PRxN recognizes your right to confidentiality and is committed to protecting your privacy. We use the information that we collect on our site to provide you with the best pharmacy services. The information we require to provide pharmacy services to you includes, in part, your name, mailing address, telephone number, Social Security number, your date of birth, gender, drug allergies, medical conditions, illnesses, current medications and method of payment. We protect all of the information you provide us against unauthorized access or release. We share your personal and prescription information with third parties if legally necessary to do so. If the patient has directed, we will release prescription information to the patient's authorized representative. To the extent specifically authorized by law, we will release such information to other persons and insurance plans. For example, at your request, PRxN may automatically forward your prescription information to your insurance plan so that we can directly handle reimbursement of your prescription purchase on your behalf. When you place an order online, your personal information and credit card information are encrypted using SSL encryption technology before being sent over the Internet, thus providing the maximum protections presently available to protect the privacy of your information. To personalize your experience at PRxN, we may use a feature on your Internet browser called a "cookie." Cookies are small files that your Web browser places on your computer's hard drive. We may use cookies to let us know that you are a prior customer and to retrieve certain information previously provided by you to us so that you do not need to re-enter this information every time you shop at the site. Except as described above, we do not release information stored in cookies to outside vendors. We welcome your feedback. If you have questions or comments about our privacy policies, feel free to send us an e-mail to pharmacy@mptn-nsn.gov. For more information, please contact us. NOTICE OF PRIVACY PRACTICES Pequot Pharmaceutical Network® (PRxN®) One Annie George Drive, Building 3 Mashantucket, Connecticut 06338 Effective Date of this Notice: 4/14/03 Privacy Contact Office - Telephone Number: 800-342-5779 THIS NOTICE DESCRIBES HOW PRESCRIPTION MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. We at PRxN understand that your prescription and medical/health information is personal and private. In order to provide you with quality care and to ensure compliance with certain legal requirements, we create a record of the care and services you receive from us. We respect the privacy and confidentiality of prescription and medical/health information about you and that can be identified with you. This is called “protected health information”. Your protected health information is contained in the medical and billing records maintained by us. It includes demographic information and information that relates to your present, past or future physical or mental health and related health care services. This Notice of Privacy Practices ("Notice") describes the ways in which we may use and disclose your protected health information. It also describes your rights and our legal obligations with respect to your protected health information. This Notice applies to uses and disclosures we may make of all your protected health information, whether created by us, or received by us, from another health care provider. A. OUR LEGAL DUTY TO PROTECT YOUR HEALTH INFORMATION * Federal Laws and our Tribal Laws require PRxN, an unincorporated instrumentality of the Mashantucket Pequot Tribal Nation, to: Ensure the privacy of your protected health information, which we have either created in our practice or received from another health care provider, whether it is about your past, present, or future health care condition; Maintain the privacy of your protected health information regarding payment for your health care; Explain the manner in which we may use and disclose your protected health information; Abide by the terms of this Notice, as currently in effect; and Obtain your written authorization to use or disclose your protected health information for reasons other than those listed below and permitted by law. CHANGES TO THE NOTICE. We reserve the right to amend this Notice at any time in the future, and make the new provisions effective for all protected health information we maintain, regardless of when it was created or received. If the Notice is amended, we will: Post the revised Notice, with the new effective date, at our service locations; Post the revised Notice on our website: www.prxn.com; and Make copies of the revised Notice available to you upon request. INCIDENTAL DISCLOSURES In the process of using or disclosing your protected health information for an authorized use, we may make incidental disclosures. We will take reasonable steps to limit incidental disclosures. B. WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION TO PROVIDE YOU WITH TREATMENT, TO OBTAIN PAYMENT FOR SERVICES RENDERED TO YOU, AND FOR HEALTH CARE OPERATIONS. 1. For treatment: We may use and disclose your protected health information to provide you with medical treatment and services, and to coordinate or manage your health care and related services or contact you for refill reminders. A specific example: We may disclose information about your health condition to your referring physician to dispense your prescription. 2. For Payment: We may use and disclose your protected health information to bill and receive payment for the treatment and services we provide. We may also provide protected health information to collection departments, consumer reporting agencies or other health care provider who requests information necessary for them to collect payment. A specific example: We may verify that a prescription drug treatment that we intend to provide is covered under your health benefit plan. 3. For Health Care Operations: We may use and disclose your protected health information as necessary for us to operate our pharmacy business. We may use and disclose your protected health information for internal operations, such as general administrative activities and quality assurance programs. Examples of when we may use and disclose your protected health information in a health care operation include: To review and improve the quality of care you receive; To train and educate students, volunteers or other medical staff; To plan for services, such as when we assess certain services that we may want to offer in the future; To evaluate the performance of our employees; To our lawyers, consultants, accountants, and other business associates; In order to compare your information with that of several other patients to determine if we should offer new services or if new treatments were effective; To identify groups of patients who have similar health problems to give them information about treatment alternatives, programs, or new procedures; To organizations that assess the quality of care we provide to our patients (such as government agencies or accrediting bodies) To organizations that evaluate, certify or license health care providers, staff or facilities in a particular specialty; For procedures involving health care fraud and abuse detection and compliance; and To develop internal protocols. C. WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION WITHOUT YOUR AUTHORIZATION IN LIMITED SITUATIONS The following are situations in which we may use or disclose your protected health information without your written authorization. 1. As Required by Law: We may disclose your protected health information when required to do so by federal or Tribal law or other judicial or administrative proceedings. 2. Emergencies: We may use or disclose protected health information as necessary in emergency treatment situations. 3. Public Health Risk: We may disclose your protected health information for public health activities. For example, we may disclose protected health information about you if you have been exposed to a communicable disease or may otherwise be at risk of spreading a disease. Other examples may include reports about injuries or disability, reports of births and deaths, reports of child abuse and/or neglect and reports regarding the recall of products. 4. At Our Service Location(s): Unless you object, we may use and disclose certain limited information about you on our sign-in sheet while you are in our service location(s). This information may include your name, but will not include information about your condition. We may also call your name to notify you that your prescription is ready, or that we need to discuss something with you. 5. Individuals Involved in Your Care or Payment for Your Care: Unless you object, we may disclose protected health information about you to a family member, relative, close personal friend or any other person you identify, including clergy, who is involved in your care. These disclosures are limited to information relevant to the person’s involvement in your care or in payment for your care. 6. Disaster Relief: Unless you object, we may disclose protected health information about you to an organization assisting in disaster relief efforts. Even if you object, we may still share information about you if necessary to respond to emergency circumstances. 7. Reporting Victims of Abuse or Neglect: When authorized by Tribal or federal law, or if you agree to the report, and if we believe that you have been a victim of abuse or neglect, we may use and disclose your protected health information to notify a government authority. 8. Health Oversight Activities: When authorized by law, we may disclose your protected health information to a health oversight agency for activities, such as audits, investigations, inspections, licensure actions or other legal proceedings. A health oversight agency is a Tribal or federal agency that oversees the health care system. 9. Judicial and Administrative Proceedings: We may disclose your protected health information in response to a court or an administrative order. In certain circumstances, we also may disclose protected health information in response to a subpoena, a discovery request, or any other lawful process by another party involved in the action. We will make a reasonable effort to inform you about the request. 10. Law Enforcement: We may disclose your protected health information for certain law enforcement purposes, including, but not limited to: Reporting certain types of physical injuries; Reports required by law; Reporting emergencies or suspicious deaths; Complying with a court order, warrant, subpoena (in certain circumstances), or other legal process; Identifying or locating a suspect or missing person, material witness or fugitive; Answering certain requests for information concerning crimes, about the victim of crimes; Reporting and/or answering requests about a death we believe may be the result of a crime; Reporting criminal conduct that took place on our premises; and In emergency situations to report a crime, the location of the crime or victim or the identity, description and/or location of a person involved in the crime. 11. Coroners, Medical Examiners, Funeral Directors: We may disclose your protected health information to a coroner, medical examiner or funeral director. We may disclose information about deceased patients to funeral directors if necessary to allow them to carry out their duties. We may disclose protected health information about you to a coroner or medical examiner for the purposes of identifying you should you die. 12. Organ/Tissue Donation Organizations: If you are an organ donor, we may disclose your protected health information to an organization involved in the donation of organs and tissue to enable them to carry out their lawful duties. 13. Research: In some situations, your protected health information may be used for research purposes, provided that the privacy and safety aspects of the research have been reviewed and approved by an institutional review board or a privacy board. The board must have established procedures to ensure that your protected health information remains confidential. 14. To Avert a Serious Threat to Health or Safety: We may use or disclose your protected health information if we believe it is necessary to prevent a serious threat to your health or safety or the health or safety of the public or another person. We may only make the disclosure to a person or entity that would be able to help lessen or prevent the threatened harm. 15. Military and Veterans: If you are a member of the armed forces, we may use and disclose your protected health information as required by military command authorities. We may also disclose your protected health information to the appropriate foreign military authority if you are a member of a foreign military. 16. National Security and Intelligence Activities: We may disclose protected health information to authorized federal officials conducting national security, counterintelligence, and intelligence activities authorized by law. 17. Protective Services for the President and Others: We may disclose your protected health information to authorized federal officials, as needed, to provide protection to the President of the United States, other authorized persons, foreign heads of states or to conduct certain special investigations. 18. Inmates/Law Enforcement Custody: If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your protected health information to the correctional institution or law enforcement official for the following purposes: To enable the correctional institution or law enforcement official to provide you with necessary health care services; To protect your own health and safety; To protect the health and safety of others; and/or For the safety and security of the correctional institution. 19. Workers’ Compensation: We may use or disclose your protected health information to comply with applicable Tribal or other laws and regulations relating to workers’ compensation or similar programs established by law that provide benefits for work-related injuries and/or illnesses. 20. Treatment Alternatives and Health-Related Benefits and Services: We may use or disclose your protected health information to inform you about treatment alternatives and health-related benefits and services that may be of interest to you. This may include telling you about: treatments; services; products; other health care providers; special programs; nutritional services. 21. Business Associates: We may disclose your protected health information to our business associates under Business Associate Agreements. Business associates may include: Answering Services Accounting Services Attorney/Legal Services D. YOUR AUTHORIZATION IS REQUIRED FOR ALL OTHER USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION. Except for those circumstances listed above as required by law, we will use and disclose your protected health information only with your written authorization. You may revoke your authorization, in writing, at any time. If you revoke an authorization, we will no longer use or disclose your protected health information for the purposes covered by that authorization, except where we have already relied on the authorization. E. YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION You have the following rights regarding your protected health information that we maintain: 1. The Right to Access Your Protected Health Information: Except under limited circumstances, and upon written request, you have the right to inspect and obtain a copy of your protected health information. Your protected health information is contained in our medical and billing records or any other record used by us to make decisions about your care. We may charge you a reasonable amount if we make a copy of your medical record. (There are some circumstances under which we are not permitted to charge you for the record, but in most cases we may charge.) To inspect and request a copy of your protected health information, you should submit your written request to us. We must respond to your request within 30 days, by either supplying the records or sending a written notification of denial. We may deny your request to inspect or receive copies of your PHI in the following limited circumstances: The information was compiled exclusively in connection with a criminal, civil or administrative proceeding; The disclosure to the patient is prohibited by the Clinical Laboratory Improvement Act (42 U.S.C. §263a); You are a correctional institution inmate and the correctional administrators have provided reasons for denying access; The information is for a research study not yet complete; The Privacy Act (5 U.S.C. §552a) prohibits access; The information was obtained by a person other than a health care provider upon our promise to keep the information confidential, and access would reveal the informant’s identity; We determine access is likely to endanger the life or safety of the patient or others; The information contains information about another person and we determine that access is likely to cause substantial harm to that person; The request for access is made by the patient’s personal representative and we believe access is likely to cause substantial harm to the patient or others. If you are denied access to your protected health information, in some cases you will have the right to request a review of this denial. The review will be performed by a licensed health care professional designated by us, who did not participate in the original decision to deny access. 2. The Right to Request Restrictions: You have the right to request a restriction on the way we use or disclose your protected health information for treatment, payment or health care operations. If you wish to request such a restriction, you should submit your written request to us. You must tell us what information you want restricted, to whom you want the information restricted, and whether you want to limit our use, disclosure or both. We are not required to agree to such a restriction. If we do agree to the restriction, we will honor that restriction except as needed to provide you with emergency treatment. 3. The Right to Request Confidential Communications: You have the right to request that we communicate with you concerning your health matters in a certain manner or at a certain location. For example, you can request that we contact you only at a certain phone number or a specific address. You should submit your written request for confidential communications to us. You must tell us how and where you want to be contacted. We will accommodate your reasonable requests, but may deny the request if you are unable to provide us with appropriate methods of contacting you. 4. The Right to Request an Amendment: You have the right to request that we amend prescription or billing records, or other protected health information maintained by us, for as long as the information is kept by us. Your request must be made in writing and must explain the reasons for the requested amendment. We may deny your request for amendment if the information: was not created by us (unless you prove the creator of the information is no longer available to amend the record); is not part of the records maintained by us; in our opinion, is accurate and complete; is information to which you do not have a right of access. We must respond to your request within 60 days of receiving the request. If we agree to the amendment, we will notify you and amend the relevant portions of your medical record. We will also make a reasonable effort to inform business associates and other individuals known to us, or identified by you, as having the protected health information being amended. If we deny your request for amendment, we will give you a written denial notice, including the reasons for the denial and explain to you that you have the right to submit a written statement disagreeing with the denial. Your statement of disagreement will be attached to your medical record. If you should submit a statement of disagreement, we have the right to insert a rebuttal statement into the medical record. We will provide you with a copy of the rebuttal statement. If you do not wish to submit a statement of disagreement, you may request that a copy of the amendment request and a copy of our denial be included with all future disclosures. Should we deny your request for an amendment, you have the right to pursue a complaint process by contacting our Privacy Contact Office, or you may contact the Secretary of Health and Human Services to lodge your complaint. If you wish to request an amendment, you should submit the request to us in writing. 5. The Right to An Accounting of Disclosures: You have the right to request an accounting of certain disclosures of your protected health information made on or after April 14, 2003. You may request an accounting of disclosures made up to six (6) years before the date of your request, beginning with records created on or after April 14, 2003. An accounting is a listing of disclosures made by us or by others on our behalf, but does not include: disclosures made for treatment, payment and health care operations; disclosures made directly to you, that you authorized, or those which are made to individuals involved in your care; disclosures made to correctional institutions or law enforcement officials about an inmate in custody; disclosures made for national security or intelligence purposes; disclosures of a limited data set; or an incidental disclosure. You must submit your request for an accounting of disclosures to us in writing. You must state the time period for which you would like the accounting. We must respond to you within 60 days after receipt of your request. The accounting will include the disclosure date, the name, address (if known) of the person or entity that received the information, a brief description of the information disclosed, and a brief statement of the purpose of the disclosure. If you request a listing of disclosures more than once within a 12-month period, we will charge you a reasonable fee for the accounting. The first accounting, within a 12-month period, is provided to you at no charge. 6. The Right to a Paper Copy of This Notice: You have the right to obtain a paper copy of this Notice, even if you have agreed to receive this Notice electronically. You may request a copy of this Notice at any time by contacting our office in writing or by phone. In addition, you may obtain a copy of this Notice on our website, www.prxn.com. F. SPECIAL RULES REGARDING THE DISCLOSURE OF MENTAL HEALTH CONDITIONS, SUBSTANCE ABUSE, AND HIV-RELATED INFORMATION. For uses and disclosures of your protected health information related to substance abuse, special restrictions may apply. Psychotherapy Notes: A special authorization is required for the disclosure of psychotherapy notes, and special rules may apply which limit the information which is disclosed. G. COMPLAINTS If you believe that your privacy rights have been violated, you may file a complaint in writing with us or with the United States Department of Health and Human Services ("HHS"). 1. To file a complaint with HHS, you may contact: Office of Civil Rights U.S. Department of Health and Human Services 200 Independence Avenue, S.W., Room 509F HHH Building Washington, D.C. 20201 2. To request additional information, to request that we respond to questions, or to file a complaint, you should contact the Privacy Contact Office listed on page one. Address your correspondence to: HIPAA Privacy Officer Pequot Pharmaceutical Network One Annie George Drive, Building Three Mashantucket, CT 06338 3. You will not be retaliated against for filing a complaint.