Notice of Privacy Practices

1Who follows this notice

This notice is issued by CoreScripts Medical Group, P.A. and the affiliated independent, physician-owned professional entities whose clinicians provide care through the CoreScripts platform (together, the “Practice”). It applies to all records of your care created or maintained by the Practice.

MXS Suppliments LLC d/b/a CoreScripts provides administrative and technology services to the Practice as a business associate under HIPAA, and is bound by a written agreement to protect your information on the same terms.

The Practice is required by law to maintain the privacy of your protected health information (“PHI”), to give you this notice of its legal duties and privacy practices, to notify you following a breach of unsecured PHI, and to abide by the terms of the notice currently in effect.

2Uses and disclosures without your authorization

Treatment

Your clinician may use your PHI to evaluate you and to prescribe, and may disclose it to a pharmacy that dispenses your prescription, to a laboratory that performs testing your clinician orders, and to other providers involved in your care.

Payment

To bill and collect for services, to verify a payment method, and to resolve a chargeback or billing dispute.

Health care operations

Quality assessment, clinical peer review, credentialing and licensure verification, training, compliance auditing, business planning, and customer service.

3Other permitted uses and disclosures

The Practice may use or disclose your PHI without your authorization in these situations, subject to the conditions in the HIPAA rules:

• As required by law, including in response to a court order, subpoena that meets HIPAA requirements, or a valid administrative request.
• Public health activities — disease reporting, product recalls, and reporting adverse events and product problems to the FDA.
• Health oversight — audits, investigations, inspections, and licensure actions by state medical and pharmacy boards and other agencies.
• Abuse, neglect, or domestic violence reporting where required or permitted.
• To avert a serious threat to the health or safety of you or others.
• Law enforcement, coroners and medical examiners, workers’ compensation, organ procurement, and specialized government functions, in the limited circumstances the rules allow.
• Research, only with Institutional Review Board or Privacy Board approval, or using a limited or de-identified data set.

4Uses that always require your written authorization

The Practice will obtain your written authorization before:

• Most marketing communications that involve payment from a third party;
• Any sale of your PHI — and the Practice does not sell PHI;
• Any use or disclosure of psychotherapy notes, with narrow exceptions;
• Any other use or disclosure not described in this notice.

You may revoke an authorization in writing at any time, except to the extent the Practice has already acted in reliance on it.

5Your rights regarding your health information

Right to inspect and copy

You may inspect and obtain a copy of your record, including an electronic copy of an electronic record, generally within 30 days of your request. A reasonable, cost-based fee may apply for copies.

Right to amend

You may ask the Practice to amend information you believe is incorrect or incomplete. The Practice may deny the request and will give you a written explanation and your right to submit a statement of disagreement, which becomes part of your record.

Right to an accounting of disclosures

You may request a list of certain disclosures made in the six years before your request, other than those for treatment, payment, or operations. One list per 12-month period is free.

Right to request restrictions

You may ask the Practice to limit how it uses or discloses your PHI. The Practice is not required to agree, except that it must agree to withhold information from a health plan about a service you paid for in full out of pocket.

Right to confidential communications

You may ask to be contacted at an alternate address or by an alternate means. Reasonable requests will be accommodated.

Right to a paper copy of this notice

You may request one at any time, even if you agreed to receive it electronically.

Right to breach notification

You will be notified if a breach of your unsecured PHI occurs.

Right to choose someone to act for you

A personal representative with legal authority may exercise these rights on your behalf.

To exercise any right, write to the Privacy Officer at support@getCoreScripts.com or 1309 Coffeen Ave, Ste 1200, Sheridan, WY 82801.

6How to file a complaint

If you believe your privacy rights have been violated, you may file a complaint with the Practice’s Privacy Officer at support@getCoreScripts.com or by writing to 1309 Coffeen Ave, Ste 1200, Sheridan, WY 82801.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201, by calling 1-877-696-6775, or online at hhs.gov/ocr/complaints.

7Changes to this notice

The Practice reserves the right to change this notice and to make the revised notice effective for PHI it already maintains as well as information it receives in the future. The current notice is always posted at getcorescripts.com/notice-of-privacy-practices.html with its effective date. A revised notice will be provided to you on request and, for material changes, by email or through the portal.