.HIPAA Notice of Privacy Practices

NOTICE OF PRIVACY PRACTICES | STATE LAW ADDENDUM

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

PLEASE REVIEW IT CAREFULLY.

Albertson’s LLC, New Albertson’s, Inc., Safeway Inc., and each of their subsidiary entities, including your pharmacy, (collectively known and hereinafter referred to as “Albertsons Companies”) are “affiliated entities” for purposes of HIPAA compliance and administration. We are committed to protecting your privacy and understand the importance of safeguarding your personal health information. We are required by federal law to maintain the privacy of health information that identifies you or that could be used to identify you (known as “Protected Health Information” or “PHI”). We also are required to provide you with this Notice, which explains our legal duties and privacy practices with respect to PHI that we collect and maintain. This Notice describes your rights under federal law and state law, where applicable, relating to your PHI. Albertsons Companies is required by federal law to abide by this Notice. However, we reserve the right to change the privacy practices outlined in this Notice and make the new practices effective for all PHI that we maintain. Should we make such a change, we will display the revised Notice at our pharmacies and make it available to you upon request.
I. USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION
A. Routine Uses and Disclosures of Protected Health Information for Treatment, Payment, or Health Care Operations.
Albertsons Companies is permitted under federal law to use and disclose PHI without your specific permission for three types of routine purposes: treatment, payment, and health care operations.
Your pharmacist will use or disclose your PHI as described below. Your PHI may be used and disclosed by your pharmacist, pharmacy staff, and others outside of the pharmacy involved in your care and treatment. Set out below are examples of the uses and disclosures of your PHI we are permitted to make for these routine purposes. While this list is not meant to be exhaustive, it should give you an idea of the everyday uses and disclosures “behind the scenes” that are essential to the care you receive.

1. Treatment. Your PHI can be used and disclosed by Albertsons Companies for treatment purposes. For example, your PHI will be used by our pharmacists to fill your prescription and to counsel you about the appropriate use of your medication. We also may use and disclose your PHI to provide you with information about our health-related products and services. We may also send you compliance communications, such as reminders to refill or renew your prescription, information about generic alternatives for your prescription, or information about ways to enhance or improve your treatment outcomes.

2. Payment. Your PHI can be used and disclosed for payment purposes. For example, we may communicate your PHI to your insurance company so that it can process payment for your prescription.

3. Health Care Operations. Your PHI can be used and disclosed to allow us to conduct health care operations, which generally are the administrative activities that we undertake in order to operate our pharmacies. For example, we may use your PHI to evaluate the performance of our pharmacists and to engage in other quality assurance activities.
B. Other Uses and Disclosures of Protected Health Information Albertsons Companies is Permitted or Required to Make Without Your Authorization.
In general, we are required to obtain your specific written authorization to use or disclose your PHI for purposes unrelated to treatment, payment, or health care operations. However, there are exceptions to this general rule under which we are permitted or required to make certain uses and disclosures of your PHI without your authorization. These situations include:

1. Required by the Secretary of Health and Human Services. We may be required to disclose your PHI to the Secretary of Health and Human Services to investigate or determine our compliance with the federal privacy law.

2. Required by Law. We may use or disclose your PHI to the extent that the use or disclosure is otherwise required by state or federal law.

3. Public Health. We may disclose your PHI for public health activities, such as disclosures to a public health authority or other government agency that is permitted by law to collect or receive the information (e.g., the Food and Drug Administration).

4. Abuse or Neglect. If you have been a victim of abuse, neglect, or domestic violence, we may disclose your PHI to the government agency authorized to receive such information.

5. Health Oversight. We may disclose PHI to a health oversight agency for activities authorized by law, such as: civil or criminal investigations; inspections; licensure or disciplinary actions; or other activities necessary for appropriate oversight of retail pharmacies, governmental health benefit programs, or compliance with laws.

6. Judicial and Administrative Proceedings. We may disclose PHI in response to a court or agency order, and in some cases, in response to a subpoena or other lawful process not accompanied by a court order.

7. Law Enforcement. We may disclose PHI for law enforcement purposes, such as providing information to the police about the victim of a crime.

8. Coroners, Medical Examiners, and Funeral Directors. We may disclose PHI to a coroner, medical examiner, or funeral director if it is needed to carry out their duties.

9. Research. We may disclose your PHI to researchers when the research is being conducted under established protocols to ensure the privacy of your information.

10. Serious Threat to Health or Safety. Your PHI may be disclosed if we believe it is necessary to prevent a serious and imminent threat to the public health or safety and it is to someone we reasonably believe is able to prevent or lessen the threat.

11. Specialized Government Functions. We may disclose PHI for purposes related to military or national security concerns, such as for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits.

12. Domestic Armed Forces Personnel. We may use and disclose your PHI for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission, if the authority has published proper notice in the Federal Register stating the purposes for which such information may be used or disclosed.

13. Inmates. Under certain circumstances, we may disclose the PHI of inmates of a correctional institution.

14. Workers’ Compensation. Your PHI may be disclosed to comply with workers’ compensation laws and other similar programs.
C. Other Restrictions on Uses and Disclosures of Protected Health Information.
The uses and disclosures of your PHI described above are permitted or required by federal law. Some states have laws that require additional privacy safeguards above and beyond the federal requirements. Thus, if a state law is more restrictive regarding uses and disclosures of your PHI or provides you with greater rights with respect to your PHI, Albertsons Companies will comply with the state law. If your state has enacted a more stringent law, we have attached as an addendum to this Notice our privacy practices regarding your PHI in that state.
D. Notice to Minors:
If you are a minor who has lawfully provided consent for treatment and you wish that we treat you as an adult for purposes of access to, and disclosure of, records related to such treatment, please notify a pharmacist or our Privacy Office.
E. Disclosures to Business Associates for Conducting Permitted Activities.
Albertsons Companies may conduct the above-described activities ourselves, or we may use non-Albertsons Companies Business Associates to perform those operations. In those instances where we disclose your PHI to a third party acting on our behalf, we will protect your PHI through an appropriate privacy agreement, referred to as a Business Associate Agreement. In addition to these contractual obligations, as of February 17, 2010, Business Associates have independent HIPAA compliance obligations.
F. Other Uses and Disclosures of Protected Health Information Based Upon Your Written Authorization.
Other uses and disclosures of your PHI, not described above, will be made only with your written authorization. We are specifically prohibited from selling your PHI without your authorization. You may revoke this authorization at any time, in writing, except to the extent that we have taken action in reliance on the authorization.
II. YOUR RIGHTS
As a patient, you have certain rights regarding your PHI. We require that you submit a written request to exercise a patient right, addressed to our HIPAA Privacy Office and delivered during regular business hours sufficiently in advance to allow us to administer your request as required. These rights include:
A. You have the right to request a restriction on certain uses and disclosures of your Protected Health Information.
This means that you may ask us not to use or disclose any part of your PHI for purposes of treatment, payment, or health care operations. You may request that we not disclose PHI to your health plan if the disclosure is for purposes of payment or health care operations and is not otherwise required by law. Albertsons Companies is obligated to honor this request when you have both submitted the request as required herein and you, or someone other than your health plan, have paid in full for the product or service.
You may also request that any part of your PHI not be disclosed to family members or friends who may be involved in your care. Your request must state the specific restriction requested and state to whom you want the restriction to apply.
Albertsons Companies is not required to agree to such a restriction. If we do agree, we will abide by your restriction unless we need to use your PHI to provide emergency treatment. In addition, we may elect to terminate the restriction at any time.
B. You have the right to request to receive information from us by an alternative means or at an alternative location if you believe it would enhance your privacy.
For example, you may request that we send written communications to an alternative address. We will attempt to accommodate all reasonable requests and will not request an explanation from you as to the basis for your request.
C. You have the right to inspect and copy your Protected Health Information.
If you would like to see or obtain copies of your PHI that we maintain in a designated record set, we are required to provide you access to your PHI for inspection and copying within 30 days after receipt of your request (60 days if the information is stored off-site). Alternatively, you have the right to request an electronic copy of your PHI, and we are required to provide it to you in a readable electronic form and format. We may charge you a reasonable, cost-based fee to cover duplicating and mailing costs or the costs of preparation and transmission of PHI in electronic form. In addition, there may be situations where we may decide to deny your request for access. For example, we may deny your request if we believe the disclosure will endanger your life or health or that of another person. Depending on the circumstances of the denial, you may have a right to have this decision reviewed.
D. You have the right to amend your Protected Health Information.
This means you may request an amendment of your PHI in our records for as long as we maintain this information. We will respond to your request within 60 days (with up to a 30-day extension, if needed). We may deny your request if, for example, we determine that your PHI is accurate and complete. If we deny your request, we will send you a written explanation and allow you to submit a written statement of disagreement.
E. You have the right to receive an accounting of certain disclosures we have made of your Protected Health Information.
An accounting is a record of the disclosures that have been made of PHI. This right generally applies to non-routine disclosures, i.e., for purposes other than treatment, payment, or health care operations, as described in this Notice, made in the six-year period prior to your request (although you are free to request an accounting for a shorter period). We are required to provide the accounting within 60 days (with one 30-day extension, if needed) and to provide one accounting free of charge in any 12-month period. (For more frequent requests, a reasonable fee may be charged.)
F. You have a right to receive notification in the event of a breach that involves your PHI.
We may use your PHI to provide the required notifications in the event of a breach.
G. You have the right to obtain a paper copy of this notice from Albertsons Companies.
You may request a copy from your pharmacy or from our HIPAA Privacy Office.
III. COMPLAINTS

If you believe your privacy rights have been violated, you have the right to report such alleged violations to Albertsons Companies, and we will promptly investigate the matter. You may file a complaint with Albertsons Companies by contacting our HIPAA Privacy Office. Rest assured, we will not retaliate against you in any way for filing a complaint about our privacy practices. You may also contact the Secretary of Health and Human Services.

You may contact our HIPAA Privacy Office at (877) 251-6559 (toll free), at HIPAAHotline@Albertsons.com, or at P.O. Box 20, Boise, Idaho 83726 for further information about the complaint process or any other information covered by this Notice.

This notice is effective as of June 2, 2016.
Back
ALBERTSONS COMPANIES

NOTICE OF PRIVACY PRACTICES

STATE LAW ADDENDUM

THIS ADDENDUM DESCRIBES STATE LAWS THAT ARE MORE RESTRICTIVE THAN FEDERAL LAW REGARDING DISCLOSURES OF YOUR MEDICAL INFORMATION IN STATES WHERE WE OPERATE PHARMACIES. PLEASE REVIEW IT CAREFULLY.
ALABAMA
Disclosure

We will not disclose your professional records to anyone without your authorization, except where it is in your best interest or where the law requires the disclosure.

Medicaid

We will disclose information pertaining to your treatment (including billing statements and itemized bills) only to:

(a) the Medicaid Fiscal Agent;
(b) the Social Security Administration;
(c) the Alabama Vocational Rehabilitation Agency;
(d) the Alabama Medicaid Agency;
(e) insurance companies requesting information about a Medicaid claim filed by the provider, an insurance application, payment of life insurance benefits, or payment of a loan; or (f) other providers who need the information for treatment of a patient.
ARIZONA

We will not disclose any confidential communicable disease related information about an individual, except in situations where the subject of the information has provided us with a written authorization allowing the release or where we are authorized or required by state or federal law to make the disclosure.
CALIFORNIA

California law limits disclosure of your medical information in ways that would otherwise be permitted under federal law. In the situations described below, the pharmacy will disclose your medical information as follows:

(a) the information may be disclosed to providers of health care, health care service plans, contractors or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission or other means between licensed emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and licensed emergency medical personnel at a health facility;
(b) the information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor or any other person or entity responsible for paying for health care services rendered to the patient to the extent necessary to allow responsibility for payment to be determined and payment to be made. If the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure or medical information and no other arrangements have been made to pay for the health care services being rendered to the patient, the information may also be disclosed to a governmental authority to the extent necessary to determine the patient’s eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient;
(c) the information may be disclosed to any person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified above in paragraph (b). However, no information so disclosed may be further disclosed by the recipient in any way that would be violative of California laws governing the use and disclosure of medical information without authorization from the patient;
(d) the information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers, utilization and quality control peer review organizations, contractor’s or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges;
(e) a provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee’s employer that:
(1) is relevant in a law suit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding;
(2) describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient’s fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed;
(f) unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits;
(g) the information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part;
(h) the information may be disclosed to an insurance institution, agent or support organization of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to the requirements of the California Insurance Code provisions.
(i) the information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent for the purpose of aiding the transplant;
(j) the information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information may be further disclosed by the recipient in any way that would be unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information;
(k) for purposes of disease management programs and services, information may be disclosed to any entity contracting with a health care service plan or the health care service plan’s contractors to monitor or administer care of enrollees for a covered benefit, provided that the disease management services and care are authorized by a treating physician or to any disease management organization that complies fully with the physician authorization requirements, provided that the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan’s or contractor’s network of physicians.
CONNECTICUT

Disclosure

We will not disclose information about pharmaceutical services rendered to you to third parties without your consent, except to the following persons:

(a) the prescribing practitioner or a pharmacist or another prescribing practitioner presently treating you when deemed medically appropriate;
(b) a nurse who is acting as an agent for a prescribing practitioner that is presently treating you or a nurse providing care to you in a hospital;
(c) third party payors who pay claims for pharmaceutical services rendered to you or who have a formal agreement or contract to audit any records or information in connection with such claims;
(d) any governmental agency with statutory authority to review or obtain such information;
(e) any individual, the state or federal government or any agency thereof or court pursuant to a subpoena; and
(f) any individual, corporation, partnership or other legal entity which has a written agreement with the pharmacy to access the pharmacy’s database provided the information accessed is limited to data which does not identify specific individuals.

HIV/AIDS

Except in limited circumstances permitted by law, and to the extent that we acquire the information, we will not disclose confidential HIV-related information about you, except in situations where you have provided us with a specific release of confidential HIV-related information. Confidential HIV-related information includes any information about you or obtained pursuant to a release of confidential HIV-related information, concerning whether you have been counseled regarding HIV infection, have been the subject of an HIV-related test, or have HIV infection, HIV-related illness or AIDS, or information which identifies or reasonably could identify you as having one or more of such conditions, including information pertaining to partners.

Sale of Information

We will not sell your individually identifiable medical record information.
FLORIDA

We will not disclose your Protected Health Information without your authorization except to the following:
• You or your legal representative;
• The Florida Department of Health;
• Your spouse in the event that you are incapacitated or unable to request your records; or
• Upon the issuance of a subpoena from a court of competent jurisdiction and proper notice to you by the party seeking such records.
GEORGA

Disclosure

Unless authorized by you, we will not disclose your confidential information to anyone other than you or your authorized representative, except to the following persons or entities:

(a) the prescriber, or other licensed health care practitioners caring for you;
(b) another licensed pharmacist for purposes of transferring a prescription or as part of a patient’s drug utilization review, or other patient counseling requirements;
(c) the Board of Pharmacy, or its representative; or
(d) any law enforcement personnel duly authorized to receive such information.

We may also disclose your confidential information without your consent pursuant to a subpoena issued and signed by an authorized government official or a court order issued and signed by a judge of an appropriate court.

HIV/AIDS

We will not disclose AIDS confidential information, except in situations where the subject of the information has provided us with a written authorization allowing the release or where we are authorized or required by state or federal law to make the disclosure.
IDAHO

We will not disclose your Protected Health Information without your authorization except upon request of the following:
• The Idaho Board of Pharmacy, or its representatives, acting in their official capacity;
• The practitioner, or the practitioner’s designee, who issued your prescription;
• Other licensed healthcare professionals who are responsible for your care;
• Agents of the Idaho Department of Health and Welfare when acting in their official capacity with reference to issues related to the practice of pharmacy, provided such request is in writing;
• Agents of any board whose practitioners have prescriptive authority, when the board is enforcing laws governing that practitioner;
• An agency of government charged with the responsibility for providing medical care for you, provided such request is in writing;
• The Food and Drug Administration, for purposes relating to monitoring of adverse drug events in compliance with the requirements of federal law, rules or regulations adopted by the Food and Drug Administration;
• The authorized insurance benefit provider or health plan that provides your health care coverage or pharmacy benefits; or
• The order of a court of competent jurisdiction.

INDIANA

Disclosures – Pharmacist Specific

We will not disclose your prescriptions, drug orders, records and patient information to any third party, except if:

(a) the health records are needed to provide health care services to you;
(b) it is in your best interests;
(c) the information is requested by the Board of Pharmacy or its representatives in connection with a proceeding before the Board;
(d) the information is requested by a law enforcement officer charged with the enforcement of laws pertaining to drugs or devices or the practice of pharmacy in connection with a criminal prosecution or proceeding involving you as a party; or
(e) when disclosure is essential to our legitimate business purposes.

Disclosures – Protected Health Information Generally

We may disclose the following protected health information to a law enforcement official who requests the protected health information for the purpose of identifying or locating you, should you become missing:

(1) contact information, including family, personal representative, and friends of the individual; and
(2) previous addresses of the individual and the individual’s family, personal representative, and friends.
KENTUCKY

Disclosure

We will not disclose your patient information or the nature of professional services rendered to you without your express consent or without a court order, except to the following authorized persons:

(a) members, inspectors, or agents of the Board of Pharmacy;
(b) you, your agent, or another pharmacist acting on your behalf;
(c) another person, upon your request;
(d) licensed health care personnel who are responsible for your care;
(e) certain state government agents charged with enforcing the controlled substances laws;
(f) federal, state, or municipal government officers who are investigating a specific person regarding drug charges; and
(g) a government agency that may be providing medical care to you, upon that agency’s written request for information.

Minimum Necessary

We will only use your information to provide pharmacy care.
MAINE

Disclosure

We will not disclose your health care information to coroners or funeral directors, without your authorization.
MASSACHUSETTS

For Medicaid recipients: We will restrict disclosure of your information to purposes directly connected with the administration of the Medicaid program.
MICHIGAN

We will not disclose your Protected Health Information without your authorization unless such disclosure is to the following:
• You or another pharmacist acting on your behalf;
• The authorized prescriber who issued the prescription, or a licensed healthcare professional who is currently treating you;
• An agency or agent of government responsible for the enforcement of laws relating to drugs and devices;
• A person engaged in research projects or studies with protocols approved by the Michigan Board of Pharmacy; or
• A person authorized by court order.

In addition, we will not disclose information pertaining to HIV or AIDS-related treatment or treatment for a serious communicable disease (as designed by the Michigan Department of Community Health), except upon the patient’s written authorization or where we are authorized by state law to make such disclosure.
MINNESOTA

Disclosure

We will not disclose your pharmacy records except:

(a) as specifically authorized in law;
(b) for a medical emergency when we are unable to obtain your consent due to the nature of the emergency or your medical condition;
(c) to other providers within related health care entities when necessary for your current treatment;
(d) to a health care facility licensed by the state or a similar facility licensed by another state when you are returning to the facility and unable to provide consent;
(e) to you, your agent, or another pharmacist acting on behalf of you or your agent;
(f) to the licensed practitioner who issued your prescription;
(g) to the licensed practitioner who is currently treating you;
(h) to a member, inspector, or investigator of the board or any federal, state, county, or municipal officer whose duty it is to enforce the laws of this state or the United States relating to drugs and who is engaged in a specific investigation involving a designated person or drug;
(i) to an agency of government charged with the responsibility of providing medical care for you;
(j) to any person duly authorized by a court order.

All other uses and disclosures of PHI require your specific consent.
MISSOURI

Disclosure

Unless specifically authorized by you, we will not release your prescription records, physician orders, or other records that the pharmacy maintains related to your care or your medical condition(s) to anyone other than:

(a) you or any other person authorized by you to receive the information;
(b) the authorized prescriber who issued the prescription order, a health care provider involved in treating you, or the health care provider’s agent, so long as they are legally qualified to administer your medications and treatments;
(c) in response to lawful requests from a court or grand jury;
(d) a person authorized by a court order;
(e) to transfer medical or prescription information between pharmacists as provided by law;
(f) government agencies acting within the scope of their statutory authority; or
(g) a person or entity to whom such information may be disclosed under HIPAA.
MISSOURI

Medicaid

We will restrict disclosure of your information to purposes directly related to your treatment, for promotion of improved quality of care, and to assist with an investigation, prosecution, or civil or criminal proceeding related to the administration of the Medicaid program.

HIV/AIDS We will not disclose any HIV/AIDS-related information, except in situations where the subject of the information has provided us with a written authorization allowing the release or where we are authorized or required by state or federal law to make the disclosure.
MONTANA

Children’s Health Insurance Program

We will restrict disclosure of your information to purposes related to the administration of the CHIP program.

Medicaid

We will only use your information for purposes related to administration of the Montana Medicaid program. We will not disclose your information without your written consent, except to state authorities.

Sexually Transmitted Diseases

We will not disclose information concerning persons infected, or reasonably suspected to be infected with a sexually transmitted disease, including HIV, except to:

(a) personnel of the Department of Public Health and Human Services;
(b) a physician who has obtained the written consent of the person whose record is requested; or
(c) a local health officer.

NEVADA

Compliance with HIPAA exempts us from additional stricter requirements under Nevada law.

You may have a right to opt out of having your personal health information disclosed electronically to other covered entities, unless you are a recipient of Medicaid or Children’s Health Insurance Program benefits.
NEW HAMPSHIRE

We will only disclose your prescription information containing patient-identifiable and prescriber-identifiable data to seek reimbursement; determining formulary compliance, care management; performing utilization review (whether done by a health care provider, your insurance provider, or an agent of either); or as otherwise provided by law.

Unless prescription information is de-identified with respect both patient and provider information or you provide us express written authorization compliant with HIPAA, we may not disclose, use, transfer, or sell it for commercial purposes, including but not limited to: advertising; marketing; promotion; or any activity that could be used to influence sales or market share of a pharmaceutical product; influence or evaluate the prescribing behavior of an individual health care professional, or evaluate the effectiveness of a professional pharmaceutical detailing sales force.

(a) Overall, we will not disclose your prescription information unless:
(b) we have obtained your consent to do so;
(c) there is a need to protect your welfare or that of the public; or
(d) the law requires us to disclose the information.
NEW MEXICO

Unless we receive a written consent from you, we will not disclose your confidential information, including your pharmacy records, to anyone other than you or your authorized representative, except to the following persons or entities:

(a) pursuant to the order or direction of a court;
(b) to the prescriber or other licensed practitioner caring for you;
(c) to another licensed pharmacist where it is in your best interest to protect your health and well-being;
(d) to the Board of Pharmacy or its representative or to such other persons or governmental agencies duly authorized by law to receive such information;
(e) to transfer a prescription to another pharmacy as required by the provisions of patient counseling;
(f) to provide a copy of a non-refillable prescription to you marked “For Information Purposes Only”;
(g) to provide drug therapy information to physicians or other authorized prescribers for their patients; or
(h) as required by the provisions of the patient counseling regulations.

To the extent your health care information is stored electronically, we will not disclose such health care information without your consent except as allowed by state or federal law, or to a provider who needs information about you to treat a condition that poses an immediate threat to your life and requires immediate attention
NEW YORK

We will not access a common electronic file or database used to maintain required personally identifiable dispensing information except upon your request or the request of a person authorized to act on your behalf. Otherwise, our pharmacists will not reveal your personally identifiable facts, data, or information obtained in their professional capacity without your prior consent, unless it is authorized or required by law.
NORTH CAROLINA

We will not disclose the contents of or provide a copy of your prescription orders on file, except to:

(a) you (if you are an adult, an emancipated minor, or an unemancipated minor whose consent is sufficient to authorize treatment for the condition for which you received the prescription);
(b) your parent, legally appointed guardian or, if you are an unemancipated minor, a person acting in loco parentis if you cannot legally consent to the treatment of the condition for which the prescription was issued;
(c) the licensed practitioner who issued the prescription or who is treating you;
(d) a pharmacist who is providing pharmacy services relating to your prescription;
(e) anyone who presents a written authorization for the release of pharmacy information signed by you or your legal representative;
(f) any person authorized by subpoena, court order or statute;
(g) any firm, company, association, partnership, business trust, or corporation who by law or by contract is responsible for providing or paying for your medical care;
(h) any member or designated employee of the Board of Pharmacy;
(i) the executor, administrator or spouse of a deceased patient for whom the prescription was issued;
(j) Board-approved researchers, if there are adequate safeguards to protect the confidential information;
(k) the person who owns the pharmacy or his licensed agent; and
(l) to investigators of occupational licensing boards overseeing licensees with prescribing authority during the course of an investigation of such licensee as permitted by state or federal law.

Otherwise, the pharmacist will only disclose information about you when he or she reasonably determines that the disclosure is necessary to protect the life or health of any person or, in his or her discretion, if the information relates to Schedule V controlled substances dispensed at the pharmacy to persons over 18 years of age without a prescription.
NORTH DAKOTA

Disclosures – Pharmacist Specific

We may not disclose the nature of pharmaceutical services rendered to you without your consent orally or in writing, unless such disclosure is by order or direction of a court or otherwise permitted by law. We may provide information copies of your prescriptions to you or other pharmacies and drug therapy information to your physician for your care.

Disclosures – Generally

We may disclose your protected health information to a public health authority without your authorization pursuant to a federal or state law designed to protect public health or safety, or if there is a specific nexus between your identity and a threat of a specific disease, death, or injury to any individual or to the public health and disclosing your identity would allow the public health authority to prevent or significantly reduce the possibility of disease, injury, or death to any individual or the public health. We will limit the content of such disclosures to the minimum necessary to achieve the aforementioned purposes.
OHIO

Unless we have obtained your written consent, we will only disclose the contents or copies of your pharmacy records to:

(a) you;
(b) the prescriber who issued the prescription or medication order;
(c) certified/licensed health care personnel who are responsible for your care;
(d) a member, inspector, agent, or investigator of the state board of pharmacy or any federal, state, county, or municipal officer whose duty is to enforce the laws of this state or the United States relating to drugs and who is engaged in a specific investigation involving a designated person or drug;
(e) an agent of the state medical board or nursing board when enforcing the statutes governing their licensees;
(f) an agency of government charged with the responsibility of providing medical care for you, upon a written request by an authorized representative of the agency requesting such information;
(g) an agent of a medical insurance company who provides prescription insurance coverage to you, upon authorization and proof of insurance by you or proof of payment by the insurance company for those medications whose information is requested;
(h) an agent who contracts with the pharmacy as a “business associate” in accordance with the regulations promulgated by the Secretary of the United States Department of Health and Human Services pursuant to the federal standards for privacy of individually identifiable health information; or
(i) to a member, inspector, agent, or investigator of the state board of pharmacy or any state, county, or municipal officer whose duty is to enforce the laws of this state or the United States relating to drugs and who is engaged in a specific investigation involving a designated person or drug upon his request, in exchange for a receipt.
(j) A pharmacist may also disclose your prescription information in emergency situations if, using his or her professional judgment, he or she determines that it is in your best interest.
OKLAHOMA

We will not divulge the nature of your problems or ailments or any confidence you have entrusted to the pharmacist in his professional capacity, except in response to legal requirements or where it is in your best interest.

Whenever possible, we will de-identify such information prior to disclosure.
PENNSYLVANIA

We will not disclose any HIV-related information to anyone but you, except in situations where the subject of the information has provided us with a written consent to disclose the information or where we are authorized or required by state or federal law to make the disclosure

When a parent or legal guardian has consented to treatment of a minor fourteen (14) years of age or older, the parent or legal guardian may consent to release of the minor’s medical records and information to the minor’s current mental health treatment provider. Under some circumstances and to the extent that we maintain such information, we may also release information related to mental health treatment for which a minor has provided consent, if it is deemed pertinent and requested or authorized for disclosure by the minor’s current mental health provider. Otherwise, the minor shall control the release of the minor’s mental health treatment records and information to the extent allowed by law
RHODE ISLAND

Disclosure – Pharmacist-Specific We will only disclose your prescription information to our agents, agents of other properly licensed pharmacies, and persons directly involved in your care, to the extent such disclosure is consistent with state and federal laws, and to researchers to the extent consistent with federal policy for the protection of human subjects.

Disclosure – Health Care Providers Generally

We will not disclose your confidential health care information without your written consent, except in the following situations:

(a) to a physician, dentist, or other medical personnel who believe in good faith that the information is necessary to diagnose or treat you in a medical or dental emergency;
(b) to qualified personnel for the purpose of conducting scientific research, management audits, financial audits, program evaluations, actuarial, insurance underwriting, or similar studies, provided that personnel does not identify, directly or indirectly, you in any report of that research, audit, or evaluation, or otherwise disclose your identity in any manner;
(c) to appropriate law enforcement personnel, or to a person if the pharmacist believes that you may pose a danger to that person or his or her family; or to appropriate law enforcement personnel if you have attempted or are attempting to obtain narcotic drugs from the pharmacy illegally; or to appropriate law enforcement personnel or appropriate child protective agencies if you are a minor child who the pharmacist believes, after providing services to you, to have been physically or psychologically abused;
(d) between or among qualified personnel and health care providers within the health care system for purposes of coordination of health care services given to you and for purposes of education and training within the same health care facility;
(e) to third party health insurers, third party administrators and other entities that provide operational support to such entities for the purpose of adjudicating health insurance claims or administering health benefits, including to utilization review agents;
(f) to a malpractice insurance carrier or lawyer if we have reason to anticipate a medical liability action or if you initiate a medical liability action against our pharmacy;
(g) to public health authorities in order to carry out their designated functions. These functions include, but are not restricted to, investigations into the causes of disease, the control of public health hazards, enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of health professionals and facilities, and review of health care such as that required by the federal government and other governmental agencies;
(h) to the state medical examiner in the event of a fatality that comes under his or her jurisdiction;
(i) in relation to information that is directly related to a current claim for workers’ compensation benefits or to any proceeding before the workers’ compensation commission or before any court proceeding relating to workers’ compensation;
(j) to our attorneys whenever we consider the release of information to be necessary in order to receive adequate legal representation;
(k) to provide appropriate school authorities with disease, health screening and/or immunization information required by the school; or when a school age child transfers from one school or school district to another school or school district;
(l) to a law enforcement authority to protect the legal interest of an insurance institution, agent, or insurance-support organization in preventing and prosecuting the perpetration of fraud upon them;
(m) to a grand jury or to a court of competent jurisdiction pursuant to a subpoena or subpoena duces tecum when that information is required for the investigation or prosecution of criminal wrongdoing by a health care provider relating to his or her or its provisions of health care services and that information is unavailable from any other source; provided, that any information so obtained is not admissible in any criminal proceeding against you;
(n) to the state board of elections pursuant to a subpoena or subpoena duces tecum when the information is required to determine your eligibility to vote by mail ballot and/or the legitimacy of a certification by a physician attesting to a voter’s illness or disability;
(o) to certify the nature and permanency of your illness or disability, the date when you were last examined and that it would be an undue hardship for you to vote at the polls so that you may obtain a mail ballot;
(p) to the Medicaid fraud control unit of the attorney general’s office for the investigation or prosecution of criminal or civil wrongdoing by a health care provider relating to his or her or its provision of health care services to then Medicaid eligible recipients or patients, residents, or former patients or residents of long term residential care facilities; provided, that any information obtained is not admissible in any criminal proceeding against you;
(q) to the state department of children, youth, and families pertaining to the disclosure of health care records of children in the custody of the department;
(r) to the foster parent or parents pertaining to the disclosure of health care records of children in the custody of the foster parent or parents; provided, that the foster parent or parents receive appropriate training and have ongoing availability of supervisory assistance in the use of sensitive information that may be the source of distress to these children; or
(s) to the workers’ compensation fraud prevention unit for purposes of investigation.

Except as specifically provided above or by federal law, we will not give, sell, transfer, or relay your confidential health care information to any other person not specified in a written consent form or notice that meets state law requirements without obtaining your additional written consent on a form stating the need for the proposed new use of this information or the need for its transfer to another person.
SOUTH CAROLINA

Disclosure-Prescription Information Privacy Act

We will not disclose your prescription drug information without first obtaining your written consent, except in the following circumstances:

(a) the lawful transmission of a prescription drug order in accordance with state and federal laws pertaining to the practice of pharmacy;
(b) communications among licensed practitioners, pharmacists and other health care professionals who are providing or have provided services to you;
(c) information gained as a result of a person requesting informational material from a prescription drug or device manufacturer or vendor;
(d) information necessary to effect the recall of a defective drug or device or protect the health and welfare of an individual or the public;
(e) information whereby the release is mandated by other state or federal laws, court order, or subpoena or regulations (e.g., accreditation or licensure requirements);
(f) information necessary to adjudicate or process payment claims for health care, if the recipient makes no further use or disclosure of the information;
(g) information voluntarily disclosed by you to entities outside of the provider-patient relationship;
(h) information used in clinical research monitored by an institutional review board, with your written authorization;
(i) information which does not identify you by name, or that is encoded so that identifying you by name or address is generally not possible, and that is used for epidemiological studies, research, statistical analysis, medical outcomes, or pharmacoeconomic research;
(j) information transferred in connection with the sale of a business to a successor in interest;
(k) information necessary to disclose to third parties in order to perform quality assurance programs, medical records review, internal audits or similar programs, if the third party makes no other use or disclosure of the information;
(l) information that may be revealed to a party who obtains a dispensed prescription on your behalf; or
(m) information necessary in order for a health plan licensed by the South Carolina Department of Insurance to perform case management, utilization management, and disease management for individuals enrolled in the health plan, if the third party makes no other use or disclosure of the information.

Disclosure – Pharmacist-Specific

We will not disclose information maintained in your patient records or information communicated to you as part of patient counseling, to anyone other than you, to those practitioners and pharmacists where, in the pharmacist’s professional judgment, release is necessary to protect the your health and well-being, and to other persons or governmental agencies authorized by law to receive such confidential information. Additionally, we will not disclose your information or the nature of professional pharmacy services rendered to you, without your express consent or the order or direction of a court, except to:

(n) you, or your agent, or another pharmacist acting on your behalf;
(o) the practitioner who issued the prescription drug order;
(p) certified/licensed health care personnel who are responsible for your care;
(q) an inspector, agent or investigator from the Board of Pharmacy or any federal, state, county, or municipal officer whose duty is to enforce the laws of South Carolina or the United States relating to drugs or devices and who is engaged in a specific investigation involving a designated person or drug; and
(r) a government agency charged with the responsibility of providing medical care for you upon written request by an authorized representative of the agency requesting the information.
SOUTH DAKOTA

Without your express written consent or a written order or direction of a court, we will not divulge or reveal the following information to anyone but you, your authorized representative, the prescriber of your drug, another licensed practitioner caring for you, or another licensed pharmacist or other person authorized by law to receive such information:

(1) the contents of any prescription drug order or medication, the therapeutic effect thereof, or the nature of professional pharmaceutical services rendered to you;
(2) the nature, extent, or degree of your illness; or
(3) any medical information furnished by your prescriber.

We will only release your patient information under the following circumstances:

(1) with your authorization;
(2) if the board of pharmacy requests it as part of an inspection or investigation of a pharmacy or pharmacist;
(3) if, in the pharmacist’s professional judgment, releasing your patient information to practitioners and other pharmacists is necessary to protect the your health and well-being; and
(4) if other persons are authorized or required by law to obtain access to patient information.

For Participants in State Medical Assistance Programs: We will only use your Protected Health Information for purposes directly related to the administration of the South Dakota medical assistance program. We will not disclose your Protected Health Information without your authorization.
TENNESSEE

Disclosure – Health Care Provider

We will not disclose your name and address or other identifying information, except to:

(a) a health or government authority pursuant to any reporting required by law;
(b) an interested third-party payor or its designee for the purpose of utilization review, case management, peer reviews, or other administrative functions; or
(c) another health care provider from whom you receive or seek care; or
(d) in response to a request by the office of inspector general or the medicaid control fraud unit with respect to an ongoing investigation or to a subpoena issued by a court of competent jurisdiction.

Disclosure – Pharmacist-Specific

We will obtain your authorization before we disclose your patient records for any reason, except where:

(e) the disclosure is in your best interest;
(f) the law requires the disclosure; or
(g) the disclosure is to an authorized prescriber or to communicate a prescription order where necessary to:
(1) carry out prospective drug use review as required by law;
(2) assist prescribers in obtaining a comprehensive drug history on you;
(3) prevent abuse or misuse of a drug or device and the diversion of controlled substances;
(4) provide a medication therapy management program or quality assurance program.

Sale of Information

We will not sell your name and address or other identifying information for any purpose.
TEXAS

Disclosures – Generally We will not electronically disclose your protected health information to any person without a separate written or electronic authorization from you or your legally authorized representative for each disclosure, except when we make disclosures to:

(a) another covered entity, as that term is defined under Texas state law, for the purpose of treatment, payment, healthcare operations;
(b) to perform an insurance or health maintenance organization function as defined in the Texas insurance laws;
(c) or as otherwise authorized or required by federal or state law.

Disclosures – Pharmacist Specific

We will only release your patient medication records, prescription drug orders, medication orders or other health-related records containing your information that is maintained by us to the following individuals and entities:

(a) you or to your agent;
(b) a practitioner or another pharmacist if, in the pharmacist’s professional judgment, the release is necessary to protect your health and well-being;
(c) the Texas State Board of Pharmacy or another state or federal agency authorized by law to receive the record;
(d) a law enforcement agency engaged in investigation of a suspected violation of the Texas controlled substances laws, or the Comprehensive Drug Abuse Prevent Control Act of 1970;
(e) a person employed by a state agency that licenses a practitioner, if the person is performing the person’s official duties; or
(f) an insurance carrier or other third party payor authorized by the patient to receive the information.

Sale of Protected Health Information

We will not disclose your protected health information to any other person in exchange for direct or indirect remuneration, except for treatment, payment, health care operations, in the performance of an insurance or health maintenance organization functions allowed under the insurance laws, and as otherwise authorized under state law. If we disclose it in the performance of an insurance or health maintenance organization function authorized by state law, the remuneration will not exceed our reasonable costs of preparing or transmitting your protected health information for such disclosure.

Marketing Disclosures

We will obtain your clear and unambiguous permission in written or electronic form to use or disclose protected health information for any of our marketing communications, except if the communication is in the following forms:

(a) a face-to-face communication made directly to you;
(b) a promotional gift of nominal value;
(c) necessary for administration of a patient assistance program or other prescription drug savings or discount program; or
(d) made at your oral request.
UTAH

We will not discuss information in your prescription or medication profile with release such information to anyone except:

(a) you or your legal guardian or designee;
(b) a lawfully authorized federal, state, or local drug enforcement officer;
(c) a third party payment program authorized by you;
(d) another pharmacist, pharmacy intern, pharmacy technician, or prescribing practitioner providing services to you or to whom you have requested us to transfer a prescription;
(e) your attorney, if we receive a written authorization signed by:
(1) you before a notary public;
(2) your parent or lawful guardian, if you are a minor;
(3) your lawful guardian, if you are incompetent; or
(4) your personal representative, in the case of deceased patients.

WASHINGTON

Disclosure

State law requires the pharmacy to disclose your health care information for the following purposes:

(a) to federal, state, or local health care authorities, to the extent the pharmacist is required by law to report health care information;
(b) when needed to determine compliance with state or federal licensure, certification or registration rules or laws;
(c) to investigate unprofessional conduct or ability to practice a health profession with reasonable skill and safety;
(d) when needed to protect the public health; or
(e) pursuant to compulsory process or discovery notices that meet state law requirements.

In the event we disclose your health care information without your written authorization, we will limit the disclosed information to the extent needed by the following recipients:

(a) to a person who the pharmacist reasonably believes is providing health care to you;
(b) to a person who the pharmacist reasonably believes previously provided health care to you to provide for additional health care, unless you have instructed the pharmacist or pharmacy in writing not to the make the disclosure;
(c) to any other person who requires health care information for health care education, or to provide planning, quality assurance, peer review, or administrative, legal, financial, or actuarial services to the pharmacy; or for assisting the pharmacy in the delivery of health care and the pharmacist reasonably believes that the person will not use or disclose the health care information for any other purpose and will take appropriate steps to protect the health care information;
(d) to any person if the pharmacist reasonably believes that disclosure will avoid or minimize an imminent danger to your or another individual’s health or safety; however, there is no obligation on the part of the pharmacist to so disclose;
(e) to an official of a penal or other custodial institution in which you are detained;
(f) for payment, including information necessary for a recipient to make a claim, or for a claim to be made on behalf of a recipient for aid, insurance or medical assistance; or
(g) for use in a research project where an institutional review board has determined that such disclosure meets statutory requirements regarding the necessity of the information to the research project’s aims and safeguards used to protect the information from being used to identify you or from being subsequently disclosed to other parties.
(a) – (b) We may also provide health care information (excluding information related to sexually transmitted diseases and mental health services) to the following parties without your authorization:

(h) to your immediate family members, including a state-registered domestic partner or other individual with whom the patient is known to have a close personal relationship, unless you have instructed the pharmacist or pharmacy in writing not to make the disclosure;
(i) to a health care provider who is the successor in interest to the pharmacy maintaining the information;
(j) to a person who obtains information for purposes of an audit, if that person agrees in writing to remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable you to be identified and not to disclose the information further, except to accomplish the audit or report unlawful or improper conduct involving fraud in payment for health care by a health care provider or patient, or other unlawful conduct by the pharmacy;
(k) to provide directory information, unless you have instructed the pharmacy not to make the disclosure;
(l) to federal, state, or local law enforcement authorities and the health care provider, health care facility, or third-party payor if any of these parties believes in good faith that the health care information disclosed constitutes evidence of criminal conduct that occurred on the premises of the health care provider, health care facility, or third-party payor or third-party payor;
(m) to another health care provider, health care facility, or third-party payor, provided that the information relates to the relationship that the provider, facility, or payor has or had with you regarding your care and the disclosure is for health care operations functions defined in state law;
(n) to county coroners an medical examiners for death investigations; or
(o) to procurement organizations or person to whom your body part passes for purposes of examination necessary to assure the medical suitability of the body part; or to a person subject to the jurisdiction of the U.S. Food and Drug Administration in regards to a product it regulates or activity for which the agency has responsibilities regarding the activity’s quality, safety, or effectiveness.

Sexually Transmitted Diseases

We will not disclose any information or records related to sexually transmitted diseases, for reasons other than those permitted by state law without your patient authorization. Additionally, as provided under the law, we will limit the information disclosed to the extent necessary for the permitted recipients’ use(s) of that information allowed under the law.

Mental Health Services

We will not disclose mental health records as they relate to the your admission to a provider of mental health services and all information and records complied, obtained or maintained in the course of providing such services except to the extent provided by law.
WEST VIRGINIA

We will not disclose confidential information relating to an individual who is obtaining or has obtained treatment for a mental illness, without the individual’s written consent, except in the following circumstances:

(a) with the signed, written consent of the individual or the individuals legal guardian;
(b) in certain proceedings involving involuntary examinations;
(c) pursuant to a court order in which the court found the relevance of the information to outweigh the importance of maintaining the confidentiality of the information;
(d) to provide notice to the federal National Instant Criminal Background Check System;
(e) to protect against clear and substantial danger of imminent injury by the individual to himself, herself, or another; or
(f) to staff of the mental health facility where the individual is being cared for or to other health professionals involved in treatment of the individual, for treatment or internal review purposes.

Under HIPAA, we are permitted to disclose confidential information without your consent, for thirty days from the date of your admission to a mental health facility if we make a good faith effort to obtain consent from you or your legal representative prior to disclosure, only provide the minimum information necessary is released for a specifically stated purpose; and promptly notify you or your legal representative of the disclosure, its purpose, and to whom the information was disclosed.

We are not required to disclose confidential information relating to receipt of diagnoses, treatment, or provision of birth control, prenatal care, drug rehabilitation and related services or venereal disease-related health care services provided to a minor to his or her parent or guardian without the minor’s written consent.
WEST VIRGINIA

We will not disclose your confidential health care information to anyone but you without your informed consent, except in the following situations

(a) to heath care facility staff committees, or accreditation or heath care services review organizations for the purposes of conducting management audits, financial audits, program monitoring and evaluation, and health care service review or accreditation.
(b) to a health care provider or any person acting under the supervision of a health care provider or to licensed emergency personnel, and only to the extent that performance of their duties requires access to the records, if the person (i) is rendering assistance to the patient, (ii) is being consulted regarding the health of the patient, (iii) the life or health of the patient appears to be in danger and the information contained in the patient health care records may aid the person in rendering assistance, or (iv) the person prepares or stores records for the purposes of the preparation or storage of those records.
(c) to the extent that the records are needed for billing, collection or payment of claims.
(d) under a lawful order of a court of record.
WYOMING

Unless we have received an authorization from you, we will only disclose your information maintained in our records or communicated to you as part of patient counseling to:

(a) you, or as you direct, to those practitioners and other pharmacists where, in the pharmacist’s professional judgment such release is necessary for treatment or to protect your health and well-being;
(b) to other licensed professionals treating you; and
(c) to such other persons or governmental agencies authorized by law to investigate controlled substance law violations.

This addendum is effective on June 2, 2016.