HIPAA NOTICE OF PRIVACY PRACTICES

Your Privacy Rights

You have rights concerning your protected health information (“PHI”). Subject to applicable law, you may exercise the following rights.

Obtain Your Health Information

You may ask to inspect or obtain an electronic or paper copy of health information we maintain about you.

We will respond within the timeframe required by law.

We may charge a reasonable, legally permitted cost-based fee.

Request a Correction

If you believe information in your pharmacy or health record is inaccurate or incomplete, you may ask us to amend it.

We may deny a request in circumstances permitted by law, but if we do, we will explain the denial in writing.

Request Confidential Communications

You may ask us to contact you through a particular telephone number, email address, mailing address, or other reasonable method.

We will accommodate reasonable requests as required by law.

Request Restrictions

You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations.

We generally are not required to agree to every requested restriction.

If you pay in full out-of-pocket for a healthcare item or service, you may ask us not to disclose information about that item or service to your health plan for payment or healthcare operations where applicable law requires us to honor that request.

Obtain an Accounting of Certain Disclosures

You may request information about certain disclosures of your PHI made during the period allowed by law.

Certain disclosures such as many disclosures for treatment, payment, and healthcare operations are not included in an accounting.

Obtain a Paper Copy of This Notice

You may request a paper copy of this Notice even if you previously agreed to receive it electronically.

Choose a Personal Representative

A legally authorized personal representative may exercise rights concerning your PHI on your behalf.

We may require documentation demonstrating that person's authority.

Your Choices

In certain circumstances, you may tell us how you want information shared.

Depending on the situation and applicable law, you may have choices concerning:

• sharing relevant information with family members, caregivers, friends, or others involved in your care or payment for your care;
• disaster-relief activities;
• other disclosures where your agreement or authorization is required.

If you cannot communicate a preference, we may disclose information when permitted by law and when we reasonably determine that disclosure is in your best interests or is necessary to reduce a serious and imminent threat.

Uses Requiring Authorization

Except where applicable law permits otherwise, we will obtain your written authorization before:

• using PHI for certain marketing purposes;
• selling PHI;
• using or disclosing certain specially protected records where authorization is required.
• If you give us authorization, you generally may revoke it in writing for future uses and disclosures.

How We Typically Use and Disclose PHI

Treatment

We may use and disclose your health information to provide, coordinate, or manage treatment and pharmacy services.

For example, we may communicate with your prescriber concerning your prescription, medication therapy, allergy information, drug interactions, refill authorization, or other treatment-related matters.

Payment

We may use and disclose health information to obtain payment.

This may include disclosures to:

• health plans;
• pharmacy benefit managers;
• Medicare or Medicaid programs;
• workers’ compensation carriers;
• no-fault carriers;
• claims administrators;
• Other entities responsible for payment, where legally permitted.

Healthcare Operations

We may use and disclose PHI for activities necessary to operate the pharmacy, including:

• quality assessment;
• patient-safety activities;
• staff training;
• auditing;
• compliance;
• licensing;
• credentialing;
• business administration;
• fraud prevention;
• service improvement.

Prescription Delivery

We may use and disclose the minimum information reasonably necessary to arrange and complete lawful medication delivery.

Business Associates

We may engage vendors that perform services involving PHI on our behalf.

Where HIPAA requires it, those vendors must enter into Business Associate Agreements and safeguard PHI.

Other Permitted or Required Uses and Disclosures

Subject to legal requirements and applicable limitations, we may use or disclose health information:

Public Health and Safety

For legally authorized activities such as:

• reporting certain diseases or conditions;
• reporting adverse drug reactions;
• product recalls;
• preventing or reducing a serious threat to health or safety;
• reporting abuse, neglect, or domestic violence when legally permitted or required;
• other public-health activities.

Health Oversight

To health oversight agencies for audits, investigations, inspections, licensure, disciplinary proceedings, and other activities authorized by law.

Required by Law

When federal, state, or local law requires disclosure.

Workers’ Compensation

As authorized by and to the extent necessary to comply with laws governing workers’ compensation and similar programs.

Legal Proceedings

In response to qualifying court orders, administrative orders, subpoenas, discovery requests, or other lawful processes, subject to HIPAA and other applicable confidentiality requirements.

Law Enforcement

For law-enforcement purposes when the disclosure is specifically permitted or required by law.

Research

For research activities meeting applicable HIPAA requirements.

Government Functions

For certain legally authorized government activities, including military, national-security, protective-service, correctional, and benefits-related functions.

Our Responsibilities

AV Chemist is required to:

• maintain the privacy and security of PHI as required by law;
• provide this Notice describing our legal duties and privacy practices;
• follow the Notice currently in effect;
• notify affected individuals when required following a breach of unsecured PHI;
• comply with other applicable federal and state privacy requirements.

We will not use or disclose PHI other than as described in this Notice or as otherwise permitted by law unless you provide a valid authorization.

Changes to This Notice

We may change this Notice and make the revised Notice effective for PHI we already maintain as well as information received in the future.