The pharmacy will provide individuals a copy of the pharmacy's Notice of Privacy Practices (Notice) upon their first visit to the pharmacy for service on or after April 14, 2003, or when this policy and procedure is implemented (whichever is first). In addition, the pharmacy will post the Notice (and revisions of the Notice) in the pharmacy and make a copy available upon request.
- INTRODUCTION
Purpose of the Notice of Privacy Practices (Notice). Individuals have a right to adequate notice of the uses and disclosures of their PHI that may be made by the pharmacy, the individual's rights, and the pharmacy's legal duties with respect to their PHI.
- PROVISION OF THE NOTICE
- Specific requirements for Pharmacy. The pharmacy will follow the criteria listed below to make the Notice available in paper to individuals and the general public.
- The pharmacy will provide the Notice upon request to any person whether or not that person is a patient of the pharmacy.
- The pharmacy will provide the Notice at the time of first service, including service delivered electronically, beginning no later than the compliance deadline of April 14, 2003.
- In an emergency, the pharmacy will provide the Notice as soon as reasonably practicable after the emergency situation.
- Except in an emergency situation, the pharmacy must make a good faith effort to obtain a written acknowledgement of receipt of the Notice from an individual. If not obtained, the pharmacy will document the efforts made and the reason not obtained.
- The pharmacy must have copies of the Notice available upon request.
- The pharmacy must post the Notice in a clear and prominent location where an individual seeking health care will be able to read the notice.
- Electronic notice. The pharmacy must make an electronic notice available if:
- If the pharmacy maintains a website that provides information about the pharmacy's customer services or benefits, then the pharmacy must prominently post the Notice on the website.
- The pharmacy may provide the Notice by email if the individual agrees to receiving electronic Notice and such agreement has not been withdrawn. If the pharmacy knows that the email transmission has failed, the pharmacy must provide a paper copy of the Notice to the individual.
- If the first delivery of the Notice to an individual is electronic, the pharmacy must provide electronic Notice automatically and contemporaneously in response to the individual's first request for service.
- Upon request, the pharmacy will also provide a paper copy of the Notice to recipients of an electronic Notice.
- CONTENTS OF THE NOTICE
- Required Elements. The pharmacy will provide a Notice that is written in plain language and that contains the following required elements:
- The Notice must contain this statement as a header: “THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.”
- Uses and disclosures. The notice must contain:
- A description and at least one example of the types of uses and disclosures that the pharmacy is permitted to make for treatment, payment, and health care operations.
- A description of each of the other purposes for which a pharmacy is permitted or required to use or disclose PHI without the individual's written consent.
- If a use or disclosure is prohibited or materially limited by other laws, the description of such use/disclosure must be reflected in the notice.
- The description and examples must include sufficient detail to put the individual on notice of the uses and disclosures that are permitted or required by the privacy regulations and other applicable laws.
- A statement that other uses and disclosures may be made only with the individual's written authorization and that the individual may revoke such authorization.
- Separate statements for certain uses or disclosures. The Notice must include separate statements if the pharmacy plans to engage in any of the following:
- The pharmacy may contact the individual to provide appointment reminders or information about treatment alternatives or other health related benefits or services that may be of interest to the individual.
- The pharmacy may contact the individual to raise funds for the pharmacy.
- Individual Rights. The Notice must contain a statement of the individual's rights with respect to PHI and a brief description of how the individual may exercise these rights, including.
- The right to request restrictions on certain uses and disclosures of PHI, including a statement that the pharmacy is not required to agree to a requested restriction.
- The right to receive confidential communication of PHI.
- The right to inspect and copy PHI.
- The right to request an amendment to PHI.
- The right to receive an accounting of disclosures of PHI.
- The right to receive a paper copy of the Notice.
- Pharmacy's duties. The Notice must contain:
- A statement that the pharmacy is required by law to maintain the privacy of PHI and to provide individuals with notice of its legal duties and privacy practices with respect to PHI.
- A statement that the pharmacy is required to abide by the terms of the Notice currently in effect.
- A statement that the pharmacy reserves the right to change the terms of its Notice and to make the new Notice provisions effective for all PHI the pharmacy maintains. A statement that describes how the pharmacy will provide individuals with a revised Notice must also be included.
- Complaints. The Notice will contain a statement that individuals may complain to the pharmacy and to the Secretary of the Department of Health and Human Services if they believe their privacy rights have been violated. This statement will include how the individual may file a complaint with the pharmacy and that the individual will not be retaliated against for filing a complaint.
- Contact. The Notice must contain the name or title and telephone number of a person or office to contact for further information.
- Effective date. The Notice must include the date with which the Notice is first in effect, which may not be earlier than the date on which the Notice is printed or otherwise published.
- REVISIONS TO THE NOTICE
A. The right to change the Notice. The pharmacy will state in the Notice that it reserves the right to revise or change its policies and procedures and that the revision may or may not affect all PHI, including previously obtained PHI that the pharmacy maintains.
B. Changes in Law. When there is a change in law that necessitates a revision to the pharmacy's policies and procedures, the pharmacy must promptly document and implement the change to include making revisions to the Notice to reflect the change in law.
C. Implementation. The pharmacy may change its policy at any time; however, implementation cannot begin until the notice has been revised and posted. The date of implementation will be on or after the effective date stated in the Notice.
D. Posting revised Notice. The revised Notice must be posted in a clear and prominent location where an individual seeking health care will be able to read the notice. In addition, the pharmacy will provide, in paper, the revised Notice for all new individuals and for others upon request.
- DOCUMENTATION
A. The pharmacy will retain copies of the Notice (original and revisions), written acknowledgements of receipt, and documentation of good faith efforts.
B. The pharmacy will retain documentation for six (6) years from the last date in effect.
- REFERENCE: Title 45 C.F.R. 164.520.
PROCEDURE
CREATION OF THE PHARMACY'S NOTICE OF PRIVACY PRACTICES
The Privacy Officer must create a Notice of Privacy Practices which contains all the requirements of section III (Content of the Notice) above.
REVISIONS OF THE NOTICE
Note. The pharmacy must have a statement in the Notice that states that the pharmacy reserves the right to change the notice.
The pharmacy will document and revise its Notice, including its effective date, upon:
Changes in law (HIPAA regulations or state regulations) that necessitate a change in the pharmacy's privacy practice; or
Changes in the pharmacy privacy practices.
The pharmacy's implementation of the revised Notice cannot begin until the Notice has been revised and posted. The date of implementation will be on or after the effective date stated in the Notice.
The revised Notice will be posted in a clear and prominent location where an individual seeking health care will be able to read the notice. In addition, the pharmacy will provide a paper copy of the revised Notice for all new individuals and for others upon request.
PROVIDING THE PRIVACY NOTICE
Upon the first visit of the individual (or parent if the patient is a minor) the pharmacy will provide the individual with a copy of its most current Notice of Privacy Practices. When a minor patient reaches their eighteenth birthday or has been adjudicated as an adult, a new copy of the Notice of Privacy Practices will be provided.
The pharmacy will request the individual to sign an Acknowledgement of Receipt of the Notice of Privacy Practices (form). If the individual refuses or is unable to sign, then the pharmacy workforce member will document the good faith effort on the same form.
The pharmacy may obtain this signature by one of three methods:
Having the patient sign the Acknowledgement of Receipt of the Notice of Privacy Practices (form).
Using the pharmacy's computer signature capture software to obtain the verification signature acknowledging receipt of the Notice.
Having the patient sign a signature log book.
All patient acknowledgment signatures must be maintained by the pharmacy and not destroyed.
DOCUMENTATION OF NOTICES
The pharmacy will retain copies of the Notice (original and revisions), written acknowledgements of receipt, and documentation of good faith efforts according to the pharmacy's Policy and Procedure: Documentation.
FORMS
Notice of Privacy Practices
Acknowledgement of Receipt of the Notice of Privacy Practices
