Notice of Pharmacy Privacy Practices

Effective January 1, 2011

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU MAY GET ACCESS TO THIS INFORMATION. PLEASE READ IT CAREFULLY.

Nash Finch Company and its subsidiaries Econofoods, Family Thrift Center, Family Fresh Market, Sunmart Foods, Erickson’s Family Pharmacy, Rivers Edge Pharmacy, and Scottsbluff Pharmacy is required by law to maintain the privacy of Protected Health Information (PHI) and to provide you with this Notice of Privacy Practices (Notice) describing our legal duties and privacy practices with respect to PHI. PHI is information that may identify you and that relates to your past, present or future physical or mental health condition and related health care services.

This Notice explains how we may use information about you and when we can disclose that information to others. The Notice also describes your rights with respect to your PHI. We are required to follow the terms of this Notice.

HOW YOUR PHI WILL BE USED AND DISCLOSED:
We may use and/or disclose your PHI for the following purposes:

Treatment. We will use your PHI to provide and coordinate the treatment, medications and services you receive. For example, your PHI may be used by the pharmacist to contact you to provide prescription refill reminders or other product or service recommendations, product recalls or drug utilization review. We may contact you with information about treatment alternatives or other health-related benefits and services that may be of interest to you, subject to any applicable changes in law as of February 17, 2010.

Payment. We will use your PHI for payment for your treatment. For example, we may use your PHI, to process payment from your health plan for your medication and determine the amount of your copayment.

Healthcare Operations. We will use your PHI for operational, administrative and quality assurance activities. For example, your PHI may be used by clinical personnel reviewing the quality of the care you receive.

Family and Friends. We may disclose your PHI to family members, other relatives, personal representatives or close personal friends when the PHI is directly relevant to that person’s involvement with your care or the payment for your care, but not if you tell us that you object to us doing so.

Notification. We may use or disclose your PHI to notify or assist a family member, a personal representative or another person responsible for your care of your location or general condition.

As Required by Law. We will disclose your PHI when required to do so by federal, state, or local law.

Public Health. As required by law, we may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury, or disability.

Food and Drug Administration (FDA). We may disclose to the FDA, or persons under the jurisdiction of the FDA, PHI relative to adverse events with respect to drugs, foods, supplements, products and product defects, or post-marketing surveillance information to enable product recalls, repairs, or replacement.

Health Oversight Activities. We may disclose your PHI to a health oversight agency for oversight activities authorized by law. These activities include audits, investigations, inspections, licensure. We may also disclose your PHI to the government to monitor the health care system, government programs and compliance with civil rights laws.

Abuse or Neglect. We may disclose PHI when it concerns abuse, neglect or violence to government authorities that are authorized by law to receive such information, including a social service or protective service agency in accordance with federal and state law.

Legal Proceedings. We may disclose your PHI in the course of certain judicial, administrative or other legal proceedings such as in response to a court order, search warrant or subpoena.

Law Enforcement. We may disclose your PHI for law enforcement purposes as required by law or in response to a subpoena or court order or other specialized governmental functions.

Public Safety. We may use or disclose your PHI when necessary to prevent or lessen a serious threat to the health or safety of you, another person or to the public.

Military and Veterans. If you are a member of the armed forces, we may release PHI about you as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority.

Workers’ Compensation. We may disclose your PHI as authorized by laws relating to workers’ compensation or similar programs to the extent authorized and necessary.

Research. We may use or disclose your PHI for certain research purposes if an Institutional Review Board or a privacy board has approved a waiver of individual authorization.

Coroners, Medical Examiners and Funeral Directors. We may disclose your PHI to a coroner, medical examiner or a funeral director. For example, we may disclose information to a coroner or medical examiner to identify a deceased person, determine a cause of death, or as authorized by law. We may also disclose information to funeral directors as necessary to carry out their duties.

Organ Donation. Consistent with applicable law, we may disclose your PHI to an organ donation or procurement organization.

Correctional Institutions or Law Enforcement Officials. If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may disclose your PHI (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

National Security, Intelligence Activities, and Protective Services for the President and Others. We may release PHI about you to federal officials for intelligence, counterintelligence, protection to the President, and other national security activities authorized by law.

Business Associates. We may disclose your PHI to a business associate with whom we contract to provide services on our behalf. To protect your PHI, we require our business associates to protect the privacy of your information. Business associates are not allowed to use or disclose any information other than as specified in the contract between us.

For Data Breach Notification Purposes. We may use your contact information to provide to you legally required notices of unauthorized acquisition, access, or disclosure of your health information.

State Laws. If you receive pharmacy services from us in any state that prohibits or materially limits any use or disclosure listed above, we will abide by the applicable state law, regulation, or requirement. More restrictive state requirements are described at the end of this notice.

Disclosure to Department of Health and Human Services. We must disclose PHI when required by the United States Department of Health and Human Services as part of an investigation or determination of our compliance with relevant laws.

AUTHORIZATIONS:
We will not use or disclose your PHI for any other purpose than those provided above without your written authorization (or as otherwise permitted or required by law). You may revoke your authorization in writing at any time, except to the extent that we have taken action in reliance on your authorization.

YOUR RIGHTS REGARDING YOUR PHI:
Under federal law, you have the following rights with respect to your PHI:

You may request a copy of your PHI. This right is subject to certain specific exceptions permitted under law. You also have the right to request that we send a copy of your health information in an electronic format. You may be charged a reasonable fee for the cost of fulfilling your request.
You may ask us, in writing, to restrict certain uses and disclosures of your PHI. We are not required to agree to your request. We cannot agree to restrictions on uses or disclosures that are legally required or which are necessary to administer our business. If we honor your request, we will disclose your PHI if it is needed for an emergency.
You have the right to request that we not send your PHI to your health plan if the PHI concerns a health care item or service for which you have paid the provider out of pocket in full.
You have the right to request to receive communications from us in a confidential manner, in a different manner or at a different place such as a post office box. To request confidential communication of your PHI, you must submit a request in writing to the Privacy Officer at the address listed below. Your request must tell us how or where you would like to be contacted. We will honor all reasonable requests.

If you feel that the PHI we maintain about you is incomplete or incorrect, you may ask us, in writing, to amend your PHI. Your request must be in writing and provide the reasons for the requested amendment. Mail your request to the Privacy Officer at the address listed below. In certain cases, we may deny your request.

You have the right to receive an accounting of the disclosures of your PHI made by us and our business associates during the last six years, except for (1) disclosures for treatment, payment or healthcare operations, (2) disclosures authorized by you, and (3) specific disclosures permitted by law. Requests for the accounting must be made in writing to the Privacy Officer at the address listed below.
You may request a paper copy of this Notice, at any time. Even if you have agreed to receive this Notice electronically, you are entitled to a paper copy. You may obtain a paper copy at the pharmacy or from the Privacy Officer at the address listed below.
You have the right to complain to us and/or to the Secretary of the Department of Health and Human Services if you believe that we have violated your privacy rights. If you choose to file a complaint, you will not be retaliated against in any way. To complain to us, please contact:

Privacy Officer, c/o Legal Department
NASH FINCH COMPANY
P.O. Box 355
Minneapolis, MN 55440
(952) 832-0534

REVISION OF NOTICE OF PRIVACY PRACTICES:
We reserve the right to change the terms of this Notice, making any revision applicable to all the PHI we maintain. If we revise the terms of this Notice, we will post a revised notice at our retail pharmacies and on our websites. We will make paper copies of the revised Notice of Privacy Practices at the retail pharmacies available upon request.

FOR MORE INFORMATION OR TO REPORT A PROBLEM:
If you have questions or would like additional information about our privacy practices, you may contact the Privacy Officer at the address above or at (952) 832‑0534.

PRIVACY PRACTICES REQUIRED BY CERTAIN STATES:

In Iowa
We will not disclose any HIV/AIDS-related information, except in situations where the subject of the information has provided us with a written authorization allowing the release or where we are authorized or required by state or federal law to make the disclosure.

In Minnesota
We will not disclose your health records without your consent, except:

a) for a medical emergency when the provider is unable to obtain your consent due to your condition or the nature of the medical emergency; or
b) to other providers within related health care entities when necessary for your current treatment.

We will not disclose your prescription orders or the contents thereof, except to:

a) you, your agent, or another pharmacist acting on your behalf or your agent’s behalf;
b) the licensed practitioner who issued the prescription;
c) the licensed practitioner who is currently treating you;
d) a member, inspector, or investigator of the board or any federal, state, county, or municipal officer whose duty it is to enforce the laws of Minnesota or the United States relating to drugs and who is engaged in a specific investigation involving a designated person or drug;
e) an agency of government charged with the responsibility of providing medical care for you;
f) an insurance carrier or attorney on receipt of written authorization signed by you or your legal representative, authorizing the release of such information; and
g) any person duly authorized by a court order.

We may release your health records to the Minnesota Commissioner of Health or the Health Data Institute under the MinnesotaCare Act, provided that the Commissioner of Health encrypts the patient identifier upon receipt of the data.

Unless we have obtained your oral or written consent, we will not disclose the nature of pharmaceutical services rendered to you, except as follows:

a) pursuant to an order or direction of a court;
b) to other pharmacies;
c) to you; or
d) drug therapy information to your physician.

In South Dakota
We will only use information concerning applicants and recipients of medical assistance for purposes directly connected to the administration of the medical assistance program. If you are a recipient of medical assistance, we will not release your information without obtaining your approval.

In Wisconsin
Without your written authorization, your patient health care records, including prescription records, will only be released to you, to your personal representatives, and to those persons and entities specified in Section 146.82 of the Wisconsin Statutes. While the releases required or allowed by Section 146.82 include a number of the situations described in this Notice, there are several exceptions. For example, we may not release your health care records to your family and friends or to our business associates without your written authorization.