Notice of Privacy Practices

1. Who this notice covers

This notice applies to Living Waters Pharmacy, LLC ("Living Waters," "we," "us"), a Texas-licensed pharmacy that prepares and dispenses compounded medications at 11222 Richmond Ave., Suite 260, Houston, TX 77082, and to every pharmacist, technician, employee, student and contractor who handles your health information for us. We currently dispense to patients in Texas and Oklahoma.

Protected health information ("PHI") is information that identifies you and relates to your health, your care or payment for your care. At our pharmacy that includes your prescriptions, the medications we prepare and dispense for you, your intake answers, allergy and medication history, communications with your prescriber, pharmacist counseling notes, your shipping address and your payment records.

2. Our legal duties

The Health Insurance Portability and Accountability Act (HIPAA) and its Privacy, Security and Breach Notification Rules (45 C.F.R. Parts 160 and 164), together with the privacy laws and pharmacy rules of each state where we dispense, require us to:

• keep your PHI private and secure;
• give you this notice of our legal duties and privacy practices;
• notify you if a breach compromises the privacy or security of your unsecured PHI; and
• follow the terms of the notice currently in effect.

We keep written policies that prohibit unauthorized disclosure of confidential records and use physical, technical and administrative safeguards against unauthorized access (22 Tex. Admin. Code §291.27). Our workforce is trained on HIPAA and Texas privacy law as Texas Health & Safety Code §181.101 requires.

3. Uses and disclosures that do not need your written permission

Treatment

We use and share your PHI to prepare, dispense and manage your medication and to work with the health care providers involved in your care. That includes your prescriber, your referring physician, your primary care physician and any practitioner you are referred to, as well as nurses, hospitals and other pharmacies caring for you. Examples: a pharmacist reviews your medication history before preparing your prescription and calls your prescriber about a possible interaction; we confirm a dose with the practitioner who referred you; we give storage and beyond-use-date instructions to a nurse giving you the medication.

If you want to limit this, you can ask for a restriction (see Your rights). We will consider any request, but except for the one case described there, the law does not require us to agree.

Payment

To bill and collect for the medications and services we provide. Examples: processing your payment; where applicable, checking coverage, obtaining prior authorization or submitting a claim to a health plan; collections.

Health care operations

To run our pharmacy and keep it safe. Examples: quality reviews of dispensing records; investigating a quality or sterility result and identifying which patients received medication from an affected batch; carrying out a recall; training staff and students; inspections, accreditation, licensing, legal and accounting services.

Business associates

Some vendors perform services for us that involve PHI, such as our pharmacy management software, secure hosting for our patient portal, email, IT support, payment processing and document destruction. Before they receive PHI, each must sign a business associate agreement that requires it to protect your information and limits how it may use it. Shipping carriers receive only what they need to deliver your package, such as your name and address.

People involved in your care or payment

Unless you object, we may share with a family member, close friend or other person you identify the PHI that is directly relevant to their involvement in your care or payment, for example releasing your medication to the person who picks it up. If you are not present or cannot respond, we will use professional judgment about what is in your best interest. You can tell us at any time to stop.

Reminders and service messages

We may contact you by phone, text, email or mail about refills, order status and shipping, and treatment alternatives or other health-related services. You can tell us how and where to contact you (see confidential communications).

4. Uses and disclosures required or permitted by law

Federal and state law require or permit the disclosures below without your written permission. When a disclosure is required by law, it is not conditioned on your consent and withholding consent does not prevent it. We disclose only what the law requires or allows for the purpose.

5. Uses and disclosures that need your written permission

We will ask for your written authorization before any use or disclosure not described in sections 3 and 4, including:

• Marketing. A communication encouraging you to buy a product or service for which a third party pays us. Texas law also requires notice and your authorization before PHI is used for marketing (Tex. Health & Safety Code §181.153). Refill reminders and messages about a medication you are currently prescribed are not marketing.
• Sale of PHI. We do not sell protected health information. Texas law prohibits it except in narrow cases (Tex. Health & Safety Code §181.152).
• Psychotherapy notes, if we ever hold them.

You can revoke an authorization in writing at any time. Revoking stops future uses and disclosures, but not ones we already made relying on it. We will not make your treatment or payment depend on signing an authorization, except where the law permits.

6. Minimum necessary, records and accountability

Minimum necessary. When we use, share or request PHI, we limit it to the minimum reasonably necessary for the purpose. As HIPAA provides (45 C.F.R. §164.502(b)(2)), this does not apply to disclosures to a provider for your treatment, to you or with your authorization, to HHS, or as required by law. In those cases the scope is set by the treating provider's need, your authorization or the law itself.

Records. We document the disclosures we must be able to account for (see your right to an accounting below) and keep that documentation for at least six years (45 C.F.R. §164.530(j)).

Verification. Before disclosing PHI to someone we don't know, we verify their identity and authority as the Privacy Rule requires (45 C.F.R. §164.514(h)).

Legal demands. Subpoenas, court orders and law-enforcement requests are reviewed by our Privacy Officer before anything is released, and we release only what the legal authority requires.

7. Your rights

To use any of these rights, contact our Privacy Officer (details in section 11). Some requests must be in writing; we will give you a form. We may need to verify your identity first.

Get a copy of your records

You can see or get a copy of the PHI we keep about you, including an electronic copy, and you can ask us to send a copy to someone you choose. We respond within 30 days (one 30-day extension is allowed). If you ask in writing for an electronic copy of your electronic health record, Texas law requires us to provide it within 15 business days (Tex. Health & Safety Code §181.102). We may charge a reasonable, cost-based fee as federal and state law allow. In limited cases we may deny access; you can ask for certain denials to be reviewed.

Ask us to correct your records

You can ask us to correct PHI you believe is wrong or incomplete. We may say no in the cases the law allows (for example, if we did not create it or it is accurate), and we will tell you why in writing. You can then submit a statement of disagreement that we will keep with your record.

Ask us to limit what we use or share

You can ask us not to use or share certain PHI for treatment, payment or operations, or with people involved in your care. We are not required to agree, and we will tell you if we can't. If we agree, we will follow the restriction except in an emergency.

One restriction we must agree to: if you pay for a medication or service in full, out of pocket, and ask us not to share information about it with your health plan for payment or operations, we will honor that request unless the law requires us to share it (45 C.F.R. §164.522(a)(1)(vi)).

Ask for confidential communications

You can ask us to contact you in a particular way (for example, only by cell phone) or at a different address. We will accommodate reasonable requests and will not ask why.

Get a list of certain disclosures

You can ask for an accounting of certain disclosures we made in the six years before your request. It does not include disclosures for treatment, payment or operations, disclosures to you or that you authorized, and certain others the law excludes. The first list in any 12-month period is free; we will tell you the cost of any additional request first.

Get a copy of this notice

You can ask for a paper copy at any time, even if you agreed to receive it electronically. It is also posted at the pharmacy and on this page.

Be notified of a breach

We will notify you after a breach of your unsecured PHI without unreasonable delay and no later than 60 days after we discover it (45 C.F.R. §§164.400–414), and as required by state breach-notification laws, including Tex. Bus. & Com. Code §521.053 and Oklahoma's Security Breach Notification Act.

Choose someone to act for you

A parent or guardian of a minor, a person with your medical power of attorney, or another legally authorized representative can use these rights for you once we verify their authority. State law may give a minor control over certain records.

File a complaint without retaliation

See Complaints. We will not retaliate against you for filing a complaint or using any of these rights, and your care will not depend on it.

8. Extra protections under other laws

Where a state or federal law gives your information more protection than HIPAA, we follow the more protective law. Examples:

• Texas: the Texas Medical Records Privacy Act (Tex. Health & Safety Code Chapter 181), confidentiality of mental health records (Chapter 611) and HIV test results (§81.103), genetic information (Tex. Occ. Code Chapter 58), and Texas State Board of Pharmacy confidentiality rules (22 Tex. Admin. Code §291.27).
• Oklahoma: Oklahoma State Board of Pharmacy rules treat patient records as privileged and allow release only to you, people you designate, prescribers and pharmacists when needed to protect your health, and others authorized by law (Okla. Admin. Code 535:15-3-14).
• Federal: the Genetic Information Nondiscrimination Act, and 42 C.F.R. Part 2 for substance use disorder treatment records if we ever receive them from a federally assisted program.

9. Notice of electronic disclosure (Texas)

Living Waters Pharmacy creates, receives, stores and sends PHI electronically, through our pharmacy management system, electronic prescriptions, our secure patient portal and secure communication with prescribers. Your protected health information is subject to electronic disclosure.

Texas law prohibits us from disclosing your PHI electronically without your authorization for each disclosure, except to another covered entity for treatment, payment, health care operations or certain insurance functions, or as otherwise authorized or required by state or federal law (Tex. Health & Safety Code §181.154). This notice is posted at our pharmacy and on our website, as §181.154 requires.

10. Complaints

If you believe your privacy rights have been violated, you can complain to us or to any of the agencies below. Filing a complaint will not affect your care.

11. Changes to this notice and how to reach us

We can change this notice, and the changes will apply to all information we have about you. The current notice is posted at the pharmacy and on this page, and you can ask us for a paper copy. The effective date is shown at the top.

Request forms (authorization, restriction and confidential-communication requests) are available from the pharmacy by phone, fax or email.