Notice of Privacy Practices

Last updated: April 9, 2020

This Notice describes how your medical information may be used and disclosed and how you can get access to this information. Please review it carefully.

PillPack LLC (“PillPack”) is committed to maintaining your privacy and we take our responsibility for safeguarding your Protected Health Information very seriously. PillPack is required by the Health Insurance Portability and Accountability Act (“HIPAA”) to provide you with this Notice to help you understand how we may use or share Protected Health Information about you that we obtain to provide services to you. “Protected Health Information” is the information we receive to provide services to you that identifies you or could be used to identify you and relates to your past, present, or future physical or mental health, treatment, or your payment for treatment. Protected Health Information includes your medication history, medical conditions, health insurance information, and other information we use to provide you your prescriptions.

This Notice applies to PillPack and all of its subsidiaries. If you have any questions about this Notice, please contact the PillPack Privacy Office at the address listed below.

How we may use and disclose your Protected Health Information

The following categories describe the typical ways that we may use and disclose your Protected Health Information without your written authorization:

• For Treatment. Protected Health Information obtained by PillPack will be used in order to dispense your prescription medications and provide the treatment and services you receive. We may disclose Protected Health Information about you to doctors, nurses, or other health care providers who are involved in taking care of you. We may also seek Protected Health Information about you from other health care providers and health information networks. For example, in order to fill your prescription we may request your medical records from your doctor or disclose Protected Health Information to your doctor.
• For Payment. We may use or disclose your Protected Health Information in order to bill and collect payment for products or services we provided to you. For example, we may contact your insurance company, health plan, or another third-party to obtain payment for your prescriptions.
• For Health Care Operations. We may use and disclose your Protected Health Information for our day-to-day health care operations. For example, we may use your Protected Health Information to monitor the performance of the staff and pharmacists providing treatment and services to our customers or to improve the quality and the effectiveness of the health care services we provide.

We may also use and disclose your Protected Health Information without your written authorization as follows:

• Business Associates. We may contract with third parties to perform certain services for us, such as accounting services, consulting services, or information technology services. In some cases, these third party service providers, called Business Associates, may need to access your Protected Health Information to perform services for us. They are required by law and contract to protect your Protected Health Information.
• Disclosures to Parents or Legal Guardians. We may release a minor’s Protected Health Information to their parents or legal guardians consistent with applicable laws. For example, parents may order prescriptions on behalf of a minor child and access the child’s prescription history.
• As Required By Law. We will disclose your Protected Health Information when required to do so by applicable law.
• To Avert a Serious Threat to Health or Safety. We may use and disclose your Protected Health Information to prevent a serious threat to your health and safety or the health and safety of the public or another person.
• Organ and Tissue Donation. Consistent with applicable law, we may disclose your Protected Health Information to organizations engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.
• Military and Veterans. If you are a member or veteran of the armed forces, we may disclose Protected Health Information about you as required by military authorities.
• Research. We may use your Protected Health Information to conduct research or disclose it to researchers as authorized by applicable law. For example, we may use or disclose your Protected Health Information as part of a research study when the research has been approved by an authorized review body that establishes processes to ensure the privacy of your information.
• Workers' Compensation. We may disclose Protected Health Information about you for workers’ compensation or similar programs that provide benefits for work-related injuries or illness.
• Public Health Activities. Applicable laws may require or permit PillPack to disclose certain Protected Health Information for reasons such as:
  • Preventing disease or telling people when they may have been exposed to or may be at risk of contracting a disease;
  • Reporting reactions to medications, problems with products, or product recalls;
  • Reporting information to your employer if we provide health care services to you at the request of your employer;
  • Providing proof of immunization to your school if you are a student or prospective student of the school; and
  • Notifying a government authority if we reasonably believe you are a victim of abuse or neglect. We will only disclose this type of information to the extent required by law, if you agree to the disclosure, or if we believe it is necessary to prevent serious harm to you or someone else.
• Health Oversight Activities. We may disclose Protected Health Information to a health oversight agency for activities authorized by law. These oversight activities may include audits, investigations, inspections, and licensure. These activities help the government monitor the health care system, government programs, and compliance with civil rights laws.
• Judicial and Administrative Proceedings. If you are involved in a lawsuit or a dispute, we may disclose Protected Health Information about you in response to a court or administrative order. We may also disclose Protected Health Information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the information requested.
• Law Enforcement. We may disclose your Protected Health Information to the police or other law enforcement officials as required by law or in compliance with a court order.
• Coroners, Medical Examiners and Funeral Directors. We may disclose Protected Health Information to a coroner or medical examiner. This may be necessary to identify a deceased person or determine the cause of death. We may also disclose Protected Health Information to funeral directors as necessary to carry out their duties.
• Correctional Institution. If you are or become an inmate of a correctional institution, we may disclose to the institution or its agents Protected Health Information necessary for your health and the health and safety of others.
• Specialized Government Functions. We may disclose your Protected Health Information to units of the government with special functions, such as the U.S. Secret Service for the protection of the President, or the U.S. Department of State to make medical suitability determinations about individuals who are members of the foreign service.

Choices you have about certain uses and disclosures of your Protected Health Information

For certain Protected Health Information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, please contact our Privacy Office.

• Sharing Protected Health Information with family, close friends, caregiver, or others involved in your care or payment for your care
• Sharing Protected Health Information in a disaster relief situation

Unless you object to such sharing, we may disclose your Protected Health Information to a family member or a close friend, or any other person you have identified that is directly relevant to the person's involvement in your care or paying for your care. If you are unavailable prior to a disclosure or otherwise not able to tell us your preference, we may exercise our professional judgment to determine whether sharing your information with one or more of these individuals is in your best interest.

Uses and disclosures of Protected Health Information that require your written authorization

Any other uses and disclosures of Protected Health Information that are not mentioned above will be made only with your written authorization, including the use or disclosure of psychotherapy notes (to the extent we have any), use or disclosure of Protected Health Information for marketing, and for the sale of Protected Health Information (except in limited circumstances where applicable law allows such uses or disclosure without your authorization).

If you provide us authorization to use or disclose your Protected Health Information, you may revoke that authorization in writing at any time by sending a revocation request to the address listed at the end of this Notice. If you revoke your authorization, we will no longer use or disclose Protected Health Information about you for the reasons covered by your written authorization. We are unable to take back any disclosures we have already made based on your authorization.

Your rights regarding your Protected Health Information

You have the following rights regarding your Protected Health Information:

• Access. With a few exceptions, you have the right to review and copy your Protected Health Information by submitting a written request to the PillPack Privacy Office.
• Amendment. If you feel that Protected Health Information in your record is incorrect or incomplete, you may ask us to amend the information by submitting a written request to the PillPack Privacy Office. You must provide a reason for your request. If we deny your request for an amendment, we will provide you with a written explanation of why we denied it.
• Accounting of Disclosures. You have the right to ask us for a list (accounting) of the times we’ve shared your Protected Health Information in the six years prior to the date you ask, including with whom we shared it with and why, by submitting a written request to the PillPack Privacy Office. We will include all the disclosures we made except for those about treatment, payment, and health care operations, and certain other disclosures (such as any disclosures you asked us to make).
• Restricting or Limiting Disclosure. You have the right to request additional restrictions on our use or disclosure of your Protected Health Information by sending a written request to the PillPack Privacy Office. We are not required to agree to the restrictions, except in the case where the disclosure is to a health plan for purposes of carrying out payment or health care operations, the disclosure is not otherwise required by applicable law, and the Protected Health Information pertains solely to a health care product or service for which you, or a person on your behalf, has paid in full.
• Alternate Communications. You have the right to request that we communicate with you about health matters in a specific way by submitting a written request to the PillPack Privacy Office. For example, you may ask that we only call you at a certain phone number. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests.
• Receiving a Paper Copy of This Notice. You have the right to a paper copy of this Notice of Privacy Practices at any time by contacting the PillPack Privacy Office, even if you have agreed to receive the Notice electronically. You may always obtain a copy of this Notice at our website, http://www.pillpack.com/notice-privacy-practices.
• Notification in the Event of a Breach. We are required by law to maintain the privacy and security of your Protected Health Information. We will notify you if a breach occurs that may have compromised the privacy or security of your Protected Health Information.

Changes to this Notice

We reserve the right to change this Notice, including for Protected Health Information we already have about you as well as any Protected Health Information we receive in the future. We will post a copy of the revised Notice on our website with the date that any updates were made.

Complaints

We take your privacy seriously and welcome your questions and feedback. If you believe your privacy rights have been violated, you may file a complaint with PillPack or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with PillPack, contact the PillPack Privacy Office. All complaints must be submitted in writing. You will not be penalized or retaliated against for filing a complaint.

PillPack Privacy Office Contact Information

All correspondence related to this Notice of Privacy Practices must be submitted to the PillPack Privacy Office at the address below. You may also reach the PillPack Privacy Office at 855-745-5725.

• PillPack LLC
• Privacy Office
• 250 Commercial Street
• Suite 2012
• Manchester, NH 03101