Privacy Practices

Avita Pharmacy’s Notice of our Privacy Practices

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (the “Notice”) describes the privacy practices of Avita Pharmacy the members of its Affiliated Covered Entity (“Avita ACE”). An Affiliated Covered Entity is a group of Covered Entities and Health Care Providers under common ownership or control that designates itself as a single entity for purposes of compliance with the Health Insurance Portability and Accountability Act (“HIPAA”). The members of the Avita ACE will share Protected Health Information (“PHI”) with each other for the treatment, payment and health care operations of the Avita ACE and as permitted by HIPAA and this Notice. For a complete list of the members of the Avita ACE, please contact the Avita Privacy Office.

Avita Pharmacy wants you to know that nothing is more central to our operations than maintaining the privacy of your personal protected health information (“PHI”). PHI is information about you that we obtain to provide our services to you and that can be used to identify you. It includes your name and other basic contact information as well as information about your health, medical conditions and prescriptions. We take our responsibility to protect this information very seriously.

Our Pledge Regarding Your Health Information

We are required by law to protect the privacy of your PHI and to provide you with this Notice explaining our legal duties and privacy practices regarding your PHI. This Notice describes how we may use and disclose your PHI. We have provided you with examples; however, not every permissible use or disclosure will be listed in this Notice. This Notice also describes your rights and the obligations we have regarding the use and disclosure of your PHI. We and our employees and workforce members are required to follow the terms of this Notice or any change to it that is in effect. We are required to follow state privacy laws when they are stricter (or more protective of your PHI) than the federal law. The states in which this is the case are attached as a State Specific Requirement Addendum. Note that some types of sensitive PHI, such as HIV information, genetic information, alcohol and/or substance abuse records and mental health records may be subject to additional confidentiality protections under state or federal law.

Uses and Disclosures of Your PHI for Treatment, Payment and Health Care Operations

We may use and disclose your PHI for treatment, payment and health care operations without your written authorization. The following categories describe and provide some examples of the different ways that may use and disclose your PHI for these purposes:

Treatment. Your health information may be used by staff members or disclosed to other health care professionals for the purpose of evaluating your health, diagnosing medical conditions, and providing treatment. For example, results of laboratory tests and procedures will be available in your medical record to all health professional who may provide treatment or who may be consulted by staff members. PHI obtained by Avita Pharmacy will be used to dispense prescription medication. We will document information related to the medications dispensed and services provided in your record. We may contact you to provide treatment related services such as refill reminders, treatment alternatives (e.g., available generic products), and other health-related benefits and services that may be of interest to you.

Payment. We may use your health information to seek payment from your health plan, from other sources of coverage such as your insurer, payor, automobile insurer, other agent, or from credit card companies that you may use to pay for services. We may have to share your PHI with that entity in order to determine whether it will pay for your prescription and the payment amounts. For example, your health plan may request and receive information on the dates of service, the services provided, and the medical condition being treated. We may also contact you about a payment or balance due for prescriptions dispensed to you by Avita Pharmacy.

Health care operations. Your health information may be used as necessary to support the day-to-day activities and management of Avita Pharmacy, including to monitor the effectiveness and quality of our health care services, to provide customer services to you and to resolve complaints. We may transfer your PHI for purposes of carrying out pharmacy services if we buy or sell pharmacy locations. For example, information on the services you received may be used to support budgeting and financial reporting, and activities to evaluate and promote quality. We may also use your PHI to tell you about opportunities that may be of interest to you, such as benefits for preferred Avita Pharmacy customers or clinical research projects.

Other Uses and Disclosures of Your PHI that Do Not Require Authorization

We are also allowed or required to share your PHI, without your authorization, in certain situations or when certain conditions have been met.

Individuals Involved in Your Care or Payment for Care. We may disclose your PHI to a friend, personal representative, family member or any other person you identify as a caregiver, who is involved in your care or the payment related to that care. For example, we may provide prescriptions and related information to your caregiver on your behalf. We may also make these disclosures after your death unless doing so is inconsistent with any prior expressed preference documented by Avita Pharmacy. Upon your death, we may disclose your PHI to an administrator, executor or other individual authorized under law to act on behalf of your estate. If you are a minor, we may release your PHI to your parents or legal guardians when permitted or required by law.

Business Associates. When we contract with third parties to perform certain services for us, such as billing or consulting, these third party service providers, known as Business Associates, may need access to your PHI to perform these services. They are required by law and their agreements with us to protect your PHI in the same way we do.

Required By Law. We will disclose your PHI when required to do so to comply with federal, state or local law.

Organ and Tissue Procurement Organizations. Consistent with applicable law, we may disclose your PHI to organizations engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.

Coroners, Medical Examiner and Funeral Director. We can share health information with a coroner, medical examiner, or funeral director when an individual dies. This may be done to assist in identifying a deceased person or to determine the cause of death, and to funeral directors to carry out their duties.

Workers’ Compensation. We may disclose your PHI to the extent authorized and necessary to comply with laws relating to worker’s compensation or similar programs established by law.

Law Enforcement and Other Government Requests. We may disclose your PHI to law enforcement officials as permitted or required by law. For example, we may use or disclose your PHI to report certain injuries or to report criminal conduct that occurred on our premises. We may also disclose your PHI in response to a court order, subpoena, warrant or other similar written request from law enforcement officials.

National Security and Intelligence Activities. We may disclose your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Protective Services for the President and Others. We may disclose your PHI to authorized federal officials so that they may provide protection to the President, other authorized persons, or foreign heads of state, or conduct special investigations.

Responding to lawsuits and legal actions. We can use or share health information about you in response to a court or administrative order, or in response to a subpoena. For example, we may disclose your PHI in response to a court order, subpoena, warrant, or summons. If you are involved in a lawsuit or legal dispute, we may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process.

Public health reporting. Your health information may be disclosed to public health agencies, including federal, state, or local authorities, as required by law. We may also disclose your PHI to any other entity charged with preventing or controlling disease injury, or disability for public health activities. For example, we are required to report certain communicable diseases to the state’s public health department, and disclose personal information to help with product recalls, reporting suspected abuse, neglect, or domestic violence, and preventing or reducing a serious threat to anyone’s health or safety. We are required to report certain adverse reactions to medications. Additionally, we may have to report reactions to medications or other products to the U.S. Food and Drug Administration or other authorized entity; disclosures to notify individuals of recalls, exposure to a disease, or risk for contracting or spreading a disease or condition.

Health Oversight Activities. We may disclose your PHI to an oversight agency for activities authorized by law. These oversight activities include audits, investigations, and inspections, as necessary for our licensure and for government monitoring of the health care system, government programs, and compliance with federal and applicable state law.

United States Department of Health and Human Services. Under federal law, we are required to disclose your PHI to the U.S. Department of Health and Human Services to determine if we are in compliance with federal laws and regulations regarding the privacy of information.

Research. Under certain circumstances, we may use or disclose your PHI for research purposes. However, before disclosing your PHI, the research project must be approved by an institution review board or privacy board that has reviewed the research proposal and established protocols to protect your PHI.

Notification. We may use or disclosure your PHI to assist in a disaster relief effort so that your family, personal representative, or friends may be notified about your condition, status, and location.

Correctional Institution. If you are to become an inmate of a correctional institution, we may disclose to the institution or its agents, PHI is necessary for your health and the health and safety of others.

To Avert a Serious Threat to Health or Safety. We may use and disclose your PHI to appropriate authorities when necessary to prevent a serious threat to your health and safety or the health and safety of another person or the public.

As Required by Law. We must disclose your PHI when required to do so by applicable federal or state law.

Other uses and disclosures require your authorization. Disclosure of your health information or its use for purposes other than those listed above requires your specific written authorization. If you change your mind after authorizing a use or disclosure of your information, you may submit a written revocation of the authorization to the Avita Pharmacy – Privacy Office, 5551 Corporate Blvd., Suite 102, Baton Rouge, LA 70808. However, your decision to revoke the authorization will not affect or undo any use or disclosure of information that occurred before you notified us of your decision to revoke your authorization. Your revocation will become effective upon our receipt of your written notice.

Additional Uses of Information

Appointment or Refill reminders. Your health information will be used by our staff to send you appointment or refill reminders.

Information about treatments. Your health information may be used to send you information that you may find interesting on the treatment and management of your medical condition. We may also send you information describing other health-related products and services that we believe may interest you. We can use or share your information for health research.

We will never share your information for marketing purposes or sell your information to a third party unless you give us written permission.

Please note that we do not create or manage a hospital directory nor do we create or maintain psychotherapy notes.

Your Choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference for how we share your information in the situations described below, tell us what you would like us to do, and we will follow your instructions. You have the right and the choice to tell us to:

• Share information with your family, close friends, or others involved in your care.
• Share information in a disaster relief situation.
• If you are not able to tell us your preference, for example if you are unconscious, we may share your information if we believe it is in your best interest. We may also share your information when needed to lessen a serious and imminent threat to health or safety.

Your Rights

You have certain rights under the federal privacy standards. These include:

• The right to ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree to your request, and we may say “no” if it would affect your care.
• The right to choose to pay for a prescription or service in full out of pocket and restrict disclosure of PHI to a health plan for payment. We will say “yes” unless the law requires us to share the information.
• Request Communications of PHI by Alternative Means or at Alternative Locations. The right to receive confidential communications concerning your medical condition and treatment. You can ask us to contact you in a specific way (for example, home or office phone) or send mail to a different address. To request confidential communication of your PHI, submit a written request to the Avita Pharmacy – Privacy Office, 5551 Corporate Blvd., Suite 102, Baton Rouge, LA 70808. Your request must state how, where, or when you would like to be contacted. We will comply with all reasonable requests.
• The right to see and copy your protected health information or get an electronic copy of your medical record and other health information we have about you. We will provide a copy or a summary of your health information, usually within 30 days of your request. We may charge a reasonable, cost based fee.
• Request an Amendment. If you feel that your PHI we maintain is incomplete or incorrect, you may request that we amend it. To request an amendment, submit a written request to the Avita Pharmacy – Privacy Office, 5551 Corporate Blvd., Suite 102, Baton Rouge, LA 70808. Requests must identify: (i) which information you seek to amend, (ii) what corrections you would like to make, (iii) why the information needs to be amended. We may say “no” to your request, but we will provide you with in explanation in writing within 60 days (with a possible 30-day extension). In our response, we will either (i) agree to make the amendment, or (ii) inform you of your denial, explain our reason, and outline appeal procedures. If denied, you will have the right to file a statement of disagreements with the decision. We will provide a rebuttal to your statement and maintain appropriate records of your disagreement and our rebuttal.
• Receive an Accounting of Disclosures. You have the right to request a list (accounting) of how and to whom your protected health information has been disclosed in the six years prior to the date of your request where your PHI has been used for purposes other than treatment, payment or health care operations. This accounting will also exclude disclosures: made directly to you, made with your authorization, made incidentally, made to caregivers, made for notification purposes, and certain other disclosures. To obtain an accounting, submit a written request to the Avita Pharmacy – Privacy Office, 5551 Corporate Blvd., Suite 102, Baton Rouge, LA 70808. Request must specify the time period, not to exceed six years. We will respond in writing within 60 days of receipt of your request (with a possible 30-day extension). We will provide one accounting a year for free but will charge a reasonable cost based fee if you ask for another one within 12 months. We will notify you in advance of the cost involved, and you may choose to withdraw your request at that time.
• Choose Someone to Act for You. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has authority and can act for you before we take any action.
• Request a General Restriction. A general restriction is one that restricts or limits our use or disclosure of your PHI. To request a general restriction, you must identify in this requests: (i) what particular information you would like to limit, (ii) whether you want to limit use, disclosure, or both, and (iii) to whom you want the limits to apply. We will consider your request but are not required to agree. We have the right to terminate the restriction if: (i) you agree orally or in writing to terminate the restriction, or (ii) if we inform you of the termination, which becomes effective only for your PHI created or received after we inform you of the termination. To submit a general restriction, send a written request to the Avita Pharmacy – Privacy Office, 5551 Corporate Blvd., Suite 102, Baton Rouge, LA 70808.
• Request a Plan Restriction. A plan restriction is one that meets the following three conditions: (A) it is to restrict disclosure of your PHI to a health plan for purposes of payment or health care operations; (B) the PHI relates solely to a health care item or service for which you, or someone on your behalf, has paid us in full; and (C) the disclosure is not otherwise required by law. If you wish to request a plan restriction, you must do so separately for each prescription and subsequent refill event, and must make your request at the pharmacy before your medication is dispensed. Otherwise the pharmacy will automatically submit the claim to your health plan on record, if any, for payment. We will not agree to a plan restriction unless we have first received payment in full for the item or service. We will also not agree to a plan restriction if by law we are required to submit PHI to the plan. If we do agree to a restriction, we will not apply the restriction in the event of an emergency. To submit a plan restriction, you must do so either in person at the pharmacy when you bring in your prescription or by telephoning the pharmacy before your prescription is sent to the pharmacy.
• Obtain a Paper Copy of this Notice. You have the right to receive a printed copy of this notice at any time. You may do so by going to Avita Care Atlanta or contacting the Avita Pharmacy. The address, telephone number, and facsimile number are set forth below.

Avita Pharmacy – Privacy Office

ATTN: Privacy Officer

5551 Corporate Blvd, Suite 102

Baton Rouge, LA 708089

Phone: (225) 236-1538

Fax: (866) 550-7485

Email: [email protected]

Our Duties

We are required by law to maintain the privacy and security of your protected health information and to provide you with this notice of privacy practices.

We are required to abide by the privacy policies and practices that are outlined in this notice and give you a copy of it.

We are required to promptly notify affected individuals if a breach occurs that may have compromised your protected health information.

For more information visit: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

Right to Revise Privacy Practices

As permitted by law, we reserve the right to amend or modify our privacy policies and practices. These changes in our policies and practices may be required by changes in federal and state laws and regulations. Upon request, we will provide you with the most recently revised notice on any pharmacy visit. The new notice will also be available in our offices and on our website. The revised policies and practices will be applied to all protected health information we maintain. We will also post the revised Notice in our retail locations and on our website at Avita Care Atlanta.

Request to Inspect Privacy Practices

You may generally inspect or copy the protected health information that we maintain. As permitted by federal regulation, we require that request to inspect access to your records by contacting our Privacy Officer at Avita Pharmacy – Privacy Office, 5551 Corporate Blvd., Suite 102, Baton Rouge, LA 70808. Your request will be reviewed and will generally be approved unless there are legal or medical reasons to deny the request.

HIV Test Results

We will not disclose medical record information that indicates HIV test results without your authorization or that of your legally authorized representative, except as authorized by State law or required by federal law.

Immunization Records

We will not disclose your immunization records without your authorization, except as permitted by State law.

Complaints

If you would like to submit a comment or complaint about our privacy practices, you can do so by sending a letter outlining your concern to:

Avita Pharmacy – Privacy Office

Privacy Officer

5551 Corporate Blvd, Suite 102

Baton Rouge, LA 708089

Fax: (866) 550-7485

Email: [email protected]

If you believe that your privacy rights have been violated, you should call the matter to our attention by sending a letter describing the cause of your concern to the same address.

You may also file a complaint with the U.S. Department of Health and Human Service Officer for Civil Rights by sending a letter to 200 Independence Avenue, S.W. Washington, D.C. 20201, calling 1-877-696-6775 or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/ .You will not be penalized or otherwise retaliated against for filing a complaint.

Contact Person

The name and address of the person you can contact for further information concerning our privacy practices is:

Avita Pharmacy – Privacy Office

ATTN: Privacy Officer

5551 Corporate Blvd, Suite 102

Baton Rouge, LA 708089

Phone: (225) 236-1538

Fax: (866) 550-7485

Email: [email protected]

Effective date

This Notice is effective on or after January 1, 2021.

STATE SPECIFIC REQUIREMENT ADDENDUM 

Alabama

Disclosure – We will not disclose your professional records to anyone without your authorization, except where it is in your best interest or where the law requires the disclosure.
Medicaid – We will disclose information pertaining to your treatment (including billing statements and itemized bills) only to:

1. the Medicaid Fiscal Agent;
2. the Social Security Administration;
3. the Alabama Vocational Rehabilitation Agency;
4. the Alabama Medicaid Agency;
5. insurance companies requesting information about a Medicaid claim filed by the provider, an insurance application, payment of life insurance benefits, or payment of a loan; or other providers who need the information for treatment of a patient.

Arizona

Communicable Diseases– We will not disclose any confidential communicable disease related information about an individual, except in situations where the subject of the information has provided us with a written authorization allowing the release or where we are authorized or required by state or federal law to make the disclosure.

California

Disclosure – California law limits disclosure of your medical information in ways that would otherwise be permitted under federal law. In the situations described below, the pharmacy will disclose your medical information as follows:

1. the information may be disclosed to providers of health care, health care service plans, contractors or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission or other means between licensed emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and licensed emergency medical personnel at a health facility;
2. the information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor or any other person or entity responsible for paying for health care services rendered to the patient to the extent necessary to allow responsibility for payment to be determined and payment to be made. If the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure or medical information and no other arrangements have been made to pay for the health care services being rendered to the patient, the information may also be disclosed to a governmental authority to the extent necessary to determine the patient’s eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient;
3. the information may be disclosed to any person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified above in paragraph (b). However, no information so disclosed may be further disclosed by the recipient in any way that would be violative of California laws governing the use and disclosure of medical information without authorization from the patient;
4. the information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers, utilization and quality control peer review organizations, contractor’s or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges;
5. a provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee’s employer that:
6. is relevant in a law suit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding;
   2. describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient’s fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed;
   6 unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits;
   7 the information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part;
   8. the information may be disclosed to an insurance institution, agent or support organization of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to the requirements of the California Insurance Code provisions;
   9. the information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent for the purpose of aiding the transplant;
   10. the information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information may be further disclosed by the recipient in any way that would be unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information;
   11. for purposes of disease management programs and services, information may be disclosed to any entity contracting with a health care service plan or the health care service plan’s contractors to monitor or administer care of enrollees for a covered benefit, provided that the disease management services and care are authorized by a treating physician or to any disease management organization that complies fully with the physician authorization requirements, provided that the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan’s or contractor’s network of physician.

Connecticut

Disclosure – We will not disclose information about pharmaceutical services rendered to you to third parties without your consent, except to the following persons:

1. the prescribing practitioner or a pharmacist or another prescribing practitioner presently treating you when deemed medically appropriate;
2. a nurse who is acting as an agent for a prescribing practitioner that is presently treating you or a nurse providing care to you in a hospital;
3. third party payors who pay claims for
4. pharmaceutical services rendered to you or who have a formal agreement or contract to audit any records or information in connection with such claims;
5. any governmental agency with statutory authority to review or obtain such information;
6. any individual, the state or federal government or any agency thereof or court pursuant to a subpoena; and
7. any individual, corporation, partnership or other legal entity which has a written agreement with the pharmacy to access the pharmacy’s database provided the information accessed is limited to data which does not identify specific individuals.

Sale of Information: We will not sell your individually identifiable medical record information.

Florida

Disclosure – We will not disclose your pharmacy records without your written authorization, except to:

1. you;
2. your legal representative;
3. the Department of Health pursuant to existing law;
4. in the event that you are incapacitated or unable to request your records, your spouse; and
5. in any civil or criminal proceeding, upon the issuance of a subpoena from a court of competent jurisdiction and proper notice to you or your legal representative, by the party seeking the records.

Georgia

Disclosure – Unless authorized by you, we will not disclose your confidential information to anyone other than you or your authorized representative, except to the following persons or entities:

1. the prescriber, or other licensed health care practitioners caring for you;
2. another licensed pharmacist for purposes of transferring a prescription or as part of a patient’s drug utilization review, or other patient counseling requirements;
3. the Board of Pharmacy, or its representative; or
4. any law enforcement personnel duly authorized to receive such information.

We may also disclose your confidential information without your consent pursuant to a subpoena issued and signed by an authorized government official or a court order issued and signed by a judge of an appropriate court.

HIV/AIDS – We will not disclose AIDS confidential information, except in situations where the subject of the information has provided us with a written authorization allowing the release or where we are authorized or required by state or federal law to make the disclosure.

Hawaii

HIV/AIDS – We will not disclose any HIV/AIDS/ARC-related information, except in situations where the subject of the information has provided us with prior written consent allowing the release or where we are authorized or required by state or federal law to make the disclosure.

Idaho

Disclosure – We will not release your identifiable prescription information to anyone other than you or your designee, unless requested by any of the following persons or entities:

1. the Board of Pharmacy, or its representatives, acting in their official capacity;
2. the practitioner, or the practitioner’s designee, who issued your prescription;
3. other licensed health care professionals who are responsible for the your care;
4. agents of the Department of Health and Welfare when acting in their official capacity with reference to issues related to the practice of pharmacy;
5. agents of any board whose practitioners have prescriptive authority, when the board is enforcing laws governing that practitioner;
6. an agency of government charged with the responsibility for providing medical care for you;
7. the federal Food and Drug Administration, for purposes relating to monitoring of adverse drug events in compliance with the requirements of federal law, rules or regulations adopted by the FDA; and
8. the authorized insurance benefit provider or health plan that provides your health care coverage or pharmacy benefits.

Indiana

Disclosure – We will disclose your confidential information only when it is in your best interests, when the information is requested by the Board of Pharmacy or its representatives or by a law enforcement officer charged with the enforcement of laws pertaining to drugs or devices or the practice of pharmacy, or when disclosure is essential to our business operations.

Iowa

HIV/AIDS – We will not disclose any HIV/AIDS-related information, except in situations where the subject of the information has provided us with a written authorization allowing the release or where we are authorized or required by state or federal law to make the disclosure.

Kentucky

Disclosure – We will not disclose your patient information or the nature of professional services rendered to you without your express consent or without a court order, except to the following authorized persons:

1. members, inspectors, or agents of the Board of Pharmacy;
2. you, your agent, or another pharmacist acting on your behalf;
3. another person, upon your request;
4. licensed health care personnel who are responsible for your care;
5. certain state government agents charged with enforcing the controlled substances laws;
6. federal, state, or municipal government officers who are investigating a specific person regarding drug charges; and
7. a government agency that may be providing medical care to you, upon that agency’s written request for information.

Minimum Necessary – We will only use your information to provide pharmacy care.

Maine

Disclosure – We will not disclose your health care information for fundraising purposes or to coroners or funeral directors, without your authorization.
Communicable Diseases – We will only disclose patient identifiable communicable disease information to Department of Human Services for adult or child protection purposes or to other public health officials, agents or agencies or to officials of a school where a child is enrolled, for public health purposes. In a public health emergency, as declared by the state health officer, we may also release your information to private health care providers and agencies for preventing further disease transmission.

Massachusetts

Medicaid – We will restrict disclosure of your information to purposes directly connected with the administration of the Medicaid program .

Michigan

Disclosure – Unless authorized by you, we will not disclose your prescription or equivalent record on file, except to the following persons:

1. you, or another pharmacist acting on your behalf;
2. the authorized prescribed who issued the prescription, or a licensed health professional who is currently treating you;
3. an agency or agent of government responsible for the enforcement of laws relating to drugs and devices; or
4. a person authorized by a court order.

HIV/AIDS – We will not disclose AIDS-related information about an individual except in situations where the subject of the information has provided us with a written authorization allowing the release or where we are authorized or required by state or federal law to make the disclosure. 

Minnesota

Disclosure – For pharmacies that elect to obtain consent pursuant to state law: We will not disclose your pharmacy records without your consent, except:

1. for a medical emergency when the provider is unable to obtain your consent due to your condition or the nature of the medical emergency; or
2. to other providers within related health care entities when necessary for your current treatment.

We will not disclose your prescription orders or the contents thereof, except to:

1. you, your agent, or another pharmacist acting on your behalf or your agent’s behalf;
2. the licensed practitioner who issued the prescription;
3. the licensed practitioner who is currently treating you;
4. a member, inspector, or investigator of the board or any federal, state, county, or municipal officer whose duty it is to enforce the laws of this state or the United States relating to drugs and who is engaged in a specific investigation involving a designated person or drug;
5. an agency of government charged with the responsibility of providing medical care for you;
6. an insurance carrier or attorney on receipt of written authorization signed by you or your legal representative, authorizing the release of such information; and
7. any person duly authorized by a court order.

Unless we have obtained your oral or written consent, we will not disclose the nature of pharmaceutical services rendered to you, except as follows:

1. pursuant to an order or direction of a court;
2. to other pharmacies;
3. to you; or
4. drug therapy information to your physician.

Missouri

Disclosure – Unless specifically authorized by you, we will not release your pharmacy records to anyone other than:

1. you or any other person authorized by you to receive the information;
2. the authorized prescriber who issued the prescription order, or a licensed health professional who is currently treating you;
3. in response to lawful requests from a court or grand jury;
4. a person authorized by a court order;
5. to transfer medical or prescription information between pharmacists as provided by law; or
6. government agencies acting within the scope of their statutory authority.

Medicaid – We will restrict disclosure of your information to purposes directly related to your treatment, for promotion of improved quality of care, and to assist with an investigation, prosecution, or civil or criminal proceeding related to the administration of the Medicaid program.
HIV/AIDS – We will not disclose any HIV/AIDS-related information, except in situations where the subject of the information has provided us with a written authorization allowing the release or where we are authorized or required by state or federal law to make the disclosure.

Montana

Children’s Health Insurance Program – We will restrict disclosure of your information to purposes related to the administration of the CHIP program.
Medicaid – We will only use your information for purposes related to administration of the Montana Medicaid program. We will not disclose your information without your written consent, except to state authorities.
Sexually Transmitted Diseases – We will not disclose information concerning persons infected, or reasonably suspected to be infected with a sexually transmitted disease, except to:

1. personnel of the Department of Public Health and Human Services;
2. a physician who has obtained the written consent of the person whose record is requested; or
3. a local health officer.

New Hampshire

Disclosure – We will only disclose your professional records if:

1. we have obtained your permission to do so;
2. it is an emergency situation and it is in your best interest for us to disclose the information; or
3. the law requires us to disclose the information.

Sales or Marketing – We will not use, release, or sell your identifiable medical information for the purposes of sales or marketing of services or products unless you have provided us with a written authorization permitting such activity.

New Jersey

Pharmaceutical Assistance to the Aged and Disabled – We will not disclose your personally identifiable information without your or your agent’s consent, except for purposes directly connected to the administration of the PAAD program or as otherwise permitted by state or federal law.

New Mexico

Disclosure – Unless we receive a written consent from you, we will not disclose your confidential information to anyone other than you or your authorized representative, except to the following persons or entities:

1. pursuant to the order or direction of a court;
2. to the prescriber or other licensed practitioner caring for you;
3. to another licensed pharmacist where it is in your best interest;
4. to the Board of Pharmacy or its representative or to such other persons or governmental agencies duly authorized by law to receive such information;
5. to transfer a prescription to another pharmacy as required by the provisions of patient counseling;
6. to provide a copy of a nonrefillable prescription to you;
7. to provide drug therapy information to physicians or other authorized prescribers for their patients; or

1. as required by the provisions of the patient counseling regulations.

New York

Disclosure – A copy of a prescription for a controlled substance will not be furnished to the patient, but may be furnished to any licensed practitioner authorized to write such a prescription.

Common Electronic File/Database – We will not access a common electronic file or database used to maintain required personally identifiable dispensing information except upon your, or your agent’s, express request.

North Carolina

Disclosure – We will not disclose or provide a copy of your prescription orders on file, except to:

1. you;
2. your parent or guardian or other person acting in loco parentis if you are a minor and have not lawfully consented to the treatment of the condition for which the prescription was issued;
3. the licensed practitioner who issued the prescription or who is treating you;
4. a pharmacist who is providing pharmacy services to you;
5. anyone who presents a written authorization for the release of pharmacy information signed by you or your legal representative;
6. any person authorized by subpoena, court order or statute;
7. any firm, company, association, partnership, business trust, or corporation who by law or by contract is responsible for providing or paying for medical care for you;
8. any member or designated employee of the Board of Pharmacy;
9. the executor, administrator or spouse of a deceased patient;
10. Board-approved researchers, if there are adequate safeguards to protect the confidential information; and,
11. the person who owns the pharmacy or his licensed agent.

North Dakota

Disclosure – We will not disclose the nature of the services we provide to you to anyone other than you, without first obtaining your oral or written consent, except that we may disclose such information:

1. to other pharmacies;
2. to your physician; or
3. as ordered or directed by a court.

Ohio

Disclosure – Unless we have obtained your written consent, we will only disclose your pharmacy records to:

1. you;
2. the prescriber who issued the prescription or medication order;
3. certified/licensed health care personnel who are responsible for your care;
4. a member, inspector, agent, or investigator of the state board of pharmacy or any federal, state, county, or municipal officer whose duty is to enforce the laws of this state or the United States relating to drugs and who is engaged in a specific investigation involving a designated person or drug;
5. an agent of the state medical board when enforcing the statutes governing physicians and limited practitioners;
6. an agency of government charged with the responsibility of providing medical care for you, upon a written request by an authorized representative of the agency requesting such information;
7. an agent of a medical insurance company who provides prescription insurance coverage to you, upon authorization and proof of insurance by you or proof of payment by the insurance company for those medications whose information is requested;
8. an agent who contracts with the pharmacy as a “business associate” in accordance with the regulations promulgated by the secretary of the United States department of health and human services pursuant to the federal standards for privacy of individually identifiable health information; or
9. in emergency situations, when it is in your best interest.

Oklahoma

Disclosure – Patient Confidences: We will not divulge the nature of your problems or ailments or any confidence you have entrusted to the pharmacist in his professional capacity, except in response to legal requirements or where it’s in your best interest.

Communicable and Venereal Diseases – We will not disclose information which identifies any person who has or may have a communicable or venereal disease, unless authorized by the individual or as otherwise permitted under state law. Whenever possible, we will de-identify such information prior to disclosure. 

Pennsylvania

HIV/AIDS – We will not disclose any HIV-related information, except in situations where the subject of the information has provided us with a written consent allowing the release or where we are authorized or required by state or federal law to make the disclosure.

Rhode Island

Disclosure – Pharmacist-Specific: We will only disclose your prescription information to our agents and persons directly involved in your care.
Disclosure – Health Care Provider: We will not disclose your confidential health care information without your consent, except in the following situations:

1. to a physician, dentist, or other medical personnel who believe in good faith that the information is necessary to diagnose or treat you in a medical or dental emergency;
2. to qualified personnel for the purpose of conducting scientific research, management audits, financial audits, program evaluations, actuarial, insurance underwriting, or similar studies, provided that personnel does not identify, directly or indirectly, you in any report of that research, audit, or evaluation, or otherwise disclose your identity in any manner;
3. to appropriate law enforcement personnel, or to a person if the pharmacist believes that you may pose a danger to that person or his or her family; or to appropriate law enforcement personnel if you have attempted or are attempting to obtain narcotic drugs from the pharmacy illegally; or to appropriate law enforcement personnel or appropriate child protective agencies if you are a minor child who the pharmacist believes, after providing services to you, to have been physically or psychologically abused;
4. between or among qualified personnel and health care providers within the health care system for purposes of coordination of health care services given to you and for purposes of education and training within the same health care facility;
5. to third party health insurers for the purpose of adjudicating health insurance claims or administering benefits, including to utilization review agents, third party administrators, and other entities that provide operational support;
6. to a malpractice insurance carrier or lawyer if we have reason to anticipate a medical liability action;
7. to our own lawyer or medical liability insurance carrier if you initiate a medical liability action against our pharmacy;
8. to public health authorities in order to carry out their designated functions. These functions include, but are not restricted to, investigations into the causes of disease, the control of public health hazards, enforcement of sanitary laws, investigation of reportable diseases, certification and licensure of health professionals and facilities, and review of health care such as that required by the federal government and other governmental agencies;
9. to the state medical examiner in the event of a fatality that comes under his or her jurisdiction;
10. in relation to information that is directly related to a current claim for workers’ compensation benefits or to any proceeding before the workers’ compensation commission or before any court proceeding relating to workers’ compensation;
11. to our attorneys whenever we consider the release of information to be necessary in order to receive adequate legal representation;
12. to a law enforcement authority to protect the legal interest of an insurance institution, agent, or insurance-support organization in preventing and prosecuting the perpetration of fraud upon them;
13. to a grand jury or to a court of competent jurisdiction pursuant to a subpoena or subpoena duces tecum when that information is required for the investigation or prosecution of criminal wrongdoing by a health care provider relating to his or her or its provisions of health care services and that information is unavailable from any other source; provided, that any information so obtained is not admissible in any criminal proceeding against you;
14. to the state board of elections pursuant to a subpoena or subpoena duces tecum when the information is required to determine your eligibility to vote by mail ballot and/or the legitimacy of a certification by a physician attesting to a voter’s illness or disability;
15. to certify the nature and permanency of your illness or disability, the date when you were last examined and that it would be an undue hardship for you to vote at the polls so that you may obtain a mail ballot;
16. to the Medicaid fraud control unit of the attorney general’s office for the investigation or prosecution of criminal or civil wrongdoing by a health care provider relating to his or her or its provision of health care services to then Medicaid eligible recipients or patients, residents, or former patients or residents of long term residential care facilities; provided, that any information obtained is not admissible in any criminal proceeding against you;
17. to the state department of children, youth, and families pertaining to the disclosure of health care records of children in the custody of the department;
18. to the foster parent or parents pertaining to the disclosure of health care records of children in the custody of the foster parent or parents; provided, that the foster parent or parents receive appropriate training and have ongoing availability of supervisory assistance in the use of sensitive information that may be the source of distress to these children; or
19. to the workers’ compensation fraud prevention unit for purposes of investigation. 

South Carolina

Disclosure – Prescription Information Privacy Act: We will not disclose your prescription drug information without first obtaining your consent, except in the following circumstances:

1. the lawful transmission of a prescription drug order in accordance with state and federal laws pertaining to the practice of pharmacy;
2. communications among licensed practitioners, pharmacists and other health care professionals who are providing or have provided services to you;
3. information gained as a result of a person requesting informational material from a prescription drug or device manufacturer or vendor;
4. information necessary to effect the recall of a defective drug or device or protect the health and welfare of an individual or the public;
5. information whereby the release is mandated by other state or federal laws, court order, or subpoena or regulations (e.g., accreditation or licensure requirements);
6. information necessary to adjudicate or process payment claims for health care, if the recipient makes no further use or disclosure of the information;
7. information voluntarily disclosed by you to entities outside of the provider-patient relationship;
8. information used in clinical research monitored by an institutional review board, with your written authorization;
9. information which does not identify you by name, or that is encoded so that identifying you by name or address is generally not possible, and that is used for epidemiological studies, research, statistical analysis, medical outcomes, or pharmacoeconomic research;
10. information transferred in connection with the sale of a business;
11. information necessary to disclose to third parties in order to perform quality assurance programs, medical records review, internal audits or similar programs, if the third party makes no other use or disclosure of the information;
12. information that may be revealed to a party who obtains a dispensed prescription on your behalf; or
13. information necessary in order for a health plan licensed by the South Carolina Department of Insurance to perform case management, utilization management, and disease management for individuals enrolled in the health plan, if the third party makes no other use or disclosure of the information.

Disclosure – Pharmacist-Specific: We will not disclose your information or the nature of professional pharmacy services rendered to you, without your express consent or the order or direction of a court, except to:

1. you, or your agent, or another pharmacist acting on your behalf;
2. the practitioner who issued the prescription drug order;
3. certified/licensed health care personnel who are responsible for your care;
4. an inspector, agent or investigator from the Board of Pharmacy or any federal, state, county, or municipal officer whose duty is to enforce the laws of South Carolina or the United States relating to drugs or devices and who is engaged in a specific investigation involving a designated person or drug; and
5. a government agency charged with the responsibility of providing medical care for you upon written request by an authorized representative of the agency requesting the information.

South Dakota

Social Services – We will only use your information for purposes directly connected to the administration of the medical assistance program. We will not disclose your information without obtaining your approval.

Tennessee

Disclosure – We will not disclose your name and address or other identifying information, except to:

1. a health or government authority pursuant to any reporting required by law;
2. an interested third-party payor for the purpose of utilization review, case management, peer reviews, or other administrative functions; or
3. in response to a subpoena issued by a court of competent jurisdiction.

We will obtain your authorization before we disclose your patient records for any reason, except where:

1. the disclosure is in your best interest;
2. the law requires the disclosure; or
3. the disclosure is to an authorized prescriber or to communicate a prescription order where necessary to:
   • carry out prospective drug use review as required by law;
   • assist prescribers in obtaining a comprehensive drug history on you; or
   • prevent abuse or misuse of a drug or device and the diversion of controlled substances.

Sale of Information – We will not sell your name and address or other identifying information for any purpose. 

Texas 

Disclosure – We will only release your confidential record to you, your agent, or to:

1. a practitioner or another pharmacist if, in the pharmacist’s professional judgment, the release is necessary to protect your health and well-being;
2. the pharmacy board or another state or federal agency authorized by law to receive the record;
3. a law enforcement agency engaged in investigation of a suspected violation of the controlled substances laws, or the Comprehensive Drug Abuse Prevent Control Act of 1970;
4. a person employed by a state agency that licenses a practitioner, if the person is performing the person’s official duties; or
5. an insurance carrier or other third party payor authorized by the patient to receive the information.

Utah

Disclosure – We will not release or discuss information in your prescription or medication profile to anyone except:

1. you or your legal guardian or designee;
2. a lawfully authorized federal, state, or local drug enforcement officer;
3. a third party payment program authorized by you;
4. another pharmacist, pharmacy intern, pharmacy technician, or prescribing practitioner providing services to you or to whom you have requested us to transfer a prescription;
5. your attorney, with a written authorization signed by:
   • you before a notary public;
   • your parent or lawful guardian, if you are a minor;
   • your lawful guardian, if you are incompetent; or
   • our personal representative, in the case of deceased patients.

Vermont

Unprofessional Conduct – Unless we have your consent or a court order, we will not disclose your information or the nature of services rendered to you, except to the following persons:

1. you, your agent, or another pharmacist acting on your behalf;
2. the practitioner who issued the prescription drug order;
3. certified or licensed health care personnel who are responsible for your care;
4. a Board of Pharmacy or federal, state, county, or municipal officer that enforces state or federal law relating to drugs or devices, pursuant to an investigation of a designated drug or person; or
5. a government agency responsible for providing medical care for you, upon a written request by an authorized agency representative.

Washington

Disclosure – Unless authorized by you, we will not disclose your health care information, except if the recipient needs to know the information and the disclosure is:

1. to a person who the pharmacist reasonably believes is providing health care to you;
2. to any other person who requires health care information for health care education, or to provide planning, quality assurance, peer review, or administrative, legal, financial, or actuarial services to the pharmacy; or for assisting the pharmacy in the delivery of health care and the pharmacist reasonably believes that the person will not use or disclose the health care information for any other purpose and will take appropriate steps to protect the health care information;
3. to any other health care provider reasonably believed to have previously provided health care to you, to the extent necessary to provide health care to you, unless you have instructed the pharmacy in writing not to make the disclosure;
4. to any person if the pharmacist reasonably believes that disclosure will avoid or minimize an imminent danger to your or another individual’s health or safety, however there is no obligation on the part of the pharmacist to so disclose;
5. oral, and made to your immediate family members, or any other individual with whom you have a close personal relationship, if made in accordance with good medical or other professional practice, unless you have instructed us in writing not to make the disclosure;
6. to a health care provider who is the successor in interest to the pharmacy;
7. to a person who obtains information for purposes of an audit, if that person agrees in writing to remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable you to be identified and not to disclose the information further, except to accomplish the audit or report unlawful or improper conduct involving fraud in payment for health care by a health care provider or patient, or other unlawful conduct by the pharmacy;
8. to an official of a penal or other custodial institution in which you are detained; or
9. to provide directory information, unless you have instructed the pharmacy not to make the disclosure

Sexually Transmitted Diseases – We will not disclose any information regarding an individual’s treatment for a sexually transmitted diseases, except in situations where the subject of the information has provided us with a written authorization allowing the release or where we are authorized or required by state or federal law to make the disclosure.

West Virginia

Mental Health – We will not disclose confidential information relating to an individual who is obtaining or has obtained treatment for a mental illness, without the individual’s written consent, except in the following circumstances:

1. with the signed, written consent of the individual or his legal guardian;
2. in certain proceedings involving involuntary examinations;
3. pursuant to a court order in which the court found the relevance of the information to outweigh the importance of maintaining the confidentiality of the information;
4. to protect against clear and substantial danger of imminent injury by the individual to himself or another; or to staff of the mental health facility where the individual is being cared for or to other health professionals involved in treatment of the individual, for treatment or internal review purposes.

Wisconsin

Disclosure – We will not disclose your prescription records to anyone other than you or someone authorized by you without first obtaining your written informed consent.

Wyoming

Disclosure – Unless we have received an authorization from you, we will only disclose your confidential information to:

1. you, or as you direct;
2. to those practitioners and other pharmacists where, in the pharmacist’s professional judgment such release is necessary for treatment or to protect your health and well being;
3. to such other persons or governmental agencies authorized by law to investigate controlled substance law violations;
4. a minor’s parent or guardian;
5. your third party payor; or
6. your agent.

California Personnel Privacy Notice

This California Personnel Privacy Notice (“Personnel Privacy Notice”) describes the personal information that Avita Pharmacy (“Avita” or “we” or “us” or “our”) collects about you in the context of your role as an employee, owner, director, officer or contractor of Avita, as well as the purposes for which Avita collects your personal information. We are providing you this Personnel Privacy Notice in effort to be transparent about how we handle your personal information.

We may collect the following categories of personal information in connection with your employment with us:

• Identifiers: We collect information that directly identifies you, such as your name (including other names used), address, email address, phone number, social security number, and government-issued identification numbers (e.g., driver’s license number or passport number).

• Protected characteristics: We collect some information regarding certain characteristics that are provided special protection under California law, such as your age, citizenship, and marital status. If you choose to provide this information to us, we may also collect information related to your sex, gender, race, ethnicity, medical history, veteran status, disability status, sexual orientation.

• Professional and employment-related information: We collect your professional and employment-related information, such as your title, date of hire, work schedule and status, compensation history, work eligibility information, employment history, education background, certificates and licenses, and other information contained within any resume and cover letter you submit to us, as well as information provided to us about you through background checks and your LinkedIn account (if applicable). We also collect benefits and leave information, and information related to any legal issues or disputes that may arise during the course of your employment or other similar professional relationship with us.

• Beneficiary and dependent information: If you provide this information to us, we collect information about your beneficiaries and dependents, such as their names, contact information, dates of birth, social security numbers and other similar information related to beneficiaries and dependents.

• Internet and electronic network activity information: We collect information about your work email account, and your usage of the internet, our electronic network, our computers, phones, and other devices to which you have access. This information includes your browsing and search history.

• Other personal records: In addition to the categories of information collected above, we may also collect other personal information that relates to, describes, or is capable of being associated with you, such as, your signature, your photograph or other depictions of your physical characteristics, birth date, financial account information, medical insurance and other benefits information, and emergency contact information.

• Inferences: We collect, through making inferences drawn from the personal information we collect in order to create a profile about you reflecting your preferences, characteristics, abilities and aptitudes. We collect the above categories of personal information to manage our employment or other similar professional relationship with you. For example, we use the above categories of personal information for the following business purposes:

• Personnel administration: We use your personal information to verify your identity and information, to provide your human resources services, to manage tax and social security services, to manage personnel work schedules, to process employee/personnel work-related claims and other similar personnel administration purposes.

• Processing personnel benefits: We use your personal information to administer and process your medical, life, retirement, or other benefits.

• Processing professional or employment-related interactions and transactions: We use your personal information to process payroll, to process expense reimbursements, and to manage salaries, sick pay, paid time off, and leaves of absences. We also use your personal information to manage employee job duties and conduct performance reviews and evaluations.

• Complying with federal and state law: We use your personal information to comply with federal and state laws. Some of these laws require us to maintain and disclose certain records and information related to you.

• Maintaining security: We use some of your personal information to monitor the use of our equipment and property for security purposes, such as detecting security risks and incidents, protecting against fraudulent or illegal activity, verifying and maintaining the quality and security of company-issued devices, and ensuring compliance with our policies and procedures.

• Our own business purposes: We may use some of your personal information to perform analytics to discover ways to improve our business, identify trends in our workforce and enhance our service offerings.

If you have questions about this Privacy Notice, please contact Human Resources at [email protected]