This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
At Summit Pharmacy, your health is our priority, and that includes the health of your data. We are required by federal law (HIPAA) to maintain the privacy of your Protected Health Information (PHI), to provide you with this notice of our legal duties and privacy practices, and to notify you promptly if a breach occurs that may have compromised the security of your unsecured PHI. We are required to follow the privacy practices described in this notice while it is in effect.
We reserve the right to change the terms of this notice at any time. Any changes we make will apply to all PHI we maintain, including information we already have. When we make a material change to this notice, we will post the updated version on our website and make it available upon request in our pharmacy.
1. How We Use & Disclose Your PHI
We typically use or share your health information in the following ways:
- Treatment: We can use your health information and share it with other professionals who are treating you. (Example: Asking your doctor about your medication dosage.)
- Payment: We can use and share your health information to bill and get payment from health plans or other entities. (Example: Submitting a claim to your insurance provider.)
- Health Care Operations: We can use and share your health information to run our practice, improve your care, and contact you when necessary.
- Business Associates: We may disclose PHI to third-party vendors (like software providers) who help us operate. These partners are required by law to protect your information just as we do.
2. Other Permitted Uses
We are allowed or required to share your information in other specific situations that contribute to the public good, usually without your direct consent:
- Public Health: Reporting adverse reactions to medications, product recalls, or preventing disease spread.
- Safety: Reporting suspected abuse, neglect, or domestic violence to appropriate authorities.
- Legal Compliance: In response to a court order, administrative order, subpoena, or discovery request.
- Law Enforcement: If required by law for specific law enforcement purposes.
- Oversight: To health oversight agencies for activities authorized by law (e.g., audits/inspections).
When we use or disclose your PHI, we make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose, as required by law.
3. When We Need Your Permission
For certain uses, we will only share your PHI if you give us specific written permission (authorization). You may revoke this permission at any time, in writing, except to the extent that we have already acted in reliance on it. These situations include:
- Marketing: We will not use your PHI for marketing purposes without your authorization.
- Sale of PHI: We will never sell your health information without your express written authorization.
4. Your Rights Under HIPAA
You have certain rights regarding your PHI. These rights help you understand and control how your information is used and shared.
Right to Access and Copy Records
You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. We will provide a copy or summary, usually within 30 days of your request, and may charge a reasonable, cost-based fee.
Right to Amend Records
If you feel that the health information we have is incorrect or incomplete, you may ask us to amend it. We may deny your request in certain circumstances, but we will explain our reasons in writing.
Right to Notice of Privacy Practices
You have the right to receive a clear Notice of Privacy Practices that explains how we use and disclose your health information, your rights, and our responsibilities. This notice is that document, and you may request a paper copy at any time.
Right to Request Restrictions
You may ask us to limit how we use or share your PHI for treatment, payment, or health care operations. While we are not required to agree to all requests, we will consider them carefully. If we agree, we will comply with your request except in emergencies or where the law requires otherwise.
Right to Restrict Disclosures to Health Plans
If you pay in full out-of-pocket for a service or medication, you may request that we not share information about that service with your health plan, unless we are required by law to do so.
Right to Request Confidential Communications
You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. We will accommodate reasonable requests.
Right to an Accounting of Disclosures
You can ask for a list (accounting) of certain disclosures we have made of your health information for six years prior to the date you ask, who we shared it with, and why. This list will not include disclosures for treatment, payment, or health care operations.
Right to Revoke Authorizations
If you have given us written authorization to use or disclose your PHI for a specific purpose, you may revoke that authorization at any time, in writing. Your revocation will not affect actions we have already taken based on your prior authorization.
Right to a Paper Copy of This Notice
You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically. We will provide you with a paper copy promptly.
Right to File a Complaint
If you believe your privacy rights have been violated, you have the right to file a complaint with us and with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be penalized or retaliated against for filing a complaint.
5. State & Specialized Protections
We comply with all applicable Colorado state laws that may provide stricter privacy protections than federal law, including laws regarding reproductive health, mental health, and HIV/AIDS information. Where state law is more protective of your privacy, we will follow state law.
6. Complaints & Contact
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. You will not be penalized or retaliated against for filing a complaint.
To file a complaint with Summit Pharmacy or to ask questions about this notice, please contact our Privacy Officer using the information below.
You may also file a complaint directly with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), by visiting
hhs.gov/ocr/privacy/hipaa/complaints/
or by calling 1-800-368-1019 (TTY: 1-800-537-7697).
This Notice of Privacy Practices is effective November 1st, 2025, and replaces all prior versions of our notice.
