HIPAA Privacy Notice

Our Pledge of Privacy

At Hill's Drug Store ("Hill's," "we," "us," or "our"), located at 503 Cynwood Dr., Easton, Maryland, we understand that your personal and health information is private. We are committed to protecting the privacy of your Protected Health Information ("PHI") as required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable Maryland state law.

This Notice of Privacy Practices ("Notice") describes how we may use and disclose your PHI to carry out treatment, payment, and health care operations, and for other permitted purposes, and describes your rights regarding that information. We are required to follow the terms of this Notice while it is in effect.

1. Understanding Your Health Information

Each time you visit our pharmacy, a record of your visit is made. This record contains your symptoms, examination, test results, diagnoses, treatment, medications dispensed, and plans for future care. This information, often referred to as your chart or medical record, is the physical property of Hill's Drug Store, but the information belongs to you. This Notice explains how we safeguard that information.

2. How We May Use and Disclose Your Health Information

Under HIPAA, the most common reasons we may use and disclose your health information are described below. Not every use or disclosure in a category is listed; however, all of the ways we are permitted to use and disclose such information fall within these categories.

3. Other Permitted and Required Uses and Disclosures

We may also use or disclose your health information in the following situations:

• Public Health Activities: such as reporting disease outbreaks, births, deaths, child abuse or neglect, and adverse reactions to medications or products.
• Food and Drug Administration (FDA): to report adverse events, product defects, or problems, and to enable product recalls, repairs, or replacements.
• Health Oversight Activities: to a health oversight agency for audits, investigations, inspections, licensure, and other activities necessary for the government to monitor the health care system and compliance with civil rights laws.
• Lawsuits and Disputes: in response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to applicable protections.
• Law Enforcement: to a law enforcement official for purposes such as locating a suspect, fugitive, or missing person, or in connection with a suspected crime, as permitted by law.
• Coroners, Medical Examiners, and Funeral Directors: to identify a deceased person or determine the cause of death, or to carry out their duties as authorized by law.
• Organ and Tissue Donation: to organizations that handle organ procurement or tissue, eye, or bone marrow banks, as necessary to facilitate donation and transplantation.
• Research: under certain circumstances, we may use and disclose health information for research purposes, subject to privacy board or institutional review board approval and applicable waivers.
• Workers' Compensation: for workers' compensation or similar programs as authorized by law.
• To Avert a Serious Threat to Health or Safety: to someone able to help prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Specialized Government Functions: for national security, intelligence, protective services for the President, and correctional institutions, as permitted by law.

4. Uses and Disclosures Requiring Your Written Authorization

The following uses and disclosures of your health information will be made only with your explicit written authorization:

• Any use or disclosure of psychotherapy notes (if we maintain them);
• Uses and disclosures of protected health information for marketing purposes;
• Disclosures that constitute a sale of your protected health information; and
• Any other uses and disclosures not described in this Notice.

You may revoke an authorization in writing at any time by submitting a request to our Privacy Officer at the address below. Once revoked, we will no longer use or disclose your information for the purposes described in that authorization, except to the extent we have already relied on it.

5. Your Health Information Rights

Under HIPAA, you have the following rights regarding your health information:

• Right to Inspect and Copy: You may request to review and obtain copies of your health information. We may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with your request.
• Right to Amend: If you believe your information is incorrect or incomplete, you may request an amendment. We may deny the request if the information was not created by us, is not part of the records you may inspect, or is already accurate and complete.
• Right to an Accounting of Disclosures: You may request a list of certain disclosures of your health information we have made, other than those for treatment, payment, operations, and other excluded categories, for the prior six years.
• Right to Request Restrictions: You may request a restriction or limitation on the health information we use or disclose for treatment, payment, or operations. We are not required to agree to most restrictions, except as required by law regarding out-of-pocket payments to health plans.
• Right to Request Confidential Communications: You may request that we communicate with you about health matters in a certain way or at a certain location, such as only by mail or at a phone number, and we will accommodate reasonable requests.
• Right to a Paper Copy of This Notice: You may request and obtain a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.
• Right to Breach Notification: You have the right to be notified in the event of a breach of your unsecured protected health information, in accordance with applicable law.

To exercise any of these rights, please submit your request in writing to our Privacy Officer at the address listed below. We may require a completed authorization form and will respond to your request within the timeframes required by law.

6. Our Responsibilities

• Maintain the privacy of your health information as required by law;
• Provide you with this Notice of our legal duties and privacy practices;
• Abide by the terms of the Notice currently in effect; and
• Notify you in the event of a breach of your unsecured protected health information.

We reserve the right to change the terms of this Notice at any time and to make the new Notice effective for all protected health information we maintain. When updated, the revised Notice will be posted at our pharmacy and on our website, and a copy will be available upon request. The effective date will appear at the top of the Notice.

7. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. To file a complaint with us, contact our Privacy Officer in writing at the address below. All complaints must be submitted in writing and should include a description of the alleged violation.

You will not be penalized, discriminated against, or retaliated against in any way for filing a complaint or for exercising any of your rights under HIPAA.

8. Contact Us

For more information about this Notice, to exercise your rights, or to file a complaint, you may contact our Privacy Officer at:

This Notice of Privacy Practices is provided for informational purposes and does not constitute legal advice. It reflects our standard practices under HIPAA and applicable Maryland law as of the effective date above.