HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice applies to protected health information ("PHI") maintained by American Drug Center, Inc. t/a Med Emporium when MedEmp is acting as a healthcare provider or supplier subject to HIPAA.

Your Rights

Get a Copy of Your Health Information

You may ask to inspect or obtain an electronic or paper copy of health information we maintain about you. We generally will provide access or a copy within the timeframe required by law. A reasonable, cost-based fee may apply when permitted.

Ask Us to Correct Your Information

You may ask us to amend health information that you believe is inaccurate or incomplete. We may deny certain requests when permitted by law, but we will explain the decision in writing.

Request Confidential Communications

You may ask us to contact you in a specific way or at a different address. We will accommodate reasonable requests as required by law.

Ask Us to Limit What We Use or Share

You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations. We are not always required to agree.

If you pay for a healthcare item or service out of pocket in full, you may ask us not to disclose information about that item or service to your health plan for payment or healthcare operations. We will honor that request when HIPAA requires us to do so unless another law requires disclosure.

Receive an Accounting of Certain Disclosures

You may ask for an accounting of certain disclosures of your health information made during the period allowed by law. The accounting will not include disclosures that HIPAA excludes from the accounting requirement, such as many disclosures for treatment, payment, and healthcare operations.

Receive a Copy of This Notice

You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

Choose Someone to Act for You

If another person has legal authority to act as your personal representative, that person may exercise your applicable rights after we verify the authority.

File a Complaint

You may complain to MedEmp if you believe your privacy rights have been violated. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. MedEmp will not retaliate against you for filing a privacy complaint.

Your Choices

In certain situations, you may tell us your preferences concerning disclosures of your health information, including sharing with family members, friends, caregivers, or others involved in your care or payment for your care. If you cannot tell us your preference, we may disclose information when permitted by law and when we reasonably believe the disclosure is in your best interest.

Written authorization generally is required for uses or disclosures involving marketing when HIPAA requires authorization, sale of PHI when HIPAA requires authorization, and most uses and disclosures of psychotherapy notes if MedEmp were ever to maintain such records. You may revoke a HIPAA authorization in writing, subject to actions already taken in reliance on it.

How We Typically Use or Share Health Information

Providing or Coordinating Equipment and Care

We may use and disclose health information to provide equipment and related services or coordinate with physicians, therapists, caregivers, manufacturers, or other healthcare professionals involved in your care.

Payment

We may use and disclose health information to bill and obtain payment from Medicare, Medicaid, Medicare Advantage organizations, private insurers, secondary insurers, or other responsible payers.

Healthcare Operations

We may use and disclose health information to operate our business and healthcare activities, including quality improvement, customer service, compliance, auditing, training, credentialing, fraud prevention, and other permitted healthcare operations.

Business Associates

We may provide PHI to vendors that perform services on our behalf where the vendor qualifies as a HIPAA business associate. When required, these vendors must enter into appropriate agreements requiring them to safeguard PHI.

Other Permitted or Required Uses and Disclosures

Subject to applicable legal requirements, we may use or disclose health information:

• for public-health and safety activities;
• in connection with product recalls or safety notices;
• to report certain adverse events;
• when required to report suspected abuse, neglect, or domestic violence;
• to reduce a serious threat to health or safety;
• for health oversight activities;
• for workers’ compensation;
• for certain lawful law-enforcement purposes;
• in response to qualifying court or administrative proceedings;
• to comply with applicable federal or state law;
• to medical examiners, coroners, or funeral directors where legally permitted;
• for certain government functions; or
• for research when all applicable legal conditions have been satisfied.

Substance Use Disorder Records

To the extent MedEmp maintains information that constitutes substance use disorder patient records protected by 42 CFR Part 2, additional protections apply. Such records may be used or disclosed only as permitted by applicable Part 2 requirements, including the restrictions applicable to certain civil, criminal, administrative, or legislative proceedings.

Our Responsibilities

MedEmp is required by law to:

• maintain the privacy and security of PHI;
• provide this Notice describing our legal duties and privacy practices;
• follow the terms of the Notice currently in effect; and
• provide legally required notification if a breach occurs that may have compromised the privacy or security of your PHI.

We will not use or disclose PHI except as permitted or required by law, as described in this Notice, or as authorized by you.

Website and Tracking Technologies

PHI collected through online healthcare, insurance, prescription, or authenticated services will be handled in accordance with HIPAA. MedEmp evaluates vendors and tracking technologies used in connection with PHI and will use appropriate safeguards and business associate agreements where legally required. A general website cookie consent does not replace a HIPAA authorization when HIPAA requires an authorization.

Changes to This Notice

We may change this Notice and make the revised Notice effective for health information we already maintain as well as information we receive in the future, as permitted by law. The current Notice will be available upon request and on our website.

Privacy Contact

Privacy Officer
American Drug Center, Inc. t/a Med Emporium
1940 Laskin Road, Suite 306, Virginia Beach, VA 23454
Email: