HIPAA

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (“Notice”) covers an Affiliated Covered Entity (“ACE”). The single covered entity is known as the PharmScript Affiliated Covered Entity. When this Notice refers to the “PharmScript ACE” and to “we”, it is referring to PharmScript, LLC (“PharmScript”) and the PharmScript affiliates, including PharmScript of Texas, LLC; PharmScript of Florida, LLC; PharmScript of PA, LLC; PharmScript of CT, LLC; and PharmScript of MI, LLC. This designation may be amended from time-to-time to add new covered entities that are under the common control and ownership of PharmScript, LLC.

Each of the PharmScript affiliates listed above is a covered entity under the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder (collectively, “HIPAA”). All of the PharmScript affiliates have been designated as a single covered entity for purposes of compliance with HIPAA.

We are committed to protecting the confidentiality of your health information, and are required by law to do so. This notice describes how we may use your health information within the PharmScript ACE and how we may disclose it to others outside the PharmScript ACE. This notice also describes the rights you have concerning your own health information. We must follow the obligations described in this notice and give you a copy of it. Please review this notice carefully and let us know if you have questions.

We are allowed or required to use or disclose health information about you for certain purposes without your authorization. Certain uses and disclosures of your health information, however, require your authorization. The following are ways in which we may use or share your health information:

Treatment:
We may use your health information to provide you with pharmacy care or other medical treatment or services. We may also disclose your health information to others who need that information to treat you, such as doctors, physician assistants, nurses, medical and nursing students, technicians, therapists, emergency service and medical transportation providers, medical equipment providers, and other facilities involved in your care. For example, we will allow your physician to have access to your medical record to determine what treatment you should receive.

We may use and disclose your health information to contact you to provide treatment-related services, such as refill reminders, adherence communications, treatment alternatives (e.g., available generic products) and other health-related benefits and services that may be of interest to you.

Payment:
We may use and disclose your health information to insurers and health plans to get paid for the treatment and services we provide to you. For example, your health plan or health insurance company may ask to see parts of your health information before they will pay us for the particular product or service.

Health Care Operations:
We may use and share your health information to run our organization, improve your care, and contact you when necessary. For example, may use and disclose PHI about you to assess the use or effectiveness of certain drugs, develop and monitor medical protocols, and to provide information regarding helpful health-management services.

Family Members and Others Involved in Your Care:
Unless you object, we may disclose your health information to a family member or close friend who is involved in your healthcare, or to someone who helps to pay for your care. We also may disclose your health information to disaster relief organizations so that your family can be notified about your condition, status, and location.

Business Associates:
We may disclose your health information to our third-party service providers (“Business Associates”) that perform functions on our behalf or provide us with services if the information is necessary for such functions or services. All of our Business Associate are obligated, under contract with us, to appropriately safeguard health information about you and are not allowed to use or disclose any information other than as specified in our contract.

Required by Law:
Federal, state, or local laws sometimes require us to disclose patients’ health information. For instance, we are required to disclose patient health information to the U.S. Department of Health and Human Services so that it can investigate complaints or determine our compliance with HIPAA. We also are required to give information to Workers’ Compensation Programs for work-related injuries.

Public Health Activities:
We may report certain health information for public health purposes. For instance, we may need to report adverse reactions to medications or medical products to the U.S. Food and Drug Administration (the “FDA”), or may notify patients of recalls of medications or products they are using.

Public Safety:
We may disclose health information for public safety purposes in limited circumstances. We may disclose health information to law enforcement Officers in response to a search warrant or a grand jury subpoena. We also may disclose health information to assist law enforcement Officers in identifying or locating a person, to prosecute a crime of violence, to report deaths that may have resulted from criminal conduct, and to report criminal conduct within the PharmScript ACE. We also may disclose your health information to law enforcement Officers and others to prevent a serious threat of health or safety.

Health Oversight Activities:
We may disclose health information to a government agency that oversees the PharmScript ACE or its personnel for activities necessary for the government to provide appropriate oversight of the health care system, certain government benefit programs, and compliance with certain civil rights laws.

Coroners, Medical Examiners, and Funeral Directors:
We may disclose information concerning deceased patients to coroners, medical examiners, and funeral directors to assist them in carrying out their duties.

Military, Veterans, National Security and Other Government Purposes:
If you are a member of the armed forces, we may release your health information as required by military command authorities or to the Department of Veterans Affairs. The PharmScript ACE may also disclose health information to federal Officers for intelligence and national security purposes or for presidential protective services.

Organ and Tissue Donation:
We may use or disclose health information to organ procurement organizations or others that obtain, bank or transplant organ, eye or tissue donation or transplantation.

Judicial Proceedings:
The PharmScript ACE may disclose health information if ordered to do so by a court or if a subpoena or search warrant is served. You will receive advance notice about this disclosure in most situations so that you will have a chance to object to sharing your health information.

Marketing/Sale of Information:
We will never sell your information or share your information for marketing purposes unless you give us written permission. If we contact you for any fundraising efforts, you can ask that we not contact you again.

Information Not Personally Identifiable:
We may use or disclose health information about you in ways that do not personally identify you or reveal who you are.

Marketing/Sale of Information:
We will never sell your information or share your information for marketing purposes unless you give us written permission. If we contact you for any fundraising efforts, you can ask that we not contact you again.

State Laws and Information with Additional Protection:
Certain types of health information have additional protection under state and federal law. We will comply with your state’s laws or other federal laws if they provide you with stricter rights over your health information or provide for more restrictions on the use or disclosure of your health information than HIPAA. For instance, under state law, health information about communicable disease and HIV/AIDS, drug and alcohol abuse treatment, genetic testing, and evaluation and treatment for a serious mental illness is often given more protection than other types of health information. For those types of information, the PharmScript ACE may be required to get your permission before disclosing that information.

Psychotherapy Notes:
The PharmScript ACE is required by law to obtain your authorization most uses and disclosures of psychotherapy notes, unless the use or disclosure is (i) for treatment; (ii) for the PharmScript ACE’s own training programs for students, trainees, or practitioners in mental health; (iii) to defend the PharmScript ACE in a legal action or other proceeding brought by you; (iv) required to determine the PharmScript ACE’s compliance with HIPAA; (v) required by law; (vi) to a health oversight agency for oversight activities authorized by law; (vii) to a coroner or medical examiner for purposes of identifying a deceased person, determining a cause of death, or other duties authorized by law; or (viii) believed by the PharmScript ACE, in good faith, to be necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. Psychotherapy notes means notes of a mental health professional from a counseling session that are maintained separate from the rest of your medical record.

Your Written Authorization for Any Other Use or Disclosure of Your Health Information:
If the PharmScript ACE wishes to use or disclose your health information for a purpose that is not discussed in this notice, the PharmScript ACE will seek your authorization. If you give your authorization to the PharmScript ACE, you may take back that authorization any time, unless we have already relied on your authorization to use or disclose information. If you would ever like to revoke your authorization, please notify the Privacy Officer in writing.

Restrictions on Disclosure of PHI to Health Plan:
The PharmScript ACE must abide by a request to restrict disclosure of PHI to a health plan if the disclosure is for payment or health care operations and is not otherwise required by law, and pertains to a health care item or service for which the individual has paid out of pocket in full.

Right to Request Your Health Information:
You have the right to look at your own health information and to get a copy of that information. Please note that exceptions may apply as provided by law. (The law requires us to keep the original record.) This includes your health record, your billing record, and other records we use to make decisions about your care. To request your health information, call or write to the Privacy Officer at the address below A fee may be charged for the expense of fulfilling your request. We will tell you in advance what this copying will cost. You can look at your record at no cost. We may deny your request in certain limited circumstances but we will respond to your request with an explanation within thirty (30) days. If you are denied access to your health information, you may request that the denial be reviewed.

Right to Request Amendment of Health Information You Believe is Erroneous or Incomplete:
If you examine your health information and believe that some of the information is wrong or incomplete, you may ask us to amend your record. To ask us to amend your health information, submit a written request to the address below. We may deny your request under certain circumstances but we will respond to your request with an explanation within sixty (60) days.

Right to Get a List of Certain Disclosures of Your Health Information:
You have the right to request a list of many of the disclosures we made of your health information. Your request must state a time period which may not go back further than six (6) years. If you would like to receive such a list, submit a written request to the address below. We will provide the first list to you free, but we may charge you for any additional lists you request during the same year. We will tell you in advance what this list will cost and you may choose to modify or withdraw your request at that time.

Right to Request Restrictions on How the PharmScript ACE Will Use or Disclose Your Health Information for Treatment, Payment, or Health Care Operations:
You have the right to ask us NOT to make uses or disclosures of your health information to treat you, to seek payment for care, or to operate the system. We are not required to agree to your request, but if we do agree, we will comply with that agreement. If you want to request a restriction, write to the Privacy Officer at the address below and describe your request in detail.

Right to Request Confidential Communications:
You have the right to ask us to communicate with you in a way that you feel is more confidential. For example, you can ask us not to call your home, but to communicate only by mail. To do this, please discuss this with your caregiver, or submit a written request to the Privacy Officer at the address below. You can also ask to speak with your health care providers in private outside the presence of other patients – just ask them.

Right to be Notified Following a Breach of Unsecured PHI:
You have the right and will be notified if your health information has been breached as soon as possible, but in any event, no later than sixty (60) days following our discovery of the breach.

Right to Choose a Representative:
If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure this person has the authority and can act for you before we take any action.

From time to time, we may change our practices concerning how we use or disclose patient health information, or how we will implement patient rights concerning their information. We reserve the right to change this notice and to make the provisions in our new Notice effective for all health information we maintain. If we change these practices, we will post a revised Notice of Privacy Practices. You can get a copy of our current Notice of Privacy Practices at any time by requesting one from the Privacy Officer at the address below.

Please tell us about any problems or concerns you have with your privacy rights or how the PharmScript ACE uses or discloses your health information. If you have a concern, please contact the Privacy Officer or the PharmScript Compliance Hotline (855-657-8029 or www.pharmscript.ethicspoint.com) with any questions or concerns.

If for some reason the PharmScript ACE cannot resolve your concern, you may also file a complaint with the federal government by sending a letter to the U.S. Department of Health and Human Services, Office for Civil rights. www.hhs.gov/ocr/privacy/hipaa/complaints/

We will not penalize you or retaliate against you in any way for filing a complaint with the federal government.

The PharmScript ACE is required by law to give you this notice and to follow the terms of the notice that is currently in effect. If you have any questions about this notice, or have further questions about how the PharmScript ACE may use and disclose your health information, please contact the Privacy Officer.

Chief Compliance and Privacy Officer:
Jennifer Krusa, RPh, CHC
jkrusa@pharmscript.com
908-389-1818, ext. 2360