THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: April 14, 2003

 

Costco Health Centers
NOTICE OF PRIVACY PRACTICES
 

General Information About This Notice

Costco continues its commitment to maintaining the confidentiality of your private health information. This Notice describes our efforts to safeguard your health information from improper or unnecessary use or disclosure while providing you with the high quality/low cost goods and services Costco members have come to expect. This Notice only applies to health-related information received by or on behalf of Costco Pharmacies, Costco Optical Centers, and Costco Hearing Aid Centers (collectively, the "Costco Health Centers"). A new federal law requires us to provide you with a summary of the Costco Health Centers' privacy practices and related legal duties, and your rights in connection with the use and disclosure of your Costco Health Center information.
 

Please note: 

• This Notice only applies to Costco Members and other patrons who are customers of the Costco Pharmacies, Costco Optical Centers, and Costco Hearing Aid Centers.
   
• This Notice does not apply to products or services provided by independent contractors who may provide health-related services and products at Costco Warehouses. Independent optometrists/ophthalmologists and certain providers of medical services, such as osteoporosis testing and flu shots, are not employees of Costco. If you are a customer of, or receive services from, any of these independent health care providers, you should request from them a copy of their privacy notice.

What is Protected?

The Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), a new federal law, requires that Costco Health Centers have a special policy for safeguarding a category of health information related to you called "protected health information," or "PHI," received or created in the course of providing services to you through the Costco Health Centers. PHI is health information that relates to: 

• your physical or mental health condition,
• the provision of health care to you, or
• payment for your health care 

that can be used to identify you. Your prescriptions, vision test results, and audiogram results, as well as the information you provide on any Costco Health Center patient health history form are all examples of PHI.

The remainder of this Notice generally describes our rules with respect to PHI received or created by the Costco Health Centers.


Uses and Disclosures of PHI

To protect the privacy of PHI, the Costco Health Centers not only guard the physical security of PHI, but we also limit the way PHI is used or disclosed to others. We may use or disclose PHI in certain permissible ways described below. 

• To provide you with health care services and products. Costco Health Centers use and disclose PHI in order to provide you with health care services and products. For example, in our hearing aid department we use your audiogram results in order to provide you with the appropriate hearing aid. Our pharmacists ask you questions regarding drug allergies or review your prescription history in order to ensure that we do not provide you prescription drugs to which you may be allergic or which may interact with other prescriptions. Costco opticians use your prescription from your ophthalmologist or optometrist to provide you with the appropriate corrective eye glasses or contact lenses.
   
• To another health care provider if needed for your treatment. For example, we may discuss your prescription information with your primary care physician if a Costco pharmacist has a drug interaction concern or questions regarding your prescription.
   
• To bill you for health care services or products. Costco Health Centers use and disclose your PHI to bill you and to accept payment for prescription drugs, glasses, contact lenses, or hearing aids which you may purchase. For example, an associate in the Costco Pharmacy may ring up your prescription drug purchases.
   
• To seek reimbursement or calculate rebates for health care products or services you receive at Costco Health Centers. For example, Costco Health Centers use and disclose PHI to receive payments from your health plan for covered prescription drugs purchased from a Costco Pharmacy. If you are a Costco Executive Member, your purchase information from any Costco Health Center will be combined with other personal information to calculate your Executive Member 2% Reward, subject to the terms and conditions of that program. We may also submit PHI to a third party who will help you secure rebates from manufacturers on your Costco Health Center purchases.
   
• For the administration and operation of the Costco Health Centers. We use and disclose PHI for numerous administrative and quality control functions necessary for the Costco Health Centers' proper operation. For example, we may use your pharmacy prescription drug purchase information for fraud and abuse detection activities or to conduct data analyses for planning-related purposes.
   
• To inform you about treatment alternatives or other health-related benefits that may be offered by Costco Health Centers. For example, we may use your prescription data to alert you to a generic drug available as a substitute for the prescription drug you are currently using.
   
• To another health care provider or health plan for administration and operations purposes. We may share PHI with another health care provider or a health plan who has a relationship with you for quality assessment and improvement activities, to review the qualifications of health care professionals who provide care to you, or for fraud and abuse detection and prevention purposes.
   
• To a family member, friend, or other person involved in your health care if you are present and you do not object to the sharing of PHI or in the event of an emergency. Our Health Centers may also allow a family member, friend or other person to pick up your purchases if, in the exercise of professional judgment and experience, we determine it is in your best interests.
   
• To comply with an applicable federal, state, or local law, including, for example, workers' compensation programs established by law.
   
• For public health reasons, including to a public health authority for the prevention or control of disease, injury or disability; to a proper government or health authority to report child abuse or neglect; to report reactions to medications or problems with products regulated by the Food and Drug Administration; to notify individuals of recalls of medication or products they may be using; or to notify a person who may have been exposed to a communicable disease or who may be at risk for contracting or spreading a disease or condition.
   
• To report a suspected case of abuse, neglect or domestic violence, as permitted or required by applicable law.
   
• To comply with health oversight activities, such as audits, investigations, inspections, licensure actions, and other government monitoring and activities related to health care provision or public benefits or services. For example, Costco Pharmacies are subject to reporting requirements regarding narcotics under state and federal law, and are subject to periodic and random inspections by state pharmacy boards. Inspectors or other government officials may view or receive PHI as a result of a government inspection or other request.
   
• To the U.S. Department of Health and Human Services to demonstrate our compliance with HIPAA.
   
• To respond to an order of a court or administrative tribunal, such as a court ordered warrant, subpoena or summons, grand jury subpoena, or administrative subpoena or other request.
   
• To respond to a subpoena, warrant, summons or other legal request if sufficient safeguards, such as a protective order in the case of a private lawsuit, are in place to maintain PHI privacy.
   
• To a law enforcement official for a law enforcement purpose as required by law.
   
• For purposes of public safety or national security.
   
• To allow a coroner or medical examiner to identify you or determine your cause of death.
   
• To allow a funeral director to carry out his or her duties.
   
• To respond to a request by military command authorities if you are or were a member of the armed forces.

To the extent required under law, we use the minimum amount of PHI necessary to perform these tasks.

If an applicable state law provides greater health information privacy protections than the federal law, we will comply with the stricter state law. If you are resident of California, Connecticut, Florida, Idaho, Michigan, Minnesota, Montana, Nevada, New Hampshire, New York, Ohio or Utah, please review the Supplemental State Notices at the end of this Notice.


Other Uses and Disclosures of PHI

Before we use or disclose PHI for any other purpose than as described above, we must obtain your written authorization. You may revoke your authorization, in writing, at any time. If you revoke your authorization, the Costco Health Centers will no longer use or disclose PHI except as described above (or as permitted by any other authorizations that have not been revoked). However, please understand that we cannot retrieve any PHI disclosed to a third party in reliance on your prior authorization.


Your Rights

Federal law provides you with certain rights regarding PHI that pertains to you. Parents of minor children and other individuals with legal authority to make health decisions for customers of Costco Health Centers may exercise these rights on behalf of such customers, consistent with state law.

• Right to request restrictions: You have the right to request a restriction or limitation on the Costco Health Centers' use or disclosure of PHI. The law does not require the Costco Health Centers to agree to your request for restriction and depending upon your request, we may not be able to grant it because it may affect our ability to provide health care services or products to you. However, if we do agree to your requested restriction or limitation, we will honor the restriction until you agree to terminate the restriction or until we notify you that we are terminating the restriction on a going-forward basis.
  
  You may submit a written request for restriction on the use and disclosure of PHI to our Privacy Officer. Your request must specify: (i) the PHI you want to limit; (ii) how you want the Costco Health Centers to
  limit the use, disclosure, or both of that PHI; and (iii) to whom you want the restrictions to apply.
  
  
• Right to receive confidential communications: You have the right to request that the Costco Health Centers communicate with you about PHI at a new address or by different means if you believe that communication through normal business practices could endanger you. You may submit a written request for confidential communications to your local Costco Health Center.
  
  
• Right to obtain a copy of PHI: You have the right to review and obtain a copy of PHI that is contained in medical or billing records that the Costco Health Centers maintain or other records that the Costco Health Centers use to make decisions about you.
  
  However, we will not give you access to PHI records created in anticipation of a civil, criminal or administrative action or proceeding. We will also deny your request to inspect and copy PHI if a licensed health care professional hired by the Costco Health Centers has determined that giving you the requested access is reasonably likely to endanger the life or physical safety of you or another individual or to cause substantial harm to you or another individual, or that the record makes references to another person (other than a health care provider), and that the requested access would likely cause substantial harm to the other person.
  
  If your request to access PHI is denied, you may have that decision reviewed. A different licensed health care professional chosen by the Costco Health Centers will review the request and denial, and we will comply with the health care professional's decision.
  
  You may make a request to review or obtain a copy of PHI at your local Costco Health Center. We may charge you a fee to cover the costs of copying, mailing or other supplies directly associated with your request. You will be notified of any costs before you incur any expenses.
  
  
• Right to amend PHI: You have the right to request an amendment of PHI if you believe the information the Costco Health Centers have about you is incorrect or incomplete. You have this right as long as PHI is maintained by the Costco Health Centers. We will correct any mistakes if we created the PHI or if the person or entity that originally created the PHI is no longer available to make the amendment.
  
  Amendments involving the addition of information to Costco Health Center records may generally be made at your local Costco Health Center. However, for other types of changes, or if the local Costco Health Center is unable to accommodate your request, you must submit a written request to amend PHI by filling out a Request for Amendment form available from the Privacy Officer and submitting the form back to our Privacy Officer. You should include evidence to support your request because we cannot amend PHI that we believe to be accurate and complete.
  
  
• Right to receive an accounting of disclosures of PHI: You have the right to request a list of certain disclosures of PHI by the Costco Health Centers. The accounting will not include (i) disclosures necessary to provide treatment, to determine proper payment, or to operate the Costco Health Centers, (ii) disclosures we make to you, (iii) disclosures permitted by your authorization, (iv) disclosures to friends or family members as discussed in this Notice, or made in your presence or because of an emergency, or (v) disclosures for national security purposes. Your first request for an accounting within a 12-month period will be free. We may charge you for costs associated with providing you additional accountings. We will notify you of the costs involved, and you may choose to withdraw or modify your request before you incur any expenses.
  
  You may submit a written request for an accounting of disclosures of PHI by filling out a Request for Accounting of Disclosures form available from the Privacy Officer and submitting the form back to the Privacy Officer. Your request must include (i) the time period for the accounting, which may not be longer than six (6) years and may not include dates prior to April 14, 2003; and (ii) the form (e.g., electronic, paper) in which you would like the accounting.
  
  
• Right to file a complaint: If you believe your rights have been violated, you should let us know immediately. We will take steps to remedy any violations of the Costco Health Centers' privacy policy or of this Notice.

You may file a formal complaint with our Privacy Officer and/or with the United States Department of Health and Human Services at the addresses below. You should attach any documents or evidence that supports your belief that your privacy rights have been violated. We take your complaints very seriously. Costco policy and federal law prohibit retaliation against any person for filing such a complaint.

Complaints should be sent to:
 

Additional Information About This Notice

• Changes to this Notice: We reserve the right to change the Costco Health Centers' privacy practices as described in this Notice. Any change may affect the use and disclosure of PHI already maintained by the Costco Health Centers, as well as any of PHI that the Costco Health Centers may receive or create in the future. If there is a material change to the terms of this Notice, revised Notices will be made available at each Costco Health Center and by logging on to Costco's Web site at www.costco.com under the Costco Health Centers section.
  
  
• Acknowledgement: When first delivering this Notice to you, each of the Costco Health Centers will ask you to sign an acknowledgement that you were provided a copy of this Notice.
  
  
• How to obtain an additional copy of this Notice: You can obtain a copy of the current notice by writing our Privacy Officer at the address or e-mail address set out in this Notice or by logging on to Costco's Web site at www.costco.com under the Costco Health Centers section.
  

1.     The information may be disclosed to providers of health care, health care service plans, contractors or other health care professionals or facilities for purposes of diagnosis or treatment of the patient. This includes, in an emergency situation, the communication of patient information by radio transmission or other means between licensed emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and licensed emergency medical personnel at a health facility;
 

2.     The information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor or any other person or entity responsible for paying for health care services rendered to the patient to the extent necessary to allow responsibility for payment to be determined and payment to be made. If the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure or medical information and no other arrangements have been made to pay for the health care services being rendered to the patient, the information may also be disclosed to a governmental authority to the extent necessary to determine the patient's eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient. The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient;
 

3.     The information may be disclosed to any person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified above in paragraph (b). However, no information so disclosed may be further disclosed by the recipient in any way that would be violative of California laws governing the use and disclosure of medical information without authorization from the patient.
 

4.     The information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers, utilization and quality control peer review organizations, contractor's or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges;
 

5.     A provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee's employer that:
 

a.     Is relevant in a lawsuit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical conditions, or treatment, provided that information may only be used or disclosed in connection with that proceeding;
 

b.     Describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient's fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed;
 

6.     Unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits;
 

7.     The information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan. Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part;
 

8.     The information may be disclosed to an insurance institution, agent or support organization of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to the requirements of the California Insurance Code provisions;
 

9.     The information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent for the purpose of aiding the transplant;
 

10.   The information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data. However, no information may be further disclosed by the recipient in any way that would be unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information;

11.   For purposes of disease management programs and services, information may be disclosed to any entity contracting with a health care service plan or the health care service plan's contractors to monitor or administer care of enrollees for a covered benefit, provided that the disease management services and care are authorized by a treating physician or to any disease management organization that complies fully with the physician authorization requirements, provided that the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan's or contractor's network of physicians.
 

You authorize Costco to use and disclose personal health information as provided for in Costco's Health Centers Notice of Privacy Practices and as provided above.


Connecticut Residents - Supplemental State Notice:

This notice supplements Costco's Health Centers Notice of Privacy Practices. Connecticut's health care law does not explicitly provide for the disclosure of your personal health information to a family member, friend, or other person involved in your health care when you are present and do not object, or to others in an emergency situation; nor does it provide for disclosure to allow a funeral director to carry out his or her duties.

Accordingly, you authorize Costco to use and disclose personal health information as stated
above and in Costco's Health Centers Notice of Privacy Practices.


Florida Residents - Supplemental State Notice:

This notice supplements Costco's Health Centers Notice of Privacy Practices. Florida's health care law does not explicitly provide for the use and disclosure of your personal health information as otherwise permitted by federal law without your written authorization. You authorize Costco to use and disclose personal health information as described in Costco's Health Centers Notice of Privacy Practices as follows: to another health care provider if needed for your treatment or for administration and operations purposes; to a family member, friend, or other person involved in your health care if you are present and you do not object or in the event of an emergency; to comply with applicable federal, state or local laws; for public health reasons such as to control diseases; to report a suspected case of abuse, neglect or domestic violence; to comply with health oversight activities related to health care services; to the U.S. Department of Health and Human Services; to law enforcement officials for a law enforcement purpose; for purposes of public safety or national security; to allow a funeral director to carry out his or her duties; or to respond to a request by military command authorities.


Idaho Residents - Supplemental State Notice:

This notice supplements Costco's Health Centers Notice of Privacy Practices. Idaho's health care law does not explicitly provide for the use and disclosure of your personal health information as otherwise permitted by federal law and provided for in Costco's Health Centers Notice of Privacy Practices. Specifically, in addition to the permitted disclosures under Idaho law, Costco may use or disclose your personal health information to a family member, friend, or other person involved in your health care if you are present and you do not object or in the event of an emergency; to comply with applicable federal, state or local laws; for public health reasons such as to control diseases; to report a suspected case of abuse, neglect or domestic violence; to comply with health oversight activities related to health care services; to the U.S. Department of Health and Human Services; to law enforcement officials for a law enforcement purpose; to respond to legal process; for purposes of public safety or national security; to allow a funeral director to carry out his or her duties; to allow a coroner or medical examiner to identify you or determine cause of death; or to respond to a request by military command authorities.

You authorize Costco to use and disclose your personal health information as described
above and in Costco's Health Centers Notice of Privacy Practices.


Michigan Residents - Supplemental State Notice:

This notice supplements Costco's Health Centers Notice of Privacy Practices. Michigan's health care law does not explicitly provide for the use and disclosure of your personal health information as otherwise permitted by federal law without your written authorization. You authorize Costco to use and disclose personal health information as described in Costco's Health Centers Notice of Privacy Practices as follows: to a family member, friend, or other person if you are present and do not object to the disclosure or in the event of an emergency; to comply with applicable federal, state or local laws; for public health reasons such as to control diseases; to report a suspected case of abuse, neglect or domestic violence; to comply with health oversight activities; to the U.S. Department of Health and Human Services; to law enforcement officials for a law enforcement purpose; to respond to legal process; for purposes of public safety or national security; to allow a funeral director to carry out his or her duties; to allow a coroner or medical examiner to identify you or determine cause or death: or to respond to a request by military command authorities.

You authorize Costco to use and disclose personal health information as stated in Costco's Health Centers Notice of Privacy Practices and request Costco to access any common electronic files or databases as necessary for those purposes.


Minnesota Residents - Supplemental State Notice:

This notice supplements Costco's Health Centers Notice of Privacy Practices. Minnesota's health care law does not explicitly provide for the use and disclosure of your personal health information as otherwise permitted by federal law without your written authorization. You authorize Costco to use and disclose personal health information as described in Costco's Health Centers Notice of Privacy Practices as follows: to comply with applicable federal, state or local laws; for public health reasons such as to control diseases; to report a suspected case of abuse, neglect or domestic violence; to comply with health oversight activities related to health care services; to the U.S. Department of Health and Human Services; to law enforcement officials for a law enforcement purpose; to respond to legal process; for purposes of public safety or national security; to allow a coroner or medical examiner to identify you or the cause of death; to allow a funeral director to perform his or her duties; to respond to a request by military command authorities; and to third parties in matters involving allegations of unprofessional conduct by a health care provider.


Montana Residents - Supplemental State Notice:

This notice supplements Costco's Health Centers Notice of Privacy Practices. Montana's health care law does not provide for disclosure of information concerning persons infected, or reasonably suspected to be infected with a sexually transmitted disease other than to personnel of the Department of Public Health and Human Services, a physician who has obtained the written consent of the person whose record is requested, or a local health officer. Costco's Health Centers Notice of Privacy Practices permits broader disclosure including for public health purposes such as to notify a person who may have been exposed to a communicable disease or who may be at risk for contracting or spreading a disease or condition; to comply with an applicable federal, state or local law; to respond to legal process and to a law enforcement official for a law enforcement purpose.

You authorize Costco to use and disclose personal health information as stated above and in Costco's Health Centers Notice of Privacy Practices.


Nevada Residents - Supplemental State Notice:

This notice supplements Costco's Health Centers Notice of Privacy Practices. Nevada's health care law does not explicitly provide for the use and disclosure of your personal health information as otherwise permitted by federal law. Costco's Health Centers Notice of Privacy Practices permits broader disclosure including to a family member, friend, or other person involved in your health care if you are present and you do not object or in the event of an emergency; to comply with applicable federal, state or local laws; for public health reasons; to report a suspected case of abuse, neglect or domestic violence; to the U.S. Department of Health and Human Services; to law enforcement officials for a law enforcement purpose; to respond to legal process; for purposes of public safety or national security; to allow a coroner or medical examiner to identify you or determine the cause of death; to allow a funeral director to carry out his or her duties; or to respond to a request by military command authorities.

You authorize Costco to use and disclose personal health information as stated above and in Costco's Health Centers Notice of Privacy Practices.


New Hampshire Residents - Supplemental State Notice:

This notice supplements Costco's Health Centers Notice of Privacy Practices. New Hampshire's health care law permits disclosure of your professional records to others with your permission to do so, in an emergency situation when it is in your best interests, and when the law otherwise requires us to disclose the information. Costco's Health Centers Notice of Privacy Practices also permits disclosure to another health care provider if needed for your treatment or administration or operations purposes.

Accordingly, you authorize Costco to use and disclose personal health information as stated in Costco's Health Centers Notice of Privacy Practices.


New York Residents - Supplemental State Notice:

This notice supplements Costco's Health Centers Notice of Privacy Practices. New York's health care law does not address all of the uses and possible disclosures of personal health information provided for in federal law and in Costco's Health Centers Notice of Privacy Practices and requires your express request or that of your agent to access any common electronic files or databases used to maintain personally identifiable dispensing information.

You authorize Costco to use and disclose personal health information as stated in Costco's Health Centers Notice of Privacy Practices and request Costco to access any common electronic files or databases as necessary for those purposes.


Ohio Residents - Supplemental State Notice:

Ohio's health care law does not explicitly provide for the use and disclosure of your personal health information as otherwise permitted by federal law. Costco's Health Centers Notice of Privacy Practices permits broader disclosure, including to respond to legal process; to law enforcement officials for a law enforcement purpose; for purposes of public safety or national security; to allow a coroner or medical examiner to identify you or determine the cause of death; to allow a funeral director to carry out his or her duties; or to respond to a request by military command authorities.

You authorize Costco to use and disclose personal health information as stated above and in Costco's Health Centers Notice of Privacy Practices.


Utah State Residents - Supplemental State Notice:

Utah's health care law does not explicitly provide for the use and disclosure of your personal health information as otherwise permitted by federal law. Costco's Health Centers Notice of Privacy Practices permits broader disclosure, including to a family member, friend, or other person in the event of an emergency; to comply with applicable federal, state or local laws; for public health reasons; to report a suspected case of abuse, neglect or domestic violence; to comply with health oversight activities; to the U.S. Department of Health and Human Services; to respond to legal process; to law enforcement officials for a law enforcement purpose; for purposes of public safety or national security; to allow a coroner or medical examiner to identify you or determine the cause of death; or to respond to a request by military command authorities.

You authorize Costco to use and disclose personal health information as stated above and in Costco's Health Centers Notice of Privacy Practices.