Costco Health Centers Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Effective Date: September 23, 2013

General Information About This Notice

What is protected?

Uses and Disclosures of PHI

Other Uses and Disclosure of PHI

Your Rights

Additional Information About This Notice

Supplemental State Notices for Residents of Certain States

---

General Information About This Notice

Costco continues its commitment to maintaining the confidentiality of your private health information. This Notice describes our efforts to safeguard your health information from improper or unnecessary use or disclosure while providing you with the high quality/low cost goods and services Costco members have come to expect. This Notice only applies to health-related information received by or on behalf of Costco Pharmacies, Costco Optical Centers, and Costco Hearing Aid Centers (collectively, the "Costco Health Centers"). A new federal law requires us to provide you with a summary of the Costco Health Centers' privacy practices and related legal duties, and your rights in connection with the use and disclosure of your Costco Health Center information.

This Notice applies to customers and patrons of any of the Costco Health Centers, whether services are provided by a Costco Health Center representative or through our Costco.com Web site.

The Costco Health Centers, and Costco employees and third parties who perform services for the Costco Health Centers, are bound by the terms of this Notice. When we refer to actions by or obligations of the Costco Health Centers in this Notice, we are including these Costco employees and third parties who perform Costco Health Center functions.

Please note:

• This Notice only applies to Costco Members and other patrons who are customers of the Costco Pharmacies, Costco Optical Centers, and Costco Hearing Aid Centers.
• This Notice does not apply to products or services provided by independent contractors who may provide health-related services and products at Costco Warehouses. Independent optometrists/ophthalmologists and certain providers of medical services, such as osteoporosis testing and flu shots, are not employees of Costco. If you are a customer of, or receive services from, any of these independent health care providers, you should request from them a copy of their privacy notice.

Back to Top

What is Protected?

The Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), a new federal law, requires that Costco Health Centers have a special policy for safeguarding a category of health information related to you called "protected health information," or "PHI," received or created in the course of providing services to you through the Costco Health Centers. PHI is health information that relates to:

• your physical or mental health condition,
• the provision of health care to you, or
• payment for your health care

that can be used to identify you. Your prescriptions, vision test results, and audiogram results, as well as the information you provide on any Costco Health Center patient health history form are all examples of PHI.

The remainder of this Notice generally describes our rules with respect to PHI received or created by the Costco Health Centers.

Back to Top

Uses and Disclosures of PHI

To protect the privacy of PHI, the Costco Health Centers not only guard the physical security of PHI, but we also limit the way PHI is used or disclosed to others. We may use or disclose PHI in certain permissible ways described below.

• To provide you with health care services and products. Costco Health Centers use and disclose PHI in order to provide you with health care services and products. For example, in our hearing aid department we use your audiogram results in order to provide you with the appropriate hearing aid. Our pharmacists ask you questions regarding drug allergies or review your prescription history in order to ensure that we do not provide you prescription drugs to which you may be allergic or which may interact with other prescriptions. Costco opticians use your prescription from your ophthalmologist or optometrist to provide you with the appropriate corrective eye glasses or contact lenses.
• To another health care provider if needed for your treatment. For example, we may discuss your prescription information with your primary care physician if a Costco pharmacist has a drug interaction concern or questions regarding your prescription.
• To bill you for health care services or products. Costco Health Centers use and disclose your PHI to bill you and to accept payment for prescription drugs, glasses, contact lenses, or hearing aids which you may purchase. For example, an associate in the Costco Pharmacy may ring up your prescription drug purchases.
• To seek reimbursement or calculate rebates for health care products or services you receive at Costco Health Centers. For example, Costco Health Centers use and disclose PHI to receive payments from your health plan for covered prescription drugs purchased from a Costco Pharmacy. If you are a Costco Executive Member, your purchase information from any Costco Health Center will be combined with other personal information to calculate your Executive Member 2% Reward, subject to the terms and conditions of that program. We may also submit PHI to a third party who will help you secure rebates from manufacturers on your Costco Health Center purchases.
• For the administration and operation of the Costco Health Centers. We use and disclose PHI for numerous administrative and quality control functions necessary for the Costco Health Centers' proper operation. For example, we may use your pharmacy prescription drug purchase information for fraud and abuse detection activities or to conduct data analyses for planning-related purposes.
• To inform you about treatment alternatives or other health-related benefits that may be offered by Costco Health Centers. For example, we may use your prescription data to alert you to a generic drug available as a substitute for the prescription drug you are currently using.
• To another health care provider or health plan for administration and operations purposes. We may share PHI with another health care provider or a health plan who has a relationship with you for quality assessment and improvement activities, to review the qualifications of health care professionals who provide care to you, or for fraud and abuse detection and prevention purposes.
• To a family member, friend, or other person involved in your health care if you are present and you do not object to the sharing of PHI or in the event of an emergency. Our Health Centers may also allow a family member, friend or other person to pick up your purchases if, in the exercise of professional judgment and experience, we determine it is in your best interests.
• To comply with an applicable federal, state, or local law, including, for example, workers' compensation programs established by law.
• For public health reasons, including to a public health authority for the prevention or control of disease, injury or disability; to a proper government or health authority to report child abuse or neglect; to report reactions to medications or problems with products regulated by the Food and Drug Administration; to notify individuals of recalls of medication or products they may be using; or to notify a person who may have been exposed to a communicable disease or who may be at risk for contracting or spreading a disease or condition.
• To report a suspected case of abuse, neglect or domestic violence, as permitted or required by applicable law.
• To comply with health oversight activities, such as audits, investigations, inspections, licensure actions, and other government monitoring and activities related to health care provision or public benefits or services. For example, Costco Pharmacies are subject to reporting requirements regarding narcotics under state and federal law, and are subject to periodic and random inspections by state pharmacy boards. Inspectors or other government officials may view or receive PHI as a result of a government inspection or other request.
• To the U.S. Department of Health and Human Services to demonstrate our compliance with HIPAA.
• To respond to an order of a court or administrative tribunal, such as a court ordered warrant, subpoena or summons, grand jury subpoena, or administrative subpoena or other request.
•  To respond to a subpoena, warrant, summons or other legal request if sufficient safeguards, such as a protective order in the case of a private lawsuit, are in place to maintain PHI privacy.
• To a law enforcement official for a law enforcement purpose as required by law.
• For purposes of public safety or national security.
• To allow a coroner or medical examiner to identify you or determine your cause of death.
• To allow a funeral director to carry out his or her duties.
• To respond to a request by military command authorities if you are or were a member of the armed forces.

To the extent required under law, we use the minimum amount of PHI necessary to perform these tasks.

If an applicable state law provides greater health information privacy protections than the federal law, we will comply with the stricter state law. If you are resident of California, Connecticut, Florida, Idaho, Michigan, Minnesota, Montana, Nevada, New Hampshire, New York, Ohio or Utah, please review the Supplemental State Notices at the end of this Notice.

Back to Top

Other Uses and Disclosures of PHI

Before we use or disclose PHI for any other purpose than as described above, we must obtain your written authorization. You may revoke your authorization, in writing, at any time. If you revoke your authorization, the Costco Health Centers will no longer use or disclose PHI except as described above (or as permitted by any other authorizations that have not been revoked). However, please understand that we cannot retrieve any PHI disclosed to a third party in reliance on your prior authorization.

Back to Top

Your Rights

Federal law provides you with certain rights regarding PHI that pertains to you. Parents of minor children and other individuals with legal authority to make health decisions for customers of Costco Health Centers may exercise these rights on behalf of such customers, consistent with state law.

Right to request restrictions: You have the right to request a restriction or limitation on the Costco Health Centers' use or disclosure of PHI. The law does not require the Costco Health Centers to agree to your request for restriction and depending upon your request, we may not be able to grant it because it may affect our ability to provide health care services or products to you. However, if we do agree to your requested restriction or limitation, we will honor the restriction until you agree to terminate the restriction or until we notify you that we are terminating the restriction on a going-forward basis.

You may submit a written request for restriction on the use and disclosure of PHI to our Privacy Officer. Your request must specify: (i) the PHI you want to limit; (ii) how you want the Costco Health Centers to limit the use, disclosure, or both of that PHI; and (iii) to whom you want the restrictions to apply.

Right to receive confidential communications: You have the right to request that the Costco Health Centers communicate with you about PHI at a new address or by different means if you believe that communication through normal business practices could endanger you. You may submit a written request for confidential communications to your local Costco Health Center.

Right to obtain a copy of PHI: You have the right to review and obtain a copy of PHI that is contained in medical or billing records that the Costco Health Centers maintain or other records that the Costco Health Centers use to make decisions about you.

However, we will not give you access to PHI records created in anticipation of a civil, criminal or administrative action or proceeding. We will also deny your request to inspect and copy PHI if a licensed health care professional hired by the Costco Health Centers has determined that giving you the requested access is reasonably likely to endanger the life or physical safety of you or another individual or to cause substantial harm to you or another individual, or that the record makes references to another person (other than a health care provider), and that the requested access would likely cause substantial harm to the other person.

If your request to access PHI is denied, you may have that decision reviewed. A different licensed health care professional chosen by the Costco Health Centers will review the request and denial, and we will comply with the health care professional's decision.

You may make a request to review or obtain a copy of PHI at your local Costco Health Center. We may charge you a fee to cover the costs of copying, mailing or other supplies directly associated with your request. You will be notified of any costs before you incur any expenses.

Right to amend PHI: You have the right to request an amendment of PHI if you believe the information the Costco Health Centers have about you is incorrect or incomplete. You have this right as long as PHI is maintained by the Costco Health Centers. We will correct any mistakes if we created the PHI or if the person or entity that originally created the PHI is no longer available to make the amendment.

Amendments involving the addition of information to Costco Health Center records may generally be made at your local Costco Health Center. However, for other types of changes, or if the local Costco Health Center is unable to accommodate your request, you must submit a written request to amend PHI by filling out a Request for Amendment form available from the Privacy Officer and submitting the form back to our Privacy Officer. You should include evidence to support your request because we cannot amend PHI that we believe to be accurate and complete.

Right to receive an accounting of disclosures of PHI: You have the right to request a list of certain disclosures of PHI by the Costco Health Centers. The accounting will not include (i) disclosures necessary to provide treatment, to determine proper payment, or to operate the Costco Health Centers, (ii) disclosures we make to you, (iii) disclosures permitted by your authorization, (iv) disclosures to friends or family members as discussed in this Notice, or made in your presence or because of an emergency, or (v) disclosures for national security purposes. Your first request for an accounting within a 12-month period will be free. We may charge you for costs associated with providing you additional accountings. We will notify you of the costs involved, and you may choose to withdraw or modify your request before you incur any expenses.

You may submit a written request for an accounting of disclosures of PHI by filling out a Request for Accounting of Disclosures form available from the Privacy Officer and submitting the form back to the Privacy Officer. Your request must include (i) the time period for the accounting, which may not be longer than six (6) years and may not include dates prior to April 14, 2003; and (ii) the form (e.g., electronic, paper) in which you would like the accounting.

Right to file a complaint: If you believe your rights have been violated, you should let us know immediately. We will take steps to remedy any violations of the Costco Health Centers' privacy policy or of this Notice.

You may file a formal complaint with our Privacy Officer and/or with the United States Department of Health and Human Services at the addresses below. You should attach any documents or evidence that supports your belief that your privacy rights have been violated. We take your complaints very seriously. Costco policy and federal law prohibit retaliation against any person for filing such a complaint.

Complaints should be sent to:

Back to Top

Additional Information About This Notice

Changes to this Notice: We reserve the right to change the Costco Health Centers' privacy practices as described in this Notice. Any change may affect the use and disclosure of PHI already maintained by the Costco Health Centers, as well as any of PHI that the Costco Health Centers may receive or create in the future. If there is a material change to the terms of this Notice, revised Notices will be made available at each Costco Health Center and by logging on to Costco's Web site at www.costco.com under the Costco Health Centers section.

Acknowledgement: When first delivering this Notice to you, each of the Costco Health Centers will ask you to sign an acknowledgement that you were provided a copy of this Notice.

How to obtain an additional copy of this Notice: You can obtain a copy of the current notice by writing our Privacy Officer at the address or e-mail address set out in this Notice or by logging on to Costco's Web site at www.costco.com under the Costco Health Centers section.

Back to Top

Supplemental State Notices for Residents of Certain States:

If you are a resident of California, Connecticut, Florida, Idaho, Michigan, Minnesota, Montana, Nevada, New Hampshire, New York, Ohio or Utah, please carefully review the Supplemental State Notice that applies to you.

Back to Top