Notice of Privacy Practices
California Pharmacy and Compounding Center (CA-Rx) is committed to compliance with all federal and state laws that pertain to any aspect of the clinical practices or the business procedures of this pharmacy. In particular, privacy and security rules relating to the Health Insurance Portability and Accountability Act (HIPPA), along with the related state laws, are integral to matters of privacy, pharmacy records, confidentiality of communications and other topics addressed in this notice.
The HIPPA Privacy Rule applies to all protected health information (PHI) in this pharmacy, including information stored and transmitted electronically, paper records and oral communications. PHI includes any information as it relates to the past, present or future physical or mental health condition of any of our customers; any prescriptions they have received; and payment information.
This notice describes how medical information about patients may be used and disclosed, and how patients can access this information. Please read it carefully. These procedures are in complete compliance with HIPPA. We are required by federal law to maintain the privacy of health information that identifies you or that could be used to identify you (PHI). We also are required to provide you with this Notice upon request, which explains our legal duties and privacy practices with respect to PHI that we collect and maintain. This Notice describes your rights under federal law and state law, where applicable, relating to your PHI. CA-Rx is required by federal law to abide by this notice. However, we reserve the right to change the privacy practices outlined in this Notice and make the new practices effective for all PHI that we maintain. Should we make such a change, we will display the revised Notice at our pharmacy and make it available to you upon request.
Uses and Disclosures of Protected Health Information
Uses and Disclosures of PHI is based upon written consent. Once you consent to use and disclosure of your PHI for treatment, payment and healthcare operations by signing the consent form, your pharmacist will use or disclose your PHI as described in this Notice. Your PHI may be used and disclosed by your pharmacist, our pharmacy staff and others outside of our pharmacy that are involved in your care and treatment for the purpose of providing health care services to you.
Following are examples of the types of uses and disclosures of your PHI that the pharmacy is permitted to make once you have signed our consent form. These examples are not meant to be exhaustive, but to describe the types of uses and disclosures that may be made by our pharmacy once you have provided consent.
Treatment: We will use and disclose your PHI to provide, coordinate, or manage your health care and any related services. For example, we may disclose PHI to physicians who may be treating you when we have to obtain a new or refill prescription. Your PHI may also be provided to a physician to whom you have been referred to ensure that the physician has the necessary information to diagnose or treat you. In addition, we may disclose your PHI from time-to-time to another pharmacy or health care provider (e.g., a specialist or laboratory) who, at the request of your physician, becomes involved in your care by providing assistance with your health care diagnosis or treatment to your physician.
Payment: Your PHI will be used, as needed, to obtain payment for your health care services. This may include certain activities that your health insurance plan may undertake before it approves or pays for health care services, such as, making a determination of eligibility or coverage for insurance benefits, reviewing services provided to you for medical necessity, and undertaking utilization review activities. For example, obtaining approval for a prescription may require that your relevant PHI be disclosed to the health plan to obtain approval for the prescription.
Healthcare Operations: We may use or disclose, as-needed, your PHI in order to support the business activities of CA-Rx. These activities include, but are not limited to, quality assessment activities, employee review activities, training activities, licensing, marketing, and conducting or arranging for other business activities. For example, we may ask your name and your physician’s name when you deliver a prescription to be filled. We may also call you by name when your prescription is ready, and if necessary ask other information such as, but not limited to, address, date of birth or phone number, to make certain that you have the correct prescription. We may use or disclose your PHI as necessary, to contact you to remind you it is time to refill a prescription or that it is time for a follow up appointment. We may also contact you to remind you of any prescription that has not been picked up, any medication that is owed to you, any special order, to respond to a request made by you, or for any other reason that we feel necessary to provide you with continued quality care. If we are unable to speak with you directly, we may leave a message for you either on your answering machine or with a member of your family, a relative, a close friend or any other person you identify. Communications or disclosures of your PHI may be in the form of verbal communications or electronic data transmissions (internet, facsimile, or e-mail). All legal measures will be taken to ensure and protect the security of your PHI. We will share your PHI with third party “business associates” that perform various activities (e.g., billing services) for the pharmacy. Whenever an arrangement between our pharmacy and a business associate involves the use or disclosure of your PHI, we will have a written contract that contains terms that will protect the privacy of your PHI. We may use or disclose your PHI, as necessary, to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you. We may also use and disclose your PHI for other marketing activities. For example, your name and address may be used to send you a newsletter about our pharmacy and the services we offer. We may also send you information about products or services that we believe may be beneficial to you. You may contact our Privacy Officer to request that these materials not be sent to you. Uses and disclosures of protected health information based upon your written authorization other uses and disclosures of your PHI will be made only with your written authorization, unless otherwise permitted or required by law as described below. You may revoke this authorization at any time in writing, except to the extent that your pharmacist or the pharmacy has taken an action in reliance on the use or disclosure indicated in the authorization. Other permitted and required uses and disclosures that may be made with your consent, authorization or opportunity to object. We may use and disclose your PHI in the following instances. You have the opportunity to agree or object to the use or disclosure of all or part of your PHI. If you are not present or able to agree or object to the use or disclosure of the PHI, then your pharmacist may, using professional judgment, determine whether the disclosure is in your best interest. In this case, only the PHI that is relevant to your health care will be disclosed.
Others Involved In Your Healthcare: If the “Authorization to Release Health Information” form is completed, we may disclose to a member of your family, a relative, a close friend, or any other person you identify, your PHI that directly relates to that person’s involvement in your health care. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary, if we determine that it is in your best interest based on our professional judgment. We may use or disclose your PHI to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care. To identify which person(s) you would grant access to your PHI, please request from the pharmacy, a copy of our “Authorization to Release Health Information” form, then complete and return the form to the pharmacy.
Emergencies: We may use or disclose your PHI in an emergency treatment situation. If this happens, your pharmacist shall try to obtain your consent as soon as possible after the delivery of treatment. If your pharmacist is required by law to treat you and has attempted to obtain your consent but is unable to obtain your consent, he or she may still use or disclose your PHI to treat you. This decision is at the discretion of that pharmacist providing care using the utmost professional judgement.
Communication Barriers: We may use or disclose your PHI if your pharmacist attempts to obtain consent from you but is unable to do so due to substantial communication barriers and the pharmacist determines, using professional judgment, that you intend to consent to use or disclosure under the circumstances. Other permitted and required uses and disclosures that may be made without your consent, authorization, or opportunity to object, we may use or disclose your PHI in the following situations without your consent or authorization. These situations include:
Required By Law: We may use or disclose your PHI to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, as required by law, of any such uses or disclosures. Public Health: We may disclose your PHI for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury, or disability. We may also disclose your PHI, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority.
Health Oversight: We may disclose PHI to a health oversight agency for activities authorized by law, such as audit, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.
Abuse or Neglect: We may disclose your PHI to a public health authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your PHI if we believe that you have been a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.
Food and Drug Administration: We may disclose your PHI to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, and track products; to enable product recalls; to make repairs or replacements; or to conduct post marketing surveillance, as required.
Legal Proceedings: We may disclose PHI in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), in certain conditions in response to a subpoena, discovery request or other lawful process.
Law Enforcement: We may also disclose PHI, so long as applicable legal requirements are met, for law enforcement purposes. These law enforcement purposes include (1) legal processes and otherwise required by law, (2) limited information requests for identification and location purposes, (3) pertaining to victims of a crime, (4) suspicion that death has occurred as a result of criminal conduct, (5) in the event that a crime occurs on the premises of the pharmacy and (6) medical emergency (not on the pharmacy’s premises) and it is likely that a crime has occurred.
Criminal Activity: Consistent with applicable federal and state laws, we may disclose your PHI, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.
Military Activity and National Security: When the appropriate conditions apply, we may use or disclose PHI of individuals who are Armed Forces personnel (1) for activities deemed necessary by appropriate military command authorities; (2) for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits, or (3) to foreign military authority if you are a member of that foreign military service. We may also disclose your PHI to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or others legally authorized.
Workers Compensation: Your PHI may be disclosed by us as authorized to comply with workers compensation laws and other similar legally established programs.
Inmates: We may use or disclose your PHI if you are an inmate of a correctional facility and your pharmacy created or received your protected health information in the course of providing care to you.
Required Uses and Disclosures: Under the law, we must make disclosures to you and when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of Section 164.500 et. seq.
California law puts more limits on how we can disclose your medical information than federal law does. In the situations described below, we may disclose your medical information as follows:
(a) We may disclose your information to health care providers, health care service plans, contractors or other health care professionals or facilities so they can diagnose or treat you. In an emergency situation, we may communicate your information by radio transmission or other means to licensed emergency medical personnel at the scene of an emergency, in an emergency medical transport vehicle, or at a health facility;
(b) We will disclose your information a person or entity responsible for paying for your health care services (for example an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor or any other person or entity responsible for paying) to the extent needed for them to determine if they are responsible for paying for the your care. If you are comatose or have another disabling medical condition that makes you unable to consent to our disclosure of medical information and no other arrangements have been made to pay for your health care, we may also disclose your information to a governmental authority to the extent necessary to determine your eligibility for, and to obtain, payment under a governmental program for health care services provided to you. We may also disclose your information to another health care provider or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services they render to you;
(c) We may disclose your information to any person or entity that provides billing, claims management, medical data processing, or other administrative services for health care providers or health care service plans or for any of the persons or entities specified above in paragraph (b). However, without your authorization, the information disclosed to them may not be further disclosed in any way that would violate California laws governing the use and disclosure of medical information;
(d) We may disclose your information to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers, utilization and quality control peer review organizations, contractors or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges;
(e) If we provide care to you at your employer’s specific prior written request, we may disclose the medical information we create as a result of that employment-related health care service to if the information: (i) is relevant in a law suit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which you has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding; (ii) describes functional limitations of you that may entitle you to leave from work for medical reasons or limit your fitness to perform your present employment, provided that no statement of medical cause is included in the information disclosed;
(f) Unless we are otherwise notified in writing of an agreement by a sponsor, insurer, or administrator, we may disclose information we created as the result of providing you services the specifically requested in writing (and paid for by) the sponsor, insurer, or administrator to that sponsor, insurer, plan administrator, or policy administrator that you seek coverage by or benefits from, for the purpose of evaluating your application for coverage or benefits;
(g) We may disclose your information to a health care service plan that we contract with and that information may be transferred to other health care providers that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except as allowed by law;
(h) We may disclose your information to insurance institutions, agents, or support organizations that comply with all requirements for obtaining the information pursuant to the requirements of the California Insurance Code provisions;
(i) We may disclose your information to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent for the purpose of aiding the transplant;
(j) We may disclose basic information about you, including your name, city of residence, age, sex, and general condition, to a state or federally recognized disaster relief organization for the purpose of responding to disaster welfare inquiries;
(k) We may disclose your information to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information may be further disclosed by the recipient in any way that would be unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information;
(l) We may disclose your information for purposes of disease management programs and services to any entity contracting with a health care service plan or the health care service plan's contractors to monitor or administer care of enrollees for a covered benefit, provided that the disease management services and care are authorized by a treating physician or to any disease management organization that complies fully with the physician authorization requirements, provided that the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan's or contractor's network of physicians;
(m) If you are a minor, we may disclose your information to a county social worker, a probation officer, or any other person who is legally authorized to have custody of or care of you so they can coordinate health care services and medical treatment provided to you;
(n) We may disclose your information to an employee welfare benefit plan, to the extent that the employee welfare benefit plan provides you medical care, and your information may also be disclosed to an entity contracting with the employee welfare benefit plan for billing, claims management, medical data processing, or other administrative services related to the provision of medical care to persons enrolled in the employee welfare benefit plan for health care coverage; and
(o) We may disclose your information to the appropriate authorities if there is suspected elder abuse.
When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you.
Get a copy of your health and claim records: You can ask to see or get a copy of your health and claims records and other health information we have about you. Ask us how to do this. We will provide a copy or a summary of your health and claims records, usually within 30 days of your request. We may charge a reasonable, cost-based fee.
Ask us to correct health and claims records: You can ask us to correct your health and claims records if you think they are incorrect or incomplete. Ask us how to do this. We may say “no” to your request, but we’ll tell you why in writing within 60 days.
Request confidential communications: You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. We will consider all reasonable requests, and must say “yes” if you tell us you would be in danger if we do not.
Ask us to limit what we use or share: You can ask us not to use or share certain health information for treatment, payment or our operations. We are not required to agree to your request, and we may say “no” if it would affect your care.
Get a list of those with whom we’ve shared information: You can ask for a list of the times we’ve shared your health information for number of years prior to the date you ask, who we shared it with, and why. We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked to make).
Get a copy of this privacy notice: You can ask for a paper copy of this notice at any time, even if you have agreed to receive the notice electronically. We will provide with a paper copy promptly.
Choose someone to act for you: If you have given someone that medical power or attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.
File a complaint if you feel your rights are violated: You can complain if you we have violated your rights by contacting us using the information on page 1. You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hippa/complaints/. We will not retaliate against you for filing a complaint.
For certain health information, you can tell us your choices about what we share. If you have a clean preference for how we share your information in the situations described below, talk to us. Tell us what you want us to do, and we will follow your instructions.
In these cases, you have both the right and choice to tell us to: Share information with your family, close friends, or others involved in payment for care. Share information in a disaster relief situation Contact you for fundraising efforts. If you are not able to tell us your preference, for example if you are unconscious, we may go ahead and share your information if we believe it is in your best interest. We may also share information when needed to lessen a serious and imminent threat to health or safety.
In these cases we never share your information unless you give us written permission: Marketing purposes. Sale of your information.
We are required by law to maintain the privacy and security of your protected health information. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information. We must follow the duties and privacy practices described in this notice and give you a copy of it. We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.
Changes to the Terms of This Notice: We can change the terms of this notice, and the changes will apply to all information we have about you. The new notice will be available upon request, on our web site, and we will mail a copy to you. Effective Date: October 2016