NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

The Pharmacy is required by law to maintain the privacy of the health information it maintains about its customers (also known as “Protected Health Information” or “PHI”) and to provide its customers with notice of our legal duties and privacy practices with respect to PHI. PHI is information that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services. This Notice of Privacy Practices (“Notice”) describes how we may use and disclose PHI to carry out treatment, obtain payment or perform our health care operations and for other specified purposes that are permitted or required by law. This Notice also describes your rights with respect to PHI about you.

The Pharmacy will follow the practices described in this Notice. Except as described in this Notice, we will not use or disclose PHI about you without your written authorization. We reserve the right to change our practices and this Notice. In the event that we revise this Notice, the new Notice provisions will be effective for all PHI we maintain. We will provide you with a revised Notice upon request.

YOUR CHOICES REGARDING YOUR PHI

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.

In these cases, you have both the right and choice to tell us to:

Share information with your family, close friends, or others involved in your care
Share information in a disaster relief situation
Include your information in a hospital directory

If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

In these cases, we never share your information unless you give us written permission:

Marketing purposes
Sale of your information
Most sharing of psychotherapy notes

For this purpose, “marketing activities” generally include communications to you that encourage you to purchase or use a product or service and potentially, communications to you in the context of treatment and health care operations where we receive remuneration (monies) from a third party for making the communications.

We may contact you for fundraising efforts, but you can tell us not to contact you again.

You may revoke an authorization in writing at any time. Upon receipt of a written revocation, we will stop using or disclosing PHI about you, except to the extent that we already have acted in reliance on the authorization.

OUR USES AND DISCLOSURES OF PHI

The following categories describe different ways that we may use and disclose your PHI. Examples of such uses or disclosures are provided for each category. These are provided for illustrative purposes only and not every use or disclosure within each category is listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories below.

1. TREATMENT. We may use and disclose your PHI with other professionals who are treating you. Information obtained from your physician may be used to dispense prescription medications to you.

2. PAYMENT. We may use and disclose your PHI to bill and get payment from other health plans or other entities. We may contact your insurer to determine whether it will pay for your prescription and the amount of your co- payment. We will bill you or a third-party payor for the cost of prescription medications dispensed to you. Alternatively, we may disclose your PHI to the pharmacy benefits managers retained by your insurer for those same payment purposes.

3. ORGANIZATION OPERATIONS. We may use and disclose your PHI for health care operations. We may use your PHI to review and assess the quality of the services we provide to you. We also may disclose your PHI to our attorneys and auditors for assistance with legal compliance and financial reporting requirements. We also may use or disclose your PHI for limited operations purposes of certain other health care providers, clearing houses or health plans. The persons or entities to which the Pharmacy personnel may disclose your PHI must have or have had a relationship with you, and the PHI disclosed must pertain to that relationship. The operations purposes for which we may disclose your PHI include, but are not limited to, various quality assessment and improvement activities, credentialing and training activities, and health care fraud and abuse detection or compliance activities.

We are allowed or required to share your information in other ways – usually in ways that contribute to the public good, such as public health and research. We have to meet many conditions in the law before we can share your information for these purposes. For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.html.

We may use or disclose your PHI for the following purposes:

1. BUSINESS ASSOCIATES. Certain of the services we provide may be delegated to contractors, known as business associates. We may provide your PHI to those of our contractors who require the information to perform certain services on our behalf. For example, we may provide PHI to a claims submission service that ensures that our claims are submitted in the appropriate form to the appropriate payors. To protect you, we require the business associate to appropriately safeguard the PHI.

2. COMMUNICATION. We may disclose to a person involved in your care or involved in payment for your care PHI relevant to that person’s involvement in your care or payment.

We may contact you to provide refill reminders or communicate with you about a drug or biologic that is currently prescribed to you so long as any payment we receive for making the communication is reasonably related to our cost of making the communication.

We may use or disclose PHI about you to notify or assist in notifying a family member, personal representative or another person responsible for your care, of information regarding your location and your general condition.

3. PUBLIC HEALTH. We may disclose information about you for certain public health and safety issues such as: preventing disease; helping with product recalls; reporting adverse events with respect to drugs, foods, supplements, products and product defects; reporting suspected abuse, neglect, or domestic violence; or preventing or reducing a serious threat to anyone’s health or safety.

We may also disclose PHI about you to an oversight agency for activities authorized by law such as state boards of pharmacy or the U.S. Drug Enforcement Administration (DEA). These oversight activities include audits, investigations, and inspections, as necessary for our licensure and for the government to monitor the health care system, government programs, and compliance with laws.

4. RESEARCH. We may use and disclose your information for health research.

5. COMPLY WITH THE LAW. We will share information about you if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.

6. TISSUE DONATION REQUESTIONS. We may disclose health information about you with organ procurement organizations for the purposes of responding to organ and tissue donation requests.

7. IN EVENT OF DEATH. We may disclose health information with a coroner, medical examiner, or funeral director when an individual dies.

8. ADDRESS WORKERS’ COMPENSATION, LAW ENFORCEMENT, AND OTHER GOVERNMENT REQUESTS. We can use or share health information about you: for workers’ compensation claims; for law enforcement purposes or with a law enforcement official; with health oversight agencies for activities authorized by law; for special government functions such as military, national security, and presidential protective services.

9. LEGAL ACTIONS. We can share health information about you in response to a court or administrative order. We may also disclose PHI about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made by the requesting party to tell you about the request or to obtain an order protecting the requested PHI.

Our responsibilities regarding your PHI include:

We are required by law to maintain the privacy and security of your protected health information.
We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
We must follow the duties and privacy practices described in this notice and give you a copy of it.
We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.

YOUR HEALTH INFORMATION RIGHTS

You have the following rights with respect to your PHI that we maintain:

1. GET AN ELECTRONIC OR PAPER COPY OF YOUR MEDICAL RECORD. You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. Ask us how to do this. We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost-based fee.

2. ASK US TO CORRECT YOUR MEDICAL RECORD. You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this. We may say “no” to your request, but we’ll tell you why in writing within 60 days. If we deny your request for amendment, you have the right to file a statement of disagreement with the decision and we may provide a rebuttal to your statement.

3. REQUEST CONFIDENTIAL COMMUNICATIONS. You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. We will say “yes” to all reasonable requests.

4. ASK US TO LIMIT WHAT WE USE OR SHARE. You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say “no” if it would affect your care. If you pay for a service or health care item out-of-pocket in full, you can ask us not to share that information for the purpose of payment or our operations with your health insurer. We will say “yes” unless a law requires us to share that information.

5. GET A LIST OF THOSE WITH WHOM WE’VE SHARED INFORMATION. You can ask for a list (accounting) of the times we’ve shared your health information for six years prior to the date you ask, who we shared it with, and why. We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We’ll provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within 12 months. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time.

6. GET A COPY OF THIS PRIVACY NOTICE. You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide you with a paper copy promptly.

7. CHOOSE SOMEONE TO ACT FOR YOU. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.

CHANGES TO THE TERMS OF THIS NOTICE

We can change the terms of this Notice, and the changes will apply to all information we have about you, including any information created or received prior to issuing the new Notice. The new Notice will be posted on our website and will be available upon request.

FOR MORE INFORMATION OR TO REPORT A PROBLEM.

If you have questions or would like additional information about Pharmacy privacy practices, you may contact our Privacy Official Mike Fuller at GRX Holdings, LLC by mail or in person (2929 Westown Parkway Suite 100, West Des Moines, IA 50266), by email (compliance@onerorx.com), or by phone (515-440-1270).

If you believe your privacy rights have been violated, you can file a complaint with the Privacy Official at the above address. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/.

There will be no retaliation for filing a complaint.