PAPA Healthcare – HIPAA – Notice of Privacy Practices

///PAPA Healthcare – HIPAA – Notice of Privacy Practices





This Notice of Privacy Practices (the “Notice”) describes the privacy practices of PAPA Healthcare, Inc. and its customers and affiliates utilizing PAPA’s products and systems (collectively, “PAPA,” “we” or “us”) as required under The Health Insurance Portability and Accountability Act (“HIPAA”).


PAPA wants you to know that nothing is more central to our operations than maintaining the privacy of your health information (“Protected Health Information” or “PHI”). PHI is information about you, including basic information that may identify you and relates to your past, present or future health or condition and dispensing of pharmaceutical products to you. We take this responsibility very seriously.


Our Pledge Regarding Your Health Information


We are required by law to protect the privacy of your health information and to provide you with this Notice covering our legal duties and privacy practices regarding your health information. We are also required to notify you in the event there is a breach of your PHI, our staff is required to protect the confidentiality of your PHI and will disclose your PHI to a person other than you or your personal representative only when permitted under federal or state law. This protection extends to any PHI that is oral, written, or electronic, such as prescriptions transmitted by facsimile, modem, or other electronic device. This Notice describes how your PHI may be used or disclosed. In some circumstances, as described in this Notice, the law permits us to use and disclose your PHI without your express permission. In all other circumstances, we will obtain your written authorization before we use or disclose your PHI. This Notice also describes your rights and the obligations we have regarding the use and disclosure of your PHI. Under federal and applicable state law, we are required to follow the terms of the Notice currently in effect. In some situations, state privacy or other applicable laws may provide greater privacy protections than those stated in this Notice. For example, depending on the state in which you reside, there may be additional state law privacy protections related to communicable diseases, reproductive health, substance abuse and mental health. When appropriate, we will follow these state or other applicable laws.


How We May Use and Disclose Your PHI Without Your Permission For Treatment, Payment or Health Care Operations


Below are examples of how federal law permits use or disclosure of your PHI for these purposes without your permission:


  1. Treatment: PHI obtained by PAPA and its customers and affiliates (collectively “we”) will be used to dispense prescription medications. We may also use and disclose your PHI to your physician or other health care provider to recommend treatment options or alternatives, or to tell them about potential drug interactions, dosing issues, side effects and issues related to your therapy. We may initiate contact with you to provide treatment-related services, such as refill reminders, treatment alternatives, compliance programs and other health care services that may be of interest to you.


  1. Payment: We may contact your insurer, payer or other agent and share your PHI with that entity to determine whether it will pay for your prescription and the payment amount. We may also contact you about a payment or balance due for prescriptions sent to you by PAPA.


  1. Health care operations: Your PHI may be used to monitor the effectiveness of our services. Your PHI may be transferred for purposes of carrying out the pharmacy services if we buy or sell pharmacy locations. We may also use your PHI to tell you about health savings available (e.g., generic products) and other opportunities that may be of interest to you, such as health education programs, health-related benefits for preferred PAPA customers or clinical research projects. We may also disclose your PHI to another health care provider or health plan for purposes of their treatment, payment or health care operations. However, we will only do so for their health care operations if they have or have had a relationship with you, if the PHI they request pertains to that relationship, and only for limited purposes, such as conducting quality improvement activities, reviewing the performance of a health care provider, or training purposes.


OTHER SPECIAL CIRCUSTANCES: In addition to the above, we are permitted under federal and applicable state law to use or disclose your PHI without your permission only in certain circumstances, as described below.


  1. Business associates: We provide some services through other entities termed “business associates.” Federal law requires us to enter into contracts with these entities to require them to safeguard your PHI and use and disclose it only as specified by PAPA.


  1. Individuals involved in your care or payment for care: We may disclose your PHI to a friend, personal representative or family member involved in your medical care or payment for your care. For example, if we can reasonably infer that you agree, we may provide prescription information to your caregiver on your behalf.


  1. Disclosures to parents or legal guardians: If you are a minor, we may release your PHI to your parents or legal guardians when we are permitted or required under federal and applicable state law.


  1. Administrator or executor: Upon your death, we may disclose your PHI to an administrator, executor or other similarly authorized individual under applicable state law.


  1. To avert a serious threat to health or safety: We may use and disclose your PHI to appropriate authorities when necessary to prevent a serious threat to your health and safety or the health and safety of another person or the public.


  1. As otherwise required by law: We must disclose your PHI when required to do so by applicable federal or state law (including judicial and administrative proceedings; government audits, investigations, and inspections; law enforcement actions; and national security and intelligence activities).


How We May Use or Disclose Your PHI for Other Purposes Only With Your Authorization.


Your written authorization to use and disclose your PHI is required in order for us to:

  • Use and disclose psychotherapy notes containing your PHI (to the extent we hold any)
  • Send marketing communications to you. If we will receive payment for making a marketing communication, we will state this in the authorization.
  • Receive payment in exchange for your PHI.


In addition to the above situations, any other uses and disclosures of your PHI not described elsewhere in this Notice will be made only with your prior written authorization. You may revoke this authorization at any time by submitting a written notice to our Customer Care address listed below. Your revocation will not apply to information released before we receive it.


You have the following rights with respect to your PHI:

  • Obtain a paper copy of the Notice upon request. To obtain a copy at any time, go to or contact PAPA at 205-437-8846.
  • Inspect and obtain a copy of your PHI. You have the right to access and copy your PHI contained in a “designated record set,” which includes prescription and billing records. You may request an electronic copy of your PHI records that we maintain electronically. To inspect or obtain a copy of your PHI, submit a written request to PAPA at the contact address below. You may also ask us to provide a copy of your PHI to another person. In that case, your written request must be signed by you, must clearly identify the person to whom you want us to send the copy of your PHI, and must state where the copy is to be sent. We will respond to your request in writing within 30 days. A fee may be charged for the expense of fulfilling your request. We may deny your request in certain limited circumstances, such as if we have reasonably determined that providing access to PHI would endanger your life or safety or cause substantial harm to you or another person. If we deny your request, we will notify you in writing and provide you with the opportunity to request a review of the denial.
  • Request an amendment of PHI. If you feel that your PHI maintained by us in a “designated record set” is incomplete or incorrect, you may request that we amend it. To request an amendment, submit a written request to PAPA at the contact address below. Requests must identify: (i) which information you seek to amend, (ii) what corrections you would like to make, and (iii) why the information needs to be amended. We will respond to your request in writing within 60 days (with a possible 30-day extension). In our response, we will either: (i) agree to make the amendment, or (ii) inform you of our denial, explain our reason and outline appeal procedures. If denied, you have the right to file a statement of disagreement with the decision. We will provide a rebuttal to your statement and maintain appropriate records of your disagreement and our rebuttal.
  • Receive an accounting of disclosures of PHI. You have the right to request an accounting of disclosures of your PHI for purposes other than treatment, payment or health care operations. This accounting will also exclude disclosures: made directly to you, made with your authorization, made to your caregivers, and certain other disclosures. To obtain an accounting, submit a written request to PAPA at the contact address below. Requests must specify the time period, not to exceed six years. We will respond in writing within 60 days of receipt of your request (with a possible 30-day extension). We will provide one free accounting per 12-month period, but you may be charged for the cost of any subsequent accountings during the same period. We will notify you in advance of the cost involved, and you may choose to withdraw or modify your request at that time.
  • Request communications of PHI by alternative means or at alternative locations. You have the right to request that we communicate with you in a certain way or at a certain location. For example, you may request that we contact you only in writing at a specific address. To request confidential communication of your PHI, submit a written request to PAPA at the contact address below. Your request must state how, where or when you would like to be contacted. We will accommodate all reasonable requests.
  • Request a restriction on certain uses and disclosures of PHI. You have the right to request a restriction or limitation on our use or disclosure of your PHI. You must identify in this request: (i) what particular information you would like to limit, (ii) whether you want to limit use, disclosure, or both, and (iii) to whom you want the limits to apply.



If you believe your privacy rights have been violated, you can file a complaint with the PAPA at the contact address below, or with the Secretary of the United States Department of Health and Human Services.


All complaints must be submitted in writing. You will not be penalized in any way for filing a complaint.


Changes to this Notice


We reserve the right to change our privacy practices. We reserve the right to make the revised Notice effective for PHI we already have about you as well as any information we receive in the future, as of the effective date of the revised Notice. Upon request to the Privacy Office, PAPA will provide a revised Notice to you. We will also post the revised Notice on our website at Effective Date: This Notice is effective as of June 19, 2017.


Contact Information


If you have any questions or concerns about this Notice, please email us at or call us at 205-437-8846


You may also contact PAPA at the following address:

PAPA, Inc.

1200 Corporate Drive, Suite 105

Birmingham, AL 35242

By | 2017-09-05T16:11:30-05:00 June 27th, 2017|Categories: Legal|Tags: , |Comments Off on PAPA Healthcare – HIPAA – Notice of Privacy Practices

About the Author:

CEO, Chief Legal Counsel & Co-founder of PAPA Healthcare, Inc.