Notice of Privacy Practices for Our California Pharmacies


The Pharmacy is required by law to maintain the privacy of our patients' Protected Health Information (“PHI"), and provide patients with notice of our legal duties and privacy practices in accordance with the federal Health Insurance Portability and Accountability Act ("HIPAA"). This Notice describes how such medical information about patients may be used and disclosed, and our legal duties with respect to this information. Please read it carefully.

Generally speaking, PHI is defined as any information, whether oral or recorded in any form or medium, which relates to:

  • Your past, present or future physical or mental health or condition;
  • The provision of health care to you; or
  • The past, present or future payment for the provision of health care to you; and
  • That identifies you or there is a reasonable basis to believe the information can be used to identify you.

We will abide by the terms of this Notice. We will not use or disclose your PHI without your written authorization, except as described in this Notice. We will notify you of any breach of your unsecured PHI. We reserve the right to change our practices and the terms of this Notice, and to make the new Notice effective for all PHI that we maintain at that time and any PHI we receive in the future. If we materially change our practices, we will revise this Notice. We will post the revised Notice in a prominent area of our retail pharmacy location. We will provide you with a copy of the revised Notice upon request. The most recent copy of this Notice will also be available on our web site at

Your Health Information Rights

To Obtain a Paper Copy of this Notice upon Request. You may request a paper copy of the latest version of this Notice at any time from a pharmacy staff member. The most recent copy of this Notice will also be available on our web site at

To Request a Restriction on Certain Uses and Disclosures of PHI. You have the right to request restrictions on our use or disclosure of your PHI for treatment, payment, or health care operations activities by sending a written request to the Privacy Officer listed at the end of this Notice. We are not required to agree to those restrictions, unless that restriction is regarding disclosure of PHI to your health plan when: (1) the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and (2) the PHI pertains solely to a health care item or service for which you or another person (other than your health plan) paid for in full. If we agree to your requested restriction, we will comply with your request unless the information is needed to provide you emergency treatment.

To Inspect and Obtain a Copy of Your PHI. You have the right to access, inspect and obtain a copy of the PHI contained in your designated record set for as long as we maintain your PHI. The PHI we maintain is limited to patient prescription and billing information accessible at the store pharmacy. To receive a copy your PHI, you must send a written request to the Privacy Officer listed at the end of this Notice. For PHI that is maintained in an electronic format, you can request an electronic copy. We may charge you a fee for the costs of labor, supplies, and postage required to fulfill your request, where permitted by law. We may deny your request to inspect and copy PHI in certain limited circumstances. If you are denied access to your PHI, you may request that the denial be reviewed.

To Request an Amendment of Your PHI. If you feel that the PHI we maintain about you is incomplete or incorrect, you may request that we amend it, for as long as we maintain the PHI. Your request for an amendment must be submitted in writing to the Privacy Officer listed at the end of this Notice. You must also include the reason for your request. In certain cases, we may deny your request for amendment. If we deny your request, you have the right to file a statement of disagreement with the decision. This statement will be kept with your PHI, and we may also give a rebuttal to your statement.

To Receive an Accounting of Disclosures of Your PHI. You have the right to receive an accounting of certain disclosures of your PHI that we have made. The accounting will exclude certain disclosures, such as disclosures made directly to you, disclosures you authorize, disclosures to friends or family members involved in your care, and disclosures for notification purposes. Your request for an accounting must be submitted in writing to the Privacy Officer listed at the end of this Notice. Your request must specify the time period, but may not be longer than six years. The first accounting you request within a 12 month period will be provided free of charge, but you may be charged for the cost of providing additional accountings within that period. We will notify you of the costs involved and give you an opportunity to withdraw or modify your request before any costs have been incurred.

To Request Communications of PHI by Alternative Means or at Alternative Locations. You may wish that we contact you in a certain manner or at a certain location, such as in some way other than mailing to your home address or calling your home telephone number. For example, you may request that written communications regarding your PHI be sent to a different residence or post office box. To request alternative communication of your PHI, you must submit a request in writing to the Privacy Officer listed at the end of this Notice. Your request must state how or where you would like to be contacted. We will accommodate all reasonable requests.

NOTE: If you are a minor who believes you are lawfully entitled to be treated as an adult for purposes of access to, use of, and disclosure of records relating to your treatment, please notify the Privacy Officer listed at the end of this Notice.

How We May Use and Disclose PHI Without Your Authorization

The following categories describe the ways that we may use and disclose your PHI without your written authorization.

Treatment: We will use and disclose your PHI to provide you with medical treatment and services. For example, information obtained by the pharmacist will be used to dispense prescription medications to you. We will document in your record information related to the medications dispensed to you and services provided to you. We may notify you of treatment alternatives or to remind you to refill your prescription. We may also disclose your PHI to other healthcare providers, who are diagnosing and treating you, to coordinate your care, such as prescriptions or lab work.

Payment: We will use and disclose your PHI to obtain payment for the services we provide to you. For example, we may contact your insurer or pharmacy benefit manager to determine whether your program will pay for your prescription and to determine the amount of your co-payment. We will bill you, your insurance carrier, or third-party payer for the cost of prescription medications dispensed to you. The information on or accompanying the bill may include information that identifies you, as well as the prescriptions you are taking.

Health Care Operations: We will use and disclose your PHI for our business activities, called Health Care Operations. These uses and disclosures are necessary to run our business and make sure our patients receive quality care. For example, the Pharmacy may use information in your health record to monitor the performance of the pharmacists providing treatment to you. This information will be used in an effort to continually improve the quality and effectiveness of the health care and service we provide. In addition, if we buy or sell pharmacy locations, your PHI may be disclosed for the purpose of carrying out pharmacy services and related due diligence.

Health-Related Communications: We may contact you to provide information such as refill reminders, or health-related benefits and services offered by our pharmacy that may be of interest to you.

Business Associates: We may contract with “Business Associates" who provide services such as billing, claims administration, or data processing on our behalf. In the course of working with a Business Associate, we may disclose your PHI so that they can perform the job we have asked them to do. To protect your PHI, we require our Business Associates to adhere to the practices outlined in this Notice, and to otherwise safeguard your PHI.

Communication with Individuals Involved in Your Care or Payment for Your Care: If you verbally agree to the disclosure and in certain other situations, we may disclose relevant PHI to a family member, other relative, close personal friend or any person you identify, who is involved in your care or payment for your care. The PHI we disclose would be limited to the PHI that is relevant to that person's involvement in your care or payment for your care. We may also make these disclosures after your death unless doing so is inconsistent with any prior expressed preference. We may use or disclose your information to notify or assist in notifying a family member, personal representative, or any other person responsible for your care regarding your location, general condition, or death. We may also use or disclose your PHI to disaster-relief organizations so that your family or other persons responsible for your care can be notified about your condition, status, and location.

As Required by Law: We may disclose your PHI when required by law to do so.

Health Oversight Activities: We may disclose your PHI to an oversight agency for activities authorized by law. These oversight activities include audits, investigations, and inspections, as necessary for our licensure and for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Public Health: We may disclose your PHI to public health agencies as authorized by law. For example, we may we may report certain communicable diseases to the state’s public health department. We may also disclose your PHI to persons under the jurisdiction of the FDA with respect to an FDA-regulated product or activity for which that person has responsibility, for the purpose of activities related to the quality, safety or effectiveness of such FDA-regulated product or activity.

Worker's Compensation: We may disclose your PHI as authorized by, and necessary to comply with, laws relating to Worker's Compensation or similar programs established by law.

Judicial and Administrative Proceedings: We may disclose your PHI in the course of certain administrative or judicial proceedings. For example, we may disclose your PHI in response to a court order. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process, but only if efforts have been made to tell you about the request or to obtain an order protecting the requested PHI.

Law Enforcement: We may disclose your PHI for law enforcement for certain specific purposes where permitted by law, such as reporting certain types of injuries.

Victims of Abuse, Neglect, or Domestic Violence: We may disclose your PHI to a government authority, such as a social service or protective services agency, if we reasonably believe you are a victim of abuse, neglect, or domestic violence. We will only disclose this type of information to the extent required by law, if you agree to the disclosure, or if the disclosure is otherwise allowed by law.

To Avert a Serious Threat to Health or Safety: We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.

In Support of Research: In certain circumstances, we may disclose your PHI to researchers. For certain research activities, an Institutional Review Board or Privacy Board may approve uses and disclosures of your PHI without your authorization. The applicable Board will review the research proposal and established protocols to ensure the privacy of your information.

Use by Coroners, Medical Examiners, and Funeral Directors: We may release your PHI to a coroner or medical examiner as necessary to identify a deceased person or determine the cause of death. We may also disclose PHI to funeral directors consistent with applicable law to carry out their duties.

Use by Organ or Tissue Procurement Organizations: We may disclose your PHI to an organ procurement organization or tissue bank that is processing the tissue of a decedent for transplant into the body of another person, but only with respect to the donating decedent, for the purpose of aiding the transplant.

Correctional Institution: If you are or become an inmate of a correctional institution, we may disclose PHI to the institution or its agents when necessary for your health or the health and safety of others.

Specialized Government Functions: In certain circumstances, HIPAA authorizes us to use or disclose your PHI to authorized federal officials for the conduct of national security activities and other specialized government functions.

Please be aware that other federal and state laws, such as the California Confidentiality of Medical Information Act, may have additional requirements that we must follow or may be more restrictive than HIPAA on how we use and disclose your PHI. If there are specific more restrictive requirements, even for some of the purposes listed above, we may not disclose your PHI without your written permission as required by such laws. For example, we may be required by law to obtain your written permission to use and disclose your information related to treatment for a mental illness, developmental disability, or alcohol or drug abuse, or HIV test results.

Other Uses and Disclosures of PHI

The Pharmacy will obtain your written authorization before using or disclosing your PHI for all purposes other than those provided above or as otherwise permitted or required by law. Some examples include:

• Psychotherapy Notes: We usually do not maintain psychotherapy notes about you. If we do, we will not use and disclose your psychotherapy notes without your written authorization except as otherwise permitted by law.

• Marketing: We will not use or disclose your PHI for marketing purposes without your written authorization except as otherwise permitted by law.

• Sale of Your PHI: We will not sell your PHI without your written authorization except as otherwise permitted by law.

The authorization will identify to whom we may disclose the information, the information to be disclosed, and the expiration date of the authorization. You may revoke an authorization in writing at any time by notifying the Privacy Officer in writing. However, your decision to revoke the authorization will not affect or undo any use or disclosure of your PHI that occurred before you notified us of your decision, or any actions that we have taken based upon your authorization.

For More Information or to Report a Concern

If you have questions, would like additional information about the Pharmacy's privacy practices, or would like to file a complaint because you believe your privacy rights have been violated, please contact the Privacy Officer in writing at Save Mart Supermarkets, PO Box 4278, Modesto, CA 95352 or by telephone at (209) 574-6295. You may also file a complaint with the Secretary of the United States Department of Health and Human Services. You will not be retaliated against for filing a complaint.

This Notice is effective as of June 22nd, 2016