Northwind Pharmaceuticals, LLC
NOTICE OF PRIVACY PRACTICES
THIS NOTICE OF PRIVACY PRACTICES (“NOTICE”) DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN GET ACCESS TO THIS INFORMATION, YOUR RIGHTS CONCERNING YOUR PROTECTED HEALTH INFORMATION (“PHI”) AND OUR RESPONSIBILITIES TO PROTECT YOUR PHI. PLEASE REVIEW THIS NOTICE CAREFULLY.
HOW WE USE AND RELEASE YOUR PHI?
We primarily maintain your PHI in a secure electronic format. Your information will most often be used, shared, or disclosed electronically. The following section explains some of the ways we are permitted to use and release PHI without authorization from you.
While we are providing you with pharmacy services, we may need to share your PHI with other health care providers or other individuals who are involved in your treatment. For example, we may use or share your PHI to review and dispense your prescriptions or share your PHI with other providers in order to coordinate your health care services and medications.
We may need to share PHI to obtain or provide payment for the health care services provided to you. For example, we may provide your information to an insurance company so it will pay for your prescription.
HEALTH-CARE OPERATIONS PURPOSES
We may need to share your PHI in the course of conducting health care business activities that are related to providing health care to you.
- Quality Improvement Activities – To use and release PHI to improve the quality or the cost of care. This may include reviewing the treatment and services provided to you. This information may be shared with those who pay for your care, or with other agencies that review this data.
- Case Management and Referral – If you have a health problem or a health care need is identified by you or one of your providers, you may be referred to an organization such as a community or government program. This may require the release of your PHI to these agencies.
- Appointment Reminders – To remind you of recommended services, treatments, or scheduled appointments.
- Business Associates – To disclose your PHI to Business Associates for services provided at our practice through contracts with Business Associates, such as medical transcription services and record storage companies. Business Associates are required by Federal law to protect your PHI.
- Audits – To ensure our business practices comply with the law and with our policies. Examples include: audits involving quality of care, medical bills, or patient confidentiality.
- Required By Law – Sometimes we must report some of your PHI to legal officials or authorities, such as law enforcement officials, court officials, governmental agencies, or attorneys. Examples include: reporting suspected abuse or neglect, reporting domestic violence or certain physical injuries, or responding to a court order, subpoena, warrant, or lawsuit request.
- Public Health Activities – We may be required to report your PHI to authorities to help prevent or control disease, injury, or disability. Examples include: reporting certain diseases, injuries, birth or death information, information of concern to the Food and Drug Administration, or information related to child abuse or neglect. We may also have to report to your employer certain work-related illnesses and injuries so that your workplace can be monitored for safety.
- Health Oversight Agencies – We may be required to release PHI to authorities so they can monitor, investigate, inspect, discipline or license those who work in the health-care system, or for governmental benefit programs.
- Activities Related to Death – We may be required to release PHI to coroners, medical examiners and funeral directors so they can carry out their duties related to your death. Examples include: identifying the body, determining the cause of death, or, in the case of funeral directors, carrying out funeral preparation activities.
- Organ, Eye or Tissue Donation – In the event of your death, we may release your PHI to organizations involved with obtaining, storing, or transplanting organs, eyes, or tissue to determine your donor status.
- Research Purposes – At times, we may use or release PHI about you for research purposes. However, all research projects require a special approval process before they begin, and do not involve in any marketing or sales activity. This process may include asking for your authorization. In some instances, your PHI may be used, but your identity is protected.
- To Avoid a Serious Threat to Health or Safety – As required by law and standards of ethical conduct, we may release your PHI to the proper authorities if we believe, in good faith, that such release is necessary to prevent or minimize a serious and/or approaching threat to your health or safety or to the health and safety of the public.
- Military, National Security or Incarceration/Law Enforcement Custody – We may be required to release your PHI to the proper authorities so they may carry out their duties under the law. This may be the case if you are in the military or involved in national security or intelligence activities, or if you are in the custody of law-enforcement officials.
- Worker’s Compensation – We may be required to release your PHI to the appropriate persons to comply with the laws related to workers’ compensation or other similar programs that provide benefits for work-related injuries or illness.
- Persons Involved in Your Care – In certain situations, we may release PHI about you to persons involved with your care, such as friends or family members, unless doing so would be inconsistent with any prior expressed preference that is known to us. We may also give information to someone who helps pay for your care. You have the right to approve such releases, unless you are unable to function, or if there is an emergency.
- Notification/Disaster Relief Purposes – In certain situations, we may share your PHI with the American Red Cross or another similar federal, state, or local disaster relief agency or authority, to help the agency locate persons affected by the disaster.
- To Provide Proof of Immunization – We will disclose proof of immunization to a school or employer where you have agreed to the disclosure on behalf of yourself or your dependent.
- HHS Secretary – We must disclose your PHI to the HHS Secretary to investigate or determine our compliance with the HIPAA.
WHEN IS YOUR AUTHORIZATION REQUIRED?
Except for the types of situations listed above, we must obtain your authorization for any other types of releases of your PHI.
WHAT ARE YOUR RIGHTS REGARDING YOUR PHI?
- Right to Receive This Notice of Privacy Practices – You have the right to receive a paper copy of this notice at any time.
- Right to Request Confidential Communications – You have the right to ask that we communicate your PHI to you in different ways or places. For example, you can ask that we only contact you by telephone at work, or that we only contact you by mail at home. We will do this whenever it is reasonably possible. You can find out how to make such a request by contacting us.
- Right to Request Restrictions – You have the right to request restrictions or limitations on how your PHI is used or released. We have the right to deny your request if it is unreasonable or difficult to administer. However, if you, or a third party on your behalf, have paid for a health care item or service in full, out of pocket, we must honor your request to restrict information from being disclosed to a health plan for purposes of payment or operations. You may obtain information about how to ask for a restriction on the use or release of your information by contacting us.
- Right to Access – With a few exceptions, you have the right to review and receive a copy of your PHI. To receive a copy of your medical records, please call us or submit a request to firstname.lastname@example.org. We will provide you with the necessary forms and assistance. We may charge you the labor costs to copy and/or mail your medical records to you. If you are denied access to your medical records for any reason, we will tell you the reasons in writing. We will also give you information about how you can file an appeal if you are not satisfied with our decision.
- Right to Amend – You have the right to ask that our information in your medical records be changed if it is not correct or complete. You must provide the reason why you are asking for a change. You may request a change by sending a request in writing to us. We will provide you with the necessary forms and assistance. We may deny your request if:
o We did not create the information;
o We do not keep the information;
o You are not allowed to see and copy the information; or
o The information is already correct and complete.
- Right to a Record of Releases – You have the right to ask for a list of releases of your PHI by sending a request in writing to us. Your request may not include dates earlier than the six years prior to the date of your request. If you request a record of releases more than once per year, we may charge a fee for providing the list. The list will contain only information that is required by law. This list will not include releases for treatment, payment, health care operations or releases that you have authorized.
- Right to be notified following a breach of unsecured PHI – You have the right to be notified if we or one of our Business Associates discloses any unauthorized PHI. We will notify you of the breach as soon as possible but no later than sixty (60) days after the breach has been discovered.
WHAT CAN YOU DO IF YOU HAVE A COMPLAINT ABOUT HOW YOUR PHI IS HANDLED?
If you believe that your privacy rights have been violated, you may file a complaint with us or with the Department of Health and Human Services’ Office for Civil Rights in Baltimore, Maryland. See the following link for more information: https://www.hhs.gov/hipaa/filing-a-complaint/what-to-expect/index.html. To receive help in filing a complaint with, you may contact us. You will not be denied treatment or penalized in any way if you file a complaint.
Northwind Pharmaceuticals, LLC
4838 Fletcher Ave
Indianapolis, IN 46203
This Notice of Privacy Practices is effective as of January 1, 2022 and may be updated by us at any time.