THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.
PLEASE READ IT CAREFULLY.
This Notice of Privacy Practices (the “Notice”) describes the privacy practices of ARC Cares, LLC., (“ARC”) and the members of its Affiliated Covered Entity (“ARC ACE”). An Affiliated Covered Entity is a group of Covered Entities and Health Care Providers under common ownership or control that designates itself as a single entity for purposes of compliance with the Health Insurance Portability and Accountability Act (“HIPAA”). The members of the ARC ACE will share Protected Health Information (“PHI”) with each other for the treatment, payment and health care operations of the ARC ACE and as permitted by HIPAA and this Notice.
PHI is information about that we obtain to provide our services and that can be used to identify a patient. It may include but is not limited to name and contact information, as well as information about health, medical conditions and prescriptions. It may relate to past, present or future physical or mental health or condition, the provision or health care products and services or payment for such products or services.
We are required by law to protect the privacy of PHI and to provide you with this Notice explaining our legal duties and privacy practices regarding PHI. This Notice describes how we may use and disclose PHI. We have provided you with examples; however, not every permissible use or disclosure will be listed in this Notice. This Notice also describes rights and the obligations regarding the use and disclosure of PHI. We and our employees and workforce members are required to follow the terms of this Notice or any change to it that is in effect. We are required to follow state privacy laws when they are stricter (or more protective of PHI) than the federal law. Note that some types of sensitive PHI, such as HIV information, genetic information, alcohol and/or substance abuse records and mental health records may be subject to additional confidentiality protections under state or federal law.
Uses and Disclosures of PHI for Treatment, Payment and Health Care Operations
We may use and disclose PHI for treatment, payment and health care operations without written authorization. The following categories describe and provide some examples of the different ways that may use and disclose PHI for these purposes:
Treatment: We may use and disclose PHI to provide and coordinate the treatment, medication and services received. For example, we may:
- Use and disclose PHI to provide and coordinate the treatment, medication and services received from ARC.
- Disclose PHI to other third parties, such as pharmacies, doctors, hospitals or other health care providers to assist them in providing care or for care coordination. In some instances, uses and disclosures of PHI for these purposes may be made through a Health Information Exchange or similar shared system.
- Contact you to provide treatment-related services, such as refill reminders, adherence communications or treatment alternatives (e.g., available generic products).
Payment: We may use and disclose PHI to obtain payment for the services we provide and for other payment activities related to the services we provide. For example, we may:
- Share PHI with insurer, pharmacy benefit manager, or other health care payor to determine whether it will pay for health care products and services needed and payment amounts owed.
- Contact you about a payment or balance due for prescriptions dispensed by ARC or the disclosure of PHI to other health care providers, health plans or other HIPAA Covered Entities who may need it for their payment activities.
Health Care Operations: We may use and disclose PHI for health care operations — those activities necessary to operate our health care business. For example, we may:
- Use and disclose PHI to monitor the quality of our health care services, to provide customer services, to resolve complaints and to coordinate care.
- Transfer or receive PHI if we buy or sell pharmacy locations.
- Use and disclose PHI to contact you about health-related products, services or opportunities that may interest you, such as programs for ARC patients.
- Disclose PHI to other HIPAA Covered Entities that have provided services so that they can improve the quality and efficacy of the health care services they provide or for their health care operations.
- Use PHI to create de-identified data, which no longer identifies a patient, and which may be used or disclosed for analytics, business planning or other purposes.
Other Uses and Disclosures of Your PHI that Do Not Require Authorization
We are also allowed or required to share PHI, without authorization, in certain situations or when certain conditions have been met.
Business Associates: When we contract with third parties to perform certain services for us, such as billing or consulting, these third party service providers, known as Business Associates, may need access to PHI to perform these services. They are required by law and their agreements with us to protect PHI in the same way we do.
Individuals Involved in Your Care or Payment for Your Care: We may disclose a patient’s PHI to a friend, personal representative, family member or any other person identified as a caregiver or authorized individual, who is involved in the patient’s care or the payment related to that care. For example, we may provide prescriptions and related information to the caregiver or authorized individual on the patient’s behalf. We may also make these disclosures after death unless doing so is inconsistent with any prior expressed preference documented by ARC. Upon death, we may disclose PHI to an administrator, executor or other individual authorized under law to act on behalf of the estate. If the patient is a minor, we may release PHI to parents or legal guardians when permitted or required by law.
Workers’ Compensation: We may disclose PHI as necessary to comply with laws related to workers’ compensation or similar programs.
Law Enforcement: We may disclose PHI to law enforcement officials as permitted or required by law. For example, we may use or disclose PHI to report certain injuries or to report criminal conduct that occurred on our premises. We may also disclose PHI in response to a court order, subpoena, warrant or other similar written request from law enforcement officials.
Required by Law: We will disclose PHI when required to do so to comply with federal, state or local law.
Judicial and Administrative Proceedings: We may disclose PHI in response to a court or administrative order, subpoena, discovery request or other lawful process.
Public Health and Safety Purposes: We may disclose PHI in certain situations to help with public health and safety issues when we are required or permitted to do so, for example to: prevent disease; report adverse reactions to medications; report suspected abuse, neglect or domestic violence; or to prevent or reduce a threat to anyone’s health or safety.
Health Oversight Activities: We may disclose PHI to an oversight agency for certain activities including audits, investigations, inspections, licensure or disciplinary actions, or civil, administrative and criminal proceedings, and as necessary for oversight of the health care system, government programs or compliance with civil rights laws.
Research: Under certain circumstances, we may use or disclose PHI for research purposes. For example, we may use or disclose PHI as part of a research study when the research has been approved by an institutional review board and there is an established protocol to ensure the privacy of information.
Coroners, Medical Examiners and Funeral Directors: We may disclose PHI to coroners, medical directors or funeral directors so that they can carry out their duties.
Organ or Tissue Donation: We may disclose PHI to organ procurement organizations.
Notification: We may use or disclose PHI to notify or assist in notifying a family member, personal representative or any other person responsible for a patient’s care regarding location, general condition or death. We may also disclose PHI to disaster relief organizations so that family or other persons responsible for a patient’s care can be notified of location, general condition or death.
Correctional Institution: If a patient is or becomes an inmate of a correctional institution, we may disclose PHI to the institution or its agents to assist them in providing health care, protecting health and safety or the health and safety of others.
Specialized Government Functions: We may disclose PHI to authorized federal officials for the conduct of military, national security activities and other specialized government functions.
Uses or Disclosures for Purposes that Require Your Authorization
Use and disclosure of PHI for other purposes may be made only with written authorization and unless we have authorization we will not:
- Use or disclose PHI for marketing purposes.
- Sell PHI to third parties (except for in connection with the transfer of a business to another health care provider required to comply with HIPAA).
- Share psychotherapy notes (to the extent we have any).
We will obtain written authorization before using or disclosing PHI for purposes other than those described in this Notice or otherwise permitted by law. Authorization may be revoked at any time by submitting a written notice to ARC. Your revocation will be effective upon receipt; however, it will not undo any use or disclosure of PHI that occurred before ARC is notified, or any actions taken based upon authorization.
Your Health Information Rights
Written Requests and Additional Information: Additional information may be requested about ARC’s privacy practices or obtain forms for submitting written requests by contacting ARC.
Obtain a Copy of the Notice: You have the right to obtain a paper copy of our current Notice at any time. You may do so by contacting ARC.
Inspect and Obtain a Copy of Your PHI: With a few exceptions, you have the right to see and get a copy of the PHI we maintain about you (or a patient, if you are identified as a caregiver or authorized individual of that patient). You may request access to such PHI electronically. To inspect or obtain a copy of such PHI, submit a written request to ARC. You may also ask us to provide a copy of such PHI to another person or entity. A reasonable fee may be charged for the expense of fulfilling request as permitted under HIPAA and/or state law. We may deny a request to inspect and copy record in certain limited circumstances.
Request an Amendment: If you feel that the PHI maintained by ARC is incomplete or incorrect, you may request that we amend it. For example, if a date of birth is incorrect, you may request that the information be corrected. To request an amendment, submit a written request to ARC. You must include a reason that supports the request.
Receive an Accounting of Disclosures: You have the right to request an accounting of disclosures we make of PHI for purposes other than treatment, payment or health care operations. Please note that certain other disclosures need not be included in the accounting we provide to you. To obtain an accounting, submit a written request to ARC. We will notify you in advance of the cost involved, and you may choose to withdraw or modify your request at that time.
Request Confidential Communications: You have the right to request that we communicate with you in a certain way or at a certain location. For example, you may request that we contact you only in writing at a specific address. To request confidential communication of PHI, submit a written request ARC. Your request must state how, where or when you would like to be contacted. We will accommodate all reasonable requests.
Request a Restriction on Certain Uses and Disclosures: You have the right to request additional restrictions on our use and disclosure of PHI by sending a written request to ARC. We are not required to agree to any request except where the disclosure is to a health plan or insurer for purposes of carrying out payment or health care operations, is not otherwise required by law and the PHI is related to a health care item or service for which you, or a person on behalf of a patient, has paid in full out-of-pocket. If you do not want a claim for payment submitted to health plan on record, please discuss with the pharmacist or health care provider before any services or products are provided by ARC.
Notification of Breach: You have a right to be notified in the event there is a breach of unsecured PHI as defined by HIPAA.
To Report a Problem
Complaints: If you believe privacy rights have been violated, you can file a complaint ARC or with the Secretary of the United States Department of Health and Human Services. All complaints must be submitted in writing. You will not be penalized or otherwise retaliated against in any way for filing a complaint.
Changes to this Notice
We reserve the right to make changes to this Notice as permitted by law and to make the revised Notice effective for PHI we already have about you as well as any information we receive in the future, as of the effective date of the revised Notice. If we make material or important changes to our privacy practices, we will promptly revise our Notice. Upon request, ARC will provide a revised Notice to you. We will also post the revised Notice on our Web site at ARCCares.com and will make copies available at our facilities and locations where patients receive health care products and services from us.
Effective Date. This Notice is effective as of March 2019.