This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully. It is provided under the HIPAA Privacy Rule, 45 CFR Part 164.
Our Duties
We are required by law to maintain the privacy of your protected health information, to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect. We must notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
How We Use and Disclose Your Information
For treatment: we use your prescription and health information to compound, verify, label and dispense your medication, and to consult with your prescriber. For payment: we use it to bill you or your practice. For health care operations: we use it for quality review, pharmacist supervision, and regulatory reporting. We may also disclose information where the law requires it — to the FDA for an adverse event, to a state board of pharmacy, or in response to a lawful order.
What We Do Not Do
We do not sell your protected health information. We do not use it for marketing without your written authorisation. Compounded preparations dispensed to provider practices under our partner agreements are self-pay and are not submitted to Medicare, Medicaid, TRICARE or any commercial payer.
Your Rights
You may inspect and request a copy of your records, ask us to correct them, ask for a list of certain disclosures we have made, request that we communicate with you by a particular method or at a particular address, and request a restriction on how we use or disclose your information. You may revoke an authorisation in writing at any time, except where we have already acted on it.
How Your Information Is Held
Prescription records and regulated identifiers — DEA registrations, NPI numbers, state licence numbers and tax identifiers — are encrypted at rest with AES-256-GCM and are displayed to staff as their last four digits only. Documents you upload are stored in private encrypted storage and retrieved through short-lived links; they are never public. Access to an identifiable record by a member of staff is recorded in an audit log.
Complaints
If you believe your privacy rights have been violated, contact us using the address below. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.
Contact
Questions about this notice: privacy@medicraftpharmacy.com · (727) 309-6666