Important Notice
Baton Rouge Pharmacy respects the privacy of health information. This general statement explains how HIPAA may apply to information handled through BatonRougePharmacy.com. It is not intended to replace the formal Notice of Privacy Practices required from a HIPAA-covered pharmacy or healthcare provider.
The final website should prominently post the applicable Notice of Privacy Practices for each covered entity involved in the service, or an approved joint notice if the participating entities qualify to use one.
When HIPAA Applies
The Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”) apply to covered healthcare providers, health plans, healthcare clearinghouses, and their business associates.
A pharmacy generally qualifies as a HIPAA-covered healthcare provider when it transmits health information electronically in connection with a transaction for which federal standards apply. Prescribing providers participating in the service may also be separately covered entities.
HIPAA applies to protected health information created, received, maintained, or transmitted by a covered entity or business associate. Not every piece of information collected on a public website is automatically PHI, and not every company involved in a consumer health website is automatically covered by HIPAA.
Information That May Be Protected
Depending on context, protected information may include:
- Questionnaire responses and medical history;
- Symptoms, diagnoses, treatment goals, and contraindications;
- Current medications and allergies;
- Provider review notes and prescription decisions;
- Prescription, dosage, refill, and dispensing information;
- Patient identity and contact information linked to healthcare;
- Billing or payment information linked to treatment; and
- Communications concerning a patient’s care.
Permitted Uses and Disclosures
A covered entity may use or disclose PHI without a separate written authorization for purposes permitted by HIPAA, which commonly include:
Treatment
Coordinating provider review, prescribing, pharmacist review, dispensing, counseling, refill management, and communication among healthcare professionals involved in care.
Payment
Processing charges, verifying benefits where applicable, handling payment disputes, and conducting related billing activities.
Healthcare Operations
Quality assessment, patient safety, compliance, auditing, training, credentialing, business management, and other permitted operational activities.
PHI may also be used or disclosed when required or permitted by law, including certain public-health, health-oversight, law-enforcement, judicial, safety, workers’ compensation, organ-donation, research, and emergency circumstances. The formal Notice of Privacy Practices must describe these categories accurately.
Uses Requiring Authorization
Uses or disclosures not otherwise permitted by HIPAA may require a written authorization. A patient may revoke an authorization prospectively in writing, subject to actions already taken in reliance on it.
HIPAA places special restrictions on certain marketing, sale-of-PHI, psychotherapy-note, reproductive-health, and substance-use-disorder-record activities. Counsel and the Privacy Officer should ensure that the formal Notice of Privacy Practices reflects requirements in effect on its publication date.
Patient Rights
Subject to legal limits and verification, HIPAA may provide a patient with rights to:
- Inspect or obtain a copy of designated medical and billing records;
- Request correction or amendment of records;
- Request certain restrictions on uses or disclosures;
- Request confidential communications by a reasonable alternative method or location;
- Receive an accounting of certain disclosures;
- Receive a paper copy of the Notice of Privacy Practices;
- Choose someone to act as a personal representative when legally authorized; and
- File a privacy complaint without retaliation.
Requests should be directed to the Privacy Officer identified in the formal Notice of Privacy Practices.
Safeguards
Covered entities and business associates must implement reasonable and appropriate administrative, physical, and technical safeguards for PHI and electronic PHI. Safeguards should include, as appropriate:
- Role-based access and minimum-necessary controls;
- Unique user authentication;
- Encryption in transit and, where appropriate, at rest;
- Secure intake and patient-communication systems;
- Audit logs and access monitoring;
- Workforce privacy and security training;
- Vendor risk review and business associate agreements;
- Secure disposal and record retention;
- Incident response and breach assessment; and
- Backup, continuity, and recovery procedures.
No system can eliminate all risk, but HIPAA-regulated entities must maintain safeguards appropriate to their operations and risk environment.
Website Tracking and Analytics
Healthcare websites require special care when using analytics, advertising pixels, session replay, chat widgets, or similar tracking technologies. These tools must not impermissibly disclose PHI to third parties.
Before launch, Baton Rouge Pharmacy should inventory all scripts and plugins operating on:
- The health questionnaire;
- Account or login pages;
- Cart and checkout pages;
- Prescription or treatment-selection pages;
- Order-status pages;
- URLs, page titles, or form fields that reveal treatment interests; and
- Any authenticated patient page.
Where a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity, a compliant business associate agreement may be required. A cookie banner or ordinary website consent is not, by itself, a substitute for HIPAA authorization or a business associate agreement.
Email and Contact Forms
Patients should not send sensitive medical information through ordinary email or a general customer-service form. General forms should direct users to a secure questionnaire or patient communication channel.
An email system used to transmit PHI should be assessed for security, access control, retention, and business associate requirements. The site currently displays more than one email address; the pharmacy should designate a single authoritative support address and a separate Privacy Officer contact if appropriate.
Business Associates
Before receiving PHI, vendors should be evaluated to determine whether they are business associates. Potential examples include:
- Website or application hosts with access to PHI;
- Questionnaire and telehealth platforms;
- Patient portals;
- Cloud storage and backup providers;
- Email or messaging providers handling PHI;
- Customer-support systems;
- Analytics or monitoring vendors receiving PHI;
- Managed IT and security providers; and
- Billing or administrative vendors.
A business associate agreement does not make an otherwise impermissible disclosure permissible; the underlying use or disclosure must also comply with HIPAA.
Breach Notification
A covered entity must assess suspected unauthorized access, use, acquisition, or disclosure of PHI. When an incident constitutes a reportable breach of unsecured PHI, notification may be required to affected individuals, the U.S. Department of Health and Human Services, and, in some circumstances, the media. Business associates must report qualifying incidents to the covered entity as required by contract and law.
Complaints
A patient may submit a privacy complaint to the covered entity’s Privacy Officer and may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Retaliation for filing a good-faith complaint or exercising a HIPAA right is prohibited.
Privacy Officer contact:
HIPAA Privacy Officer
Tennis Friends LLC d/b/a Baton Rouge Pharmacy.com
12090 S Harrells Ferry Rd, Baton Rouge, LA 70816
midcity@rxtogeaux.com
Required Formal Notice Before Publication
Before this HIPAA page goes live, the pharmacy and prescribing organization should determine:
- Which entity or entities are HIPAA covered entities;
- Whether separate or joint Notices of Privacy Practices will be used;
- The legal names and addresses of all entities covered by each notice;
- The designated Privacy Officer and complaint contact;
- Actual permitted uses, disclosures, affiliations, and data flows;
- Whether substance-use-disorder or other specially protected records are handled;
- Whether the notice requires current reproductive-health or Part 2 language;
- How patients acknowledge receipt of the notice;
- Where the notice is displayed during intake and on the website; and
- How patients may obtain a paper copy.