NOTICE OF PRIVACY PRACTICES FOR

OUR CALIFORNIA PHARMACIES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

The Pharmacy is required by law to maintain the privacy of our patients’ Protected Health Information (“PHI”), and provide patients with notice of our legal duties and privacy practices in accordance with the federal Health Insurance Portability and Accountability Act (HIPAA), as well as the California Confidentiality of Medical Information Act. This Notice describes how such medical information about patients may be used and disclosed, and how patients can gain access to this information. Please read it carefully.

Protected health information (PHI) includes:

• Any personal information that may identify you;
• Any medical information pertaining to your past, present, or future physical or mental health or condition; and,
• Any information pertaining to the health care services you receive.

We will not use or disclose your PHI without your written authorization, except as described in this Notice. We reserve the right to change our practices, or the terms of this notice, and to make the new Notice effective for all PHI that we maintain at that time. If we change our practices or this Notice, we will post the revised Notice in a prominent area of our retail pharmacy location. We will provide you with a copy of the revised Notice upon request. The most recent copy of this Notice will also be available on our web site at www.savemart.com.

Your Health Information Rights

NOTE: Minors will be responsible for advance notification to the pharmacy, in writing, whether or not they are legally authorized to consent to treatment and services. If you are minor who has lawfully provided consent for treatment, and you wish our pharmacy to treat you as an adult for purposes of access to and disclosure of records relating to your treatment, please notify the Privacy Officer listed at the end of this Notice.

To Obtain a Paper Copy of this Notice upon Request.You may request a paper copy of the latest version of this Notice at any time from a pharmacy staff member.

To Request a Restriction on Certain Uses and Disclosures of PHI. You have the right to request restrictions on our use or disclosure of your PHI by sending a written request to the Privacy Officer listed at the end of this Notice. We are not required to agree to those restrictions.

To Restrict Disclosures to Health Plans. You have the right to restrict certain disclosures of PHI to your health plan when 1) the disclosure is for the sole purpose of carrying out payment or health care operations, and is not otherwise required by law, and 2) you have paid out of pocket in full for the health care item or service.

To Inspect and Obtain a Copy of Your PHI.You have the right to access, inspect and obtain a copy of the PHI contained in your designated record set for as long as we maintain your protected health information. The PHI we maintain is limited to patient prescription and billing information accessible at the store pharmacy. To receive a copy your PHI, you must send a written request to the Privacy Officer listed at the end of this Notice. For PHI that is maintained in an electronic format, you can request an electronic copy. We may charge you a fee for the costs of supplies, copying, and mailing required to fulfill your request. We may deny your request to inspect and copy PHI in certain limited circumstances. If you are denied access to your PHI, you may request that the denial be reviewed.

To Request an Amendment of Your PHI. If you feel that the PHI we maintain about you is incomplete or incorrect, you may request that we amend it, for as long as we maintain the PHI. Your request for an amendment must be submitted in writing to the Privacy Officer listed at the end of this Notice. You must also include the reason for your request. In certain cases, we may deny your request for amendment. If we deny your request, you have the right to file a statement of disagreement with the decision. This statement will be kept with your PHI, and we may also give a rebuttal to your statement.

To Receive an Accounting of Disclosures of Your PHI. For most purposes other than treatment, payment, or health care operations, you have the right to receive an accounting of the disclosures we have made in the six years prior to the date of your request. The accounting will exclude certain disclosures, such as disclosures made directly to you, disclosures you authorize, disclosures to friends or family members involved in your care, and disclosures for notification purposes. The right to receive an accounting is subject to certain other exceptions, restrictions, and limitations (what are these?). Your request for an accounting must be submitted in writing to the Privacy Officer listed at the end of this Notice. Your request must specify the time period, but may not be longer than six years. The first accounting you request within a 12 month period will be provided free of charge, but you may be charged for the cost of providing additional accountings within that period.

To Request Communications of PHI by Alternative Means or at Alternative Locations. You may wish that we contact you in some way other than mailing to your home address or calling your home telephone number. You may request that written communications regarding your PHI be sent to a different residence or post office box. To request alternative communication of your PHI, you must submit a request in writing to the Privacy Officer listed at the end of this Notice. Your request must state how or where you would like to be contacted. We will accommodate all reasonable requests.

Examples of How We May Use and Disclose PHI

We will use PHI for Treatment.Examples: Information obtained by the pharmacist will be used to dispense prescription medications to you. We will document in your record information related to the medications dispensed to you and services provided to you. We may notify you of treatment alternatives or to remind you to refill your prescription. We may also disclose your PHI to other healthcare providers, who are diagnosing and treating you, to coordinate the different things you need, such as prescriptions or lab work. This includes, in an emergency, the communication of patient information by radio transmission, or other means, between licensed medical personnel at the scene of an emergency or in an emergency vehicle such as an ambulance.

We will use PHI to Receive Payment for Products and Services.Example: We will contact your insurer or pharmacy benefit manager to determine whether your program will pay for your prescription and to determine the amount of your co-payment. We will bill you, your insurance carrier, or third-party payer for the cost of prescription medications dispensed to you. The information on or accompanying the bill may include information that identifies you, as well as the prescriptions you are taking. If you are unable to consent to the disclosure of your PHI due to a disabling medical condition (e.g., comatose), and no other arrangements have been made to pay for your healthcare, we may disclose your PHI to a government agency to the extent necessary to determine eligibility and payment under a government program for health care.

We will use PHI for Health Care Operations.Examples: The Pharmacy may use information in your health record to monitor the performance of the pharmacists providing treatment to you. This information will be used in an effort to continually improve the quality and effectiveness of the health care and service we provide. If we buy or sell pharmacy locations, your PHI may be transferred for the purpose of carrying out pharmacy services and related due diligence.

We are Likely to Use or Disclose Your PHI for the Following Purposes

Business Associates: We may contract with “Business Associates” who provide services such as billing, claims administration, or data processing. In the course of working with a Business Associate, we may disclose your PHI so that they can perform the job we have asked them to do. To protect your PHI, we require our Business Associates to adhere to the practices outlined in this Notice, and to otherwise safeguard your PHI. The Business Associate may not further disclose your PHI without your authorization.

Communication with Individuals Involved in Your Care or Payment for Your Care:Health professionals such as pharmacists, using their professional judgment, may disclose relevant PHI to a family member, other relative, close personal friend or any person you identify, who is involved in your care or payment for your care.

Health-Related Communications or Marketing:We may contact you to provide information such as refill reminders, or health-related benefits and services offered by our pharmacy that may be of interest to you.
NOTE: We will not “sell” your PHI or disclose it to third parties seeking to market their products or services, without your express authorization.

Food and Drug Administration (FDA):We may disclose to the FDA, or persons under the jurisdiction of the FDA, PHI relative to adverse events with respect to drugs, foods, supplements, products and product defects, or post-marketing surveillance (i.e., monitoring the safety of a drug or device) to enable product recalls, repairs, or replacement.

Worker’s Compensation:We may disclose your PHI as authorized by, and necessary to comply with, regulations relating to Worker’s Compensation or similar programs established by law.

As Required by Law:We may disclose your PHI for law enforcement or other purposes as required by law or in response to a valid subpoena, a valid search warrant, or other legal process.

Health Oversight Activities: We may disclose your PHI to an oversight agency for activities authorized by law. These oversight activities include audits, investigations, and inspections, as necessary for our licensure and for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Public Health/Disaster Relief: As required by law, we may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury, or disability. Basic information may be disclosed to a state or federal disaster relief organization in responding to disaster welfare inquiries.

Judicial and Administrative Proceedings: If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the requested PHI.

We are Permitted to Use or Disclose Your PHI for the Following Purposes

In Support of Research: We may disclose your PHI to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your information.

Use by Coroners, Medical Examiners, and Funeral Directors: We may release your PHI to a coroner or medical examiner as necessary to identify a deceased person or determine the cause of death. We may also disclose PHI to funeral directors consistent with applicable law to carry out their duties.

Use by Individuals Involved in Care of Decedent: Upon your death, we are required to comply with privacy regulations regarding your PHI for a period of 50 years. However, we are permitted to disclose PHI to family members and others who were involved in your care or the payment of your care, unless doing so conflicts with your prior known preferences. Such disclosures will be limited to the PHI relevant to the particular family member’s or other person’s involvement in the decedent’s health care or payment for health care.

Use by Organ or Tissue Procurement Organizations:We may disclose your PHI to an organ procurement organization or tissue bank that is processing the tissue of a decedent for transplant into the body of another person, but only with respect to the donating decedent for the purpose of aiding the transplant.

Notification:We may use or disclose your PHI to notify or assist in notifying a family member, personal representative, or another person responsible for your care, your location, and your general condition.

To Your Employer: In the event of health care services provided for you at the written request and expense of your employer, we may disclose to your employer PHI that is relevant to a lawsuit, arbitration, grievance, or other claim to which you and your employer are parties, and where 1) you have placed at issue your medical or mental history, condition, or treatment, provided that the PHI may only be disclosed in connection with that proceeding, or 2) it describes limitations you may have in performing your job, as long as no statement of medical cause is included in the information provided.

Treatment of Minors: We may disclose PHI to a social worker, probation officer, or any person who is legally authorized to have custody or care of a minor, for the purpose of coordinating health care services or medical treatment of the minor.

Health Care Service Plan or Insurer: We may disclose your PHI to a sponsor, insurer, or administrator of a health care plan or policy that you are seeking coverage or benefits from, so that they may evaluate your application. We may also disclose your PHI to a health care service plan for whom we provide service for the purpose of administering the plan.

Insurance Institution/Agent or Medical Support Organization: We may disclose your PHI to an insurance institution, agent, or medical support organization, as long as they have met the California Insurance Code requirements for obtaining such information.

Third-Party Processing and Encryption of PHI: We may disclose PHI to a third-party for encoding and encryption, further ensuring the anonymity of PHI. However, none of the disclosed information may be further disclosed by the recipient, or manipulated in any way that reveals your identifiable health information.

Reviews of Professional Competence or Liability:We may disclose your PHI to organized committees of professional societies, medical staff of licensed hospitals, professional standards review organizations, quality control peer review organizations, and other similar entities engaged in reviewing the competence or qualifications of health care professionals. We may also disclose your PHI to such entities with respect to medical necessity, level of care, quality of care, or justification of charges.

Correctional Institution:If you are or become an inmate of a correctional institution, we may disclose PHI to the institution or its agents when necessary for your health or the health and safety of others.

To Avert a Serious Threat to Health or Safety:We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.

Military and Veterans:If you are a member of the armed forces, we may release your PHI as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate military authority.

National Security and Intelligence Activities:We may release your PHI to authorized federal officials for intelligence, counter-intelligence, and other national security activities authorized by law.

Victims of Abuse, Neglect, or Domestic Violence:We may disclose your PHI to a government authority, such as a social service or protective services agency, if we reasonably believe you are a victim of abuse, neglect, or domestic violence. We will only disclose this type of information to the extent required by law, if you agree to the disclosure, or if the disclosure is allowed by law and we believe it is necessary to prevent serious harm to you or someone else; or, if the law enforcement or public official that is to receive the report assures us that it is necessary and will not be used against you.

Other Uses and Disclosures of PHI

The Pharmacy will obtain your written authorization before using or disclosing your PHI for all purposes other than those provided above or as otherwise permitted or required by law. The authorization will identify the persons to whom we may disclose the information, the information to be disclosed, and the expiration date of the authorization. You may revoke an authorization in writing at any time. Upon receipt of the written revocation, we will stop using or disclosing your PHI, except to the extent that we have already taken action in reliance on the authorization.

Notification of Release of Information

We will notify you if a release (or breach) occurs that may have compromised the privacy or security of your information.

For More Information or to Report a Concern

If you have questions or would like additional information about the Pharmacy’s privacy practices, please contact the Privacy Officer. If you believe your privacy rights have been violated, you can file a written notice of your concern with theDirector of Compliance/Privacy Officer at Save Mart Supermarkets, PO Box 4278, Modesto, CA 95352; or with the US Secretary of Health and Human Services, 200 Independence Ave SW, Washington, DC 20201. There will be no retaliation for filing a complaint. This Notice is effective as of September 23, 2013.