CENTER STREET PHARMACY NOTICE OF PRIVACY PRACTICES
This notice describes how medical information about you may be used and disclosed as well as how you can get access to this information. If you have any questions or concerns on any of the information listed with the Notice of Privacy Practices document, we ask you to reach out to our Privacy Officer at Center Street Pharmacy by phone at (919)629-4900 or by mail at the address listed within this document.
Please review this information carefully.
USES AND DISCLOSURES
Treatment
Your health information may be disclosed for the purpose of evaluating your health, diagnosing medical conditions, and providing treatment to other healthcare professionals, caregivers, or a designated responsible party. For example, information you share with your pharmacist regarding your medication therapy will be made available in your medical record to all health professionals who may provide treatment or who may be consulted by staff members.
Payment
Your health information may be used to seek payment from your insurance company or credit card companies that you may use to pay for services. For example, your insurance may request and receive information on dates of service, the services provided, and the medical condition being treated.
Health Care Operations
Your health information may be used as necessary to support day-to-day activities and management of Center Street Pharmacy. For example, information on services you received may be used to support budgeting and financial reporting, and activities to evaluate and promote quality.
Law Enforcement
Your health information may be disclosed to law enforcement agencies to support government audits and inspections, to facilitate law-enforcement investigations, and to comply with government mandated reporting.
Public Health Reporting
Your health information may be disclosed to public health agencies as required by law. For example, we are required to report certain communicable disease to the state’s public health department.
Disclosure of your health information for any other purpose than those listed above requires your specific written authorization. You have authorization at any time to change your mind on a use of disclosure. If this occurs, you must submit written revocation of the authorization. Your decision to revoke authorization will not affect or undo any use of disclosure of information that occurred before you notified us of your decision to revoke your authorization.
We are prohibited to use or disclose your protected health information for marketing purposes when financial remuneration is involved without your authorization. We may not use or disclose any psychotherapy notes, sell your protected health information, or use or disclose any of your protected health information that contains genetic information without your authorization.
Information about Treatments
In addition to documentation on your medications as required by federal and state regulations, Center Street Pharmacy may use your health information to send you additional information on the treatment and management of your medical condition(s).
We may also send additional information describing other health-related services and products our pharmacy provides that we believe may be of interest to you.
Marketing
Unless otherwise requested, there are some marketing activities for which we may use your name and address to provide you with information about services available from Center Street Pharmacy. If you would not like to receive communication from our pharmacy, you may opt out of such.
Individual Rights
You have certain rights under federal privacy standards. These include:
- The right to request restrictions on the use and disclosure of your protected health information
- The right to receive confidential communications concerning your medical condition and treatment
- The right to inspect and copy your protected health information
- The right to amend or submit corrections to your protected health information
- The right to receive an account of how and to whom your protected health information has been disclosed to
- The right to receive a printed copy of this notice
Center Street Pharmacy Duties
Center Street Pharmacy is required by law to maintain the privacy of your protected health information and to provide you with this notice of privacy practices. We are also required to abide by all privacy policies and practices outlined within this notice. In the event of any breach of unsecured protected health information, if your information has been compromised it is our duty to notify you.
Right to Revise Privacy Practices
By law, it is permitted to amend or modify our privacy policies and practices. Some of these changes may be required by changes in federal and state laws and regulations. Upon request, we will provide you with the most recently revised notice. The revised policies and practices will be applied to all protected health information we maintain.
Request to Inspect Protected Health Information
As permitted by federal regulations, we require that requests to inspect or copy protected health information be submitted to us in writing. You may obtain a form to request access to your records by contacting Center Street Pharmacy via letter to our address provided on our website. Your request shall be reviewed and will be approved unless there are legal or medical reasons to deny the request of which you shall be notified.
Right to File a Complaint
You may file a complaint with the Office for Civil Rights (OCR) if you believe:
- Center Street Pharmacy or its business associates violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy, Security, or Breach Notification Rules.
- A substance use disorder (SUD) treatment program violated your confidentiality rights under 42 CFR part 2 (called “Part 2”).
OCR can investigate health information privacy complaints against covered entities (health plans, health care clearinghouses, or health care providers that conduct certain transactions electronically) and their business associates. OCR can also investigate complaints of Part 2 violations against a Part 2 program or its qualified service organization; a lawful holder of Part 2 records, such as a HIPAA covered entity or its business associate; or another person holding Part 2 records.
How to File a Health Information Privacy or Security Complaint
Complaint Requirements
Anyone can file a complaint about noncompliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules or 42 CFR part 2 (“Part 2”), Confidentiality of Substance Use Disorder Patient Records.
Your complaint must:
- Be filed in writing by mail, fax, e-mail, or via the OCR Complaint Portal.
- Name the entity involved:
- For a HIPAA complaint, name the covered entity or business associate
- For a Part 2 complaint, name the Part 2 program, Qualified Service Organization, lawful holder of Part 2 records, or other person holding Part 2 records
- Describe the acts or omissions you believed violated the requirements of the Privacy, Security, or Breach Notification Rules or Part 2.
- Be filed within 180 days of when you knew that the act or omission complained of occurred. OCR may extend the 180- day period if you can show “good cause”
HIPAA and Part 2 Prohibit Retaliation
Under HIPAA and Part 2, an entity cannot retaliate against you for filing a complaint. You should notify OCR immediately in the event of any retaliatory action.
File a Health Information Privacy or Security Complaint Online
Open the OCR Complaint Portal and select the type of complaint you would like to file. Complete as much information as possible, including:
- Information about you, the complainant
- Details of the complaint
- Any additional information that might help OCR when reviewing your complaint
You will then need to electronically sign the complaint and complete the consent form. After completing the consent form, you will be able to print out a copy of your complaint to keep for your records
File a Health Information Privacy or Security Complaint in Writing
File a Complaint Using the HIPAA Privacy and Security Complaint Form Package or the Part 2 Complaint Form Package
Open and fill out the HIPAA Privacy and Security Complaint Form Package [PDF, 408 KB] or the Part 2 Complaint Form Package [PDF, 617 KB] in PDF format. You will need Adobe Reader software to fill out the complaint and consent forms. You may either:
- Print and mail the completed complaint and consent forms to:
Centralized Case Management Operations
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Bldg.
Washington, D.C. 20201 - Email the completed complaint and consent forms to OCRComplaint@hhs.gov (Please note that communication by unencrypted email presents a risk that personally identifiable information contained in such an email, may be intercepted by unauthorized third parties)
File A Complaint Without Using Health Information Privacy Complaint Package
If you prefer, you may submit a written complaint in your own format by either:
- Print and mail the completed complaint and consent forms to:
Centralized Case Management Operations
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Bldg.
Washington, D.C. 20201 - Email to OCRComplaint@hhs.gov
Be sure to include:
- Your name
- Full address
- Telephone numbers (include area code)
- E-mail address (if available)
- Name, full address and telephone number of the person, agency, or organization you believe violated your (or someone else’s) health information privacy rights or committed another violation of the HIPAA Privacy, Security, or Breach Notification Rules or Part 2.
- Brief description of what happened. How, why, and when do you believe your (or someone else’s) health information privacy rights were violated, or how the Privacy, Security, or Breach Notification Rules or Part 2 were otherwise violated
- Any other relevant information
- Your signature and date of complaint
If you are filing a complaint on someone’s behalf, also provide the name of the person on whose behalf you are filing.
You may also include:
- If you need special accommodation for us to communicate with you about this complaint
- Contact information for someone who can help us reach you if we cannot reach you directly
- If you have filed your complaint somewhere else and where you’ve filed
Before You File a HIPAA Complaint
Review these questions before filing a HIPAA complaint with OCR.
Are you filing a complaint against an entity that is required by law to comply with the HIPAA Privacy, Security, or Breach Notification Rules?
Not all entities are required to comply with the Privacy and Security Rules. OCR can only investigate the covered entities that must comply with these rules. Covered entities include most:
- Doctors
- Clinics
- Hospitals
- Psychologists
- Chiropractors
- Nursing Homes
- Pharmacies
- Dentists
- Health Insurance Companies
- Company Health Plans
- Medicare, Medicaid, and other government programs that pay for health care
Does your complaint describe an activity that might violate the Privacy or Security Rule?
If you are not sure, go ahead and file your complaint. But, OCR can only investigate complaints that allege an action or omission that fails to comply with the Privacy, Security, or Breach Notification Rules. For example, a doctor can send your medical test results to another doctor without your permission if the doctor needs the information to treat you; this is not a violation of the Privacy Rule, so we would not investigate a complaint that described this situation.
Are you willing to give OCR your name and contact information?
OCR does not investigate complaints filed without a name and contact information on the complaint. If you want OCR to keep your name and contact information confidential during the investigation, you may specify that on the consent form.
What to Expect
You may file a health information privacy and security complaint with the Office for Civil Rights (OCR) if you feel a covered entity or business associate violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy, Security, or Breach Notification Rules (“HIPAA Rules”).
You may also file a complaint with OCR for a potential violation of the confidentiality regulation protecting substance use disorder (SUD) patient records, 42 CFR part 2 (“Part 2”).
How OCR Investigates a Health Information Privacy and Security Complaint
OCR carefully reviews all health information privacy and security complaints. Generally, OCR may take action on complaints only if you file your complaint within 180 days of the violation.
Your complaint also must be about a HIPAA or Part 2 violation by a person or organization who is required to follow those laws (also called a “regulated entity”).
- For HIPAA Complaints, your complaint must be about a violation of the HIPAA Rules by a covered entity or business associate.
- For Part 2 complaints, your complaint must be about a violation of the Part 2 confidentiality requirements for SUD patient records created or received by a federally assisted SUD treatment program or a redisclosure of those records in violation of Part 2.
What Happens After the Investigation
At the end of the investigation, OCR issues a letter describing the resolution of the investigation.
If OCR determines that a regulated entity may not have complied with the HIPAA Rules or Part 2, that entity must:
- Voluntarily comply with the HIPAA Rules or Part 2
- Take corrective action
- Agree to a settlement
If the regulated entity does not take satisfactory action to resolve the matter, OCR may decide to impose civil money penalties (CMPs) on the entity. If CMPs are imposed, the regulated entity may request a hearing in which an HHS administrative law judge decides if the penalties are supported by the evidence in the case.
How to File a Patient Safety Confidentiality Complaint
About Patient Safety Confidentiality
OCR enforces the confidentiality provisions of the Patient Safety and Quality Improvement Act of 2005 (Patient Safety Act) and the Patient Safety and Quality Improvement Rule (Patient Safety Rule). Together, the Patient Safety Act and Rule establish a voluntary system for Patient Safety Organizations (PSOs) to collect and analyze medical error and patient safety event data. To encourage provider reporting, the Patient Safety Act and Rule include Federal privilege and confidentiality protections for patient safety work products (PSWP). Information submitted to, and developed by, these PSOs is protected as PSWP.
What is PSWP?
PSWP is any information:
- Assembled or developed by a health care provider for reporting to a Patient Safety Organization (PSO) that is listed by the HHS Agency for Healthcare Research and Quality (AHRQ) and is documented as being within the provider’s patient safety evaluation system for reporting to a PSO
- Developed by a PSO for the conduct of patient safety activities
- Identifies or constitutes the deliberations, or analysis of, or identifies the fact of reporting pursuant to a patient safety evaluation system
PSWP may identify patients, health care providers and individuals that report medical errors or other patient safety events. This PSWP is confidential and may only be disclosed in certain very limited situations.
Complaint Requirements
Anyone can file a patient safety confidentiality complaint. If you believe that a person or organization shared PSWP, you may file a complaint with OCR. Your complaint must:
- Be filed in writing: sent by mail, fax or e-mail
- Name the person that is the subject of the complaint and describe the act or acts believed to be in violation of the Patient Safety Act requirement to keep PSWP confidential
- Be filed within 180 days of when you knew or should have known that the act complained of occurred, however OCR may waive the 180-day time limit for “good cause” shown
File a Patient Safety Confidentiality Complaint
File a Complaint Using the Patient Safety Confidentiality Complaint Form Package
Open and fill out the Patient Safety Confidentiality Complaint Form [PDF, 671 KB] and Consent Form Package [PDF, 592 KB] in PDF format. You will need Adobe Reader software to fill out the complaint and consent forms. You may either:
- Print and mail or fax the completed complaint and consent forms to the appropriate OCR regional office
- Email the completed complaint and consent forms to OCRComplaint@hhs.gov (Please note that communication by unencrypted email presents a risk that personally identifiable information contained in such an email, may be intercepted by unauthorized third parties)
File a Complaint Without Using Our Patient Safety Confidentiality Complaint Package
If you prefer, you may submit a written complaint in your own format by either:
- Mail or fax to the appropriate OCR regional office
- Email to OCRComplaint@hhs.gov
Be sure to include:
- Your name
- Full address
- Telephone numbers (include area code)
- E-mail address (if available)
- Name, full address and telephone number of the person, agency, or organization you believe violated your (or someone else’s) health information privacy rights or committed another violation of the Privacy or Security Rule
- Brief description of what happened, including how, why, and when you believe a person impermissibly disclosed patient safety work product
- Any other relevant information
- Your signature and date of complaint
You may also include:
- If you need special accommodations for us to communicate with you about this complaint
- Contact information for someone who can help us reach you if we cannot reach you directly
- If you have filed your complaint somewhere else and where you’ve filed
How OCR Investigates Your Complaint
OCR will investigate complaints that allege potential violations of the Rule. To the extent practicable, OCR will provide technical assistance and seek informal resolution of complaints involving the inappropriate sharing of PSWP through voluntary compliance from the responsible person, entity, or organization. When OCR is unable to achieve an informal resolution of an indicated violation through such voluntary compliance, the Secretary may impose a civil money penalty of up to $14,960 for each knowing and reckless disclosure of PSWP that is in violation of the confidentiality provisions.