HIPPA Policy

This policy ensures full compliance with the federal Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and the Texas Medical Records Privacy Act (Texas Health and Safety Code Chapter 181). As a covered entity, this pharmacy is strictly dedicated to safeguarding the privacy and security of all Protected Health Information (PHI) and electronic PHI (ePHI).

2. Designation of Privacy & Security Officers

The pharmacy designates the following roles to manage oversight:

  • Privacy Officer: [Insert Name/Title] – Responsible for developing and implementing privacy policies, handling patient rights requests, and managing privacy training.

  • Security Officer: [Insert Name/Title] – Responsible for the implementation of administrative, physical, and technical safeguards for ePHI.

3. Permitted Uses and Disclosures of PHI

Pharmacy staff may use or disclose PHI without explicit patient authorization only for the following Treatment, Payment, and Healthcare Operations (TPO):

  • Treatment: Filling prescriptions, counseling patients, and consulting with a patient’s prescribing physician or healthcare provider.

  • Payment: Submitting claims to insurance companies, pharmacy benefit managers (PBMs), or Medicare/Medicaid for reimbursement.

  • Healthcare Operations: Conducting internal quality assessments, staff training, and pharmacy audits.

  • Other Permitted Disclosures: Disclosures required by law, such as reporting adverse events to the FDA or controlled substance tracking to the Texas State Board of Pharmacy.

All other uses or disclosures (including marketing or selling PHI) require a signed, written patient authorization.

4. Patient Privacy Rights

In accordance with federal laws and the strict mandates of the Texas Medical Records Privacy Act, patients possess the following rights:

  • Notice of Privacy Practices (NPP): The pharmacy must provide a written NPP to every new patient at the first point of service and display it prominently in the store and on its website.

  • Access to Records: Patients have the right to inspect and obtain a copy of their PHI. Per updated regulations, the pharmacy must fulfill written access requests within 15 days. Patients may inspect their PHI in person and take notes or photos.

  • Amendment Requests: Patients may request corrections to inaccurate or incomplete PHI in their pharmacy records.

  • Accounting of Disclosures: Patients may request a list of certain non-TPO disclosures made by the pharmacy over the past six years.

  • Restriction Requests: Patients have the right to request restrictions on how their PHI is used. If a patient pays for a prescription entirely out-of-pocket and requests that the pharmacy not disclose the information to their health insurance plan, the pharmacy must honor this restriction.

5. Safeguards (Minimum Necessary Rule)

Staff must make reasonable efforts to limit the use, disclosure, or request of PHI to the minimum necessary to accomplish the intended purpose.

  • Administrative: All pharmacy workforce members must undergo HIPAA training within 90 days of hire and annually thereafter, tracking compliance under Texas law.

  • Physical: All paper records, logs, and filled prescription bags awaiting pickup must be kept behind the pharmacy counter out of public view. Computer monitors displaying patient profiles must be angled away from the counter or fitted with privacy screens.

  • Technical: Every employee must use a unique login and strong password. Pharmacy systems must automatically log off after [Insert time, e.g., 5 minutes] of inactivity. All data transmissions (e.g., e-prescribing, insurance billing) must be encrypted.

6. Breach Notification Protocol

A breach occurs when there is an unauthorized acquisition, access, use, or disclosure of unencrypted PHI. In the event of a suspected or confirmed breach, the pharmacy will immediately run a four-factor risk assessment and proceed with required notifications:

  • Affected Individuals: Written notice must be sent via first-class mail (or email if preferred by the patient) without unreasonable delay and within 60 days of breach discovery.

  • Department of Health and Human Services (HHS):

    • Breaches affecting 500 or more individuals must be reported to HHS contemporaneously with the individual notice.

    • Breaches affecting fewer than 500 individuals must be logged internally and reported to HHS within 60 days of the end of the calendar year.

  • Texas Attorney General: In accordance with Texas state law, breaches affecting Texas residents must also be reported to the Texas Attorney General within the state-mandated timeframe.

7. Sanctions and Enforcement

Violations of this policy will result in disciplinary action up to and including immediate termination of employment. Civil and criminal penalties may also apply under federal law and the Texas Medical Records Privacy Act for individuals who knowingly access or disclose PHI without authorization.