Notice of Privacy Practices

This notice describes how medical information about YOU may be used and disclosed and how YOU can get access to this information. Please read it carefully.

Rite Aid will ask you to sign an Acknowledgment that you have received this Notice of Privacy Practices ("Notice"). This Notice describes, in accordance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule, how Rite Aid may use and disclose your protected health information to carry out treatment, payment or health care operations and for other specific purposes that are permitted or required by law. The Notice also describes your rights and Rite Aid's duties with respect to protected health information about you.

TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS

We will use your protected health information to treat you. For example, we may receive written, verbal, facsimile or electronic health information and prescription orders for you and will use protected health information to dispense prescription medications to you. We may also disclose your information to other health care providers to coordinate your treatment and provide you with prescriptions, lab work or other healthcare. We may contact you to provide treatment-related services, such as refill reminders, treatment alternatives (e.g., available generic products), and other health-related benefits and services that may be of interest to you.

We will use your protected health information to obtain payment for products and services. For example, we may contact your third party payor (such as your insurer or pharmaceutical benefits manager) to determine whether the third party payor will pay for your prescription. We will bill you and/or a third party payor for the cost of prescription medications dispensed to you. The information on or accompanying the bill may include your identification information, as well as the prescriptions you are taking.

We will use your protected health information to carry out health care operations. These uses and disclosures are necessary to run the pharmacy and to make sure that all of our patients receive quality care. For example, we may use your protected health information to monitor the quality of pharmacist performance and to train pharmacy personnel. Your protected health information may also be transferred for the purposes of carrying out pharmacy services if we buy or sell pharmacy locations.

USES AND DISCLOSURES THAT ARE EITHER PERMITTED OR REQUIRED BY THE HIPAA PRIVACY RULE

Using their professional judgment, our pharmacists may disclose your protected health information to a family member, other relative, close personal friend, or any person you identify as being involved in your health care. This could include allowing those persons to pick up filled prescriptions, medical supplies, or medical records on your behalf. We may enter into contracts with some entities known as Business Associates that perform services for us. For example, we sometimes engage Business Associates to sort insurance or other third party payor claims for submission to the actual payor. We may disclose protected health information to our Business Associates so that they can perform their services and then bill your third party payor for services rendered. We require the Business Associates to appropriately safeguard the protected health information.

OTHER REQUIRED OR PERMITTED DISCLOSURES OF PROTECTED HEALTH INFORMATION

Although it is likely that Rite Aid may never have reason to make some of these disclosures, there are certain limited circumstances where the law may require us to disclose your protected health information. Also, in other cases, federal and state laws allow us to disclose your protected health information. Below is a list of the circumstances that the law either requires or allows us to disclose your protected health information:

• to the Food and Drug Administration (FDA) relative to adverse events regarding drugs, foods, supplements, and other health products or to post marketing surveillance to enable product recalls, repairs, or replacement;

• to public health or legal authorities charged with preventing or controlling disease, injury, or disability;

• to law enforcement agencies as required by law or in response to a valid subpoena or other legal process;

• to health oversight agencies (g., medical licensing boards) for activities authorized by law such as audits, investigations, and inspections necessary for Rite Aid's licensure and for the government to monitor the health care system, etc.;

• in response to a court order, administrative order, subpoena, discovery request, or other lawful process by another person involved in a dispute involving a patient, but only if efforts have been made to tell the patient about the request or to obtain an order protecting the requested protected health information;

• as authorized by and as necessary to comply with laws relating to worker's compensation or similar programs established by law;

• whenever required to do so by law;

• to a coroner or medical examiner when necessary, for example, to identify a deceased person or to determine a cause of death, or to funeral directors consistent with applicable law to carry out their duties;

• to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant, consistent with applicable law;

• to notify, or assist in notifying, a family member, personal representative, or another person responsible for the patient's care, of the patient's location, or general condition;

• to a correctional institution or its agents, if a patient is or becomes an inmate of such an institution, when necessary for the patient's health or the health and safety of others;

• when necessary to prevent a serious threat to the patient's health and safety or the health and safety of the public or another person;

• as required by military command authorities, when the patient is a member of the armed forces, and to appropriate military authorities about foreign military personnel;

• to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law;

• to authorized federal officials so they may provide protection to the President, other authorized persons, or foreign heads of state or conduct special investigations;

• to a government authority, such as a social service or protective services agency, if Rite Aid reasonably believes the patient to be a victim of abuse, neglect, or domestic violence, but only to the extent required by law, if the patient agrees to the disclosure, or if the disclosure is allowed by law and Rite Aid believes it is necessary to prevent serious harm to the patient or to someone else or the law enforcement or public official that is to receive the report represents that it is necessary and will not be used against the patient.

MORE STRINGENT STATE LAWS

If your state has a law or regulation that is more stringent than the HIPAA Privacy Rule, we are required to follow it. If you would like additional information about state law protections in your state, please contact the Rite Aid Privacy Office at: Privacy Office, Rite Aid, P.O. Box 3165, Harrisburg, PA 17105.

AUTHORIZED USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION

We will obtain your written Authorization before using or disclosing protected health information about you for marketing purposes, to sell your protected health information, or for purposes other than those listed above or otherwise permitted or required by law. You may revoke an Authorization in writing at any time. Such revocations must be made in writing. Upon receipt of the written revocation, we will stop using or disclosing protected health information about you, except to the extent that we have already taken action in reliance on the Authorization.

THE PATIENT'S RIGHTS
 

RESTRICTION REQUESTS

You have the right to request that we restrict how your protected health information is used or disclosed in carrying out treatment, payment, or health care operations. Such requests must be made in writing via the amendment to PHI form to the Privacy Office, Rite Aid, P.O. Box 3165, Harrisburg, PA 1710 or to the fax number listed on said form. If you request the restriction of a disclosure that is (i) made for the purpose of carrying out payment or health care operations, (ii) not otherwise required by law and (iii) relates to an health care item or service for which you have paid out of pocket in full, then we will honor your affirmative request not to disclose that information to a health plan. We are not required to agree to most other required restrictions. If, however, we do agree to the requested restrictions, that agreement will be binding on us. If you are a minor who has lawfully provided consent for treatment and you wish Rite Aid to treat you as an adult for purposes of access to and disclosure of records related to such treatment, please notify Rite Aid's Privacy Officer.

ALTERNATIVE MEANS OF COMMUNICATION

You have the right to request that our communications to you concerning your protected health information be made by alternative means or at alternative locations. For example, you may wish us to communicate in some way other than mailing to your home address or calling your home telephone number. Such requests must be made in writing via the amendment to PHI form to the Privacy Office, Rite Aid, P.O. Box 3165, Harrisburg, PA 17105 or the fax number listed on the form. We will comply with a reasonable request for such an alternative means of communication.

ACCESS TO PROTECTED HEALTH INFORMATION

You have the right to inspect and obtain a copy of your protected health information. You have the right to access and copy protected health information about you contained in the designated record set for as long as we maintain your protected health information. The designated record set usually will include prescription and billing records. To receive a copy of your protected health information, you can either (i)  request such access via the Portal, (ii) print, complete and fax a records request form, including any supporting documentation , or (iii) mail a completed records request form [AP2] and supporting documentation to the Privacy Office, Rite Aid, P.O. Box 3165, Harrisburg, PA 17105. In most cases, we will charge you a reasonable fee for the costs of copying, mailing, or other supplies that are necessary to grant your request. We may also deny your request to inspect and copy in limited circumstances. If you are denied access to your protected health information in most cases you may request that the denial be reviewed.

AMENDMENTS TO PROTECTED HEALTH INFORMATION

If you feel that the protected health information we maintain about you is incomplete or incorrect, you may request that we amend it. You may request an amendment for as long as we maintain the protected health information. A request for an amendment must be made in writing. Please print and complete an amendment to PHI form , send it to the Privacy Office, Rite Aid, P.O. Box 3165, Harrisburg, PA 17105 or to the fax number listed on said form. You must include a reason that supports your request. In certain cases, we may deny the request. If the request for amendment is denied, you have the right to file a statement of disagreement with the decision, and we may give a rebuttal to your statement.

ACCOUNTING OF DISCLOSURES OF PROTECTED HEALTH INFORMATION

For most disclosures of protected health information other than those made for treatment, payment, or health care operations, you have the right to receive an accounting of the disclosures we made in the six years before the date of your request for an accounting of disclosures of your protected health information. The accounting will exclude disclosures we may have made directly to you, disclosures to friends or family members involved in your care, and disclosures for purposes you specifically authorized in writing. The right to receive an accounting of disclosures of protected health information is subject to certain other exceptions, restrictions, and limitations. A request for an accounting must be made in writing. Print and complete an accounting of disclosures form , send it to the Privacy Office, Rite Aid, P.O. Box 3165, Harrisburg, PA 17105, or fax it to the number listed on the form. The time period for the requested accounting must be specified and it may not be longer than six years. The first accounting you request within a 12-month period will be provided free of charge, but you will be charged for the cost of providing additional accountings within that period. We will notify you of the cost involved and you may choose to withdraw or modify the request at that time.

PAPER COPY OF NOTICE OF PRIVACY PRACTICES

You have a right to receive a paper copy of this Notice from us upon request even if you have already received the Notice electronically (for example, on the Internet).

RITE AID'S DUTIES

We are required by law to maintain the privacy and confidentiality of protected health information and to provide you with a Notice of Privacy Practices including our legal duties with respect to protected health information. We are also required by law to notify you following a breach of your unsecured protected health information.

We reserve the right to change the terms of our Notice and to make the new Notice provisions effective for all protected health information that we maintain. When we make changes in our Notice, copies of the revised Notice will be available on request in all our pharmacies. A copy will be posted in all of our pharmacies and will be available on our web site at www.riteaid.com.

FOR MORE INFORMATION OR TO REPORT A PROBLEM

If you have questions or would like additional information about our privacy practices, you may contact the Privacy Office at (717) 761-2633 or by writing to the Privacy Office, Rite Aid, P.O. Box 3165, Harrisburg, PA 17105. Forms for filing a written complaint to Rite Aid are available at our pharmacies. If you believe your privacy rights have been violated, you can file a complaint with Rite Aid's Privacy Office or with the Secretary of Health and Human Services. There will be no retaliation against you for filing a complaint.

EFFECTIVE DATE

This Notice of Privacy Practices is effective as of 9/2/2022.