Privacy Practices

HIPPA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT A PATIENT MAY BE USED AND DISCLOSED AND HOW THE PATIENT CAN OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW THESE PRIVACY PRACTICES CAREFULLY.

Introduction

Tar Heel Drug, Inc values each patient’s business and is aware that respect for patient privacy is the foundation of continued patronage. Tar Heel Drug, Inc. is committed to protecting the privacy of each patient’s protected health information (PHI) which is in their possession and only using and disclosing a patient’s PHI as necessary to provide them with health care products and services. PHI is any information that Tar Heel Drug, Inc. possesses, uses and discloses that identifies a patient and relates them to their past, present or future physical and mental health conditions or illnesses and the health care products and services that have been provided to them.

This “Notice of Privacy Practices” (Notice) has been created to help each patient understand Tar Heel Drug, Inc.’s legal duties to protect each patient’s PHI and how Tar Heel Drug, Inc. may use and disclose a patient’s PHI in relation to their past, present and future physical and/or mental health conditions or illnesses and its treatment. Tar Heel Drug, Inc. will use and disclose a patient’s PHI primarily in relation to health care products and services that is provided to them, such as dispensing prescription medication. Specifically, Tar Heel Drug, Inc. will use and disclose a patient’s PHI as necessary to provide treatment to them, obtain payment for health care products and services provided to them, and other health care operations and activities as described later in this Notice. This Notice also describes the legal rights that each patient has related to their PHI that is in the possession of Tar Heel Drug, Inc.

Each patient’s PHI will only be used and disclosed as described in this Notice. Should a need for use and/or disclosure of patients’ PHI occur that is not described in this Notice, Tar Heel Drug, Inc. will obtain their written authorization before the use and/or disclosure. At a future point in time it may be necessary for revisions to be made to this Notice. If and when such revisions become necessary, Tar Heel Drug, Inc. will post the revised Notice in the pharmacy area and, if requested, provide the patient with a written Notice.

Patient’s Rights With Respect To Their PHI

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) provides each patient’s PHI. These rights are summarized below. If a patient would like more information about any of these policies and practices, please contact the Tar Heel Drug, Inc. Privacy Officer at 316 South Main Street, Graham, NC 27253 or (336) 227-2093.

  1. Patients have the right to receive this written Notice of Privacy Practices describing how Tar Heel Drug, Inc. will protect their PHI and their rights related to PHI. Patients are entitled to request this written Notice at any time.
  2. Patients have the right to request a limitation on Tar Heel Drug, Inc.’s use and disclosure of their PHI. However, patients should be aware that Tar Heel Drug, Inc. may not be able to agree to their requested limitation if it prohibits Tar Heel Drug, Inc. from being able to provide health care products and services to them or if Tar Heel Drug, Inc. is required to used and disclose the PHI under federal or state law. All requests for limitation on the use and disclosure of a patient’s PHI must be submitted to the Tar Heel Drug, Inc. Privacy Officer in written form using the prepared request form.
  3. Patients have the right to review or receive photocopies of Tar Heel Drug, Inc.’s records that contain their PHI, to the extent that these records are part of a designated set of data as defined by HIPAA. The most common type of such records are patients’ prescription medication profiles, demographic information and billing records for health care products and services provided. Patients may review their records that are on file during normal business hours.
    If Tar Heel Drug, Inc. is unable to provide a copy of their records, Tar Heel Drug, Inc. will provide the patient with a written explanation why they were not able to provide the requested records. Depending on the reason, a patient may submit a written request for Tar Heel Drug, Inc. to reconsider the records request. All requests to review or receive photocopies of a patient’s records that contain PHI must be submitted to the Tar Heel Drug, Inc. Privacy Officer in written form using the prepared form provided.
  4. Each patient has the right to request changes to their PHI contained in the records of Tar Heel Drug, Inc. where they believe the content is incomplete, inaccurate, or needs change due to some other reason. Tar Heel Drug, Inc. may not be able to agree to the patient’s requested change if the records are no longer on file or if the requested change would cause the PHI to be inaccurate. If Tar Heel Drug, Inc. is not able to agree to the requested change, the patient will receive a written notification explaining why the requested change could not be made. The patient has the right to submit a written statement of disagreement, to which Tar Heel Drug, Inc. can elect to respond to in written form. All requests for changes to a patient’s PHI on record at Tar Heel Drug, Inc. must be submitted to the Tar Heel Drug, Inc. Privacy Officer in written form using the prepared form provided.
  5. Each patient has the right to request that Tar Heel Drug, Inc. communicate with them about their PHI in a confidential manner and only to locations (such as a post office box) or by means (such as a personal cellular phone or PDA) specified by the customer. All requests for confidential communications must be submitted to the Tar Heel Drug, Inc. Privacy Officer in written form using the prepared form provided.
  6. Each patient has the right to obtain an accounting of some the disclosures of their PHI made after April 14, 2003. An accounting is defined as a written record of these disclosures. Some of the disclosures made by Tar Heel Drug, Inc. of a patient’s PHI are not required by HIPAA to be included in the accounting. Most notable among these are disclosures for purposes of treatment, obtaining payment, and carrying out health care operations. Other disclosures of a patient’s PHI that are not included in the accounting are disclosures made directly to the patient or disclosures that the patient has authorized, made to family, friends and others who assist them with their care (caregivers) and made for other purposes allowed by HIPAA. Patients should consult with the Tar Heel Drug, Inc. Privacy Officer for more information on the disclosures not required to be included in the accounting.
    The period of time for which Tar Heel Drug, Inc. is required to provide the accounting is the six-year period immediately prior to the date of the patient’s request for the accounting but no earlier than April 14, 2003; however, a patient’s request for the accounting can be for a shorter period of time. Patients may obtain from Tar Heel Drug, Inc., without charge, one accounting during a 12-month period. All requests for an accounting of Tar Heel Drug, Inc. disclosures of a patient’s PHI must be submitted to the Tar Heel Drug, Inc. Privacy Officer in written form using the prepared form provided.
  7. Each patient has the right to file a complaint if they believe that Tar Heel Drug, Inc. has violated their rights as described above, and should not fear retaliation or adverse action by Tar Heel Drug, Inc. for exercising that right. Patients may file a complaint directly to Tar Heel Drug, Inc., or with the United States Department of Health and Human Services (HHS). Patients should be assured that Tar Heel Drug, Inc. will work with the patient to resolve any complaint, including providing the patient with the address for filing a complaint with the HHS.

PATIENTS THAT HAVE QUESTIONS ABOUT ANY OF THEIR RIGHTS AS DESCRIBED ABOVE MAY CONTACT THE TAR HEEL DRUG, INC. PRIVACY OFFICER AT 316 SOUTH MAIN STREET, GRAHAM, NC 27253 OR 336-227-2093

Means Of Use And Disclosure Of Patient PHI

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires that this Notice tell each patient how Tar Heel Drug, Inc. may use and disclose their PHI. These uses and disclosures are summarized below, but if a patient would like more information about any of these they may contact the Tar Heel Drug, Inc. Privacy Officer at the address or telephone number of Tar Heel Drug, Inc as listed above.

  1. Treatment. HIPAA defines treatment as “the provision, coordination or management of healthcare and related services by one or more healthcare providers, including the coordination or management of healthcare by a health care provider with a third party; consultation between healthcare providers relating to a patient; or the referral of a patient for healthcare from one healthcare provider to another.” Tar Heel Drug, Inc. will maintain records that contain each patient’s PHI, and will use and disclosed their PHI as necessary to provide healthcare products and services to carry out and support their treatment. As a pharmacy, Tar Heel Drug, Inc. may use and disclose a patient’s PHI as necessary to maintain their patient profile, which may include specific information such as: the patient’s medical condition, medications and prescription devices they use; any allergies the patient may have; and any other information, such as health insurance, the patient may have. Tar Heel Drug, Inc. may use and disclose each patient’s PHI in dispensing prescription medications and related products and services, including counseling patients, their caregivers, and their families about the proper use of the patient’s medications. Tar Heel Drug, Inc. may discuss such problems with the patient’s healthcare professionals, such as their physician or dentist, and through such discussions Tar Heel Drug, Inc. may use and disclose their PHI. Finally, Tar Heel Drug, Inc. may use and disclose a patient’s PHI to patients and their caregivers in their discussions with the patients and their caregivers about their treatment.
  2. Payment. HIPAA defines payment, in relation to healthcare providers, such as Tar Heel Drug, Inc., as activities to obtain reimbursement for the healthcare products and services that they provide to the patient. These activities primarily include billing the patient directly or the person responsible, such as a family member or health insurance company, for payment of the patient’s healthcare products and services provided by Tar Heel Drug, Inc. Activities related to billing may include claims management collections, charge accounts, and related healthcare data processing. Depending on who is responsible for the payment for the healthcare products and services provided to the patient, other activities may include determination of eligibility or coverage; medical necessity; review of healthcare services with respect to medical necessity, coverage under a health plan appropriateness of care or justification of charges; utilization review activities, including precertification and preauthorization of services; concurrent and retrospective review of services; and disclosure to consumer reporting agencies of some or all of the following PHI necessary for collection of payment: name and address; date of birth; social security number; payment history; account number and/or health plan. Tar Heel Drug, Inc. will use and disclose a patient’s PHI to carry out the above activities as necessary or required to obtain payment for the healthcare products and services that they provide to the patient. In relation to this, public and private healthcare insurance programs that may provide or pay for the patient’s healthcare can conduct audits, inspections and investigations of Tar Heel Drug, Inc. in relation to their activities and the patient’s activities. Tar Heel Drug, Inc. may be required to disclose a patient’s PHI to these programs for purposes of audits, inspections and investigations.
  3. Healthcare operations. HIPAA defines healthcare operations as those activities necessary and related to Tar Heel Drug, Inc. providing healthcare products and services to each customer. These activities include, but may not be limited, the following.
    1. Conducting quality assessment and improvement activities, case management and care coordination, and contacting of healthcare providers and patients with information about treatment alternatives and related functions that do not include treatment.
    2. Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse detection and compliance programs.
    3. Tar Heel Drug, Inc. pharmacy management and general administrative activities, including, but not limited to, activities relating to implementation of and compliance with the requirements of HIPAA.
  4. Tar Heel Drug, Inc. will use and disclose a patient’s PHI to carry out the above activities as necessary or required, and especially to monitor and improve the quality of the healthcare products and services that are provided to the customer by Tar Heel Drug, Inc. and other healthcare professionals.

    In addition to treatment, payment, and healthcare operations as described above, Tar Heel Drug, Inc. my use and disclose a patient’s PHI for the following purposes listed in 4-15.

  5. Business associates. The nature of the healthcare system is such that Tar Heel Drug, Inc. may not be able to provide healthcare products and services to each customer without the involvement of other businesses or persons. Depending on what services, information and products these other businesses or persons provides for Tar Heel Drug, Inc., they may become “business associates” as defined by HIPAA. In many situations, it will be necessary for Tar Heel Drug, Inc. to provide a patient’s PHI to these business associates so that they can carry out the activities that Tar Heel Drug, Inc. needs to have performed in order to provide the patient with healthcare products and services. One of Tar Heel Drug, Inc.’s most common business associates is a health insurance company or a company that processes claims that Tar Heel Drug, Inc submits for payment for healthcare products and services provided to the patient, if the patient has health insurance that pays for their prescription medications. Contracts have been submitted or will be submitted to all of Tar Heel Drug, Inc.’s business associates to whom they provide a patient’s PHI so that they may carry out activities on the patient’s behalf. These contracts require Tar Heel Drug, Inc.’s business associates to give their assurance that they, like Tar Heel Drug, Inc., will protect the privacy of each patient’s PHI.
    1. Disclosures of a patient’s PHI not involving treatment, payment and healthcare operations. In providing healthcare products and services to the patient, Tar Heel Drug, Inc. may find it necessary to communicate with businesses and individuals not already described above. Most of these disclosures will be related to providing treatment to the patient, and to carrying out payment and healthcare operations as discussed above. In addition to communicating with these businesses and individuals, Tar Heel Drug, Inc. may also communicate with the patient directly, as well as others who assist the patient with their healthcare, commonly referred to as caregivers. Tar Heel Drug, Inc. will disclose a patient’s PHI to these caregivers, or appropriate others, as they believe necessary and appropriate for the patient’s healthcare.
    2. Communications with each patient concerning their health and treatment. Tar Heel Drug, Inc. seeks to do all that is legal and beneficial in assisting each patient in maintaining their health and obtaining the most benefit from their treatment. Tar Heel Drug, Inc. routinely monitors each patient’s prescription medications for appropriateness and takes other steps to help the patient use their medication properly. For example, if Tar Heel Drug, Inc.’s records show that a refill of the patient’s medication is due, they may contact the patient to remind them to obtain the refill. Tar Heel Drug, Inc. may also call the patient or send the patient materials regarding products and services that they believe may be of benefit to the patient. As a final example, in the event of a medication recall, Tar Heel Drug, Inc. may contact a patient if they are taking the medication subject to the recall.
    3. Federal and state government agencies. Tar Heel Drug, Inc. may disclose a patient’s PHI to federal and state government agencies for a variety of purposes, most of which are directed at monitoring healthcare quality and safety, and government programs related to healthcare and Tar Heel Drug, Inc.’s compliance with laws applicable to healthcare. For example, the United States Drug Enforcement Agency (DEA) monitors the distribution and usage of controlled substances, while the United States Food and Drug Administration (FDA) monitors adverse drug events. Tar Heel Drug, Inc. may disclose a patient’s PHI to such agencies where required by the agency so that the agency can carry out its required activities. Related to this, some private businesses, such as the manufacturers of medications and medical devices, are legally required to conduct post-marketing surveillance in order to ensure the safety of their products. Disclosing a patient’s PHI for such surveillance may be necessary.
    4. Federal and state government healthcare insurance programs. If a patient applies for and receives benefits from federal and state healthcare programs, such as Medicare or Medicaid, their PHI may be disclosed to the agency granting these benefits. If the patient is employed by a business that is required to carry workers’ compensation insurance, and the patient is injured in such a way that the worker’s compensation plan covers their healthcare, it may be necessary to disclose the patient’s PHI to the workers’ compensation plan. Such plans have a right to conduct audits, inspections, and investigations of Tar Heel Drug, Inc.’s activities and the patient’s activities, and where required, Tar Heel Drug, Inc. will disclose the patient’s PHI for these activities.
    5. Matters of public health and safety. There are a number of federal and state laws that require healthcare providers to report to various government agencies matters related to public health. If a patient’s physical or mental health condition and illness is of a nature that federal or state law requires that it be reported, then Tar Heel Drug, Inc. will disclose the patient’s PHI to the appropriate government agency in order to comply with these laws. In addition to reporting about physical and mental health conditions and illnesses, Tar Heel Drug, Inc. may also disclose a patient’s PHI to government agencies in other situations where they are required to submit reports, such as suspected domestic, child or elder abuse, or neglect.
    6. Law enforcement activities. A number of federal, state, and local government agencies are charged with enforcing the healthcare and drug laws, and other laws in relation to the healthcare products and services that Tar Heel Drug, Inc. may provide to the patient. In addition, as a state licensed pharmacy, a variety of federal, state, and local healthcare agencies, such as the state board of pharmacy, regulate Tar Heel Drug, Inc.’s activities. These agencies may engage in a number of activities designed to monitor and improve federal and state healthcare programs and systems, including conducting of inspections and investigations of Tar Heel Drug, Inc.’s activities and healthcare products and services that they provide to patients. At any time Tar Heel Drug, Inc. is required by federal or state laws, or by court order, subpoena or other legal mandate, to disclose a patient’s PHI, they will do so as necessary.
    7. Legal disputes. Lawsuits and other legal disputes may involve a patient’s PHI that is in the possession of Tar Heel Drug, Inc. In the event that a patient is involved in a lawsuit or other legal proceeding, either as a plaintiff or a defendant, and without regard to the basis for the lawsuit, such as medical malpractice or divorce, Tar Heel Drug, Inc. will disclose the patient’s PHI when required to comply with a court order, subpoena, discovery proceeding, such as a deposition, or other legal mandate served upon them.
    8. Disclosures for the benefit of the patient and others. A variety of events could occur where Tar Heel Drug, Inc. would use and disclose a patient’s PHI for their benefit and to prevent or reduce the risk of harm to them. For example, if a patient is in a car accident and is unconscious in a hospital emergency room and the emergency room staff calls Tar Heel Drug, Inc. with a request for the patient’s PHI, Tar Heel Drug, Inc. may disclose the patient’s PHI for the purpose of assisting in their prompt medical treatment. Finally, Tar Heel Drug, Inc. may disclose a patient’s PHI where necessary to protect the health and safety of others.
    9. Disclosures for national security and intelligence. Tar Heel Drug, Inc. is legally required to disclose a patient’s PHI where necessary to national security activities and intelligence and counterintelligence activities. Disclosures related to this may also include those where required in relation to the protection of the President of the United States. Any disclosure for these purposes would be made only to authorized government officials.
    10. Disclosures if the patient is in the military or a veteran. Tar Heel Drug, Inc. may disclose a patient’s PHI, if they are a member of any branch of the armed services, whether on active or reserve status as required by the United States Military. If the patient is a veteran, Tar Heel Drug, Inc. may release their PHI, particularly if the patient is receiving healthcare products and services from the Veterans Services. Any disclosure for these purposes would be made only to authorized government officials.
    11. Disclosures of a miscellaneous nature. This last category of disclosures includes a variety of disclosures that we may make in accordance with HIPAA. Tar Heel Drug, Inc. may disclose a patient’s PHI to their family members in the form of ‘End of the Year’ print-outs unless the patient requests otherwise in writing. Tar Heel Drug, Inc. may be required to disclose a patient’s PHI it they are placed in the custody of a federal or state correctional system, if necessary to protect the health and safety of the patient and others. Healthcare is an area where much research is being conducted, and Tar Heel Drug, Inc. may disclose a patient’s PHI for purposes of a research project. Finally, given the national need for organ donations, Tar Heel Drug, Inc. may disclose a patient’s PHI to organizations that manage organ transplantation programs.

    PATIENTS THAT HAVE QUESTIONS ABOUT ANY OF THEIR RIGHTS AS DESCRIBED ABOVE MAY CONTACT THE TAR HEEL DRUG, INC. PRIVACY OFFICER AT 316 SOUTH MAIN STREET, GRAHAM, NC 27253 OR 336-227-2093

    Uses and Disclosures Not Contained In This Notice

    If a use and disclosure of a patient’s PHI is not contained in this Notice, then Tar Heel Drug, Inc. will obtain the patient’s written authorization before the use and disclosure. Each patient has the right to refuse to authorize the use and disclosure, or if they grant authorization, to revoke the authorization at any time. If such authorization is requested, Tar Heel Drug, Inc. will provide the patient with a form that describes the proposed use and disclosure and their rights related to the requested authorization.

    Conclusion

    Patients should consult with the Tar Heel Drug, Inc. Privacy Officer if they have any questions or want more information concerning their healthcare and privacy rights under HIPAA or the laws of North Carolina, or Tar Heel Drug, Inc.’s privacy practices. Also, patients should consult the Tar Heel Drug, Inc. Privacy Officer if they wish to file a complaint about Tar Heel Drug, Inc.’s privacy practices or if they believe that Tar Heel Drug, Inc. has violated any of the patient’s rights as described in this Notice.

    Effective Date: April 14, 2003