U.S. Pharmacy Notice of Privacy Practices
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
I. Our Commitment to Your Privacy
The Great Atlantic & Pacific Tea Company, Inc. ("A&P") and its family of U.S. companies (all of which are sometimes called "the Company"), including the pharmacies it operates in its stores, are committed to protecting the privacy of your Protected Health Information ("PHI") that we receive in accordance with federal and state privacy laws, as well as the Company's own privacy policies, practices and procedures. The Company is required by law to maintain the privacy of PHI, to provide (or to have its pharmacies provide) individuals with notice of its legal duties and privacy practices with respect to PHI and to notify affected individuals following a breach of unsecured protected health information.
PHI is information about you, including basic demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services. This Notice of Privacy Practices ("Notice") describes how the Company's pharmacies (and certain related areas within the Company) may use and disclose PHI to carry out treatment, payment, or health care operations and for other specified purposes that are permitted or required by law. This Notice also describes your rights with respect to PHI about you. To help you better understand this Notice, please note the following: (1) whenever this Notice uses the word "Pharmacy" or "Pharmacies", it means one or more of the pharmacies that the Company operates in its stores; (2) whenever this Notice uses the word "we", "us" or "our", it means the Pharmacies and certain groups within the Company that are involved in Pharmacy operations in certain ways.
We are required to follow the terms of this Notice. We will not use or disclose PHI about you without your written authorization, except as described in this Notice.
II. Changes to this Notice
We reserve the right to revise, change, or amend our practices and this Notice and to make the new Notice effective for all PHI that we already have about you, as well as any of your PHI that we may receive, create, or maintain in the future. We will post a copy of our current Notice in a prominent location, and you may request a paper copy of our current Notice from us. We will also post our Notice on our web site at www.aptea.com and will post links from the web sites for the Company's different banners to the Company web site.
III. Your Health Information Rights
You have the following rights with respect to PHI about you:
Obtain a paper copy of the Notice upon request. You may request a copy of the Notice at any time. Even if you have agreed to receive the Notice electronically, you are still entitled to a paper copy. To obtain a paper copy, simply stop by your local Pharmacy to pick up a copy, or send a written request to the Company's Privacy Officer addressed as follows:
The Great Atlantic & Pacific Tea Company, Inc.
Attn.: Privacy Officer
2 Paragon Drive
Montvale, New Jersey 07645
... or a different address that the Company may designate at a later date (the Notice Address).
Request a restriction on certain uses and disclosures of PHI. You have the right to request additional restrictions on our use or disclosure of PHI about you by sending a written request to the Company's Privacy Officer addressed to the Notice Address. Please clearly and concisely identify:
- The information you wish to be restricted;
- How you want the information restricted; and
- To whom you want the limits to apply.
We are not required to agree to those restrictions, except a request by you to restrict disclosure of PHI to a health plan if (A) the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and (B) the PHI pertains solely to a health care item or service for which you, or someone on your behalf other than the health plan, has paid us in full. Moreover, if we agree to any other restrictions, we will comply with the restrictions, except to the extent when otherwise required by law, in emergencies, or when the information is necessary to treat you.
Inspect and obtain a copy of PHI. You have the right to access and copy PHI about you that may be used to make decisions about you - a "designated record set" - for as long as A&P Pharmacy maintains the PHI. The designated record set usually will include prescription and billing records. To inspect or copy PHI about you, you must send a written request to the Company's Privacy Officer at the Notice Address that is provided in section VII of this Notice. We may charge you a fee for the costs associated with copying and mailing your request. We may deny your request to inspect and copy in certain limited circumstances. If you are denied access to PHI about you, you may request that the denial be reviewed by sending a written request to the Company's Privacy Officer at the Notice Address.
Request an amendment of PHI. If you feel that PHI we maintain about you is incomplete or incorrect, you may request that we amend it. You may request an amendment for as long as we maintain the PHI. To request an amendment, you must send a written request to the Company's Privacy Officer at the Notice Address. You must include a reason that supports your request. In certain cases, we may deny your request for amendment. If we deny your request for amendment, you have the right to file a statement of disagreement with the decision by sending your statement to with the Privacy Officer at the Notice Address, and we may give a rebuttal to your statement.
Receive an accounting of disclosures of PHI. You have the right to receive an accounting of the disclosures we have made of PHI about you after April 14, 2003 for certain purposes. The accounting will exclude certain uses and disclosures, such as those made for treatment, payment, or healthcare operations, disclosures made directly to you, disclosures you authorize, and disclosures to friends or family members involved in your care. The right to receive an accounting is subject to certain other exceptions, restrictions, and limitations. To request an accounting, you must submit a request in writing to the Company's Privacy Officer at the Notice Address. Your request must specify the time period, but may not be longer than six years. The first accounting you request within a 12 month period will be provided free of charge, but you may be charged for the cost of providing additional accountings. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time.
Confidential communications. You have the right to request that we communicate with you about your health and related issues in a particular manner, or at a certain location. For instance, you may request that we contact you about medical matters only in writing, rather than by telephone, or at work, rather than at home. To request confidential communication of PHI about you, you must submit a request in writing to the Company's Privacy Officer at the Notice Address. Your request must state how or where you would like to be contacted, but you do not need to provide a reason for your request. We will accommodate all reasonable requests.
IV. Examples of How We May Use and Disclose PHI
The following are descriptions and examples of ways we will, or may, use and disclose your PHI. Please note that each particular use or disclosure is not listed below. However, the different ways that we are permitted to use and disclose your PHI fall within one of the categories listed in this section.
We will use PHI for treatment. Example: Information obtained by the pharmacist will be used to dispense prescription medications to you. We may request information from the prescribing physician or another physician to whom we are referred by the prescribing physician. In addition, we will document in your record information related to the medications dispensed to you and services provided to you.
We will use PHI for payment. Example: We will contact your insurer or pharmacy benefit manager to determine whether it will pay for your prescription and the amount of your co-payment. We will bill you or a third-party payer for the cost of prescription medications dispensed to you. The information on or accompanying the bill may include information that identifies you, as well as the prescriptions you are taking.
We will use PHI for health care operations. Example: We may use information in your health record to monitor the performance of the pharmacists providing treatment to you, or to conduct cost-management and business planning activities. This information will be used in an effort to improve the quality and/or effectiveness of the health care services and products that we provide.
Business associates: We may share your PHI with certain business associates that perform services for us through contracts that we have with them. Examples include any company that we engage to administer any of our prescription drug benefit programs, to process health benefit claims and/or payments, process Medicare claims, maintain or service the computer systems that process any such types of data or store PHI. When these services are contracted for, we may disclose PHI about you to a business associate so that the business associate can perform the job we have asked it to do and bill you or your third-party payer for services rendered. To protect PHI about you, we require the business associate to appropriately safeguard the PHI.
Health-related communications: We may use or disclose your PHI in order to communicate with you, by telephone or otherwise, about a product or service related to your treatment (such as prescriptions and refill reminders), or to help coordinate or manage your care, or to direct or recommend treatment alternatives, therapies, providers, settings of care, or other health-related benefits and services that may be of interest to you.
Food and Drug Administration (FDA): We may disclose to the FDA, or persons under the jurisdiction of the FDA, PHI relative to adverse events with respect to drugs, foods, supplements, products and product defects, or post-marketing surveillance information to enable product recalls, repairs, or replacement.
Worker's compensation: We may disclose PHI about you as authorized by, and as necessary to comply with, laws relating to worker's compensation or similar programs established by law.
Public health: As required by law, we may disclose PHI about you to public health or legal authorities charged with preventing or controlling disease, injury, or disability. Law enforcement: We may disclose PHI about you for law enforcement purposes as required by law or in response to a valid subpoena or other legal process.
As required by law: We must disclose PHI about you when required to do so by law.
Health oversight activities: We may disclose PHI about you to an oversight agency for activities authorized by law. These oversight activities can include, for example, audits, investigations, and inspections, as necessary for our licensure and for the government to monitor government programs, compliance with civil rights laws, and the health care system in general.
Judicial and administrative proceedings: If you are involved in a lawsuit or a dispute, we may disclose PHI about you in response to a court or administrative order. We may also disclose PHI about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order protecting the requested PHI.
Coroners, medical examiners, and funeral directors: We may release PHI about you to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose PHI to funeral directors consistent with applicable law to carry out their duties.
Correctional institution: If you are or become an inmate of a correctional institution, we may disclose PHI to the institution or law enforcement officials when necessary to provide health services to you, for the safety and security of the institution, and/or to protect your health and safety or the health and safety of others.
To avert a serious threat to health or safety: We may use and disclose PHI about you when necessary to reduce or prevent a serious threat to your health and safety or the health and safety of the public or another person.
Military and veterans: If you are a member of the armed forces, we may release PHI about you as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate military authority.
National security and intelligence activities: We may release PHI about you to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.
Protective services for the President and others: We may disclose PHI about you to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state, or to conduct special investigations.
Victims of abuse, neglect, or domestic violence: We may disclose PHI about you to a government authority, such as a social service or protective services agency, if we reasonably believe you are a victim of abuse, neglect, or domestic violence. We will only disclose this type of information to the extent required by law, if you agree to the disclosure, or if the disclosure is allowed by law and we believe it is necessary to prevent serious harm to you or someone else, and if the law enforcement or public official that is to receive the report represents that it is necessary and will not be used against you.
V. Authorization for Other Uses and Disclosures of PHI
We will obtain your written authorization before using or disclosing PHI about you for purposes other than those provided for above or as otherwise permitted or required by law. Your authorization is required for any use or disclosure of PHI for marketing communications or sales of PHI that involve financial renumeration to the Company. You may revoke an authorization in writing at any time. Upon receipt of the written revocation, we will stop using or disclosing PHI about you, except to the extent that we have already taken action in reliance on the authorization. However, please note that we may be required by applicable law to retain certain PHI about you, particularly regarding the provision of health care services and products.
VI. For More Information or to Report a Problem
If you have questions or would like additional information about the A&P Pharmacy's privacy practices, you may contact the Company's Privacy Officer at email@example.com or at the Notice Address. If you believe your privacy rights have been violated, you can file a written complaint with the Company's Privacy Officer at the Notice Address or with the Secretary of the federal Department of Health and Human Services. There will be no retaliation for filing a complaint.
VII. Notice Address and Phone Number
Call 1-866-443-7374 or send all correspondence, requests, questions and complaints related to the permitted or required uses and disclosure of your PHI by the Company and your rights with respect to your PHI to the following address (Notice Address) in written form:
The Great Atlantic & Pacific Tea Company, Inc.
Attn.: Privacy Officer
2 Paragon Drive
Montvale, New Jersey 07645
VIII. Effective Date
This Notice is effective as of September 23, 2013.
ADDENDUM TO NOTICE OF PRIVACY PRACTICES OF THE GREAT ATLANTIC & PACIFIC TEA COMPANY, INC., AND SUBSIDIARIES - DISCLOSURE OF MORE RESTRICTIVE STATE LAWS CONCERNING THE PRIVACY OF HEALTH INFORMATION
The following is a summary of state laws in those states where the Company currently operates Pharmacies that are more stringent than the Privacy Rule and/or the Company policies and practices described in this Notice. Each Company Pharmacy located in any of the states listed below will comply with the more stringent laws of the state where that Pharmacy is located, as set forth below:
Except as otherwise permitted by applicable law, and except in connection with the sale or merger of a pharmacy business, we will not sell your individually identifiable medical record information.
We will not disclose confidential HIV-related information, except to the following persons:
- Any person who secures a release of confidential HIV-related information;
- A health care provider or health facility when knowledge of the HIV-related information is necessary to provide appropriate care or treatment to the protected individual or a child of the individual;
- Life and health insurers, government payers and health care centers and their affiliates, in connection with underwriting and claim activity for life, health, and disability benefits;
- Any health care provider specifically designated by the protected individual to receive such information received by a life or health insurer or health care center pursuant to an application for life, health or disability insurance; and
- A procurement organization for the purposes of assessing donor suitability.
Except as permitted under applicable law, we will not disclose HIV- or AIDS-related information health information that identifies the individual who is the subject of such information.
For Pharmaceutical Assistance to the Aged and Disabled (PAAD) Program recipients, we will not disclose your personally identifiable information without the written consent of you, your beneficiary or your authorized agent, except for purposes directly connected to the administration of the PAAD Program or as otherwise permitted by state or federal law.
We will not access a common electronic file or database used to maintain required personally identifiable dispensing information except upon your, or your agent's, express request.
We will not disclose confidential HIV-related information (including confidential HIV related information that has been disclosed to us), except as follows:
- To any person who secures a release of confidential HIV-related information;
- To a health care provider when knowledge of the HIV-related information is necessary to provide care or treatment to the protected individual, a child of the individual, a contact of the protected individual or a person authorized to consent to health care for such a contact;
- To a health care provider, in relation to the procurement, processing, distributing or use of a human body or a human body part for use in medical education, research, therapy, or for transplantation to individuals;
- To an authorized agency in connection with foster care or adoption of a child;
- To third party reimbursers or their agents provided that, where necessary, an otherwise appropriate authorization for such disclosure has been secured by the provider;
- To an insurance institution, provided the insurance institution secures a dated and written authorization;
- To an attorney appointed to represent a minor with respect to confidential HIV-related information relating to the minor and for the purpose of representing the minor; and
- To an executor or an administrator of an estate for access to the confidential HIV information of a deceased person as needed to fulfill his or her responsibilities/duties as an executor or administrator.
Except as permitted under applicable law, we will not disclose HIV-related information in accordance with a subpoena, although we may disclose such information in accordance with a court order, if an adequate showing of necessity is made to such court.
We are not permitted to furnish a patient a copy of a prescription for a controlled substance, and copies of other prescriptions shall be furnished to the patient at his or her request but must indicate that the copy is for informational purposes only.
We will not disclose any HIV-related information, except in situations where the subject of the information has provided us with a written consent allowing the release or where we are authorized or required by state or federal law to make the disclosure.