HIPAA Privacy Notice
Under the Health Insurance Portability and Accountability Act (HIPAA), signed into law on August 21, 1996, Tully Medical Clinic Pharmacy follows and has HIPAA-related policies and procedures to protect the confidentiality of your health information.
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
To ensure Tully Medical Clinic Pharmacy’s uses and disclosures of Protected Health Information (“PHI”) are limited to the minimum necessary to accomplish the intended purpose.
It is the policy of Tully Medical Clinic Pharmacy to make a reasonable effort to use or disclose, or to request from another health care provider, the minimum amount of PHI required to achieve the particular use or disclosure unless an exception applies.
The Facility will identify people or classes of people in its work force who need access to PHI to carry out their duties, the category or categories of PHI to which access is needed, and any conditions appropriate to such access.
For any non-routine request for disclosure of PHI that does not meet an exception, the Facility will review the request for disclosure on an individual basis.
Minimum necessary requirements do not apply to disclosures to health care providers for treatment purposes.
- Tully Medical Clinic Pharmacy will identify role based access to PHI per job description, including:
- People or classes of people in its workforce who need access to PHI to carry out their duties, and
- The category or categories of PHI to which access is needed, including any conditions that may be relevant to such access.
- Tully Medical Clinic Pharmacy, for any type of disclosure or request for disclosure that is added on a routine and recurring basis, will limit the disclosed PHI, or the request for disclosure, to that which is reasonably necessary to achieve the purpose of the disclosure or request.
- Tully Medical Clinic Pharmacy, for disclosures or requests for that are not made on a routine and recurring basis (non-routine disclosures), will review the request to verify that PHI disclosed or requested is the minimum necessary.All requests for non-routine disclosures or requests that do not meet an exception will be reviewed using standard criteria.
- Exceptions to minimum necessary requirements: Tully Medical Clinic Pharmacy will release information without concern for the minimum necessary standard as follows:
- Disclosures to or requests by a health care provider for treatment.
- Uses or disclosures made to the individual who is the subject of the PHI.
- Uses or disclosures made pursuant to an authorization signed by the individual.
- Disclosures made to the Secretary of the U.S. Department of Health and Human Services (federal government).
- Disclosures that are required by law (such as for the Department of Health state surveys, federal surveys, public health reportable events, FDA as related to product quality, safety, effectiveness or recalls etc.).
- Uses and disclosures that are required for compliance with the HIPAA Privacy Rule.
- Tully Medical Clinic Pharmacy may use or disclose an individual’s entire Medical Record only when such use or disclosure is specifically justified as the amount that is reasonably necessary to accomplish the intended purpose or one of the exceptions noted above applies.
- Requests for entire Medical Records that are not covered by an exception will be reviewed using standard criteria.
- Reasonable Reliance: Tully Medical Clinic Pharmacy may rely on a requested disclosure as minimum necessary for the stated purpose(s) when:
- Making disclosures to public officials, if the official represents that the information is the minimum necessary for the stated purpose(s).
- The information is requested by another covered entity (health care provider, clearinghouse or health plan).
- The information is requested by a professional who is a member of Tully Medical Clinic Pharmacy’s workforce or is a Business Associate for the purpose of providing professional services to Tully Medical Clinic Pharmacy, if the professional represents that the information requested is the minimum necessary for the stated purpose(s).
- The information is requested for research purposes and the person requesting the information has provided documentation or representations to Tully Medical Clinic Pharmacy that meet the HIPAA Privacy Rule. Contact the Privacy Officer to assist in the determination of whether such requirements have been met.
- Tully Medical Clinic Pharmacy, upon determination that the use, disclosure or request for PHI is the minimum necessary or one of the above exceptions apply (see Items 4 and 6), will release the PHI to the requestor.
- Requests for PHI from Another Covered Entity: When requesting PHI from another Covered Entity, Tully Medical Clinic Pharmacy must limit its request for PHI to the amount reasonably necessary to accomplish the purpose for which the request is made. For requests that are made on a routine and recurring basis, the pharmacy shall take reasonable steps to ensure that the request is limited to the amount of PHI reasonably necessary to accomplish the purpose for which the request is made.For requests that are not on a routine or recurring basis, the pharmacy shall evaluate the request according to the following criteria:
- Is the purpose for the request stated with specificity?
- Is the amount of PHI to be disclosed limited to the intended purpose?
- Have the requirements for supporting documentation, statements, or representations been satisfied?
- Have all applicable requirements of the HIPAA Privacy Rule been satisfied with respect to the request?
If we make changes to this policy, we will notify you here that it has been updated, so that you are aware of what information we will use and/or disclose.