We at Phipps Pharmacy understand that medical information about you and your health is personal. We are
committed to protecting the privacy of your protected health information (PHI). This “Notice of Privacy Practices”
has been created in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to
help you understand our legal duties to protect your PHI and how we may use your PHI in relation to your past,
present, and future physical or mental health condition or illness and its treatment.
It also summarizes your rights related to your PHI.

We will not use or disclose your health information without your written authorization, except as described below.
If you do authorize us to use or disclose your health information for another purpose, you may revoke your
authorization in writing at any time. The law permits us to use or disclose you health information for the
following purposes without your authorization:

Treatment. HIPAA defines treatment as “the provision, coordination, or management of health care and
related services by one or more health care providers, including coordination or management of health care
by a health care provider; consultation between health care providers relating to a patient; or the referral
of a patient for health care from one health care provider to another.” We will maintain records that contain
your protected health information, and we will use and disclose your PHI as necessary to maintain a patient
profile on you, which may include information about you; your medical condition, medications, and prescription
devices that you use; any allergies that you have; and other information, such as health insurance that you
may have. We may use and disclose your PHI in dispensing prescription medicines and related products and
services, including counseling you and your caregivers about proper use of your medications. We may discuss
such problems with your other health care professionals, such as your physician, and through such discussions
we may disclose your PHI. Finally, we may disclose your PHI to you and your caregivers in our discussions
with you and your caregivers about your treatment.

Payment. HIPAA defines payment, in relation to health care providers such as us, as activities to obtain
reimbursement for the health care products and services that we provide to you. We may use and disclose your
health information to obtain payment from you, an insurance company or a third party for the health care
products and services that we provide to you. In relation to this, public and private health care insurance
programs that may provide or pay for your health care can conduct audits, inspections, and investigations of us
in relation to our activities and your activities. We may be required to disclose your PHI to these programs for
purposes of audits, inspections, and investigations.

Health Care Operations. HIPAA defines health care operations as those activities necessary and related to our
providing of health care products and services to you. These activities include, but may not be limited to, the following.

A. Conducting quality assessment and improvement activities, case management and care coordination, and
contacting of health care providers and patients with information about treatment alternatives and related functions
that do not include treatment.

B. Conducting or arranging for medical review, legal services, and auditing functions, including fraud and abuse
detection and compliance programs.

C. Our pharmacy management and general administrative activities, including, but not limited to, activities relating to
implementation of and compliance with the requirements of HIPAA.

We will use and disclose your health information to carry out the above activities as necessary or required, and
especially to monitor and improve the quality of the health care products and services that are provided to you by us
and other health care professionals.

Business Associates. Due to the nature of the health care system, the involvement of other businesses or persons
may be necessary in order to provide you with health care products and services. Depending on what these businesses
or persons do for us, they may become “business associates” as defined by HIPAA. It will be necessary for us to provide
these business associates with your health information in order for them to carry out the activities on our behalf.
Examples of two of our most common business associates are health insurance companies and companies that process
claims that we submit for payment for health care products and services that we provide to you if you have health
insurance. Contracts have or will be submitted to all of our business associates to whom it is necessary for us to provide
PHI. These contracts require that our business associates agree to protect the privacy of your protected health information.

Disclosures of your health information not involving treatment, payment, and health care operations. When
providing health care products and services to you, it may be necessary for us to communicate with businesses and
individuals not already described above. Most of these disclosures will be related to providing treatment to you, and
carrying out payment and health care operations as discussed above. In addition to communicating with these businesses
and individuals, we may also communicate directly with you as well as with caregivers who assist you with your health care.
We will disclose your health information to these caregivers, or appropriate others, only as we believe necessary and
appropriate for your health care.

Communications with you concerning your health and treatment. We want to do everything we can to assist you
with maintaining your health and to ensure that you obtain the most benefit from your treatment. We routinely monitor your
prescription medications for appropriateness and take other steps to help you use your medication properly. For example,
we may contact you to remind you that a refill of your medication is due. We may also contact you or send you materials
regarding products and services that may be of benefit to you. Also, in the event of a medication recall, we may contact
you if you are taking the medication that is the subject of the recall.

Federal and State Government Agencies. We may disclose your health information to federal and state government
agencies for a variety of health oversight activities. Most of these activities involve monitoring health care and safety or are
government programs related to health care and our compliance with laws applicable to health care. Some of these activities
may include audits, investigations, inspections, and licensure. Examples of these agencies include the United States Drug
Enforcement Administration (DEA) which monitors the distribution and usage of controlled substances and the United States
Food and Drug Administration (FDA) which monitors adverse drug events. In addition, some private businesses, such as the
manufacturers of medications and medical devices, are legally required to conduct post-marketing surveillance in order to
ensure the safety of their products. Disclosing your health information for such surveillance may be necessary.

Federal and State Government Health Care Insurance Programs. If you receive benefits from federal and state health
care programs, such as Medicare or Medicaid (e.g. TennCare), your health information may be disclosed to the agency
granting these benefits. If you are employed by a business that is required to carry workers’ compensation insurance, and
you are injured in such a way that the worker’s compensation plan covers your health care, we may disclose your health
information to the worker’s compensation plan. Such plans have a right to conduct audits, inspections, and investigations
of our activities and your activities. We will disclose you health information for these activities when required.

Public Health Risks. We may disclose health information about you for matters of public health and safety. These activities
may include the following:

(1) to prevent or control disease, injury, or disability; (2) to notify the appropriate public health or government authority to
report suspected abuse, neglect or domestic violence; (3) to notify a person who may have been exposed to a disease or may
be at risk of contracting or spreading a disease or condition.

Aversion of a Serious Threat to Health or Safety. We may use and disclose health information about you when
necessary to prevent or reduce a serious threat to your health or safety or the health and safety of others. A disclosure will
only be made to someone who is able to help prevent or lessen the threat.

Lawsuits and other Legal Disputes. If you are involved in a lawsuit or dispute, we will disclose your PHI when required to
comply with a court order, subpoena, discovery proceeding, such as a deposition, or other legal mandate served upon us.

Specific Government Functions. We may disclose health information for the following government functions:
(1) health information of military personnel (both active and reserve) and veterans as required by
     the U.S. Military or Veterans Services;
(2) health information of inmates, to a correctional institution or law enforcement official;
3) in response to a request from law enforcement, if certain conditions are satisfied; and (4) for national security
    activities and intelligence.

Required by Law. We will disclose health information about you when required to do so by federal, state or local law.

• You have the right to receive this written Notice of Privacy Practices describing how we will protect your health information
and your rights related to your PHI. You may request a copy of this written Notice at any time.

• You have the right to request restrictions on certain uses and disclosures of your health information. However, we may
not be able to agree to your request if it results in our not being able to provide health care products and services to you or
if we are required to use and disclose the health information under federal or state law. All requests for restrictions on the use
and disclosure of your PHI must be submitted to our Pharmacy Privacy Officer in writing using a form that we will provide to you.

• You have the right to inspect and receive a photocopy of our records that contain your protected health information as long
as the pharmacy maintains the health information. The most common records that we maintain are your prescriptions on file
with us, our patient profile for you, and our billing records for health care products and services that have been provided to you.
To inspect or receive copies of your health information, you must submit a written request to us using a form that is available
at the pharmacy. We will be pleased to allow you to review these records at no charge during normal business hours.
However, we may charge a fee for the costs of copying, mailing or other supplies that are necessary to grant your request.
Unless you request otherwise, we will allow an immediate family member to request and receive patient profile billing records
for other immediate family members (i.e. spouse and children). We may deny your request to inspect and copy in certain
limited circumstances. If your request is denied, you may request that the denial be reviewed.

• You have the right to request changes in the content of you health information contained in our records if you believe the
content is incomplete or inaccurate. To request a change, you must submit a written request to the pharmacy (form available
at the pharmacy) along with the reason for the request. A request may be denied if we no longer have the records or if the
requested change would cause your PHI to become inaccurate. If a request is denied, we will notify you in writing of this decision.
You will then have the right to submit a request to have this denial reviewed. We will provide you with information about the
procedure for addressing any disagreement with a denial.

• You have the right to request communications of your health information by alternative means (such as a personal cell phone)
or at alternative locations (such as a post office box). To request confidential communication of your health information, you
must submit a written request to the pharmacy using a form that we will provide to you. This request must state how or when
you would like to be contacted. We will accommodate all reasonable requests.

• You have the right to receive an accounting (written record) of some of our disclosures of your health information made after
April 14, 2003 for purposes other than disclosures (1) for treatment, payment, or health care operation, (2) to you or based
upon your authorization and (3) for certain government functions. To request an accounting, you must do so in writing using a
form that we will provide to you. You must specify the time period, which may not be longer than six years. You may obtain one
accounting during a 12-month period at no charge. However, if you request additional accountings during the same 12-month
period, we may charge you a fee for printing or photocopying of the accounting, as well as any charges incurred
for mailing, faxing, etc.

• You have a right to file a complaint if you believe that we have violated your rights as described above. You can file the
complaint with us directly, or with the United States Department of Health and Human Services (HHS). Please be assured that
we will work with you to resolve and complaint, including providing you with the address for filing a complaint with HHS. There
will be no retaliation for filing a complaint.

We reserve the right to change this Notice. We reserve the right to make the revised or changed Notice effective for health
information we already have about you as well as for future information we receive. We will post any revised Notice in the
pharmacy. A revised copy will be provided to you upon request.

Effective February 20, 2004

© 2008 - 2010 Phipps Pharmacy, All Rights Reserved, All information, code, images, and resources are the copyrighted properties of their respective owners.
Site Design and Maintenance by: Elliott Design © 2008 All Rights Reserved
No portion of this website is to be reproduced in any form.