Preamble: The following policies and procedures have been duly adopted by Hinkle's Pharmacy Inc. for purposes of complying with the Health Insurance Portability and Accountability Act of 1996 (HIPAA). These policies and procedures are mandatory with respect to all operations and employees of Hinkle's Pharmacy Inc..

Respect for Patient's Privacy

All employees of Hinkle's Pharmacy Inc. shall respect the privacy of a patient's personally identifiable health information/protected health information (hereinafter "PHI") and shall not use and disclose PHI except as described in the Notice of Privacy Practices of Hinkle's Pharmacy Inc. or otherwise permitted by HIPAA. If an employee has any question concerning the use and disclosure of PHI, the employee shall consult with the Pharmacy Privacy Officer. Any violation by an employee of a patient's privacy shall be grounds for disciplinary action, including termination of employment.

Notice of Privacy Practices

Effective April 14, 2003, all patients shall be given the written Notice of Privacy Practices of Hinkle's Pharmacy Inc.. An actual, physical handing of the written Notice of the Privacy Practices shall be attempted, rather than asking the patient if he or she wants a written Notice of Privacy Practices. This policy shall continue for the six-month period concluding October 14, 2003, at which time the patient may be asked if he or she has received a written Notice of Privacy Practices. This policy is adopted on the good faith belief that the majority of patients will have received the written Notice of Privacy Practices during the six-month period referred to immediately above.

If a patient states that a Notice of Privacy Practices was received on a previous visit to the pharmacy, the employee shall ask the patient if, at the time of receipt of the written Notice of Privacy Practices, the patient signed the appropriate document available at Hinkle's Pharmacy Inc. acknowledging that the patient received the Notice of Privacy Practices.

The written Notice of Privacy Practices of Hinkle's Pharmacy Inc. shall be posted in a conspicuous place, where it can be easily viewed by patients and others.

The written Notice of Privacy Practices shall be placed upon the website of Hinkle's Pharmacy Inc..

The written Notice of Privacy Practices shall remain current and shall be revised as necessary, with any revised written Notice of Privacy Practices being posted in a conspicuous place, where it can be easily viewed by patients and others, and made available in printed form for any person requesting a printed version of the written Notice of Privacy Practices.
Any person who is not a patient, but who requests the written Notice of Privacy Practices of Hinkle's Pharmacy Inc., is entitled to receive the written Notice of Privacy Practices even though not a patient.

Patient Acknowledgement of Receipt of Notice of Privacy Practices

At any time a patient is given the written Notice of Privacy Practices, the patient shall be requested to sign the appropriate document available at Hinkle's Pharmacy Inc. acknowledging that the patient received the Notice of Privacy Practices.

If at any time a patient refuses to sign the document acknowledging receipt of the written Notice of Privacy Practices, the employee shall notify the patient that Hinkle's Pharmacy Inc. is required to obtain the patient's signature. If the patient continues to refuse to sign the document, then the employee shall notify the Pharmacy Privacy Officer or pharmacist on duty of the refusal, so that the good faith effort to obtain the signature can be appropriately documented.

If a patient requests that a Notice of Privacy Practices be provided in a manner other than in writing, such as by electronic mail, the request shall be referred to the Pharmacy Privacy Officer.

For patients not able to physically visit Hinkle's Pharmacy Inc., then a reasonable effort shall be made to deliver the written Notice of Privacy Practices to the patient and obtain the patient's signature acknowledging receipt of the written Notice of Privacy Practices. In such situations, delivery can be accomplished by U.S. mail, special courier, electronic mail, delivery to the patient's home, or delivery to the patient's caregiver who does physically visit the pharmacy. If acknowledgement of receipt of the written Notice of Privacy Practices cannot be obtained, the Pharmacy Privacy Officer shall document the good faith effort to deliver the written Notice of Privacy Practices and obtain the patient's signature acknowledging receipt of the written Notice of Privacy Practices.

Accommodating Patient Rights

Patients possess a variety of rights related to their PHI at Hinkle's Pharmacy Inc.. The rights, in addition to the right to receive a written Notice of Privacy Practices, include the following:

1. A request for access to pharmacy records;
2. A request to amend pharmacy records;
3. A request for an accounting;
4. A request for confidential communication; and
5. A request to file a complaint.

Any employee receiving a request from a patient related to any of the above-listed patient rights shall immediately refer the request to the Pharmacy Privacy Officer, and if the Pharmacy Privacy Officer is not available, the request shall be referred to the pharmacist on duty.

Any patient requesting the exercising of any of the above-listed rights shall be requested to complete the form that relates to the patient right. However, if a patient refuses to complete the form, and instead wants to exercise the right based only upon an oral request, the Pharmacy Privacy Officer or pharmacist on duty shall make a good faith effort to accommodate the patient request.

Every effort shall be made to accommodate a request of a patient to exercise a right granted to the patient by HIPAA. All requests to exercise a patient right shall be promptly reviewed and acted upon by the Pharmacy Privacy Officer. Where a patient is entitled to a written response to a request to exercise a patient right, the written response shall be provided promptly to the patient. Documentation of resolution and response of a request to exercise a patient right shall be placed upon the appropriate Hinkle's Pharmacy Inc. form as necessary or required by the form.

The Pharmacy Privacy Officer shall consult with the pharmacist on duty as necessary with regard to any request related to a patient right.

Uses and Disclosures of PHI

Use and disclosure of PHI shall occur only in accordance with the written Notice of Privacy Practices of Hinkle's Pharmacy Inc.

With respect to any use and disclosure of PHI, only the minimum necessary PHI shall be used and disclosed, unless otherwise permitted by the Pharmacy Privacy Officer or pharmacist on duty who is familiar with the rules concerning the minimum necessary standard.

Only the Pharmacy Privacy Officer and pharmacist on duty shall be allowed to request a written authorization for a use and disclosure of PHI that is not described in the Notice of Privacy Practices, or otherwise requires a written authorization pursuant to HIPAA.

Use and disclosure of PHI shall occur only with respect to the employees of Hinkle's Pharmacy Inc. who have an essential need for the PHI in order to carry out their job tasks and responsibilities. Such employees shall not use or disclose PHI to other employees.

Any use and disclosure of PHI for purposes of marketing must be approved in advance by the Pharmacy Privacy Officer.

Record Keeping Requirements

The initial written Notice of Privacy Practices and any revised written Notices of Privacy Practices that may be prepared shall be maintained at Hinkle's Pharmacy Inc. for at least six years from the effective date stated on the written Notice of Privacy Practices.

The document used to record patients' signatures acknowledging receipt of the written Notice of Privacy Practices shall be maintained at Hinkle's Pharmacy Inc. for at least six years from the date of the last patient signature contained on the document.

Any use and disclosure of PHI that is subject to the HIPAA accounting requirement shall be maintained in an appropriate database, electronic or written, with performance of routine backing up, and shall be maintained for at least six years from the date of the use and disclosure.

All contracts with business associates shall include the HIPAA required "satisfactory assurances" and shall be maintained in a readily retrievable manner.

Staff Training

Although not all employees will have access to PHI, it is the policy of Hinkle's Pharmacy Inc. that all employees will undergo staff training.

Staff training shall be accomplished by all current employees prior to the HIPAA implementation deadline of April 14, 2003.

Staff training shall be accomplished within a reasonable time by all employees hired after the HIPAA implementation deadline of April 14, 2003.

Staff training programs and materials shall be modified as needed to remain current, and all employees shall be retrained as necessary.

Cooperation with Investigations and Compliance Reviews

It is the policy of Hinkle's Pharmacy Inc. to fully cooperate with any investigation or compliance review concerning the compliance of Hinkle's Pharmacy Inc. with the HIPAA privacy standards.

Tom Davis - Privacy Officer
Hinkle's Pharmacy Inc