HIPAA

Meridian North Pharmacy,Inc.
Address: 8801 N. Meridian Street, Suite 108, Indianapolis, IN 46260

Phone: (317)846-6654

Christian S. James, Privacy Officer

Policies and Procedures for Compliance with HIPAA Privacy Standards

Preamble

The following policies and procedures have been duly adopted by Meridian North Pharmacy for purposes of complying with the Health Insurance Portability and Accountability Act of 1996(HIPAA). These policies and procedures are mandatory with respect to all operations and employees of Meridian North Pharmacy.

Respect for Patient's Privacy

All employees of Meridian North Pharmacy shall respect the privacy of a patient's personally identifiable health information/protected health information (hereinafter "PHI") and shall not use and disclose PHI except as described in the Notice of Privacy Practices of Meridian North Pharmacy or otherwise permitted by HIPAA. If an employee has any question concerning the use and disclosure of PHI, the employee shall consult the Pharmacy Privacy Officer. Any violation by an employee of a patient's privacy shall be grounds for disciplinary action, including termination of employment.

Notice of Privacy Practices

Effective April 14, 2003, all patients shall be given the written Notice of Privacy Practices of Meridian North Pharmacy. An actual, physical handing of the written Notice of the Privacy Practices shall be attempted, rather than asking the patient if she or she wants a written Notice of Privacy Practices. If a patient states that a Notice of Privacy Practices was received on a previous visit to the pharmacy, the employee shall ask the patient if, at the time of receipt of the written Notice of Privacy Practices, the patient signed the appropriate document available at Meridian North Pharmacy acknowledging that the patient received the Notice of Privacy Practices.

The written Notice of Privacy Practices of Meridian North Pharmacy shall be posted in a conspicuous place, where it can be easily viewed by patients and others.

The written Notice of Privacy Practices shall be placed upon the website of Meridian North Pharmacy.

The written Notice of Privacy Practices shall remain current and shall be revised as necessary, with any revised written Notice of Privacy Practices being posted in a conspicuous place, where it can be easily viewed by patients and others, and made available in printed form for any person requesting a printed version of the written Notice of Privacy Practices. Any person who is not a patient, but who requests the written Notice of Privacy Practices of Meridian North Pharmacy is entitled to receive Notice of Privacy Practices even though not a patient.

Patient Acknowledgement of Receipt of Notice of Privacy Practices

At any time a patient is giving the written Notice of Privacy Practices, the patient shall be requested to sign the appropriate document available at Meridian North Pharmacy acknowledging that the patient received the Notice of Privacy Practices.

If at any time a patient refuses to sign the document acknowledging receipt of the written Notice of Privacy Practices, the employee shall notify the patient that Meridian North Pharmacy is required to obtain the patient's signature. If the patient continues to refuse to sign the document, then the employee shall notify the Pharmacy Privacy Officer or pharmacist on duty of the refusal, so that the good faith effort to obtain the signature can be appropriately documented.

For patients not able to physically visit Meridian North Pharmacy, then a reasonable effort shall be made to deliver the written Notice of Privacy Practices to the patient and obtain the patient's signature acknowledging receipt of the written Notice of Privacy Practices. In such situations, delivery can be accomplished by U.S. mail, special courier, electronic mail, delivery to the patient's home, or delivery to the patient's caregiver who does physically visit the pharmacy. If acknowledgement of receipt of the written Notice of Privacy Practices cannot be obtained, the Pharmacy Privacy Officer shall document the good faith effort to deliver the written Notice of Privacy Practices and obtain the patient's signature acknowledging receipt of the written Notice of Privacy Practices.

Accommodating Patients Rights

Patients possess a variety of rights related to their PHI at Meridian North Pharmacy. The rights, in addition to the right to receive a written Notice of Privacy Practices, include the following:

A request for access to pharmacy records;
A request to amend pharmacy records;
A request for an accounting;
A request for confidential communications; and
A request to file a complaint.

Any employee receiving a request from a patient related to any of the above-listed patient rights shall immediately refer the request to the Pharmacy Privacy Officer, and if the Pharmacy Privacy Officer is not available, the request shall be referred to the pharmacist on duty.

Any patient requesting the exercising of any of the above-listed rights shall be requested to complete the form that relates to the patient right. However, if a patient refuses to complete the form, and instead wants to exercise the right based only upon an oral request, the Pharmacy Privacy Office or pharmacist on duty shall make a good faith effort to accommodate the request.

Every effort shall be made to accommodate a request of a patient to exercise a right granted to the patient by HIPAA. All requests to exercise a patient right shall be promptly reviewed and acted upon by the Pharmacy Privacy Officer. Where a patient is entitled to a written response to a request to exercise a patient right, the written response shall be provided promptly to the patient. Documentation of resolution and response of a request to exercise a patient right shall be placed upon the appropriate Meridian North Pharmacy form as necessary or required by the form.

The Pharmacy Privacy Officer shall consult with the pharmacist on duty as necessary with regard to any request to a patient right.

Uses and Disclosures of PHI

Use and disclosure of PHI shall occur only in accordance with the written Notice of Privacy Practices of Meridian North Pharmacy. With respect to any use and disclosure of PHI, only the minimum necessary PHI shall be used and disclosed, unless otherwise permitted by the Pharmacy Privacy Office or pharmacist on duty who is familiar with the rules concerning the minimum necessary standard.

Only the Pharmacy Privacy Officer and pharmacist on duty shall be allowed to request a written authorization for a use and disclosure of PHI that is not described in the Notice of Privacy Practices, or otherwise requires a written authorization pursuant to HIPAA.

Use and disclosure of PHI shall occur only with respect to the employees of Meridian North Pharmacy who have an essential need for the PHI in order to carry out their job tasks and responsibilities. Such employees shall not use or disclose PHI to other employees.

Any sue and disclosure of PHI for purposes of marketing must be approved in advance by the Pharmacy Privacy Officer.

Record Keeping Requirements

The initial written Notice of Privacy Practices and any revised written Notices of Privacy Practices that may be prepared shall be maintained at Meridian North Pharmacy for at least six years from the effective date stated on the written Notice of Privacy Practices.

The document used to record patients' signatures acknowledging receipt of the written Notice of Privacy Practices shall be maintained at Meridian North Pharmacy for at least six years from the date of the last patient signature contained on the document.

Any sue and disclosure of PHI that is subject to the HIPAA accounting requirement shall be maintained in an appropriate database, electronic oar written, with performance of routing backing up, and shall be maintained for at least six years from the date of the sue and disclosure.

All contracts with business associates shall include the HIPAA required "satisfactory assurances" and shall be maintained in a readily retrievable manner.

Staff Training

Although not all employees will have access to PHI, it is the policy of Meridian North Pharmacy that all employees will undergo staff training. Staff training shall be accomplished by all current employees prior to the HIPAA implementation deadline of April 14, 2003. Staff training shall be accomplished with in a reasonable time by all employees hired after the HIPAA implementation deadline of April 14, 2003. Staff training programs and materials shall be modified as needed to remain current, and all employees shall be retrained as necessary.

Cooperation with Investigations and Compliance Reviews

It is the policy of Meridian North Pharmacy to fully cooperate with any investigation or compliance review concerning the compliance of Meridian North Pharmacy with the HIPAA privacy standards.