Citrus Care Pharmacy

HIPAA Privacy & Security Policy

Effective Date: [Insert Date]
Last Updated: [Insert Date]

Citrus Care Pharmacy (“Citrus Care Pharmacy,” “we,” “our,” or “us”) is committed to protecting the privacy, confidentiality, integrity, and security of our patients’ health information. We maintain policies and safeguards designed to protect Protected Health Information (“PHI”) in accordance with applicable federal and state privacy and security requirements, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended, and applicable HIPAA regulations.

This policy provides general information about how Citrus Care Pharmacy protects health information and how patients may exercise their privacy rights.

1. Protected Health Information

Protected Health Information generally includes individually identifiable health information that we create, receive, maintain, or transmit in connection with providing pharmacy services.

Depending on the services provided, this information may include:

• Patient name, address, telephone number, email address, and other contact information

• Date of birth and demographic information

• Prescription and medication information

• Prescriber and healthcare provider information

• Allergy and medication history

• Insurance and billing information

• Payment information where applicable

• Information related to pharmacy services and communications

• Other health information protected under applicable law

2. How We May Use and Disclose PHI

Citrus Care Pharmacy may use or disclose PHI as permitted or required by law, including for purposes such as:

Treatment: We may use and disclose PHI to pharmacists, prescribers, healthcare providers, and other authorized individuals involved in a patient's treatment or coordination of care.

Payment: We may use or disclose PHI for billing, insurance claims, payment processing, eligibility verification, and other activities necessary to obtain payment for pharmacy services.

Healthcare Operations: We may use PHI for permitted operational purposes, including quality improvement, compliance, auditing, pharmacy administration, and other activities necessary to operate our pharmacy.

Required or Permitted by Law: We may disclose PHI when required or permitted by applicable law, including certain public health, health oversight, judicial or administrative, law enforcement, and other legally authorized purposes.

With Patient Authorization: When HIPAA or other applicable law requires written authorization, we will obtain appropriate authorization before using or disclosing PHI.

3. Minimum Necessary Standard

When applicable, Citrus Care Pharmacy takes reasonable steps to limit the use, disclosure, and request of PHI to the minimum amount necessary to accomplish the intended purpose.

The minimum necessary requirement does not apply to certain disclosures, including disclosures for treatment and other circumstances specified by law.

4. Privacy Safeguards

Citrus Care Pharmacy maintains reasonable administrative, physical, and technical safeguards designed to protect PHI from unauthorized access, use, disclosure, alteration, or destruction.

These safeguards may include, as appropriate:

• Access controls and authentication

• Role-based access to patient information

• Workforce privacy and security training

• Confidentiality requirements

• Secure handling and disposal of records

• Security measures for electronic systems

• Procedures for responding to suspected privacy or security incidents

• Appropriate oversight of vendors and business associates that handle PHI on our behalf

5. Electronic Protected Health Information

Citrus Care Pharmacy takes reasonable measures to protect electronic Protected Health Information (“ePHI”) maintained or transmitted through our information systems.

Our security program is designed to address administrative, physical, and technical safeguards required by applicable HIPAA Security Rule requirements. Security measures are reviewed and updated as appropriate based on operational needs, identified risks, technological changes, and applicable legal requirements.

6. Website and Electronic Communications

Information submitted through our website may be subject to different privacy protections depending on the nature of the information and the method through which it is submitted.

Patients should use designated secure methods provided by Citrus Care Pharmacy when submitting prescription information, medical information, or other sensitive health information electronically.

Patients should avoid transmitting sensitive health information through unsecured email, general website contact forms, social media, or other communication channels unless specifically instructed that the method is appropriate for communicating such information.

7. Business Associates

Citrus Care Pharmacy may use third-party service providers that perform services involving PHI on our behalf.

When required by HIPAA, we enter into Business Associate Agreements with these organizations requiring them to appropriately safeguard PHI and comply with applicable HIPAA requirements.

8. Patient Privacy Rights

Subject to applicable law and certain limitations, patients may have the right to:

• Request access to and obtain copies of certain health records

• Request corrections or amendments to certain health information

• Request restrictions on certain uses or disclosures of PHI

• Request confidential communications through alternative means or locations

• Request an accounting of certain disclosures of PHI

• Receive a copy of our Notice of Privacy Practices

• File a privacy complaint without retaliation

Certain requests may be required to be submitted in writing.

9. Notice of Privacy Practices

Citrus Care Pharmacy maintains a Notice of Privacy Practices describing how medical information about patients may be used and disclosed and how patients can exercise their rights regarding that information.

Patients may request a copy of the current Notice of Privacy Practices by contacting Citrus Care Pharmacy.

10. Security and Breach Response

Citrus Care Pharmacy maintains procedures for identifying, investigating, mitigating, and responding to suspected privacy or security incidents involving PHI.

When an incident constitutes a reportable breach of unsecured PHI, Citrus Care Pharmacy will provide notifications as required by applicable law.

11. Workforce Responsibilities

Citrus Care Pharmacy requires workforce members with access to PHI to follow applicable privacy and security policies and procedures.

Workforce members receive appropriate privacy and security training based on their responsibilities and may be subject to disciplinary action for violations of pharmacy privacy or security requirements.

12. Retention and Disposal

Citrus Care Pharmacy maintains and disposes of records containing PHI in accordance with applicable federal and state requirements and our record-retention policies.

When records containing PHI are disposed of, reasonable safeguards are used to prevent unauthorized access or disclosure.

13. Patient Communications

Citrus Care Pharmacy may communicate with patients regarding prescriptions, refill reminders, pharmacy services, treatment-related matters, and other communications permitted by applicable law.

We take reasonable precautions when communicating health information and may verify a patient's identity before releasing certain information.

14. Complaints

Patients who believe their privacy rights have been violated may submit a complaint directly to Citrus Care Pharmacy.

Patients may also have the right to file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

Citrus Care Pharmacy will not retaliate against an individual for filing a privacy complaint or exercising rights provided under HIPAA.

15. Changes to This Policy

Citrus Care Pharmacy may revise this HIPAA Privacy & Security Policy periodically to reflect changes in our practices, technology, services, or applicable legal requirements.

The most current version will be made available through our website or upon request.

16. Contact Us

For questions regarding this policy, our privacy practices, or your privacy rights, please contact:

Martha Guzman, RPh - Officer

Citrus Care Pharmacy
HIPAA Privacy Officer: M. Guzman
Address:

2024 Hwy 44 W

Inverness, FL 34453
Phone: 352-503-2056
Email: info@citruscarepharmacy.com

Important Notice: This website policy provides a general description of Citrus Care Pharmacy's privacy and security practices. It is not intended to replace the pharmacy's formal Notice of Privacy Practices, internal HIPAA Privacy and Security policies and procedures, HIPAA risk analysis, workforce training, Business Associate Agreements, breach-response procedures, or other documentation required by applicable law.