Costco Health Centers Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Effective Date: September 23, 2013

General Information About This Notice

Costco is committed to maintaining the confidentiality of your private health information. This Notice describes our efforts to safeguard your health information from improper or unnecessary use or disclosure while providing you with the high quality/low cost goods and services Costco members have come to expect. This Notice only applies to health-related information created, received, maintained or transmitted by or on behalf of Costco Pharmacies, Costco Optical Centers, and Costco Hearing Aid Centers (collectively, the "Costco Health Centers"). Federal law requires us to provide you with a summary of the Costco Health Centers' privacy practices and related legal duties and your rights in connection with our use and disclosure of your health information.

• This Notice only applies to Costco Members and other patrons who are customers of the Costco Pharmacies, Costco Optical Centers, and Costco Hearing Aid Centers, whether services are provided by a Costco Health Center representative or through our www.costco.com Web site. The Costco Health Centers, and Costco employees and third parties who perform services for the Costco Health Centers are bound by the terms of this Notice.


• This Notice does not apply to products or services provided by independent contractors (for example, independent optometrists, ophthalmologists, and some providers of medical services such as, but not limited to, osteoporosis testing). If you are a customer of, or receive services from, any of these independent health care providers, you should request from them a copy of their privacy notice.

What is Protected?

The federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as modified by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), requires that Costco Health Centers safeguard health information about you called "protected health information," or "PHI," created, received, maintained or transmitted in the course of providing services to you through the Costco Health Centers. PHI is health information that can be used to identify you and that relates to (1) your physical or mental health condition, (2) the provision of health care to you, or (3) payment for your health care. Your prescriptions, vision test results, and audiogram results, as well as the information you provide on any Costco Health Center patient health history form, including family member history, if applicable, are all examples of PHI.

The remainder of this Notice generally describes our rules with respect to PHI created, received, maintained or transmitted by the Costco Health Centers and your rights regarding that information.

Uses and Disclosures of PHI

To protect the privacy of PHI, the Costco Health Centers not only guard the physical security of PHI, but we also limit the way PHI is used or disclosed to others. We may use or disclose PHI in certain permissible ways described below.

• To provide you with health care services and products. Costco Health Centers use and disclose PHI in order to provide you with health care services and products. For example, in our hearing aid department we use your audiogram results in order to provide you with the appropriate hearing aid. Our pharmacists ask you questions regarding drug allergies or review your prescription history in order to ensure that we do not provide you prescription drugs to which you may be allergic or which may interact with other prescriptions. Costco opticians use your prescription from your ophthalmologist or optometrist to provide you with the appropriate corrective eye glasses or contact lenses.


• To another health care provider if needed for your treatment. For example, we may discuss your prescription information with your primary care physician if a Costco pharmacist has a drug interaction concern or questions regarding your prescription. We may also contact medical professionals who have prescribed controlled substances for you to discuss whether they are appropriate and necessary for you.


• To bill you for health care services or products. Costco Health Centers use and disclose your PHI to bill you and to accept payment for prescription drugs, glasses, contact lenses, or hearing aids which you may purchase. For example, an associate in the Costco Pharmacy may ring up your prescription drug purchases.


• To seek reimbursement or calculate rebates for health care products or services you receive at Costco Health Centers. For example, Costco Health Centers use and disclose PHI to receive payments from your health plan for covered prescription drugs purchased from a Costco Pharmacy. If you are a Costco Executive Member, your purchase information from any Costco Health Center will be combined with other personal information to calculate your Executive Member 2% Reward, subject to the terms and conditions of that program. We may also disclose PHI to a third party (called a “business associate”) who assists us in our operations. For example, a third party who helps secure rebates for you from manufacturers on your Costco Health Center purchases is a business associate. Business associates must also comply with HIPAA.


• For the administration and operation of the Costco Health Centers. We use and disclose PHI for numerous administrative and quality control functions necessary for the Costco Health Centers' proper operation. For example, we may use your pharmacy prescription drug purchase information for fraud and abuse detection activities or to conduct data analyses for planning-related purposes.


• To inform you about treatment alternatives or other health-related benefits that may be offered by Costco Health Centers. For example, we may use your prescription data to alert you to a generic drug available as a substitute for the prescription drug you are currently using.


• To another health care provider or health plan for administration and operations purposes. We may share PHI with another health care provider or a health plan that has a relationship with you for quality assessment and improvement activities, to review the qualifications of health care professionals who provide care to you, or for fraud and abuse detection and prevention purposes.


• To a family member, friend, or other person involved in your health care if you are present and you do not object to the sharing of PHI or in the event of an emergency. Our Costco Health Centers may also allow a family member, friend or other person to pick up your purchases after providing us with some verifying information such as your address or date of your birth.


• To comply with an applicable federal, state, or local law, including, for example, workers' compensation programs established by law.


• For public health reasons,including to a public health authority for the prevention or control of disease, injury or disability; to a proper government or health authority to report child abuse or neglect; to report reactions to medications or problems with products regulated by the Food and Drug Administration; to notify individuals of recalls of medication or products they may be using; or to notify a person who may have been exposed to a communicable disease or who may be at risk for contracting or spreading a disease or condition.


• To report a suspected case of abuse, neglect or domestic violence, as permitted or required by applicable law.


• To comply with health oversight activities, such as audits, investigations, inspections, licensure actions, and other government monitoring and activities related to health care provision or public benefits or services. For example, Costco Pharmacies are subject to reporting requirements regarding narcotics under state and federal law, and are subject to periodic and random inspections by state pharmacy boards and the federal Drug Enforcement Agency. Inspectors or other government officials may view or receive PHI as a result of a government inspection or other request.


• To the U.S. Department of Health and Human Services to demonstrate our compliance with HIPAA.


• To respond to an order of a court or administrative tribunal, such as a court-ordered warrant, subpoena or summons, grand jury subpoena, or administrative subpoena or other request.


• To respond to a subpoena, warrant, summons or other legal request if sufficient safeguards, such as a protective order in the case of a private lawsuit, are in place to maintain PHI privacy.


• To a law enforcement official for a law enforcement purpose as required by law.


• For purposes of public safety or national security.


• To allow a coroner or medical examiner to identify you or determine your cause of death.


• To allow a funeral director to carry out his or her duties.


• To respond to a request by military command authorities if you are or were a member of the armed forces.

We use the minimum amount of PHI necessary to perform these tasks. We also require our business associates to limit any use or disclosure of your PHI to the minimum necessary amount.

If an applicable state or federal law provides greater health information privacy protections than HIPAA, we will comply with the stricter law. For example, federal and state laws may provide privacy protections to PHI related to mental health, HIV/AIDS, reproductive health or chemical dependency that are more strict than HIPAA.

Finally, if we or one of our business associates create, receive, maintain or transmit your PHI in an unsecured manner (such as in paper form or in an unencrypted electronic form) and a breach occurs, we will notify you.

Other Uses and Disclosures of PHI

Before we use or disclose PHI for any purpose other than as described above, we must obtain your written authorization, including uses and disclosures for:

• Marketing. Marketing means making a communication about a product or service that encourages you to purchase or use the product or service. Marketing does not include our face-to-face interactions with you or refill reminders or other communications we might have with or send to you about a drug currently prescribed for you, provided that any payment that we may receive from a third party for making any such communication is reasonably related to our costs in making that communication. Marketing also does not include case management or care coordination for your treatment or to recommend alternative treatments, therapies, or health care providers for you as long as we do not receive any payment for making these communications.


• Receiving direct or indirect payment in exchange for providing the information. However, the disclosure of your PHI to a health insurer in order to receive payment for products or services we provide to you is permissible.

You may revoke your authorization, in writing, at any time. If you revoke your authorization, the Costco Health Centers will no longer use or disclose PHI except as described above (or as permitted by any other authorizations that have not been revoked). However, please understand that we cannot retrieve any PHI disclosed to a third party in reliance on your prior authorization.

Your Rights

Federal law provides you with certain rights regarding PHI that pertains to you. Parents of minor children who are customers of the Costco Health Centers and other individuals with legal authority to make health decisions for customers of the Costco Health Centers may exercise these rights on behalf of such customers, consistent with state law.

• Right to request restrictions:You have the right to request a restriction or limitation on the Costco Health Centers' use or disclosure of PHI. The law does not require the Costco Health Centers to agree to your request unless the request relates to a health care item or service for which you have paid in full out-of-pocket and you have requested in advance that we do not disclose the item or service to your health plan for the purpose of obtaining payment. We will honor such a request provided that such disclosure is not otherwise required by law. If you want to request such a restriction concerning an item or service that you pay for in full out-of-pocket, you must submit the request in advance of your purchase using the form provided by the Costco Health Center. The request will only be valid at the particular Costco Health Center location where the form is submitted and you must submit a new form in advance for each purchase you intend to make. For example, each time you present a prescription to be filled or request a refill of an existing prescription, you must submit a new form to the Costco pharmacy location where you intend to make the purchase before (or at the same time) you present the prescription or refill request. In addition, you must submit a form prior to your health care provider calling in a prescription. It is important that you submit each restriction request to the specific Costco Health Center warehouse location where you intend to make the purchase. Otherwise, the Costco Health Center will not have notice of your request.
  
  You may submit other restriction requests (i.e. , those not related to a product or service for which you have paid in full out-of-pocket) in writing to our Privacy Office. Your request must specify: (i) the PHI you want to limit; (ii) how you want the Costco Health Centers to limit the use, disclosure, or both of that PHI; and (iii) to whom you want the restrictions to apply. We may not be able to grant it because it may affect our ability to provide health care services or products to you. However, unlike the restriction for products you pay for in full out-of pocket discussed above, if we do agree to your requested restriction or limitation, we will honor the restriction until you agree to terminate the restriction or until we notify you that we are terminating the restriction on a going-forward basis.


• Right to receive confidential communications:You have the right to request that the Costco Health Centers communicate with you about PHI at a new address or by different means if you believe that communication through normal business practices could endanger you. You may submit a written request for confidential communications to your local Costco Health Center.


• Right to obtain a copy of PHI:You have the right to review and obtain a copy of PHI that is contained in medical or billing records that the Costco Health Centers maintain or other records that the Costco Health Centers use to make decisions about you.
  
  However, we will not give you access to PHI records created in anticipation of a civil, criminal or administrative action or proceeding. We will also deny your request to inspect and copy PHI if a licensed health care professional hired by the Costco Health Centers has determined that giving you the requested access is reasonably likely to endanger the life or physical safety of you or another individual or to cause substantial harm to you or another individual, or that the record makes references to another person (other than a health care provider), and that the requested access would likely cause substantial harm to the other person.
  
  If your request to access PHI is denied, you may have that decision reviewed. A different licensed health care professional chosen by the Costco Health Centers will review the request and denial, and we will comply with the health care professional's decision.
  
  You may make a request to review or obtain a copy of PHI at your local Costco Health Center. We may charge you a fee to cover the costs of copying, mailing or other supplies directly associated with your request. You will be notified of any costs before you incur any expenses.


• Right to amend PHI:You have the right to request an amendment of PHI if you believe the information the Costco Health Centers have about you is incorrect or incomplete. You have this right as long as PHI is maintained by the Costco Health Centers. We will correct any mistakes if we created the PHI or if the person or entity that originally created the PHI is no longer available to make the amendment.
  
  Amendments involving the addition of information to Costco Health Center records may generally be made at your local Costco Health Center. However, for other types of changes, or if the local Costco Health Center is unable to accommodate your request, you must submit a written request to amend PHI by filling out a Request for Amendment form available from the Privacy Officer and submitting the form back to our Privacy Officer. You should include evidence to support your request because we cannot amend PHI that we believe to be accurate and complete.


• Right to receive an accounting of disclosures of PHI: You have the right to request a list of certain disclosures of PHI by the Costco Health Centers. The accounting will not include certain disclosures. For example, the accounting would not include disclosures we made to you or in response to your written authorization. We will notify you at the time we provide the accounting of the disclosures that are not included.
  
  Your first request for an accounting within a 12-month period will be free. We may charge you for costs associated with providing you additional accountings. We will notify you of the costs involved, and you may choose to withdraw or modify your request before you incur any expenses.
  
  You may submit a written request for an accounting of disclosures of PHI by filling out a Request for Accounting of Disclosures form available from the Privacy Office and submitting the form back to the Privacy Office. Your request must include (i) the time period for the accounting, which may not be longer than required by federal law; and (ii) the form (e.g., electronic, paper) in which you would like the accounting


• Right to file a complaint:If you believe your rights have been violated, you should let us know immediately. We will take steps to remedy any violations of the Costco Health Centers' privacy policy or of this Notice.
  
  You may file a formal complaint with our Privacy Office and/or with the United States Department of Health and Human Services at the addresses below. You should attach any documents or evidence that supports your belief that your privacy rights have been violated. We take your complaints very seriously. Costco policy and federal law prohibit retaliation against any person for filing such a complaint.

Complaints should be sent to:

Additional Information About This Notice

• Changes to this Notice:We reserve the right to change the Costco Health Centers' privacy practices as described in this Notice. Any change may affect the use and disclosure of PHI already maintained by the Costco Health Centers, as well as any of PHI that the Costco Health Centers may receive or create in the future. If there is a material change to the terms of this Notice, revised Notices will be made available at each Costco Health Center and by logging on to Costco's Web site at www.costco.com under the Costco Health Centers section.


• Acknowledgement: When first delivering this Notice to you, each of the Costco Health Centers will ask you to sign an acknowledgement that you were provided a copy of this Notice.