Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (“Notice”) describes the privacy practices of Pharmaceutical Technologies, Inc., National Pharmaceutical Services and The Pharmacy SmartCard (collectively “PTI”). We want you to know that nothing is more central to our operations than maintaining the privacy of your protected health information (“PHI”). PHI is information about you, including basic information that may identify you and relates to your past, present, or future health or condition and the dispensing of pharmaceutical products to you. We take this responsibility very seriously.

OUR COMMITMENT TO PROTECTING YOUR PERSONAL HEALTH INFORMATION

We are required by federal and applicable state law, regulations, and other authorities to protect the privacy of your health information and to provide you with this Notice. We are required to protect the confidentiality of your PHI and will disclose your PHI to a person other than you or your personal representative only when permitted under federal or state law. This protection extends to any PHI that is oral, written, or electronic, such as prescriptions transmitted by facsimile, modem, or other electronic device. This Notice describes how we may use and disclose your PHI. In some circumstances, as described in this Notice, the law permits us to use and disclose your PHI without your express permission. In all other circumstances, we will obtain your written authorization before we use or disclose your PHI. This Notice also describes your rights and the obligations we have regarding the use and disclosure of your PHI. Under federal and applicable state law, we are required to follow the terms of the Notice currently in effect. YOU ARE NOT REQUIRED TO AUTHORIZE ADDITIONAL USES AND DISCLOSURES OF YOUR PHI.

USES AND DISCLOSURES

How We May Use and Disclose Your PHI Without Your Permission

Below are examples of how Federal law permits use or disclosure of your PHI without your permission.

  1. Treatment: The PHI we obtain may be used and disclosed to healthcare professionals to provide, coordinate and manage the dispensing of your prescription medications. For example, we may disclose medical information about you to your physician in order to coordinate the prescribing and delivery of your drugs through your prescription drug program. We may contact you to provide treatment-related services, such as refill reminders, treatment alternatives (e.g., available generic products), and other health related benefits and services that may be of interest to you.

  2. Payment: If it is necessary to determine whether a third party will pay for your prescription, and the related payment amount, we may contact and share your PHI with a third party. We may use and disclose your medical information about you to manage your prescription plan, fulfill our responsibilities under your prescription plan, and process your claims for prescriptions you have received. We may also contact you about a payment or balance due for prescriptions dispensed to you, which could include mailing an explanation of benefits to the address we have on file for you. For example, we may give medical information to your plan so that we can confirm your eligibility for prescription drugs, or we may submit claims to your health plan, third party administrator, employer or other payment entity for payment. The information on or accompanying the bill may include information that identifies you, as well as the prescriptions you are taking.

  3. Health Care Operations: We may use and disclose your medical information to carry out business planning and healthcare operations. These activities include conducting utilization reviews; conducting quality assessment and improvement activities, including outcomes management; reviewing and evaluating a network pharmacy’s qualifications and performance; contacting health care providers with information about treatment alternatives; engaging in cost-management analyses, including Formulary development and administration. We do this so we can provide you with pharmacy benefits and ensure you receive the highest-quality services. As an example, we may use and disclose medical information about you to: assess the use or effectiveness of certain drugs, develop and monitor medical protocols, give you helpful medication reminders and health management services.

How We May Use And Disclose Your PHI In Other Special Circumstances:

We are permitted under federal and applicable state law and are likely to use or disclose your PHI without your permission only when certain circumstances may arise, as described below.

Although we may not engage in the following activities, under federal or applicable state law, we are allowed to use or disclose your PHI without your permission for these purposes.

We May Use Or Disclose Your PHI For Other Purposes Only With Your Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes other than those described above (or as otherwise permitted or required by law) including before using or disclosing your PHI for marketing purposes or in exchange for remuneration. You may revoke this authorization at any time by submitting a written notice to our Privacy Officer at the address listed below. Your revocation will become effective upon our receipt of your written notice.

YOUR INDIVIDUAL RIGHTS

You have the following rights with respect to your PHI:

  1. Obtain a paper copy of this Notice upon request. To obtain a copy of this Notice at any time, go to www.pti-nps.com or contact us at 1-800-546-5677. TTY users should call 1-866-706-4757. Or you may write to our Privacy Officer at PTI P.O. Box 407 Boys Town, NE 68010.

  2. Inspect and obtain a copy of your PHI. You have the right to access and copy your PHI contained in the “designated record set,” which includes prescription and billing records. To inspect or copy your PHI, submit a written request to our Privacy Officer. We will respond to your request in writing within 30 days (with a possible 30-day extension). You also have the right to request an electronic copy of your PHI. If your PHI is not readily producible in such an electronic form or format, we will provide your PHI in a readable electronic form and format as agreed to by you and PTI. A fee may be charged for the expense of fulfilling your request. We may deny your request to inspect and copy in certain limited circumstances, such as if we have reasonably determined that providing access to PHI would endanger your life or safety or cause substantial harm to you or another person. If we deny your request, we will notify you in writing and provide you with the opportunity to request a review of the denial, if applicable.

  3. Request an amendment of PHI. If you feel that your PHI is incomplete or incorrect, you may request that we amend it for as long as we maintain the PHI. To request an amendment, submit a written request to our Privacy Officer. Requests must identify: (i) which information you seek to amend, (ii) what corrections you would like to make, and (iii) why the information needs to be amended. We will respond to your request in writing within 60 days (with a possible 30-day extension). In our response, we will either: (i) agree to make the amendment, or (ii) inform you of our denial, explain our reason, and outline appeal procedures, if applicable. If denied, you have the right to file a statement of disagreement with the decision. We may provide a rebuttal to your statement and will provide you with a copy if we do so. We will maintain appropriate records of your disagreement and our rebuttal.

  4. Receive an accounting of disclosures of PHI. You have the right to request an accounting of your PHI disclosures for purposes other than treatment, payment, or health care operations. This accounting will exclude disclosures: made directly to you, made with your authorization, made incident to a use or disclosure required by law or regulation, made to caregivers, made for national security or intelligence purposes, made to correctional institutions or law enforcement officials and/or made as part of a limited data set. To obtain an accounting, submit a written request to our Privacy Officer. Requests must specify the time period, not to exceed six years, for which you would like to receive the accounting. We will respond in writing within 60 days of receipt of your request (with a possible 30-day extension). We will provide you with one accounting per 12-month period free of charge, but you may be charged for the cost of any subsequent accountings during the same 12-month period. We will notify you in advance of the cost involved, and you may choose to withdraw or modify your request at that time.

  5. Request communications of PHI by alternative means or at alternative locations. You have the right to request that we communicate with you in a certain way or at a certain location. For example, you may request that we contact you only in writing at a specific address. To request confidential communication of your PHI, submit a written request to our Privacy Officer. Your request must state how, where, or when you would like to be contacted. We will accommodate all reasonable requests.

  6. Request a restriction on certain uses and disclosures of PHI. You have the right to request a restriction or limitation on our use or disclosure of your PHI by submitting a written request to our Privacy Officer. You must identify in this request: (i) what particular information you would like to limit, (ii) whether you want to limit use, disclosure, or both, and (iii) to whom you want the limits to apply. All requests will be carefully considered, but we are not required to agree to those restrictions, except in certain circumstances. We will provide you with a written response to your request within 30 days. If we do agree to restrict use or disclosure of your PHI, we will not apply these restrictions in the event of an emergency. We also have the right to terminate the restriction if: (i) you agree orally or in writing, or (ii) we inform you of the termination, which becomes effective only with respect to your PHI created or received after we inform you of the termination. All requests for restrictions must include your full name, date of birth, and address.

  7. Restriction on disclosure of PHI when paying out of pocket. You have the right to request a restriction on the disclosure of your PHI (for payment or healthcare operations) to your health plan when you have paid for the service or item in question out of pocket in full by submitting a written request to our Privacy Officer. We are required to agree to this restriction. We will provide you with a written response to your request within 30 days. All requests for PHI must include your full name, date of birth, and address.

  8. Breach notification. You have the right to be notified when a breach of your unsecured PHI has occurred. We will provide you with such notification as soon as information regarding the breach is available.

WHAT TO DO IF YOU HAVE A COMPLAINT

If you believe your privacy rights have been violated, you can file a complaint with our Privacy Officer at PTI P.O. Box 407 Boys Town, NE 68010 or to the Secretary of the U.S. Department of Health and Human Services. All complaints must be submitted in writing. You will not be penalized in any way for filing a complaint. You may also contact our Privacy Officer at 1-800-546-5677 if you have any questions or comments about our privacy practices.

CHANGES TO THIS NOTICE

We reserve the right to change our privacy practices. We reserve the right to make the revised Notice effective for PHI we already have about you as well as any information we receive in the future, as of the effective date of the revised Notice. Upon request to our Privacy Officer, we will provide a revised Notice to you. We will also post the revised Notice on our Web site at www.pti-nps.com. Please note that many states require state specific provisions. THIS NOTICE IS EFFECTIVE AS OF APRIL 14, 2003 (JULY 2013 REVISION).