Notice of Privacy Practices - Express Scripts, Inc.

Notice of Privacy Practices
Effective Date: September 13, 2010

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Background
When this Notice refers to the Express Scripts ACE, it is referring to Express Scripts, Inc., ("Express Scripts") and each of the following Express Scripts subsidiaries: CuraScript, Inc.; Lynnfield Drug, Inc.; Lynnfield Compounding Center, Inc.; Next Rx, Inc.; Express Scripts Insurance Company; ESI Mail Pharmacy Service, Inc.; Mooresville On-Site Pharmacy LLC.; and Express Scripts Specialty Distribution Services, Inc.

Each of the Express Scripts subsidiaries listed above is a covered entity under the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder (collectively, "HIPAA"). Each of the above listed subsidiaries is wholly-owned by Express Scripts, and therefore is under the common control and ownership of Express Scripts, Inc.

Pursuant to 45 C.F.R. § 164.105(b), each of the above listed Express Scripts subsidiaries hereby designates itself as a single affiliated covered entity for purposes of compliance with HIPAA. The single affiliated covered entity shall be known as the Express Scripts Affiliated Covered Entity or the "Express Scripts ACE." This designation may be amended from time-to-time to add new covered entities that are under the common control and ownership of Express Scripts.

This Notice of Privacy Practices ("Notice") describes:

How we (i.e., each of the subsidiaries that comprise the Express Scripts ACE) may use and disclose your protected health information ("PHI")
Your rights to access and amend your PHI

We are required by law to:

Maintain the privacy of your PHI
Provide you with notice of our legal duties and privacy practices with respect to PHI
Abide by the terms of the Notice currently in effect for the Express Scripts ACE

PERMITTED USES AND DISCLOSURES OF YOUR PHI
We may use and disclose your PHI for the following purposes.

Treatment: We may use and disclose your PHI to healthcare professionals or other third parties to provide, coordinate and manage the delivery of health care. For example, your pharmacist may disclose PHI about you to your doctor in order to coordinate the prescribing and delivery of your drugs. We also may provide you with treatment reminders and information about potential side effects, drug interactions and other treatment related issues involving your medicine.
Payment: We may use and disclose PHI about you to manage your account, fulfill our responsibilities under your benefit plan, and process your claims for drugs you have received. For example, we may give PHI to your health plan (or its designee) so we can confirm your eligibility for pharmacy benefits, or we may submit claims to your health plan, employer or other third party for payment.
- See "Right to Request Restrictions" for additional information that may affect disclosures to a health plan for payment purposes.
Healthcare Operations: We may use and disclose your PHI to carry on our own business planning and administrative operations. We need to do this so we can provide you with high-quality services. For example, we may use and disclose PHI about you to assess the use or effectiveness of certain drugs, develop and monitor medical protocols, and to provide information regarding helpful health-management services.
- See "Right to Request Restrictions" for additional information that may affect disclosures to a health plan for payment purposes.
Information that May Be of Interest to You: We may use or disclose your PHI to contact you about treatment options or alternatives that may be of interest to you. For example, we may call you to remind you of expired prescriptions, the availability of alternative drugs, or to inform you of other products that may benefit your health.
Individuals Involved in Your Care or Payment for Your Care: We may disclose PHI about you to someone who assists in or pays for your care. Unless you write to us and specifically tell us not to, we may disclose your PHI to someone who has your permission to act on your behalf. We will require this person to provide adequate proof that he or she has your permission.
Business Associates: We arrange to provide some services through contracts with business associates. On occasion, we may disclose your PHI to business associates acting on our behalf. If any PHI is disclosed, we will protect your information from further use and disclosure using confidentiality agreements.
Research: Under certain circumstances, we may use and disclose PHI about you for research purposes. Before we use or disclose PHI about you, we will either remove information that personally identifies you or gain approval through a special approval process designed to protect the privacy of your PHI. In some circumstances, we may use your PHI to generate aggregate data (summarized data that does not identify you) to study outcomes, costs and provider profiles, and to suggest benefit designs for your employer or health plan. These studies generate aggregate data that we may sell or disclose to other companies or organizations. Aggregate data does not personally identify you.
Abuse, Neglect or Domestic Violence: We may disclose your PHI to a social service, protective agency or other government authority if we believe you are a victim of abuse, neglect or domestic violence. We will inform you of our disclosure unless informing you will place you at risk of serious harm.
Public Health: We may disclose your PHI for public health purposes, such as reporting adverse events, post marketing surveillance in connection with FDA-regulated entities' legal obligations (e.g., pharmaceutical manufacturer reporting or connections with an FDA-mandated product REMS) and product recalls. We may also disclose your PHI to a person or company that is regulated by the U.S. Food and Drug Administration for the purpose of: 1. reporting or tracking product defects or problems; 2. repairing, replacing, or recalling defective or dangerous products; or 3. monitoring the performance of a product after it has been approved for use by the general public.
Health Oversight: We may disclose PHI to a health oversight agency performing activities authorized by law, such as investigations and audits. These agencies include governmental agencies that oversee the healthcare system, government benefit programs, and organizations subject to government regulation and civil rights laws.
To Avert Serious Threat to Health or Safety: We may disclose your PHI to prevent or lessen an imminent threat to the health or safety of another person or the public. Such disclosure will only be made to someone in a position to prevent or lessen the threat.
Judicial Proceedings: We may disclose your PHI in the course of any judicial proceeding in response to a court order, subpoena or other lawful process, but only after we have been assured that efforts have been made to notify you of the request.
Law Enforcement: We may disclose your PHI, as required by law, in response to a subpoena, warrant, summons, or in some circumstances, to report crime.
Coroners and Medical Examiners: We may disclose your PHI to a coroner or a medical examiner for the purpose of determining cause of death or other duties authorized by law.
Organ, Eye and Tissue Donation: We may disclose your PHI to organizations involved in organ transplantation to facilitate donation and transplantation.
Workers' Compensation: We may disclose your PHI in order to comply with workers' compensation laws and other similar programs.
Specialized Government Functions, Military and Veterans: We may disclose your PHI to authorized federal officials to perform intelligence, counter-intelligence, medical suitability determinations, Presidential protection activities, and other national security activities authorized by law. If you are a member of the U.S. armed forces or of a foreign military, we may disclose your PHI as required by military command authorities or law. If you are an inmate in a correctional institution or under the custody of a law enforcement official, we may disclose your PHI to those parties if disclosure is necessary for: 1. the provision of your healthcare; 2. maintaining the health or safety of yourself or other inmates; or 3. ensuring the safety and security of the correctional institution or its agents.
As Otherwise Required By Law: We will disclose PHI about you when required to do so by law. If federal, state or local law within your jurisdiction offers you additional protections against improper use or disclosure of PHI, we will follow such laws to the extent they apply.
Other Uses and Disclosures: Other uses and disclosures of your PHI not listed in this Notice will be made only with your written authorization unless we are permitted by applicable law to make such other use and disclosing in which case we shall comply with applicable law. You may revoke this authorization at any time unless we have taken action in reliance upon it. Other uses and disclosures of your PHI not listed in this Notice will be made only with your written authorization unless we are permitted by applicable law to make such other use and disclosing in which case we shall comply with applicable law. You may revoke this authorization at any time unless we have taken action in reliance upon it.

YOUR RIGHTS WITH RESPECT TO YOUR PHI
You have the following rights regarding PHI we maintain about you:

Right to Inspect and Copy: Subject to some restrictions, you may inspect and copy PHI that may be used to make decisions about you. To do so, submit a written request to Express Scripts at the address listed below.
- As of February 17, 2010, if we maintain an electronic health record containing your PHI, you have the right to request that we send a copy of your PHI in an electronic format to you or to a third party that you identify.
Right to Amend: If you believe PHI about you is incorrect or incomplete, you may ask us to amend the information. Such request must be made in writing and submitted to Express Scripts at the address listed below. In addition, you must provide a reason supporting your request to amend.
Right to an Accounting of Disclosures: You have the right to request an accounting of disclosures of your PHI. This accounting identifies the disclosures we have made of your PHI other than for treatment, payment or healthcare operations. You must submit your request in writing to Express Scripts at the address listed below. The provision of an accounting of disclosures is subject to certain restrictions.
Right to Request Restrictions: You have the right to request a restriction or limitation on the PHI we use and disclose about you for treatment, payment or healthcare operations. You may also request your PHI not be disclosed to family members or friends who may be involved in your care or paying for your care. Your request must: 1. be in writing; 2. state the restrictions you are requesting; and 3. state to whom the restriction applies. We are not required to agree to your request. If we do agree, we will comply with your request unless the restricted information is needed to provide you with emergency treatment.
- As of February 17, 2010, we will agree to your request to restrict PHI disclosed to a health plan for payment or healthcare operations (i.e., non-treatment) purposes if the information is about a medication for which you paid us, out-of-pocket, in full.
Confidential Communications: You may ask that we communicate with you in a particular way and in a particular place to protect the confidentiality of your PHI. Your request must be submitted in writing to Express Scripts at the address listed below, and you must state an alternate method or location you would like us to use to communicate your PHI to you.
Right to a Paper Copy of This Notice: You have the right to request a paper copy of this Notice at anytime. For pre-recorded information about how to obtain a copy of this Notice and answers to frequently asked questions, please call toll free 877.279.6391. Even if we have agreed to provide this Notice electronically, you are still entitled to a paper copy. You may obtain a copy of this Notice from our website at www.express-scripts.com/privacy/.
Right to File a Complaint: If you believe we have violated your privacy rights, you may file a written complaint to Express Scripts at the address listed below. You may also file a complaint with the Secretary of the Department of Health and Human Services. You will not be retaliated against for filing a complaint.

Written complaints and written requests for a copy of your PHI, amendment to your PHI, an accounting of disclosures, restrictions on your PHI or for confidential communications may be mailed to:

Express Scripts
Attn: Privacy Officer
PO Box 66561
St. Louis, MO 63166-6561

E-mail: privacy@express-scripts.com

Please include your name, address and patient ID number.

We reserve the right to revise this Notice. A revised Notice will be effective for PHI we already have about you, as well as any PHI we may receive in the future. We will communicate revisions to this Notice through our website, www.express-scripts.com/privacy/.

ACKNOWLEDGEMENT OF NOTICE OF PRIVACY PRACTICES
Express Scripts would like to secure your acknowledgement of receipt of this Notice of Privacy Practices ("Notice"). Your acknowledgement or lack of acknowledgement of this Notice will not affect your prescription benefits. You will continue to receive the same service as usual.

Please note that this acknowledgement applies only to you. Other members of your family who are on your prescription-benefit plan should make a separate acknowledgement that they have read the Notice of Privacy Practices.