Privacy Policy

Introduction: Our Commitment to Your Privacy

At Opioid Meds Pharmacy, we understand that seeking treatment for pain management or opioid use disorder is a deeply personal journey that requires immense trust. We recognize that the privacy of your medical information is not just a legal requirement—it is a fundamental right and the cornerstone of your confidence in our care.

This Privacy Policy describes how Opioid Meds Pharmacy (“we,” “us,” or “our”) collects, uses, protects, and discloses your protected health information (PHI). We are required by law to maintain the privacy of your health information and to provide you with this notice of our legal duties and privacy practices .

IMPORTANT: DUAL PROTECTION UNDER HIPAA AND 42 CFR PART 2
Because Opioid Meds Pharmacy specializes in medications for opioid use disorder, your records are protected not only by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) but also by the stricter federal confidentiality regulations found in Title 42, Part 2 of the Code of Federal Regulations (42 C.F.R. Part 2) . These Part 2 rules provide special privacy protections for records relating to substance use disorder treatment. Under these rules, we generally cannot disclose your substance use disorder treatment records to anyone outside our organization without your specific written consent, with very limited exceptions .

Please review this document carefully. It explains your rights and how your information is safeguarded.

2. Who We Are and What Information This Policy Covers

The Covered Entity: Opioid Meds Pharmacy is a HIPAA-covered entity because we provide healthcare services (dispensing prescriptions) and electronically transmit health information in connection with standard transactions like billing and insurance eligibility checks .

Types of Information We Collect:

• Protected Health Information (PHI): This includes information that identifies you and relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or the payment for that care .

• Part 2 Protected Records: Specifically, this refers to records created by us pertaining to the treatment of opioid use disorder, including prescriptions for medications such as buprenorphine, methadone, and naltrexone. These records receive heightened confidentiality protections .

Hybrid Entity Status: Please note that while our pharmacy operations are governed by this HIPAA Notice, any information you provide through our general website contact forms (e.g., name, email, inquiry) for non-treatment purposes is handled separately. We recommend you do not submit detailed medical information via unsecured website forms .

3. Your Rights Regarding Your Health Information

You have specific rights concerning the health information we maintain about you. To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information in Section 12.

A. Right to Inspect and Copy (Access)
You have the right to look at and get a paper or electronic copy of your medical information, including pharmacy records and prescription histories . We may charge a reasonable, cost-based fee for copying, postage, and supplies. Requests must be made in writing to our Privacy Officer .

B. Right to Request Amendment
If you believe that the health information we have about you is incorrect or incomplete, you may ask us to amend it. You must provide a reason for your request. We may deny your request if it is not in writing, if the information was not created by us, or if we determine the information is accurate and complete .

C. Right to an Accounting of Disclosures
You have the right to request a list (an “accounting”) of certain disclosures we have made of your health information. This list will not include disclosures made for treatment, payment, health care operations, disclosures made directly to you, or disclosures made with your authorization. Your request must state a time period (up to six years). The first accounting in a 12-month period is free; we may charge a fee for subsequent requests .

D. Right to Request Restrictions
You have the right to request that we restrict or limit how we use or disclose your health information for treatment, payment, or health care operations. We are not required to agree to your request unless:

• You ask us to restrict disclosure to a health plan (insurance company) regarding a specific item or service for which you have paid us out-of-pocket in full. In that case, we are required to agree to the restriction and will not send the claim to your insurance .

• If we do agree to a restriction, we will comply unless the information is needed to provide you with emergency treatment .

E. Right to Request Confidential Communications
You have the right to ask that we communicate with you about your health matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail to a P.O. Box. We will accommodate all reasonable requests . You do not need to tell us the reason for your request .

F. Right to Receive a Paper Copy of This Notice
Even if you have agreed to receive this notice electronically, you have the right to a paper copy at any time. You may request one from our Privacy Officer or at the pharmacy counter .

G. Right to Revoke Authorization
You have the right to revoke (take back) your written authorization to use or disclose your health information at any time. However, revocation will not affect any actions we have already taken in reliance on that authorization .

H. Right to Be Notified of a Breach
You have the right to be notified if we discover a breach of your unsecured protected health information .

4. How We May Use and Disclose Your Information

A. Uses and Disclosures With Your Written Consent (Specifically for Part 2 Records)

For records protected under 42 CFR Part 2 (relating to substance use disorder treatment), we generally must obtain your written consent before disclosing your information to a third party. This includes disclosures for routine purposes like treatment, payment, and health care operations to entities outside our pharmacy .

• Single Consent for All Future TPO: You may provide a single consent for all future uses and disclosures for treatment, payment, and health care operations purposes .

• Mandated Treatment: If your treatment is mandated by the criminal legal system, you must sign a separate consent allowing us to share information with the court, probation, or parole officers .

B. Uses and Disclosures Without Authorization (Treatment, Payment, Operations)

We may use and disclose your health information without your written authorization for the following purposes, in compliance with both HIPAA and, where applicable, Part 2 rules :

• For Treatment. We may use your health information to dispense medications to you and to coordinate your care.

  • Example: We may disclose your prescription history to your prescriber to check for harmful drug interactions or to consult with them regarding your treatment plan .

• For Payment. We may use and disclose your information to bill and collect payment for the medications and services we provide.

  • Example: We may share information with your health insurance plan, pharmacy benefit manager, or Medicare to determine coverage or to get paid for your prescription .

• For Health Care Operations. We may use and disclose your information for the operational activities of our business.

  • Example: This includes using your information for quality improvement (e.g., reviewing the performance of our pharmacists), customer service, fraud prevention, and business management .

C. Other Permitted Uses and Disclosures (Without Authorization)

We may use or disclose your information without your authorization in the following situations, subject to applicable legal requirements:

• Business Associates: We may share your information with third-party contractors (“business associates”) who perform services on our behalf, such as billing software companies, delivery services, or IT support. These business associates are required by law and by contract to protect your information .

• Disclosures to Family/Friends Involved in Your Care: We may disclose relevant information to a family member, friend, or caregiver who is involved in your medical care or payment for that care. If you are present, we will give you an opportunity to object before sharing. If you are not present or incapacitated, we will use our professional judgment to determine if sharing is in your best interest .

• Prescription Drug Monitoring Programs (PDMPs): We are required by state law to report information about dispensed controlled substances to the state Prescription Drug Monitoring Program. This is a public health reporting activity permitted by law .

• Public Health and Safety: We may disclose information to public health authorities for purposes such as reporting adverse reactions to medications, preventing or controlling disease, or reporting product defects or recalls .

• Health Oversight Activities: We may disclose information to a health oversight agency (such as a State Board of Pharmacy or the DEA) for activities authorized by law, including audits, investigations, inspections, and licensure actions .

• Required by Law: We will disclose information when required to do so by federal, state, or local law .

• Judicial and Administrative Proceedings: We may disclose information in response to a court or administrative order. For Part 2 records, such an order is only valid after notice and an opportunity for a hearing is provided to you . We may also respond to a subpoena or discovery request if accompanied by a court order or if you provide consent .

• Law Enforcement: We may disclose information to law enforcement officials under specific circumstances, such as pursuant to a court order, to report a crime committed on our premises, or to identify a suspect if you commit a crime in our facility .

• To Avert a Serious Threat to Health or Safety: We may use or disclose your information when necessary to prevent or lessen a serious and imminent threat to your health and safety or the health and safety of the public or another person .

• Coroners, Medical Examiners, and Funeral Directors: We may disclose information to a coroner or medical examiner to identify a deceased person or determine the cause of death .

• Research: We may use or disclose your information for research purposes, provided the research is approved by an institutional review board or privacy board and protocols are in place to ensure the privacy of your information .

• Specialized Government Functions: This includes disclosures for national security and intelligence activities, or to correctional institutions if you are an inmate .

• Workers’ Compensation: We may disclose information to comply with workers’ compensation or similar programs established by law .

D. Prohibition on Selling Your Information

We are not in the business of selling our patients’ personal information, including your protected health information. Any sale of PHI would require your explicit written authorization .

E. Marketing

We will not use or disclose your health information for marketing purposes without your express written authorization, unless the communication is in the form of a face-to-face promotional communication or a promotional gift of nominal value .

5. Special Protections Under 42 CFR Part 2

Because Opioid Meds Pharmacy provides medications for opioid use disorder, certain records are subject to 42 CFR Part 2. The following additional rules apply to these specific records:

• General Prohibition on Re-disclosure: If your Part 2 records are disclosed to another entity (such as a hospital or insurance company) with your consent, that recipient is also bound by Part 2. They are prohibited from making any further disclosure of that information unless they obtain your separate written consent, unless a specific Part 2 exception applies .

• Notice Must Accompany Disclosure: Any disclosure of Part 2 records made with your consent must be accompanied by a specific written statement that prohibits the recipient from re-disclosing the information .

• Court Orders: Your Part 2 records can only be used or disclosed in any civil, criminal, administrative, or legislative proceedings against you if you provide specific consent or if a court orders the disclosure after providing you with notice and an opportunity to be heard .

• Health Information Exchanges (HIEs): We will only share your Part 2 records with a Health Information Exchange if you have signed a specific, separate consent form permitting us to do so .

6. Our Responsibilities and Security Measures

We are required by law to:

• Maintain the privacy and security of your health information .

• Provide you with this notice of our legal duties and privacy practices .

• Notify you if a breach occurs that may have compromised the privacy or security of your unsecured PHI .

• Abide by the terms of this notice currently in effect .

To fulfill these duties, we implement administrative, physical, and technical safeguards :

• Workforce Training: All our staff, including pharmacists, technicians, and delivery personnel, undergo mandatory HIPAA and Part 2 training to ensure they understand their responsibilities .

• Physical Safeguards: We design our pharmacy environment to protect patient conversations and information from being overheard or seen by unauthorized individuals. We ensure secure disposal of documents containing PHI, such as prescription labels, through shredding or incineration .

• Technical Safeguards: We use secure systems, access controls, passwords, and encryption to protect electronic PHI from unauthorized access, alteration, or deletion .

7. Changes to This Notice

We reserve the right to change the terms of this notice at any time. If we make a material change, the new notice will be effective for all protected health information that we already hold, as well as for any information we receive in the future . We will post a copy of the current notice on our website and in our pharmacy, with the effective date clearly marked .

8. Minors and Guardians

In certain circumstances, parents or legal guardians may be the personal representatives of a minor child and may exercise the minor’s rights and make choices about their health information, consistent with state and other applicable laws .

9. For Patients in Emergency or Disaster Relief Situations

We may disclose your health information to disaster relief organizations, such as the Red Cross, to assist in notifying your family of your location and condition in the event of a disaster .

10. State-Specific Privacy Requirements

We also comply with applicable state laws that govern the confidentiality of pharmacy and medical records. Where state laws provide you with greater privacy protections or more stringent requirements than HIPAA or Part 2, we will follow the stricter state law . For example, some states have specific statutes regarding the confidentiality of drug-dependent person information and may require specific consent forms .

11. Complaints and Reporting Violations

If you believe your privacy rights have been violated, or if you disagree with a decision we made regarding your health information, you have the right to file a complaint. You will not be penalized or retaliated against for filing a complaint .

You may file a complaint with:

1. Opioid Meds Pharmacy Privacy Officer (Contact information below)

2. The U.S. Department of Health and Human Services (HHS), Office for Civil Rights. You can file a complaint online at www.hhs.gov/ocr/privacy, by mail, or by phone. .

12. Contact Information

For questions regarding this notice, to exercise any of your rights, or to file a complaint, please contact our designated Privacy Officer:

Opioid Meds Pharmacy Privacy Officer

• Email: info@opioidmedspharmacy.com