POLICY

The pharmacy will provide individuals a copy of the pharmacy’s Notice of Privacy
Practices (Notice) upon their first visit to the pharmacy for service on or after April 14,
2003, or when this policy and procedure is implemented (whichever is first). In addition,
the pharmacy will post the Notice (and revisions of the Notice) in the pharmacy and
make a copy available upon request.

STANDARD

I. INTRODUCTION

Purpose of the Notice of Privacy Practices (Notice). Individuals have a right to
an adequate notice of the uses and disclosures of their PHI that may be made by
the pharmacy and of the individual’s rights and of the pharmacy’s legal duties
with respect to their PHI.

II. PROVISION OF THE NOTICE

A. Specific requirements for Pharmacy. The pharmacy will follow the criteria
listed below to make the Notice available in paper to individuals and the
general public.

1. The pharmacy will provide the Notice upon request to any person
whether or not that person is a patient of the pharmacy.

2. The pharmacy will provide the Notice at the time of first service,
including service delivered electronically, beginning no later than
the compliance deadline of April 14, 2003.

3. In an emergency, the pharmacy will provide the Notice as soon as
reasonably practicable after the emergency situation.

4. Except in an emergency situation, the pharmacy must make a
good faith effort to obtain a written acknowledgement of receipt of
the Notice from an individual. If not obtained, the pharmacy will
document the efforts made and the reason not obtained.

5. The pharmacy must have copies of the Notice available upon
request.

6. The pharmacy must post the Notice in a clear and prominent
location where an individual seeking health care will be able to
read the notice.

B. Electronic notice. The pharmacy must make an electronic notice available
if:

1. If the pharmacy maintains a website that provides information
about the pharmacy’s customer services or benefits, then the
pharmacy must prominently post the Notice on the website.

2. The pharmacy may provide the Notice by email if the individual
agrees to receiving electronic Notice and such agreement has not
been withdrawn. If the pharmacy knows that the email
transmission has failed, the pharmacy must provide a paper copy
of the Notice to the individual.

3. If the first delivery of the Notice to an individual is electronic, the
pharmacy must provide electronic Notice automatically and
contemporaneously in response to the individual’s first request for
service.

4. Upon request, the pharmacy will also provide a paper copy of the
Notice to recipients of an electronic Notice.

III. CONTENTS OF THE NOTICE

A. Required Elements. The pharmacy will provide a Notice that is written in
plain language and that contains the following required elements:

1. The Notice must contain this statement as a header: “THIS
NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”

2. Uses and disclosures. The notice must contain:

a. A description and at least one example of the types of uses and disclosures that the pharmacy is permitted to make for treatment, payment, and health care operations.

b. A description of each of the other purposes for which a pharmacy is permitted or required to use or disclose PHI without the individual’s written consent.

c. If a use or disclosure is prohibited or materiallylimited by other laws, the description of such use/disclosure must be reflected in the notice.

d. The description and examples must include sufficient detail to put the individual on notice of the uses and disclosures that are permitted or required by the privacy regulations and other applicable laws.

e. A statement that other uses and disclosures may be made only with the individual’s written authorization and that the individual may revoke such authorization.

3. Separate statements for certain uses or disclosures. The Notice must include separate statements if the pharmacy plans to engage in any of the following:

a. The pharmacy may contact the individual to provide appointment reminders or information about treatment alternatives or other health related benefits or services that may be of interest to the individual.

b. The pharmacy may contact the individual to raise funds for the pharmacy.

4. Individual Rights. The Notice must contain a statement of the
individual’s rights with respect to PHI and a brief description of
how the individual may exercise these rights, including.

a. The right to request restrictions on certain uses and disclosures of PHI, including a statement that the pharmacy is not required to agree to a requested restriction.

b. The right to receive confidential communication of PHI.

c. The right to inspect and copy PHI.

d. The right to request an amendment to PHI.

e. The right to receive an accounting of disclosures of PHI.

f. The right to receive a paper copy of the Notice.

5. Pharmacy’s duties. The Notice must contain:

a. A statement that the pharmacy is required by law to maintain the privacy of PHI and to provide individuals with notice of its legal duties and privacy practices with respect to PHI.

b. A statement that the pharmacy is required to abide by the terms of the Notice currently in effect.

c. A statement that the pharmacy reserves the right to change the terms of its Notice and to make the new Notice provisions effective for all PHI the pharmacy maintains. A statement that describes how the pharmacy will provide individuals with a revised Notice must also be included.

6. Complaints. The Notice will contain a statement that individuals may complain to the pharmacy and to the Secretary of the Department of Health and Human Services if they believe their privacy rights have been violated. This statement will include how the individual may file a complaint with the pharmacy and that the individual will not be retaliated against for filing a complaint.

7. Contact. The Notice must contain the name or title and telephone number of a person or office to contact for further information.

8. Effective date. The Notice must include the date on which the Notice is first in effect, which may not be earlier than the date on which the Notice is printed or otherwise published.

IV. REVISIONS TO THE NOTICE

A. The right to change the Notice. The pharmacy will state in the Notice that
it reserves the right to revise or change its policies and procedures and
that the revision may or may not affect all PHI, including previously
obtained PHI that the pharmacy maintains.

B. Changes in Law. When there is a change in law that necessitates a
revision to the pharmacy’s policies and procedures, the pharmacy must
promptly document and implement the change to include making revisions
to the Notice to reflect the change in law.

C. Implementation. The pharmacy may change its policy at any time;
however, implementation cannot begin until the notice has been revised
and posted. The date of implementation will be on or after the effective
date stated in the Notice.

D. Posting revised Notice. The revised Notice must be posted in a clear and
prominent location where an individual seeking health care will be able to
read the notice. In addition, the pharmacy will provide, in paper, the
revised Notice for all new individuals and for others upon request.

V. DOCUMENTATION

A. The pharmacy will retain copies of the Notice (original and revisions),
written acknowledgements of receipt, and documentation of good faith
efforts.

B. The pharmacy will retain documentation for six (6) years from the last date
in effect.

VI. REFERENCE: Title 45 C.F.R. 164.520.

PROCEDURE

CREATION OF THE PHARMACY’S NOTICE OF PRIVACY PRACTICES

The Privacy Officer must create a Notice of Privacy Practices which contains all
the requirements of section III (Content of the Notice) above.

REVISIONS OF THE NOTICE
Note. The pharmacy must have a statement in the Notice that states that the pharmacy
reserves the right to change the notice.

The pharmacy will document and revise its Notice, including its effective date,
upon:

• Changes in law (HIPAA regulations or state regulations) that necessitate a
  change in the pharmacy’s privacy practice; or

• Changes in the pharmacy privacy practices.

The pharmacy’s implementation of the revised Notice cannot begin until the
Notice has been revised and posted. The date of implementation will be on or
after the effective date stated in the Notice.

The revised Notice will be posted in a clear and prominent location where an
individual seeking health care will be able to read the notice. In addition, the
pharmacy will provide a paper copy of the revised Notice for all new individuals
and for others upon request.

PROVIDING THE PRIVACY NOTICE

Upon the first visit of the individual (or parent if the patient is a minor) the
pharmacy will provide the individual with a copy of its most current Notice of
Privacy Practices. When a minor patient reaches their eighteenth birthday or has
been adjudicated as an adult, a new copy of the Notice of Privacy Practices will
be provided.

The pharmacy will request the individual to sign an Acknowledgement of Receipt
of the Notice of Privacy Practices (form). If the individual refuses or is unable to
sign, then the pharmacy workforce member will document the good faith effort on
the same form.

The pharmacy may obtain this signature by one of three methods:

• Having the patient sign the Acknowledgement of Receipt of the Notice of
  Privacy Practices (form).

• Using the pharmacy’s computer signature capture software to obtain the
  verification signature acknowledging receipt of the Notice.

• Having the patient sign a signature log book.

DOCUMENTATION OF NOTICES

• The pharmacy will retain copies of the Notice (original and revisions), written
  acknowledgements of receipt, and documentation of good faith efforts according
  to the pharmacy’s Policy and Procedure: Documentation.
  

FORMS

• Notice of Privacy Practices

• Acknowledgement of Receipt of the Notice of Privacy Practices

Copyright © McElroy Phamacy, Inc. Site Design by Sharp Innovations.