HIPAA PRIVACY NOTICE
Effective: July 1, 2025
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
OUR COMMITMENT TO YOUR PRIVACY
It is our duty to maintain the privacy and confidentiality of your protected health information (PHI). We will create records regarding your PHI and the treatment and service we provide to you. We are required by law to maintain the privacy of your PHI, which includes any individually identifiable information that we obtain from you or others that relates to your past, present, or future physical or mental health, the health care you have received, or payment for your health care. We will share protected health information with one another, as necessary, to carry out treatment, payment or health care operations relating to the services to be rendered at the pharmacy.
As required by law, this notice provides you with information about your rights and our legal duties and privacy practices with respect to the privacy of PHI. This notice also discusses the uses and disclosures we will make of your PHI. We must comply with the provisions of this notice as currently in effect, although we reserve the right to change the terms of this notice from time to time and to make the revised notice effective for all PHI we maintain. You can always request a written copy of our most current privacy notice from the Specialty Care Rx Privacy Officer.
PERMITTED USES AND DISCLOSURES
We can use or disclose your PHI for purposes of treatment, payment, and health care operations. For each of these categories of uses and disclosures, we have provided a description and an example below. However, not every particular use or disclosure in every category will be listed.
Treatment means providing services as ordered by your physician. Treatment also includes coordination and consultations with other health care providers relating to your care and referrals for healthcare from one health care provider to another. We may also disclose PHI to outside entities performing other services related to your treatment such as hospitals, diagnostic laboratories, home health or hospice agencies, etc.
Payment means the activities we undertake to obtain reimbursement for the health care provided to you, including billing, collections, claims management, prior authorization, determinations of eligibility and coverage, and other utilization review activities. Federal or state law may require us to obtain a written release from you prior to disclosing certain specially protected PHI for payment purposes, and we will ask you to sign a release, when necessary, under applicable law.
Health care operations means the support functions of the pharmacy, related to treatment and payment, such as quality assurance activities, case management, patient comments and complaints, physician reviews, compliance programs, audits, business plans, and development, management, and administrative activities. We may use your PHI to evaluate the performance of our staff when caring for you. We may also combine PHI about many patients to decide what additional services we should offer, what services are not needed, and whether certain new treatments are =effective. We may also disclose PHI for review and learning purposes. In addition, we may remove information that identifies you so that others can use the de-identified information to study health care and health care delivery without learning who you are.
OTHER USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION
We may also use your PHI in the following ways:
When permitted by law, we may coordinate our uses and disclosures of PHI with public or private entities authorized by law or by charter to assist in disaster relief efforts.
We will allow your family and friends to act on your behalf to pick up filled prescriptions, medical supplies, X-rays, and similar forms of PHI, when we determine, in our professional judgment, that it is in your best interest to make such disclosures.
We may contact you as part of our fundraising and marketing efforts as permitted by applicable law. You have the right to opt out of receiving such fundraising communications.
We may use or disclose your PHI for research purposes, subject to the requirements of applicable law. For example, a research project may involve comparisons of the health and recovery of all patients who received a particular medication. All research projects are subject to a special approval process which balances research needs with a patient’s need for privacy. When required, we will obtain a written authorization from you prior to using your health information for research.
We will use or disclose PHI about you when required to do so by applicable law.
In accordance with applicable law, we may disclose your PHI to your employer if we are retained to conduct an evaluation relating to medical surveillance of your workplace or to evaluate whether you have a work-related illness or injury. You will be notified of these disclosures by your employer, or the pharmacy, as required by applicable law. Note: incidental uses and disclosures of PHI sometimes occur and are not considered to be a violation of your rights. Incidental uses and disclosures are by-products of otherwise permitted uses or disclosures which are limited in nature and cannot be reasonably prevented.
SPECIAL SITUATIONS
Subject to the requirements of applicable law, we will make the following uses and disclosures of your PHI:
• Organ and Tissue Donation. If you are an organ donor, we may release PHI to organizations that handle organ procurement or transplantation as necessary to facilitate organ or tissue donation and transplantation.
• Military and Veterans. If you are a member of the Armed Forces, we may release PHI about you as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority.
• Health Oversight Activities. We may disclose PHI to federal or state agencies that oversee our activities (e.g., providing health care, seeking payment, and civil rights).
• Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose PHI subject to certain limitations.
• Law Enforcement. We may release PHI if asked to do so by a law enforcement official:
• Coroners, Medical Examiners and Funeral Directors. We may release PHI to a coroner or medical examiner. We may also release PHI about patients to funeral directors as necessary to carry out their duties.
• National Security and Intelligence Activities. We may release PHI about you to authorized federal officials for intelligence, counter intelligence, other national security activities authorized by law or to authorized federal officials, so they may provide protection to the President or foreign heads of state.
• Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release PHI about you to the correctional institution or law enforcement official. This release would be necessary (1) to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.
• Serious Threats. As permitted by applicable law and standards of ethical conduct, we may use and disclose PHI if we, in good faith, believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public or is necessary for law enforcement authorities to identify or apprehend an individual.
Note: HIV-related information, genetic information, alcohol and/or substance abuse records, mental health records, and other specially protected health information may enjoy certain special confidentiality protections under applicable state and federal law. Any disclosures of these types of records will be subject to these special protections.
OTHER USES OF YOUR HEALTH INFORMATION
Certain uses and disclosures of PHI will be made only with your written authorization, including uses and/or disclosures: (a)of psychotherapy notes (where appropriate); (b) for marketing purposes; and(c) that constitute a sale of PHI under the Privacy Rule. Other uses and disclosures of PHI not covered by this notice or the laws that apply to us will be made only with your written authorization. You have the right to revoke that authorization at any time, provided that the revocation is in writing, except to the extent that we already have taken action in reliance on your authorization.
YOUR RIGHTS
You have the right to request restrictions on our use and disclosures of PHI for treatment, payment, and health care operations. However, we are not required to agree to your request unless the disclosure is to a health plan in order to receive payment, the PHI pertains solely to your health care items or services for which you have paid the bill in full, and the disclosure is not otherwise required by law. To request a restriction, you may make your request in writing to the Specialty Care Rx Privacy Officer.
You have the right to reasonably request to receive confidential communications of your PHI by alternative means or at alternative locations. To make such a request, you may submit your request in writing to the Specialty Care Rx Privacy Officer.
You have the right to inspect and copy the PHI contained in our pharmacy records, except:
In order to inspect or obtain a copy of your PHI, you may submit your request in writing to the Specialty Care Rx Privacy Officer.
You have the right to request an amendment to your PHI, but we may deny your request for amendment, if we determine that the PHI or record that is the subject of the request:
In any event, any agreed upon amendment will be included as an addition to, and not a replacement of, already existing records. In order to request an amendment to your PHI, you must submit your request in writing to the Specialty Care Rx Privacy Officer at our pharmacy, along with a description of the reason for your request.
You have the right to receive an accounting of disclosures of PHI made by us to individuals or entities other than to you for the six years prior to your request, except for disclosures:
To request an accounting of disclosures of your PHI, you must submit your request in writing to the Specialty Care Rx Privacy Officer at our pharmacy.
You have the right to receive a notification, in the event that there is a breach of your unsecured PHI, which requires notification under the Privacy Rule.
COMPLAINTS
If you believe that your privacy rights have been violated, you should immediately contact the Specialty Care Rx Privacy Officer. We will not take action against you to file a complaint. You also may file a complaint with the Secretary of the U.S. Department of Health and Human Services, 200 Independence Ave. S.W., Washington DC, 20201.
CALIFORNIA RESIDENTS – CALIFORNIA PRIVACY RIGHTS ACT (CPRA)
California residents may have additional rights regarding your personal information under the California Privacy Rights Act (CPRA). For more information about your rights and how to exercise them, please contact Specialty Care Rx Privacy Officer to obtain a copy of our California Privacy Rights Act (CPRA) Privacy Notice.
WRITTEN REQUESTS AND OTHER INFORMATION
You may ask for more information about our privacy practices or obtain forms for submitting written requests by contacting the Specialty Care Rx Privacy Officer:
SPECIALTY CARE RX HIPAA PRIVACY NOTICE Page 4 of 5
OBTAIN A COPY OF THIS NOTICE
You have the right to a paper copy of our current Notice at any time. You may obtain a copy by contacting the Specialty Care Rx Privacy Officer using the contact information provided above.
—–
CALIFORNIA PRIVACY RIGHTS ACT (CPRA) PRIVACY NOTICE
Effective Date: July 1, 2025 Applies To: California Residents Only
This California Privacy Rights Act (CPRA) Privacy Notice (“Notice”) applies to California residents and supplements our HIPAA Notice of Privacy Practices. It describes how Specialty Care Rx (“we,” “us,” or “our”) collects, uses, and discloses personal information (“PI”) that is not otherwise regulated as protected health information (PHI) under HIPAA.
Health information that we maintain as PHI and process in our capacity as a covered entity or business associate under HIPAA is exempt from CPRA and is governed by our HIPAA Notice of Privacy Practices, available upon request.
Because Specialty Care Rx operates primarily as a licensed pharmacy and home infusion provider, the personal information we collect beyond PHI is limited. We may collect the following categories of PI:
We do not collect sensitive personal information beyond what is strictly necessary to provide pharmacy services, and we do not use sensitive PI for purposes beyond those necessary services.
We collect and use PI for the following business purposes:
We collect PI from the following sources:
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
We may disclose PI to the following categories of third parties for legitimate business purposes:
We retain PI for as long as necessary to fulfill the purposes described in this Notice, or as required by applicable law, regulation, or accreditation standards. When PI is no longer needed, we dispose of it securely in accordance with our data retention policies.
If you are a California resident, you have the following rights with respect to your personal information. These rights do not apply to PHI, which is governed by HIPAA.
Right to Know. You have the right to request that we disclose the categories and specific pieces of PI we have collected about you, the purposes for collection, the sources, and the categories of third parties with whom we have shared it.
Right to Delete. You have the right to request deletion of PI we have collected from you, subject to certain exceptions permitted by law (e.g., to complete a transaction, comply with a legal obligation, or detect security incidents).
Right to Correct. You have the right to request correction of inaccurate PI we maintain about you.
Right to Opt Out of Sale or Sharing. We do not sell or share PI. No opt-out is required, but you may submit a request to confirm our practices at any time.
Right to Limit Use of Sensitive PI. We do not use sensitive PI for purposes beyond what is strictly necessary to provide our services. No limitation request is required.
Right to Non-Discrimination. We will not discriminate against you for exercising any of your CPRA rights. We will not deny services, charge different prices, or provide a different level of quality because you exercised a right under this Notice.
To exercise any of the rights described above, you or your authorized agent may submit a verifiable consumer request by contacting our Privacy Officer:
By email: privacy@myscrx.com
By mail: Specialty Care Rx, Attn: Privacy Officer, 200 E. Katella Ave., Orange, CA 92867
By phone: (949) 506-1300
We will acknowledge your request within 10 business days and respond within 45 calendar days of receipt. If we require additional time (up to 90 days total), we will notify you in writing of the reason and extension. We will not charge a fee for processing your request unless it is excessive, repetitive, or manifestly unfounded.
To verify your identity, we may ask you to provide information consistent with our existing relationship with you. We will not require you to create an account to submit a request.
You may designate an authorized agent to submit a request on your behalf. We may require written proof of authorization and may verify your identity directly with you to protect against fraudulent requests.
Our website may use cookies and similar tracking technologies to collect Internet or network activity data as described in Section 1. You may configure your browser to reject cookies; however, some features of our website may not function properly if cookies are disabled.
California law requires us to disclose how we respond to “Do Not Track” (DNT) signals. At this time, our website does not respond to DNT signals from browsers. We do not sell or share PI for behavioral advertising purposes regardless of DNT status. We do not use third-party advertising cookies or cross-context behavioral advertising trackers regardless of DNT status.
We reserve the right to amend this Notice at any time. When we make material changes, we will update the Effective Date at the top of this Notice and post the revised Notice on our website. Your continued use of our website or services after the posting of changes constitutes your acknowledgment of the updated Notice.
If you have questions or concerns about this Notice or our privacy practices, please contact:
Specialty Care Rx – Privacy Officer
Email: privacy@myscrx.com
Mail: 200 E. Katella Ave., Orange, CA 92867
Phone: (949) 506-1300
This Notice applies only to personal information that is not regulated as PHI under HIPAA. For information about how we handle your protected health information, please request a copy of our HIPAA Notice of Privacy Practices.
