Notice of Privacy Practices

NOTICE OF PRIVACY PRACTICES

TWH Commerce d/b/a Thrifty White Health Essentials

Thrifty Drug Stores, Inc.

d/b/a Thrifty White Pharmacy/White Drug &

Rvision Health, P.C., d/b/a Rvision

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY.

This Joint Notice of Privacy Practices ("Notice") applies to entities that are owned or managed by the Thrifty White Pharmacy and White Drug, including Rvision clinics inside of such facilities and telehealth services provided by Rvision (collectively, the "Pharmacy"); our employees, contractors, trainees, and volunteers; and any other members of the Pharmacy workforce who are authorized to use or access your health information (collectively, "we" or "us"). For a list of the Pharmacy entities that follow this Notice, please see our website thriftywhite.com or call the Privacy Office at (763)513-4300. We have formed an Organized Health Care Arrangement ("OHCA") to enable us to better address your health care needs by simplifying the ways we protect and use your health information. The OHCA allows us to provide you with this single Notice and to efficiently share your health information among ourselves for purposes of treatment, payment, and health care operations. For example, your medical information may be shared across the OHCA in order to assess quality, effectiveness and cost of care. However, each member of the OHCA remains its own legal identity.

The Pharmacy is required by the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the HITECH Act and all regulations promulgated under HIPAA and HITECH, to maintain the privacy of your protected health information ("PHI") and to provide you with this notice of our legal duties and privacy practices with respect to PHI. PHI is information about you that identifies you and that relates to your past, present or future physical or mental health or condition and related health care services. This Notice of Privacy Practices ("Notice") describes your rights regarding your PHI and how the Pharmacy may use and disclose this PHI. The Pharmacy is required to follow the terms of the Notice that is currently in effect. We will notify you in the event there is a breach of your unsecured PHI.

Your Health Information Rights under State Law

Some state laws provide you with greater protection for you information or greater access to your records than the federal HIPAA laws. The Pharmacy will abide by the laws in the state where you obtain services from us in the case that these state laws provide you with even greater protection or access to your health information than HIPAA provides. Note that in certain states, some personal health information, including HIV/AIDS-related information (Iowa, Montana, North Dakota), information about sexually transmitted diseases (Montana), substance abuse information (Iowa, North Dakota) and mental health information (Iowa, Montana, North Dakota) is subject to additional restrictions on disclosure.

Your Personal Health Information Rights under HIPAA

You have the following rights with respect to your PHI:

Our Uses and Disclosures of PHI

The following are the ways that we typically use or disclose your PHI:

• We will use PHI for treatment. Information obtained by the Pharmacy will be used to dispense prescription medications to you, contact physicians, and counsel you and other caregivers. We will document information related to the medications dispensed and services provided. We may use PHI to coordinate care with other pharmacies and healthcare providers. We may contact other health care professionals if we have concerns regarding prescription misuse or addiction.
• We will use PHI for payment. We will contact your insurer or pharmacy benefit manager to determine whether they will pay for your prescription and the amount of your co-payment. We will bill you or a third party payer for the cost of prescription medications dispensed to you. The billing information may include the prescriptions you are taking. We will disclose information as needed to others involved in paying for your care to obtain payment for services provided to you. We will give an insurer the information necessary to perform their duties with your plan sponsor.
• We will use PHI for health care operations. Health care operations include activities such as training, legal, auditing and compliance, customer service and other pharmacy management and administration activities. We may use your PHI to monitor the performance of the pharmacists providing treatment to you and to improve the quality and effectiveness of the health care and service we provide. If another pharmacy buys our pharmacy, we may transfer your PHI to the acquiring pharmacy, which allows you to have your prescription history available to you.

We may also use or disclose your PHI for the following purposes:

• Business associates: Some pharmacy services are provided through contracts with our business associates. Examples of business associates include liability insurers, attorneys, collection agencies, pharmacy software and systems providers, and data switches to relay data to your insurer. When we work with business associates, we may disclose PHI so that the business associate can perform the job we have asked them to do. To protect your PHI, we require the business associate to appropriately safeguard all PHI.
• Communication with individuals involved in your care or payment for your care: Pharmacists and other Pharmacy employees, using their professional judgment, may disclose PHI to a person that you have designated to act on your behalf and/or is acting as your "agent" or authorized representative, as permitted under state law. We may disclose PHI relevant to that person's involvement in your care or payment related to your care. For example, we may disclose PHI to a person designated by you to pick up your prescription or to someone calling on your behalf to our Accounts Receivable Department.
• Refill reminders and health-related communications: We may contact you to provide refill reminders or information about current medications, treatment alternatives or other health-related benefits and services that may be of interest to you. This communication may be via phone, mail, e-mail, text message or other form of communication. If we receive any financial remuneration for making such refill medication or pharmacy services communications beyond our costs of making the communication, we must first obtain your written authorization to make such communications. We are not required to obtain your written authorization for face-to-face communications.
• Food and Drug Administration (FDA): We may disclose to the FDA, or persons under the jurisdiction of the FDA, PHI relative to adverse events with respect to drugs, food, supplements, products and product defects, or post-marketing surveillance information to enable product recalls, repairs, or replacement.
• Worker's compensation: We may disclose PHI about you as authorized by and as necessary to comply with state laws relating to worker's compensation or similar programs.
  • Iowa law allows release of all information concerning an employee's physical or mental condition relative to the claim of any party making or defending a claim for benefits.
  • Minnesota law permits disclosure, without consent, of information related to a workers' compensation claim to those parties that are involved in the claim.
  • Montana law provides that so long as a patient is claiming workers' compensation or occupational disease benefits, a signed claim for those benefits authorizes disclosure to the insurer of information relating to the patient's condition.
  • North Dakota law provides that filing a workers compensation claim constitutes consent to the use of medical information by the state workers' compensation bureau, in any proceeding by the bureau or to which the bureau is a party.
  • South Dakota law requires medical practitioners to make reports as required by the state Department of Labor. Medical information must be made available on demand to an employer, employee, insurer, or the Department of Labor for purposes of a workers' compensation claim.
  • Wisconsin law allows disclosure of information regarding a work-related injury to your employer, your employer's workers compensation insurer, or the Department of Workforce Development.
• Public health: As required by law, we may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury, or disability.
• Law enforcement: We will disclose your PHI for law enforcement purposes as required or permitted by law, including disclosures to an inspector or investigator whose duty it is to enforce the laws relating to drugs and who is engaged in a specific investigation involving a designated person or drug, or for reporting suspected crimes such as child abuse.
  • Minnesota and Wisconsin laws generally do not allow the release of information from a person's health record without a valid court order or warrant, unless specifically required or authorized by law.
  • Iowa law generally requires your consent or a court order to release information for law enforcement purposes, unless otherwise authorized or required by law.
• Health oversight activities: We may disclose PHI to an oversight agency for activities authorized by law. These oversight activities include audits, investigations, and inspections, as necessary for our licensure and for the government to monitor the health care system and government programs, and to remain compliant with civil rights laws.
  • Minnesota and Wisconsin laws require that most patient-identifying information (such as name and address) be removed (when possible) from most disclosures for health oversight activities, unless you have provided written consent for access to your protected health information.
  • Wisconsin law allows private-pay patients that are not nursing home residents to deny access of this type by annually submitting to the Pharmacy a written request on a form provided by the state Department of Health.
• Judicial and administrative proceedings: We may disclose your PHI in response to a valid court or administrative order. We may also disclose PHI in response to certain types of subpoenas, discovery requests, or other lawful processes. We may disclose in the context of civil litigation when you have put your condition at issue in the litigation, warrant or grand jury subpoena.
  • Minnesota law requires a valid court order, administrative order, warrant, statutory authority, or your written consent. Wisconsin law requires a valid court order, statutory authority, or your written consent.
• Research: We may only disclose your PHI to researchers when an institutional review board or a privacy board has reviewed the research proposal and established protocols to ensure the privacy of your information, or with your written authorization.
  • Minnesota law generally requires a written consent before we can disclose any medical information about you for medical research to an outside researcher. We will obtain your consent or refusal to participate in any research study, or we will make a good faith effort to obtain your consent or refusal, prior to releasing any identifiable information about you for research purposes.
• Coroners, medical examiners, and funeral directors: We may release PHI to a coroner, medical examiner, or funeral director. This may be necessary, for example, to identify a deceased person, determine the cause of death or allow them to carry out their duties.
• Organ or tissue procurement organizations: Consistent with applicable law, we may disclose PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.
• Fundraising: Pharmacy, or one of its business associates, may use certain information about you (including basic demographic information, dates that you received care from Pharmacy, outcome information and insurance status) to let you know about fundraising opportunities for Pharmacy or its foundation. You have the right to opt out of receiving such fundraising communications, and each communication you receive will include an opportunity to opt out of future fundraising communications. You may also notify the Privacy Officer to opt out of receiving all fundraising communications.
• Correctional institution: If you are or become an inmate of a correctional institution, we may disclose PHI to the institution or its agents when necessary for your health or the health and safety of others.
  • In most situations, Minnesota law requires us to obtain written consent prior to making such disclosures, however, Minnesota law does allow certain persons acting on your behalf (as your "agent") to have access to your prescription information. When the correctional institution acts as your agent, we will provide the correctional institution with your prescription information.
  • In most situations, Iowa law requires us to obtain written consent prior to making such disclosures, however, Iowa law does allow disclosures to your authorized agent and as determined by the pharmacist in his or her professional judgment to those he or she believes are entitled to the information. When the correctional institution acts as your authorized agent, or when the pharmacist determines in his or her professional judgment that the correctional institution is entitled to the information, we will provide the correctional institution with such information.
• To avert a serious threat to health or safety: We may use and disclose PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Generally, we will do so only with your written consent unless we are authorized or required by law to make the disclosure. For example, we will disclose the information in situations where state law provides that the pharmacist has a "duty to warn" about a specific threat or danger.
• Military and veterans: If you are a member of the armed forces, we will release your PHI as required by military command authorities if required to do so by law. We may also release PHI about foreign military personnel to the appropriate military authority, if required to do so by law. If release is not required or permitted by law, we will obtain your consent prior to making such disclosures.
  • Minnesota, Wisconsin and Iowa law generally do not permit this type of disclosure without written consent or unless otherwise required by federal law.
• National security, intelligence activities, and protective services for the President: We may release your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law. We may also disclose your PHI to authorized federal officials so they may provide protection to the President, other authorized persons or foreign heads of state, or to conduct special investigations.
  • Minnesota, Wisconsin and Iowa law generally do not permit this type of disclosure without written consent, or unless otherwise required by federal law.
• Victims of abuse, neglect, or domestic violence: We may disclose your PHI to a government authority, such as a social service agency, if we reasonably believe you are a victim of abuse, neglect, or domestic violence. We will only disclose this type of information: (i) to the extent required by law; (ii) if you consent to the disclosure; (iii) if the disclosure is allowed by law and we believe it is necessary to prevent serious harm to you or someone else; or (iv) the law enforcement or public official that is to receive the report represents that it is necessary and will not be used against you.
• As required by law: We must disclose your PHI whenever required to do so by law.

Required Written Authorization for Other Uses and Disclosures of PHI

The Pharmacy will obtain your written authorization before using or disclosing your PHI for purposes other than those provided for above (or as otherwise permitted or required by law). If you provide us with this written authorization to use or disclose medical information about you, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose medical information about you for the reasons covered by your written authorization, except to the extent we have already relied on your authorization. We are unable to take back any disclosures we have already made with your permission, and we are required to retain our records of the care that we provided to you. We are required to obtain a written authorization from you for most uses and disclosures of psychotherapy notes, uses and disclosures of PHI for marketing purposes and disclosures that constitute a sale of PHI.

If you have any questions or would like additional information about the Pharmacy's privacy practices, you may contact:

This Notice is effective as of January 1, 2023. We reserve the right to change our practices and this Notice, and to make the new Notice effective for all PHI we maintain. Upon request, we will provide a revised Notice to you, and we will post a revised notice at each Thrifty White Pharmacy and White Drug location.