HIPAA Notice of Privacy Practices

Who We Are

PactRX, LLC ("PactRX") is a licensed specialty pharmacy and a "Covered Entity" under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). We are required by law to maintain the privacy of your Protected Health Information (PHI), provide you with this Notice of our legal duties and privacy practices, and follow the terms of this Notice currently in effect.

What is Protected Health Information (PHI)?

Protected Health Information is individually identifiable health information that relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or past, present, or future payment for healthcare. PHI includes information in any form — written, electronic, or oral.

How We May Use and Disclose Your PHI

For Treatment

We may use and disclose your PHI to provide, coordinate, and manage your pharmacy care and related services. This includes dispensing medications, consulting with your prescribers, coordinating care with other healthcare providers, and providing medication therapy management.

For Payment

We may use and disclose your PHI to obtain payment for services we provide, including billing your health insurance plan, verifying coverage and eligibility, submitting claims, and collecting copayments and deductibles.

For Healthcare Operations

We may use and disclose your PHI for our internal operations, including quality assessment and improvement activities, reviewing the competence of our staff, conducting audits, business planning, and general administrative activities.

With Your Authorization

Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization. You may revoke any authorization you have given us at any time by notifying us in writing, except to the extent we have already taken action in reliance on the authorization.

Other Permitted Uses and Disclosures

We may also use or disclose your PHI without your authorization for the following purposes:

• As required by law: We will disclose PHI when required by federal, state, or local law
• Public health activities: To prevent or control disease, injury, or disability; to report births, deaths, and adverse events
• Health oversight activities: To health oversight agencies for audits, investigations, inspections, and licensure
• Judicial and administrative proceedings: In response to a court order, subpoena, or other lawful process
• Law enforcement: To identify or locate a suspect, witness, or missing person, or to report certain types of injuries
• To avert a serious threat: To prevent or lessen a serious and imminent threat to health or safety
• Workers' compensation: As authorized by workers' compensation laws
• Coroners and funeral directors: To assist in identification of a deceased person or determination of cause of death
• Organ donation: To facilitate organ, eye, or tissue donation and transplantation
• Research: Under certain conditions and with appropriate approvals
• Military and veterans: If you are a member of the armed forces, as required by military authorities
• Inmates: If you are an inmate of a correctional institution, for your health and safety or the health and safety of others

Personal Representatives & Caregivers

We may disclose your PHI to a family member, personal representative, or other person you designate as involved in your care. If you are incapacitated or in an emergency, we may use our professional judgment to determine whether disclosure is in your best interest.

PactRX offers a Care Partner program that allows authorized caregivers, family members, and facility staff to access certain information about your care. Care Partners must be formally designated through our enrollment process and sign a Business Associate Agreement (BAA) where applicable.

Your Rights Regarding Your PHI

Under HIPAA, you have the following rights:

Right to Access

You have the right to inspect and obtain a copy of your PHI that we maintain in our records. To request access, submit a written request to our Privacy Officer. We may charge a reasonable fee for copying and mailing.

Right to Amend

You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request in certain circumstances, but we will provide you with a written explanation.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures of your PHI that we have made. This accounting does not include disclosures made for treatment, payment, or healthcare operations, or disclosures you have authorized.

Right to Request Restrictions

You have the right to request that we restrict certain uses and disclosures of your PHI. We are not required to agree to your request except where the disclosure is to a health plan for payment or healthcare operations purposes, and the PHI relates solely to a healthcare item or service for which you have paid in full out of pocket.

Right to Confidential Communications

You have the right to request that we communicate with you about your health matters using a specific method or at a specific location. For example, you may request that we contact you only by mail or at a particular phone number.

Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you have previously agreed to receive it electronically.

Breach Notification

In the event of a breach of your unsecured PHI, we will notify you as required by law. We will provide notification without unreasonable delay and no later than 60 days after discovery of the breach, as required by the HITECH Act.

Changes to This Notice

We reserve the right to change the terms of this Notice and make the new provisions effective for all PHI we maintain. If we make a material change to this Notice, we will post the revised Notice on our website and make it available at our pharmacy.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with PactRX or with the U.S. Department of Health and Human Services Office for Civil Rights. You will not be penalized or retaliated against for filing a complaint.

To file a complaint with the Office for Civil Rights, visit www.hhs.gov/hipaa/filing-a-complaint or call 1-800-368-1019.

Contact Our Privacy Officer

For questions about this Notice, to exercise your rights, or to file a complaint, contact: