HIPAA Notice of Privacy Practices

When this Notice of Privacy Practices (“Notice”) refers to “we” or “us,” it is referring to Duffy Rx LLC, dba Statmeds, and all of the pharmacists who provide health care services and the employees of our pharmacy. We are required by law to maintain the privacy of your protected health information (“PHI”), to follow the terms of the Notice currently in effect, to give you this Notice setting forth our legal duties and privacy practices concerning your PHI, and to notify affected individuals following a breach of unsecured PHI. This Notice describes how we may use and disclose your PHI. It also explains the rights you have with respect to your PHI and certain obligations we must abide by in accordance with the law. We reserve the right to change this Notice and to make the new Notice effective for all PHI we maintain. If we make any material revisions, we will post a copy of the revised Notice in the pharmacy and on our website and will offer you a copy.

I. Use and disclosure of your PHI

We will use and disclose your PHI for treatment, payment and health care operations. We may also use your PHI for other purposes that are permitted or required by law and pursuant to your written authorization. The following are examples of how we may use or disclose your PHI. Any other uses not described in this Notice will only be made with your explicit written authorization, which you may revoke at any time by giving us written notice of your revocation.

A. Treatment

We may use and disclose your PHI to provide you with prescription and supply services. We may disclose your PHI to other pharmacists, pharmacy technicians and health care providers involved in your care.

B. Payment

We will use and disclose your PHI to obtain payment for the health care services we provide to you. We may also need to disclose your PHI to receive prior approval from your health plan or to determine whether your health plan will cover a certain prescription or service.

C. Health care operations

We may use and disclose your PHI in connection with the management of our pharmacy, for example for quality assessment and improvement, internal compliance audits and performance evaluations. We may also use your PHI for our business management and general administrative activities.

D. Prescription refill reminders, treatment alternatives or health-related benefits

We may use and disclose your PHI to contact you to remind you about prescription refills, to tell you about treatment options or alternatives, or to inform you about health-related benefits or services that may be of interest to you.

E. Family members, relatives or close friends

Unless you object, we may disclose your PHI to your family members, relatives or close personal friends, or any other person you identify as being involved in your treatment or in payment for your medical care. If you are not present to agree or object, we may use our professional judgment to determine whether the disclosure is in your best interest. If we disclose your PHI, we will disclose only the PHI relevant to your treatment or payment.

F. Other permitted and required uses and disclosures

We may use your PHI without your authorization, and without offering you the opportunity to agree or object, as follows:

as required by law, provided that the use or disclosure complies with applicable law; to a public health authority authorized by law to collect or receive such information, or to a foreign government agency acting in collaboration with a public health authority. These activities generally include preventing or controlling disease, reporting deaths, reporting adverse effects of medications or problems with products, notification of communicable disease, and reporting abuse or neglect under certain circumstances;
to a health oversight agency for oversight activities authorized by law, including audits, inspections, and civil, administrative or criminal investigations, proceedings or actions;
for judicial or administrative proceedings in response to a subpoena, court order, discovery request or similar process, but only if efforts have been made to inform you about the request or to obtain an order protecting the information requested;
to law enforcement to report certain injuries, comply with court orders, warrants or similar process, identify a suspect, fugitive, missing person or victim, or report a crime;
to a coroner or medical examiner to perform duties authorized by law, such as identifying a deceased person or determining the cause of death;
to funeral directors, consistent with applicable law, as necessary to carry out their duties;
to organ procurement organizations or similar entities to facilitate organ, eye or tissue donation and transplantation;
for research purposes, provided that certain approvals take place and assurances are given;
to avert a serious threat to health or safety, so long as the disclosure is only to a person reasonably able to prevent or lessen the threat;
for military and veterans activities (including foreign military personnel) to assure the proper execution of a military mission and to determine eligibility for benefits;
for national security and intelligence activities for the purpose of conducting lawful intelligence, counter-intelligence and other national security activities;
for protection of the President and other authorized persons or foreign heads of state, or to conduct authorized investigations;
to a correctional institution or law enforcement custodian if you are an inmate or in custody; and
to the extent necessary to comply with laws relating to workers’ compensation and work-related injuries.

G. Uses and disclosures that require your written authorization

Most uses and disclosures of psychotherapy notes, uses and disclosures of PHI for marketing purposes, and disclosures that constitute a sale of PHI require your written authorization.

H. Additional protections under New York law

New York law gives some information extra protection. We disclose confidential HIV-related information only as Public Health Law Article 27-F permits, and mental health information, genetic test results and substance use disorder treatment records only as Mental Hygiene Law §33.13, Civil Rights Law §79-l and 42 CFR Part 2 permit, which may require your specific written consent or a court order.

II. Your rights as our patient

As our patient, you have a number of rights associated with your PHI:

A. Restrictions

You have the right to request restrictions or limitations on how we use or disclose your PHI. We do not have to agree to your request, except for restrictions on disclosures to your health plan for items you paid for in full out of pocket. Your written request must specify (1) whether you want to restrict or limit our use or disclosure, or both; (2) what information you want restricted or limited; and (3) to whom the restriction or limitation applies (for example, a spouse). If we agree, it will not prevent us from disclosing your PHI (1) to you, if you request access or an accounting of disclosures; (2) for purposes required or permitted by law; or (3) in an emergency.

B. Confidential communications

You have the right to receive confidential communications about your PHI by alternative means or at alternative locations, for example at an address other than your home. To do so, submit your request in writing to the Privacy Officer describing the alternative means or location. We will accommodate all reasonable requests.

C. Access

You have the right to access, inspect and obtain a copy of your PHI, including electronic PHI, except for certain PHI exempted under HIPAA. To the extent we maintain electronic PHI, we will provide a copy in the format you request when possible. If we do not have your PHI, we will provide the appropriate contact information when we receive your request. We will respond in a timely fashion and may charge a reasonable, cost-based fee for copying and postage. In limited circumstances we may deny access, in which case you may request that the denial be reviewed. If access is ultimately denied, you are entitled to a written explanation of the reasons.

D. Accounting of disclosures

You have the right to receive an accounting of disclosures of your PHI made by us, including disclosures to or by our business associates, for the six (6) years before the date of your request, or a shorter period you specify. You will receive one accounting per year free of charge. For additional requests within the same twelve-month period, we may charge a reasonable, cost-based fee. We will tell you the cost in advance, and you may withdraw or modify your request before you are charged.

E. Amendment

If you believe PHI we have about you is incorrect or incomplete, you may make a written request for an amendment stating the reasons that support it, for as long as we maintain your PHI. If we do not have your PHI, we will provide the appropriate contact information. We may deny your request if, for example, we determine that the PHI was not created by us or is already accurate and complete. You may respond to a denial by filing a written statement of disagreement, and we have the right to rebut it. If this occurs, you may request that your original request, our denial, your statement of disagreement and our rebuttal be included in future disclosures of your PHI.

F. Paper copy of this Notice

You have the right to obtain a paper copy of this Notice at any time, even if you received it electronically. Send your request in writing to the Privacy Officer at the address below, or ask at the pharmacy.

G. Fundraising and sale of PHI

You have the right to opt out of fundraising communications, and your PHI will not be used for fundraising purposes or sold without your prior written authorization.

III. Additional information, questions or complaints

For more information about this Notice, or to exercise any of the rights described in it, contact the pharmacy:

Duffy Rx LLC dba Statmeds
Attn: Privacy Officer
399 W John St, Ste 100
Hicksville, NY 11801
Phone: (516) 900-0636
Fax: (877) 961-1116
Email: info@stat-meds.com

If you believe your privacy rights have been violated, you may file a complaint, without retaliation, with our Privacy Officer or with the Secretary of the U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C. 20201, or online at hhs.gov/ocr/complaints.

Effective date: October 29, 2026. This Notice replaces our Notice effective June 1, 2018.