Privacy Practice

What Is PHI?

Protected Health Information (PHI) or electronic health information (ePHI) includes all individually identifiable health information. This includes demographic data, medical histories, test results, insurance information, and other information used to identify a patient or give healthcare services/coverage. The types of information covered by this policy also includes telephone/cellphone communications and verbal and faxed information.

Our Responsibilities

• We are required by law to maintain the privacy and security of your PHI.
• We will secure and properly store all records and identify who has authority to review or access clinicalrecords. This is to prevent loss, destruction, or tampering of information.
• We will require all personnel with access to PHI to sign a confidentiality statement.
• We will alert you right away if there is a breach that may have compromised the privacy or security of yourinformation.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described here unless you let us know in writing thatwe can. You may also change your mind at any time, just let us know in writing.
• For more information, go to the website: https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html

How We May Use and Disclose Your PHI

The following categories describe different ways that we use and disclose your PHI. For each category of uses or disclosures, we will explain what we mean and give some examples. Not every use or disclosure in any category is listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

Treating you. We can use your PHI and share it with other providers who are treating you or administering your medication(s) or services. An example of this practice is providing your prescription information to the pharmacy of your choice so that it may be dispensed.

Billing for your services. We can use and share your PHI to bill and get payment from health plans or other entities. For example, we may contact your insurer to determine whether it will pay for your prescription and the amount of your co-payment.

Running our pharmacy. We can use and share your PHI to run our pharmacy, better your care, and contact you when needed as we give services to you. For example, we may use your PHI to review and assess the quality of the services we give to you. We also may disclose your PHI to our attorneys and auditors for assistance with legal compliance.

Public health and safety. We can share health information about you for certain situations, such as: preventing disease, helping with product recalls, reporting adverse drug reactions, reporting suspected abuse, neglect, or domestic violence, or preventing a serious threat to anyone’s health or safety.

Comply with the law. We will share information about you if state or federal laws require it. This includes sharing with the Department of Health and Human Services if they want to see that we’re complying with federal privacy law. We can share health information about you in response to a court or administrative order, or in response to a subpoena.

14| PREVEON SPECIALTYHow We Won’t Use Your PHI

• We do not ask for, collect, or store genetic information
• Marketing purposes
• Sale of your PHI

Your Health Information Rights

You have the following rights with respect to your PHI that we maintain:

• Get an electronic or paper copy of your medical record. You can ask to see or get a copy of an electronicor paper copy of your medical records and other health information we have about you. Ask us how to dothis by contacting Preveon Specialty. We will give a copy or a summary of your PHI, usually within 30 days ofyour request. We may charge a reasonable, cost-based fee. We may deny your request in certain limitedcircumstances. If you are denied access to your PHI, you may request that the denial be reviewed.
• Receive an accounting of disclosures of PHI made by us to individuals or entities other than to you for the sixyears prior to your request, except for disclosures:
  • I.To carry out treatment, payment and health care operations as stated above;
  • II.Incidental to a use or disclosure otherwise permitted or required by applicable law
  • III.Pursuant to your written authorization;
    • To persons involved in your care or for other notification purposes as stated by law;
    • For national security or intelligence purposes as stated by law;
    • To correctional institutions or law enforcement officials as stated by law;
    • As part of a limited data set as stated by law.
  • To request an accounting of disclosures of your PHI, you must submit your request in writing to the Privacy Officer at our pharmacy. Your request must state a specific time period for the accounting (e.g., the past three months). The first accounting you request within a twelve (12) month period will be free. For additional accountings, we may charge you for the costs of providing the list. We will notify you of the costs involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.
• Get a copy of this Notice. You may request a copy of this Notice at any time. To obtain a paper copy of theNotice, please call Preveon Specialty at 877-842-5181.
• Receive written notification following a breach of your unsecured PHI.
• Give alternative communications on the Notice to individuals with disabilities in another format incompliance with Section 504 of the Rehabilitation Act of 1973 or the Americans with Disabilities Act of 1990.
• We shall honor requests to restrict certain disclosures of your PHI to a health plan regarding services or ahealthcare item for which you have paid Preveon Specialty out of pocket in full.
• Request a restriction on certain uses and disclosures of PHI. You have the right to request certain restrictionson our use or disclosure of your PHI that we maintain. To request such a restriction, please send a writtenrequest to Preveon Specialty.
• Ask us to correct your medical record. If you feel that the PHI we maintain about you is incomplete or PREVEON SPECIALTY | 15incorrect, you may request that we amend it. You may request an amendment for as long as we maintain the PHI in a designated record set. To request an amendment, you must send a written request to Preveon Specialty. You must include a reason that supports your request for amendment. In certain cases, we may deny your request for amendment. If we deny your request for amendment, you have the right to file a statement of disagreement with the decision and we may give a rebuttal to your statement.
• Request communications of PHI by alternative means or at alternative locations. You may request thatwe contact you concerning your PHI by alternative means and/or at alternative locations. For example,you may request that we contact you about medical matters only in writing or at a different residence. Torequest to receive communications of your PHI by alternative means or at alternative locations, you mustsubmit a written request to Preveon Specialty. Your request must state how or where you would like to becontacted. We must accommodate all reasonable requests. We will not ask you to give a reason for yourrequest.

Other Ways We May Use or Disclose Your PHI for the Following Purpose

• Some of the services we give are delegated to contractors, known as Business Associates. We will give yourPHI to those of our contractors who require the information to perform certain services on our behalf. Forexample, we may give PHI to a claims submission service that ensures that our claims are submitted in theappropriate form to the appropriate payers. To protect you, we require the Business Associate and theircontractors to appropriately safeguard the PHI.
• Communication with individuals involved in your care or payment for your care. We may disclose to apersoninvolved in your care or payment for your care PHI relevant to that person’s involvement in your careorpayment.
• To give appointment reminders for treatment or medical care.
• To tell you about or recommend possible treatment alternatives or other health-related benefits and servicesthat may be of interest to you.
• To disclose to any other individuals authorized by you to the extent directly related to that person’sinvolvement in your care or the payment for your care. We may use or disclose your PHI to notify, or help inthe notification of, a family member, a personal representative, or another person responsible for your care,of your location, general condition or death. If you are available, we will give you an opportunity to objecttothese disclosures, and we will not make these disclosures if you do not allow us to. If you are not available,wewill determine whether a disclosure to your family or friends is in your best interest, taking into account thecircumstances and based upon our professional judgment.
• We will allow authorized persons to act on your behalf to pick up filled prescriptions, medical supplies, X-rays,and similar forms of PHI, when we determine, in our professional judgment, that it is in your best interest tomake such disclosures.
• We may contact you as part of our fundraising and marketing efforts as permitted by applicable law. Youhave the right to opt out of receiving such fundraising communications.
• We may use or disclose your PHI for research purposes, subject to the requirements of applicable law.For example, a research project may involve comparisons of the health and recovery of all patients whoreceived a particular medication. All research projects are subject to a special approval process whichbalances research needs with a patient’s need for privacy. When required, we will obtain a writtenauthorization from you prior to using your health information for research.
• We will use or disclose PHI about you when required to do so by applicable law.
• in accordance with applicable law, we may disclose your PHI to your employer if we are retained toconduct an evaluation relating to medical surveillance of your workplace or to evaluate whether you havea work-related illness or injury. You will be notified of these disclosures by your employer or the pharmacy asrequired by applicable law.

Special Situations

Subject to the requirements of applicable law, we will make the following uses and disclosures of your PHI:

Organ and tissue donation. If you are an organ donor, we may release PHI to organizations that handle organ procurement or transplantation as needed to facilitate organ or tissue donation and transplantation.Military and Veterans. If you are a member of the Armed Forces, we may release PHI about you as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority.

Worker’s compensation. We may release PHI about you for programs that give benefits for work-related injuries or illnesses.

Public health activities. We may disclose PHI about you for public health activities, including disclosures:

• To prevent or control disease, injury or disability;
• To report births and deaths;
• To report child abuse or neglect;
• To persons subject to the jurisdiction of the Food and Drug Administration (FDA) for activities related to thequality, safety, or effectiveness of FDA-regulated products or services and to report reactions to medicationorproblems with products;
• To notify a person who may have been exposed to a disease or may be at risk for contracting or spreadinga disease or condition;
• To notify the appropriate government authority if we believe that an adult patient has been the victim ofabuse, neglect or domestic violence. We will only make this disclosure if the patient agrees or when requiredor authorized by law.

Health oversight activities.We may disclose PHI to federal or state agencies that oversee our activities (e.g., providing health care, seeking payment, and civil rights).

Lawsuits and disputes. If you are involved in a lawsuit or a dispute, we may disclose PHI subject to certain limitations.

Law enforcement.We may release PHI if asked to do so by a law enforcement official:

• In response to a court order, warrant, summons or similar process;
• To identify or locate a suspect, fugitive, material witness, or missing person;
• About the victim of a crime under certain limited circumstances;
• About a death we believe may be the result of criminal conduct;
• About criminal conduct on our premises; or
• In emergency circumstances, to report a crime, the location of the crime or the victims, or the identity,description or location of the person who committed the crime.

Coroners, medical examiners and funeral directors. We may release PHI to a coroner or medical examiner. We may also release PHI about patients to funeral directors as needed to carry out their duties.

National security and intelligence activities. We may release PHI about you to authorized federal officials for intelligence, counterintelligence, other national security activities authorized by law or to authorized federal officials so they may give protection to the President or foreign heads of state.

Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release PHI about you to the correctional institution or law enforcement official. This release would be needed (1) to give you health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Serious threats.As permitted by applicable law and standards of ethical conduct, we may use and disclose PHI if we, in good faith, believe that the use or disclosure is needed to prevent or lessen a serious and imminent threat to the health or safety of a person or the public or is necessary for law enforcement authorities to identify or apprehend an individual.

Note: HIV-related information, genetic information, alcohol and/or substance abuse records, mental health records and other specially protected health information may have certain special confidentiality protections under applicable state and federal law. Any disclosures of these types of records will be subject to these special protections.

Aggregated or De-Identified Data

We may use aggregate or de-identified data for various business purposes to learn more about the benefits of our program and how we may better our services or create additional service offerings.