This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

{Store Name} will ask you to sign an Acknowledgement that you have received this Notice of Privacy Practices (Notice). This Notice describes how {Store Name}may use and disclose your protected health information in accordance with the HIPAA Privacy Rule. It also describes your rights and {Store Name}’s duties with respect to protected health information about you.

Section A: Uses and Disclosures of Protected Health Information

1. Treatment, Payment and Health Care Operations

a. We will use your health information to provide treatment. This may involve receiving or sharing information with other health care providers such as your physician. This information may be written, verbal, electronic or via facsimile. This will include receiving prescription orders so that we may dispense prescription medications. We may also share information with other health care providers who are treating you to coordinate the different things you need, such as medications, lab work or other appointments. We may also contact you to provide treatment-related services, such as refill reminders, treatment alternatives and other health related services that may be of benefit to you.

b. We will use your health information to obtain payment. This will include sending claims for payment to your insurance or third-party payer. It may also include providing health information to the payer to resolve issues of claim coverage.

c. We will use your health information for our health care operations necessary to run the pharmacy. This may include monitoring the quality of care that our employees provide to you and for training purposes.

2. Permitted or Required Uses and Disclosures

a. Our pharmacists, using their professional judgment may disclose your protected health information to a family member, other relative, close personal friend or other person you identify as being involved in your health care. This includes allowing such persons to pick up filled prescriptions, medical supplies or medical records on your behalf.

b. We also have contracts with entities called Business Associates that perform some services for us that require access to your protected health information. Examples may include companies that route claims to your insurance company or that reconcile the payments we receive from your insurance. We require our Business Associates to safeguard any protected health information appropriately.

c. Under certain circumstances {Store Name} may be required to disclose health information as required or permitted by federal or state laws. These include, but are not limited to:

i. To the Secretary of Health and Human Services for investigations into our compliance with HIPAA rules and to respond to patient complaints.

ii. To the Food and Drug Administration (FDA) relating to adverse events regarding drugs, foods, supplements and other health products or for post-marketing surveillance to enable product recalls, repairs or replacement.

iii. To public health or legal authorities charged with preventing or controlling disease, injury or disability.

iv. To law enforcement agencies as required by law or in response to a valid subpoena or other legal process.

v. To health oversight agencies (e.g., licensing boards) for activities authorized by law such as audits, investigations and inspections necessary for {Store Name}’s licensure and for monitoring of health care systems.

vi. In response to a court order, administrative order, subpoena, discovery request or other lawful process by another person involved in a dispute involving a patient, but only if efforts have been made to tell the patient about the request or to obtain an order protecting the requested health information.

vii. As authorized by and as necessary to comply with laws relating to worker’s compensation or similar programs established by the law.

viii. Whenever required to do so by law.

ix. To a Coroner or Medical Examiner when necessary. Examples include: identifying a deceased person or to determine a cause of death.

x. To Funeral Directors to carry out their duties

xi. To organ procurement organizations or other entities engaged in procurement, banking or transplantation of organs for the purpose of tissue donation and transplant.

xii. To notify or assist in notifying a family member, personal representative or another person responsible for the patient’s care of the patient’s location or general condition.

xiii. For certain research purposes.

xiv. To a correctional institution or its agents if a patient is or becomes an inmate of such an institution when necessary for the patient’s health or the health and safety of others.

xv. When necessary to prevent a serious threat to the patient’s health and safety or the health and safety of the public or another person.

xvi. As required by military command authorities when the patient is a member of the armed forces and to appropriate military authority about foreign military personnel.

xvii. To authorized officials for intelligence, counterintelligence and other national security activities authorized by law.

xviii. To authorized federal officials so they may provide protection to the president, other authorized persons or foreign heads of state or to conduct special investigations.

xix. To a government authority, such as social service or protective services agency, if {Store Name} reasonably believes the patient to be a victim of abuse, neglect or domestic violence but only to the extent required by law, if the patient agrees to the disclosure or if the disclosure is allowed by law and we believe it is necessary to prevent serious harm to the patient or to someone else or the law enforcement or public official that is to receive the report represents that it is necessary and will not be used against the patient.

d. During an emergency or disaster relief situation, if you are unconscious or unable to tell us your preference, we may share information to lessen a serious and imminent threat to health or safety.

e. We may contact you for fundraising efforts, but you can request that we not contact you again.

3. Authorized Use and Disclosure

a. Use or disclosure other than those previously listed or as permitted or required by law, will not be made unless we obtain your written Authorization in advance. You may revoke any such Authorization in writing at any time. Upon receipt of a revocation, we will cease using or disclosing protected health information about you unless we have already taken action based on your Authorization.

b. Your authorization is always required for Marketing purposes, Sale of your information, and any sharing of Psychotherapy notes.

4. More Stringent Laws

a. Some states may have laws that are more stringent than HIPAA. Please refer to the end of the Notice for the laws that may apply.

Section B: Patient’s Rights

1. Restriction Requests

a. You have a right to request a restriction be placed on the use and disclosure of your protected health information for purposes of carrying out treatment, payment or health care operations. Restrictions may include requests for not submitting claims to your insurance or third-party payer or limitations on which persons may be considered personal representatives.

b. {Store Name} is not required to accept restrictions other than payment related uses not required by law that have been paid in full by the individual or representative other than a health plan.

c. If we do agree to requested restrictions, they shall be binding until you request that they be terminated.

d. Requests for restrictions or termination of restrictions must be submitted in writing to the Privacy Officer listed in Section D of this Notice.

2. Alternative Means of Communication

a. You have a right to receive confidential communications of protected health information by alternate methods or at alternate locations upon reasonable request. Examples of alternatives may be sending information to a phone or mailing address other than your home.

b. {Store Name} shall make reasonable accommodation to honor requests.

c. Requests must be submitted in writing to the Privacy Officer listed in Section D of this Notice.

3. Access to Health Information

a. You have a right to inspect and copy your protected health information. The designated record set will usually include prescription and billing records. You have the right to request the protected health information in the designated record set for as long as we maintain your records.

b. You have the right to have requested records provided to you in a timely fashion.

c. You have the right to request that your protected health information be provided to you in your preferred format, including an electronic format if available.

d. You have the right to have your information disclosed to another person or third-party that you choose.

e. Requests may be submitted in writing to the Privacy Officer listed in Section D of this Notice.

f. Any costs or fees associated with copying, mailing or preparing the requested records will be charged prior to granting your request.

g. {Store Name} may deny your request for records in limited circumstances. In case of denial, you may request a review of the denial for most reasons. Requests for review of a denial must also be submitted to the Privacy Officer listed in Section D of this Notice.

4. Amendments to Health Information

a. If you believe that your protected health information is incomplete or incorrect, you may request an amendment to your records. You may request amendment to any records for as long as we maintain your records.

b. Requests must be submitted in writing to the Privacy Officer listed in Section D of this Notice.

c. Requests must include a reason that supports the amendment to your health information.

d. {Store Name} may deny amendment requests in certain cases. In case of denial, you have the right to submit a Statement of Disagreement. We have the right to provide a rebuttal to your statement.

5. Accounting of Uses and Disclosures

a. You have the right to request an accounting of uses and disclosures that are not for treatment, payment or health care operations. This accounting may include up to the six years prior to the date of request and will not include an accounting of disclosures to yourself, your personal representatives or anything authorized by you in writing. Other restrictions may apply as required in the Privacy Rule.

b. Requests must be submitted in writing to the Privacy Officer listed in Section D of this Notice.

c. The first accounting in any 12-month period will be provided to you at no cost. Any additional requests within the same 12-month period will be charged a fee to cover the cost of providing the accounting. This fee amount will be provided to you prior to completing the request. You may choose to withdraw your request to avoid paying this fee.

6. Notice of Privacy Practices

a. You have a right to receive a paper copy of this Notice even if you previously agreed to receive a copy electronically.

b. You have a right to request a revised or updated copy of this notice.

c. Please submit a request to the Privacy Officer listed in Section D of this Notice.

Section C: {Store Name}’s Duties

{Store Name} is required by law to maintain the privacy of protected health information, to provide individuals with notice of its legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured protected health information.

{Store Name} is required to abide by the terms of this Notice. We reserve the right to change the terms of this Notice and to make the new notice provisions effective for all protected health information that we maintain. Any such revised Notice will be made available upon request.

Section D: Contacting Us

1. Additional Questions, Submitting Requests or Complaints

a. If you have questions about this Notice or how {Store Name} uses and discloses your protected health information please contact our Privacy Officer below.

b. You may obtain forms needed for request submission from our pharmacy or from our Privacy Officer.

c. If you believe your privacy rights have been violated you may file a complaint with our Privacy Officer or with the Secretary of Health and Human Services. You will not be retaliated against for filing a complaint.

2. Privacy Officer

{Privacy Officer}

{Store Name}

{Address1}

{City}, {State} {Zip}

{Phone}

3. Secretary of Health and Human Services, Office for Civil Rights

a. For online complaint forms and contact information for the Regional OCR offices: http://www.hhs.gov/ocr/privacy/index.html

b. Email: OCRComplaint@hhs.gov for assistance or questions about complaint forms

Section E: State Specific Requirements

{Insert State requirements here}

Version # {NCPDP}-PAAS-2020-3.0

Effective Date

This Notice of Privacy Practices is effective as of {Date Submitted}

Merchant Policies