HIPAA COMPLIANCE

Health Insurance Portability and Accountability Act (“HIPAA”)

NOTICE OF PATIENT PRIVACY PRACTICES

Crafted Rx wants you to know that maintaining the privacy of your health information is an important part of our operations.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

The Health Insurance Portability and Accountability Act (HIPAA) was passed to promote standardization and efficiency within the healthcare industry. It also establishes certain privacy and security requirements that apply to Protected Health Information (PHI), which includes your name and other basic contact information as well as information about your health, medical conditions and prescriptions. Crafted Rx takes our responsibility to protect this information very seriously and would like to make you aware of your rights and our responsibilities with regard to your Protected Health Information as identified by HIPAA.

The following categories describe examples of the way we may use and disclose your PHI without your written authorization:

Treatment: Your PHI will be used to dispense prescription medications. We will document information related to the medications dispensed and services provided in your record. We may also disclose your PHI to your prescriber or physician to assist either them or us in providing care to you. We may contact you to provide treatment-related services, such as refill reminders, treatment alternatives such as generic products and other health-related benefits or services that may be of interest to you.

Payment: We may use and disclose your PHI to obtain payment for the services we provide to you. For example, your third party payor may be contacted to determine coverage or eligibility, to discuss payment or reimbursement, or to gather additional information in an attempt to submit claims.

Health Care Operations: We may use and disclose your PHI to evaluate the effectiveness and quality of our services, to provide customer services to you and/or to resolve any complaints. We may also use your PHI to inform you of opportunities that may be of interest to you, such as in-house benefits or clinical research projects.

Business Associates: We may also disclose your PHI to third party business associates that perform services on our behalf, such as billing and collection services. These contractors are required by law and their agreements with us to protect your PHI in the same way we do.

Persons Involved in Your Care or Payment for Your Care: We may disclose your PHI to a relative, a friend, or any other person you identify who is involved in your care or who helps pay for your care. For example, we may provide prescriptions and related information to your caregiver on your behalf.

Worker’s Compensation: We may disclose your PHI to authorized personnel to comply with laws relating to worker’s compensation or similar programs.

Law Enforcement: We may disclose your PHI to a law enforcement official for certain specific purposes, such as reporting certain types of injuries or crimes.

Judicial and Administrative Proceedings: If you are involved in a legal dispute, we may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or similar motion of the court.

Research: Under certain circumstances, we may disclose your PHI to researchers who are conducting a specific research project. Before disclosing your PHI, the research project must be approved by an institutional review board or privacy board that has also agreed to protect your PHI.

Public Health: We may disclose your PHI to federal, state, or local authorities, or other entities charged with preventing or controlling disease, injury, or disability for public health activities.

United States Department of Health and Human Services: We are required by federal law to disclose your PHI to the U.S. Department of Health and Human Services to determine if we are in compliance with federal laws and regulations regarding the privacy of health information.

Deceased Persons: We may disclose your PHI to coroners, medical examiners, or funeral directors so that they can carry out their duties.
Notification: We may use or disclose your PHI to assist in a disaster relief effort so that your family or personal representative may be notified about your condition, status and location.

Incarceration: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your PHI to the correctional institution or law enforcement official to assist them in providing you health care, protecting your health and safety or the health and safety of others, or for the safety of the correctional institution.

Disclosure of your PHI or its use for any purpose other than those listed above requires your specific written authorization. The following categories below describe examples of the way we may use and disclose your PHI only with your written authorization. Some examples include but are not limited to:

Marketing: We will not use or disclosure your PHI for marketing purposes without your written authorization except as permitted by law.

Sale of Your PHI: We do not currently sell or receive payment for your PHI, either during or after treatment with us. If we do consider the sale of PHI in the future, we will not sell your health information without your written authorization except as otherwise permitted by law.

You have the following rights with respect to your PHI:
The section below describes your rights regarding the PHI we collect and maintain about you. All communications to us to exercise your rights discussed in this policy must be submitted in writing to Crafted Rx, Attention: Privacy Office, 609 State Hwy 47 # C, Warrenton, MO 63383.

Inspect and obtain a copy of your PHI: You have the right to view and get a copy your PHI that we maintain, which includes your prescription and billing records. To get a copy of your PHI, submit in writing to Crafted Rx, Attention: Privacy Office, 609 State Hwy 47 # C, Warrenton, MO 63383. You may also ask us to provide a copy of your PHI to another person. We will respond to your request within 30 days. A fee may be charged for the expense of fulfilling your request. In the limited event that we deny your request, we will notify you in writing and let you know that you may request a review of the denial.

Request an Amendment: For as long as the information is kept by us, you have the right to make a written request that we amend or correct your PHI that you believe is incorrect or incomplete. You must provide explanation regarding any information that you would like to amend. Under certain circumstances we may deny your request. In the limited event that we deny your request, we will notify you in writing and let you know that you may request a review of the denial.

Right to Receive an Accounting of Disclosures: You have the right to request a list of all disclosures of your PHI that we have made to others purposes other than treatment, payment, or health care operations. Your request must state a time period which may not go back further than six years. We will provide one accounting per year free of charge, but you may be charged for the cost of any additional accountings. We will notify you of the costs involved in advance and give you an opportunity to withdraw or modify your request before any fees are processed. To obtain an accounting, submit a written request to Crafted Rx, Attention: Privacy Office, 609 State Hwy 47 # C, Warrenton, MO 63383.

Right to Request Restrictions: You have the right to request general restrictions on how your PHI is used or disclosed for treatment, payment, or health care operations activities. To request a general restriction, you must identify in this request what particular information you would like to limit, whether you want to limit use, disclosure, or both, and to whom you want the limits to apply. If we agree to your requested restriction, we will comply with your request unless the information is needed to provide you emergency treatment. Please note that we are not required to agree to your requested restriction unless that restriction is regarding disclosure of PHI to your health insurance company and the disclosure is for payment or health care operations and is not required by law and the PHI pertains to a health care product or service for which you or another person paid for in full.

Complaints:
You have the right to file a complaint if you believe that your privacy rights have been violated or if you disagree with a decision that has been made with regard to your records. If you would like to file a complaint about our privacy practices, you can do mail a letter to Crafted Rx, Attention: Privacy Office, 609 State Hwy 47 # C, Warrenton, MO 63383 or by contacting the state’s Board of Pharmacy or by filing a complaint with the Secretary of the Department of Health and Human Services. Your complaint must be filed in writing within 180 days of the violation. The complaint must list the name of the entity thought to be in violation and describe the acts and/or omissions believed to be in violation. You will not be penalized in any way for filing a complaint.

Changes to this Notice:
This Notice may be updated and revised over time. We reserve the right to make the new Notice provisions effective for all PHI we currently maintain, as well as any PHI we receive in the future, as of the effective date of the revised Notice. Upon request we will provide a revised Notice to you. We will also post the revised Notice on our website at www.crafted-rx.com.

State Specific Provisions:
Missouri

HIV-Related Information:
Crafted Rx will not disclose HIV-related information except to you or your authorized representative, or as permitted by State or Federal law.

Effective Date:
This Notice has been in effect since April 15, 2020.