safety of the public or another person.
• Specialized Government Functions. To specialized government functions related to military or national security concerns, such as for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits.
• Domestic Armed Forces Personnel. To the military if you are a member of the armed forces and we are authorized or required to do so by law.
• Inmates. Under certain circumstances, we may disclose the pharmacy information of inmates of a correctional institution.
• Workers’ Compensation. For workers’ compensation or similar programs providing benefits for work-related injuries or illness as authorized or required to do so by law.