Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. .

At Best Quality Health, we value your relationship, and want you to know we respect your privacy. We are committed to protecting your private personal health information, and we will only use and disclose your personal health information as necessary to provide you with health care products and services. Protected health information (PHI) is any information that we possess, use and disclose that identifies you and relates to your past, current or future physical and mental health condition or illness and the health care products and services that have been provided to you.

This purpose of this "Notice of Privacy Practices" (Notice) is to help you understand our legal duties to protect your PHI and how we may use and disclose your PHI in relation to your past, present and future physical or mental health condition or illness and its treatment. The use and disclosure of your PHI will primarily involve the health care products and services that we provide you, such as dispensing your prescriptions. Specifically, we will use and disclose your PHI as necessary in providing treatment to you, obtaining payment for health care products and services provided to you and other health care operations as described later in this Notice. This Notice also describes your legal rights related to your PHI that is in our possession. We take the obligations described in this Notice very serious, because we are legally required to comply with this notice, and because we respect you and your right to privacy.

Your PHI will only be used and disclosed as described in this Notice. Should a situation requiring use and disclosure of your PHI that is not described in this Notice occur, we will obtain your written authorization before the use and disclosure. At some future date it may be necessary for us to revise this Notice. If this occurs, we will post the revised Notice in the pharmacy and, if you request, provide a written Notice to you.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), provides you with several rights related to your PHI. These rights are summarized below. If you would like more information about your rights, please ask to speak with our Privacy Officer at the address or telephone number above.

Right to Receive Notice of Privacy Practices: You have the right to receive this written Notice of Privacy Practices describing how we will protect your PHI and your rights related to PHI. You are entitled to request this written Notice at any time.

Right to Request Limitation of Use and Disclosure of PHI: You have the right to request a limitation on our use and disclosure of your PHI. But please be aware that we may not be able to agree to your requested limitation if it results in our not being able to provide health care products and services to you or if we are required to use and disclose the PHI under federal or state law. All requests for limitation on the use and disclosure of your PHI must be submitted to our Privacy Officer in writing using a form that we will provide to you.

Right to Review and Receive a Copy of Records: You have the right to review or receive photocopies of our records that contain your PHI, to the extent that these records are part of a designated record set as defined by HIPAA. The most common type of records are your prescriptions on file with us, our patient profile for you and our billing records for health care products and services that have been provided to you. If you wish to review or obtain a copy of a family member's PHI you may need to complete a "Right to Access and Consent for Release of PHI to Patient's Authorized Representative". This is of course subject to any limitations on use and disclosure of PHI we have on file for that family member. We will be pleased to allow you to review such records meeting the requirements of this Notice of Privacy Practices at no charge during normal business hours. However, we may charge you a reasonable, cost-based fee for photocopies of the records, together with any expenses for mailing, special courier, faxing and supplies necessary to complete your records request.

If we are unable to provide our records to you, we will provide you a written explanation of why we are not able to provide the records. Depending on the reason, you may submit a written request for us to reconsider. All requests to review or receive photocopies of our records that contain your PHI must be submitted to our Privacy Officer in writing using a form that we will provide to you.

Right to Request Amendments to Records: You have the right to request changes in the content of your PHI contained in our records where you believe the content is incomplete, inaccurate or for some other reason needs to be changed. We may not be able to agree to your requested change if we no longer have the records or if the requested change would cause your PHI to become inaccurate. If we are not able to agree to your requested change we will notify you in writing as to why we are not able to agree. You will then have the right to submit to us a written statement of disagreement, to which we may elect to further respond in writing to you. All requests for change to your PHI in our records must be submitted to our Privacy Officer in writing using a form that we will provide to you.

Right to Request Confidential Communications: You have the right to request that we communicate with you about your PHI in a confidential manner and only to locations (such as a post office box) or by means (such as personal cellular telephone) specified by you. All requests for confidential communications must be submitted to our Privacy Officer in writing. using a form that we will provide to you.

Right to an Accounting of Non-Treatment, Payment and Operations (TPO) Disclosures: You have the right to obtain an accounting of some of our disclosures of your PHI made after April 14,2003. By accounting we main a written record of these disclosures. Some of our disclosures of your PHI are not required by HIPAA to be included in the accounting. Most notable among these are disclosures for purposes of TPO. Other disclosures of your PHI that are not required to be included in the accounting are disclosures make directly to you or that you have authorized, made to family, friends and others who assist you with your care (caregivers) and made for other purposes allowed by HIPAA. Please consult with our Privacy Officer for more information on the disclosures not required to be included in the accounting.

We are required to provide an accounting of disclosures for the six (6) year period immediately prior to the date of your request for the accounting; however, your request for an accounting can be for a shorter period of time and cannot precede the HIPAA compliance date. You may obtain from us, without charge, one accounting during a twelve-month period. However, if you request additional accountings during the same twelve month period we may charge you a reasonable, cost-based fee for printing or photocopying of the accounting, together with any expenses for mailing, special courier, faxing and supplies necessary to fulfill your request for the accounting. If it becomes necessary for us to charge you for an accounting, we will notify you in advance and allow you to withdraw or modify your request for the accounting. All requests for an accounting of our disclosures of your PHI must be submitted to our Privacy Officer in writing.

Right to File a Complaint: You have the right to file a complaint if you believe that we have violated your rights as described above, and to not fear retaliation or adverse action by us against you for exercising your right. You can file the complaint with us directly, or with the United States Department of Health and Human Services (HHS). Please be assured that we will work with you to resolve any complaint including providing you with the address for filing a complaint with HHS. If you have any concern about our privacy practices or wish to file a complaint, please contact our Privacy Officer at the address or telephone number of our pharmacy.

If you have any questions about any of your privacy rights as described, please contact our Privacy Officer at the address or telephone number listed at the beginning of this document.

Normal Pharmacy Activities Resulting in Uses and Disclosures of your PHI

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), requires that this "Notice" describe how we may use and disclose your protected health information (PHI). These uses and disclosures are summarized below, but if you would like more information about any of these please contact our Privacy Officer at the address or telephone number of our pharmacy.

Treatment: HIPAA regulations define treatment as "the provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another". We will maintain records that contain your PHI and we will use and disclose your PHI as necessary to provide health care products and services to carry out and support your treatment. As a pharmacy, we will use and disclose your PHI as necessary to maintain your patient profile, which includes information about you, your medical condition, medications and prescription devices that you use, any allergies that you may have and other information, such as any health insurance that you may have. We will use and disclose your PHI in dispensing prescription medicines and related products and services, including counseling you and your caregivers about proper use of your medications. We will also use your patient profile to watch for medication related problems, such a drug interactions and overuse or under use of your medications that may present a risk to you. We may discuss such problems with your other health care professionals, such as your physician or dentist, and through such discussions, we may use and disclose your PHI. And of course, we will use and disclose your PHI to you and your caregivers (if you allow us), in our discussions with you and your caregivers about your treatment.

Payment: HIPAA regulations define payment, in relation to health care providers such as pharmacies, as activities to obtain reimbursement for the health care products and services that we provide to you. These activities include primarily billing you directly or someone who pays for your health care, such as a family member or health insurance company, for health care products and services that we provide to you. Activities related to billing may include claims management, collections and related health care data processing. Depending on who pays for the health care products and services that we provide you, other activities may include eligibility determination; drug coverage determination; medical necessity under a health plan; appropriateness of care, or justification of charges; including prior authorization of drugs and services; prospective and retrospective drug utilization review services. Some examples of PHI that may be used and disclosed to collect payment are:

Name Address Birthdate Gender Social Security Number Insurance Member ID Number Relationship to Insured Health Plan Information Health Care Provider Information

We will use and disclose your PHI to carry out the above activities as necessary or required to obtain payment for the health care products and services that we provide to you. In relation to this, public and private health care insurance programs that may provide or pay for your health care can conduct audits, inspections and investigations of us in relation to our activities and your activities. We may be required to disclose your PHI to these programs for purposes of audits, inspections and investigations. Health care operations: HIPAA defines health care operations as those activities necessary and related to our providing of health care products and services to you. These activities include, but may not be limited to, the following:

- Conducting quality assessment and improvement activities, case management, disease management and care coordination, contacting of health care providers and patients with information about treatment alternatives and related functions that do not include treatment.

- Conducting or arranging for medical review, legal services and auditing functions, including fraud and abuse detection and compliance programs.

- Our pharmacy management and general administrative activities, including, but not limited to, activities relating to implementation of and compliance with the requirements of HIPAA.

We will use and disclose your PHI to carry out the above activities as necessary or required, and especially to monitor and improve the quality of the health care products and services that are provided to you by us and other health care professionals.

In addition to treatment, payment and health care operations as described above, we may use and disclose your PHI for the following purposes:

Business associates: The health care system is very complex and as such we may not be able to provide health care products and services to you without the involvement of other businesses or persons. Depending on what these other businesses or persons do for us, they may become "business associates" as defined by HIPAA. In many situations it will be necessary for us to provide your PHI to these business associates so that they can carry out the activities that we need to have performed in order to provide you health care products and services. For patients that have health insurance that includes a pharmacy benefit, one of our most common business associates is a health insurance company or a pharmacy benefits company that processes claims we submit for payment for health care products and services on your behalf. We have written contracts with all of our business associates to whom we provide your PHI so that they can carry out their activities on our behalf. In an effort to provide you a level of comfort, you should know, these contracts require our business associates to give us their assurance that they, like us, will protect the privacy of your PHI.

Communications with you concerning your health and treatment: We want to do whatever we can to assist you with maintaining your health and obtaining the most benefit from your treatment. We routinely monitor your prescription medications for appropriateness and take other steps to help you use your medication properly. For example, if you forget to obtain a refill of your medication, we may contact you to remind you to obtain the refill. We may also call you or send you materials regarding products and services that we believe may be of benefit to you. In the event that a pharmaceutical manufacturer or the Food and Drug Administration (FDA) is to issue a medication recall, we may contact you if you are taking the medication subject to the recall.

Federal and state government agencies: We may disclose your PHI to federal and state government agencies for a variety of purposes, most of which are directed at monitoring health care quality and safety, government programs related to health care and our compliance with laws applicable to health care. For example, the United State Drug Enforcement Administration (DEA) monitors the distribution and use of controlled substances, while the FDA monitors adverse drug events. We may disclose your PHI to such agencies where required by the agency so that the agency can carry out its required activities. Related to this, some private businesses, such as the manufacturers of medications and medical devices, are legally required to conduct post marketing surveillance in order to ensure the safety of their products. Disclosing your PHI for such surveillance may be necessary. A number of state agencies also conduct health care quality and safety activities, for which we may disclose your PHI. For example, some states maintain a controlled substance monitoring program and require that we report to the state the prescriptions for controlled substances that we dispense to you.

Federal and state government health care insurance programs: If you apply for and receive benefits from federal and state health care programs, such as Medicare or Medicaid, your PHI may be disclosed to the agency granting these benefits. If you are employed by a business that is required to carry workers' compensation insurance, and you are injured in such a way that the workers' compensation plan covers your health care, it may be necessary to disclose you PHI to the workers' compensation plan. Such plans have a right to conduct audits, inspections and investigations of our activities and your activities, and where required, we will disclose your PHI for these activities.

Public health and safety: There are several federal and state laws that require health care providers to report to various government agencies matters related to public health. If your physical or mental health condition and illness is of a nature that requires that it be reported, then we will disclose your PHI to the appropriate government agency in order to comply with these laws. In addition to reporting about physical and mental health conditions and illnesses, we may also disclose your PHI to government agencies in other situations where we are required to submit reports, such as suspected domestic, child or elder abuse or neglect.

Law enforcement activities: A number of federal, state and local government agencies are charged with enforcing the health care and drug laws, and other laws in relations to the health care products and services that we may provide to you. In addition, as a state licensed pharmacy, a variety of federal, state and local health care agencies, such as the state board of pharmacy, regulate our activities. These agencies may engage in a number of activities designed to monitor and improve federal and state health care programs and systems, including conducting of inspections and investigations of our activities and the health care products and services that we provide to our patients. At any time we are required by federal or state laws, or by court order, subpoena of other legal mandate, to disclose your PHI we will do so as necessary.

Legal disputes: Lawsuits and other legal disputes are common today, and depending on the issues, may involve your PHI that we possess. In the event that you are involved in a lawsuit or other legal proceeding, whether as a plaintiff or a defendant, and without regard to the basis for the lawsuit, such as medical malpractice or divorce, we will disclose your PHI when required to comply with a court order, subpoena, discovery proceeding, such as a deposition, or other legal mandate served upon us. We will attempt to notify you prior to the disclosure if you are not the party to the legal dispute requesting your PHI so that you and your attorney can determine whether you want to take legal actions to prevent disclosure of your PHI.

Disclosures for the benefit of you and others: Events can occur where we would use and disclosure your PHI for your benefit and to prevent or reduce the risk of harm to you. For example, if you are in a car accident and are unconscious in a hospital emergency room and the emergency room medical staff calls us with a request for your PHI, we may disclose it for the purpose of assisting in your prompt medical treatment. The same is true if a family member, friend or caregiver contacts us in an emergency situation, or where an emergency situation is not present, but we have reason to believe you are at risk of harm or serious injury and we believe that disclosing your PHI will assist them in caring for you. We may also disclose your PHI upon your death to a funeral director, embalmer, medical examiner or coroner's office to assist them in carrying out their legal responsibilities related to your death. Finally, we may disclose your PHI where necessary to protect the health and safety of others.

Disclosures for national security and intelligence: We are legally required to disclose your PHI when necessary to national security and intelligence and counter-intelligence activities. Any disclosure for these purposes would be made only to authorized government officials.

Disclosures if you are in the military or a veteran: We may disclose your PHI, if you are a member of any branch of the armed services, whether on active or reserve status. If you are a veteran, we may release your PHI. Particularly if you are receiving health care products and services from the Veterans Services. Any disclosure for these purposes would be made only to authorized government officials.

Disclosures of a miscellaneous nature: We may be required to disclose your PHI if you are placed into custody of a federal or state correctional system if necessary to protect the health and safety of you and others. Health care is an area where much research is being conducted, and we may disclose your PHI for purposes of a research project, but only if we are satisfied that the research project has been approved by a responsible institutional review board and the research project has established adequate methods to protect your privacy. Much health care research is sponsored through organizations that conduct fundraising activities, and we may inquire with you using your PHI to determine your interest in participating in or otherwise supporting a fundraising activity. Finally, given the national need for organ donations, we may disclose your PHI to organizations that manage organ transplantation programs.

If you have any questions about any of the uses and disclosures of your PHI as described above, Please contact our Privacy Officer at the address or telephone number listed at the beginning of this document.

Uses and Disclosures not Contained in this Notice

If a use and disclosure of your PHI is not contained in this Notice, we will obtain your written authorization before the use and disclosure. You may have the right to refuse to authorize the use and disclosure, or if you grant the authorization, to revoke the authorization at any time. If such authorization is requested, we will provide you with a form that describes the proposed use and disclosure and your rights related to the requested authorization.

HIPAA requires that we give you this "Notice of Privacy Practices" and make a good faith effort to obtain your written acknowledgement that you were given this notice. Upon giving you this Notice, you will be asked to sign a document acknowledging that you received this notice. We appreciate your cooperation in reviewing this notice and in giving us your written acknowledgment.

HIPAA also requires that this Notice, at a minimum, cover the following three areas.

- How we will use and disclose your personally identifiable health information.

- Your rights with respect to your personally identifiable health information.

- Our legal duties to protect the confidentiality of your personally identifiable health information.

In preparing this Notice, we made every effort to comply with this HIPAA requirement. Also, you should be aware that the Federal regulation HIPAA does not take precedence over State Law when the State Law is more strict. You may have additional protections under State Law.

Please consult our Privacy Officer if you have any questions or want more information concerning your health care and privacy rights under HIPAA or the laws of our state, or our privacy practices. Also, you should consult our Privacy Officer if you wish to file a complaint about our privacy practices or if you believe we have violated any of your rights as described in this Notice.

Thank you for allowing us the privilege of assisting you with your health care needs. We look forward to providing you with high quality health care products and services.