SUPERVALU PHARMACIES, INC. dba CUB FOODS
NOTICE OF PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
SUPERVALU Pharmacies, Inc. dba Cub Foods (“SUPERVALU”) is committed to protecting your privacy and understands the importance of safeguarding your personal health information. We are required by federal law to maintain the privacy of health information that identifies you or that could be used to identify you (known as “Protected Health Information” or “PHI”). We also are required to provide you with this Notice, which explains our legal duties and privacy practices with respect to PHI that we collect and maintain. This Notice describes your rights under federal law and state law, where applicable, relating to your PHI. SUPERVALU is required by federal law to abide by this Notice. However, we reserve the right to change the privacy practices outlined in this Notice and make the new practices effective for all PHI that we maintain. Should we make such a change, we will display the revised Notice at our pharmacies and make it available to you upon request.
Routine Uses and Disclosures of Protected Health Information For Treatment, Payment, or Health Care Operations
SUPERVALU is permitted under federal law to use and disclose PHI without your specific permission for three types of routine purposes: treatment, payment, and health care operations.
Persons Involved in Your Care. We may disclose your PHI to a family member, relative, close personal friend, or any other person you identify for the involvement of your care, payment related to your care, or for notification purposes.
Required by the Secretary of Health and Human Services. We may be required to disclose your PHI to the Secretary of Health and Human Services to investigate or determine our compliance with the federal privacy law.
Required by Law. We may use or disclose your PHI to the extent that the use or disclosure is otherwise required by state or federal law.
USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION
Routine Uses and Disclosures of Protected Health Information For Treatment, Payment, or Health Care Operations
SUPERVALU is permitted under federal law to use and disclose PHI without your specific permission for three types of routine purposes: treatment, payment, and health care operations.
Your pharmacist will use or disclose your PHI as described below. Your PHI may be used and disclosed by your pharmacist, pharmacy staff, and others outside of the pharmacy who are involved in your care and treatment. Set out below are examples of the uses and disclosures of your PHI we are permitted to make for these routine purposes. While this list is not meant to be exhaustive, it should give you an idea of the everyday uses and disclosures “behind the scenes” that are essential to the care you receive.
Treatment. Your PHI can be used and disclosed by SUPERVALU for treatment purposes. For example, your PHI will be used by our pharmacists to fill your prescription and to counsel you about the appropriate use of your medication.
We also may use and disclose your PHI to provide you with information regarding possible alternative treatment options and other health-related benefits and services that we believe might interest you as long as we notify you of any funding received from third parties for these types of communications. For example, we may send you reminders to refill or renew your prescription, information about the availability of cheaper generic alternatives for your prescription, or information about new or updated products that may enhance or improve your treatment.
Payment. Your PHI can be used and disclosed for payment purposes. For example, we may communicate your PHI to your insurance company so that it can process payment for your prescription.
Health Care Operations. Your PHI can be used and disclosed to allow us to conduct health care operations, which generally are the administrative activities that we undertake in order to operate our pharmacies. For example, we may use your PHI to evaluate the performance of our pharmacists and to engage in other quality assurance activities.
Other Uses and Disclosures of Protected Health Information SUPERVALU is Permitted or Required to Make Without Your Authorization
In general, we are required to obtain your specific written authorization to use or disclose your PHI for purposes unrelated to treatment, payment, or health care operations, including uses and disclosures of PHI for most marketing communications and disclosures that would constitute a sale of PHI. However, there are exceptions to this general rule under which we are permitted or required to make certain uses and disclosures of your PHI without authorization. These situations include:
Persons Involved in Your Care. We may disclose your PHI to a family member, relative, close personal friend, or any other person you identify for the involvement of your care, payment related to your care, or for notification purposes.
Required by the Secretary of Health and Human Services. We may be required to disclose your PHI to the Secretary of Health and Human Services to investigate or determine our compliance with the federal privacy law.
Required by Law. We may use or disclose your PHI to the extent that the use or disclosure is otherwise required by state or federal law.
Public Health. We may disclose your PHI for public health activities, such as disclosures to a public health authority or other government agency that is permitted by law to collect or receive the information (e.g., the Food and Drug Administration).
Abuse or Neglect. If you have been a victim of abuse, neglect, or domestic violence, we may disclose your PHI to the government agency authorized to receive such information.
Health Oversight. We may disclose PHI to a health oversight agency for activities authorized by law, such as: civil or criminal investigations; inspections; licensure or disciplinary actions; or other activities necessary for appropriate oversight of retail pharmacies, governmental health benefit programs, or compliance with laws.
Judicial and Administrative Proceedings. We may disclose PHI in response to a court or agency order, and in some cases, in response to a subpoena or other lawful process not accompanied by a court order.
Law Enforcement. We may disclose PHI for law enforcement purposes, such as providing information to the police about the victim of a crime.
Coroners, Medical Examiners, and Funeral Directors. We may disclose PHI to a coroner, medical examiner, or funeral director if it is needed to carry out their duties.
Research. We may disclose your PHI to researchers when the research is being conducted under established protocols to ensure the privacy of your information.
Serious Threat to Health or Safety. Your PHI may be disclosed if we believe it is necessary to prevent a serious and imminent threat to the public health or safety and it is to someone we reasonably believe is able to prevent or lessen the threat.
Specialized Government Functions. We may disclose PHI for purposes related to military or national security concerns, such as for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits.
Domestic Armed Forces Personnel. We may use and disclose your PHI for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission, if the authority has published proper notice in the Federal Register stating the purposes for which such information may be used or disclosed.
Workers’ Compensation. Your PHI may be disclosed to comply with workers’ compensation laws and other similar programs.
Disaster Relief Purposes. Your PHI may be used or disclosed to a public or private entity authorized by law or by its charter to assist in disaster relief efforts for the purpose of coordinating disaster relief efforts.
The uses and disclosures of your PHI described above are permitted or required by federal law. Some states have laws that require additional privacy safeguards above and beyond the federal requirements. Thus, if a state law is more restrictive regarding uses and disclosures of your PHI or provides you with greater rights with respect to your PHI, SUPERVALU will comply with the state law. If your state has enacted a more stringent law, we have attached as an addendum to this Notice our privacy practices regarding your PHI in that state.
Notice to Minors: If you are a minor who has lawfully provided consent for treatment and you wish that we treat you as an adult for purposes of access to and disclosure of records related to such treatment, please notify a pharmacist or our Privacy Office.
SUPERVALU may conduct the above-described activities ourselves, or we may use non-SUPERVALU entities to perform those operations. In those instances where we disclose your PHI to a third party acting on our behalf, we will protect your PHI through an appropriate privacy agreement, referred to as a Business Associate Agreement.
Other Uses and Disclosures of Protected Health Information Based Upon Your Written Authorization
Other uses and disclosures of your PHI, not described above, will be made only with your written authorization. You may revoke this authorization at any time, in writing, except to the extent that we have taken action in reliance on the authorization.
YOUR RIGHTS
As a patient, you have certain rights regarding your PHI. We may ask that you submit a written request to exercise your patient rights. These rights include:
You have the right to request a restriction on certain uses and disclosures of your Protected Health Information. This means that you may ask us not to use or disclose any part of your PHI for purposes of treatment, payment, or health care operations. You may also request that any part of your PHI not be disclosed to family members or friends who may be involved in your care. Your request must state the specific restriction requested and state to whom you want the restriction to apply.
SUPERVALU is not required to agree to such a restriction. If we do agree, we will abide by your restriction unless we need to use your PHI to provide emergency treatment. In addition, we may elect to terminate the restriction at any time. We will honor requests to restrict disclosures to health plans or insurers for payment or health care operations purposes if you pay for the full amount of your health care item or service out-of-pocket unless the disclosure is permitted by law.
You have the right to inspect and obtain copies of your Protected Health Information. If you would like to see or obtain copies of your PHI, we are required to provide you access to your PHI for inspection and copying within 30 days after receipt of your request (with up to a 30-day extension, if needed). We may charge you a reasonable fee to cover duplicating costs. In addition, there may be situations where we may decide to deny your request for access. For example, we may deny your request if we believe the disclosure will endanger your life or health or that of another person. Depending on the circumstances of the denial, you may have a right to have this decision reviewed.
You have a right to or will receive notifications of any breach of your unsecured Protected Health Information.
COMPLAINTS
CHANGES TO THIS NOTICE
We reserve the right to change the terms of this Notice and make the new Notice provisions effective for all PHI that we maintain. The new Notice will be available upon request in all our pharmacies and on Cub.com.
MINNESOTA STATE LAW ADDENDUM
Disclosure
We will not disclose your pharmacy records except:
Inmates. Under certain circumstances, we may disclose the PHI of inmates of a correctional institution.
Workers’ Compensation. Your PHI may be disclosed to comply with workers’ compensation laws and other similar programs.
Disaster Relief Purposes. Your PHI may be used or disclosed to a public or private entity authorized by law or by its charter to assist in disaster relief efforts for the purpose of coordinating disaster relief efforts.
Personal Representative. We may disclose your PHI to your personal representative.
Other Restrictions on Uses and Disclosures of Protected Health Information
The uses and disclosures of your PHI described above are permitted or required by federal law. Some states have laws that require additional privacy safeguards above and beyond the federal requirements. Thus, if a state law is more restrictive regarding uses and disclosures of your PHI or provides you with greater rights with respect to your PHI, SUPERVALU will comply with the state law. If your state has enacted a more stringent law, we have attached as an addendum to this Notice our privacy practices regarding your PHI in that state.
Notice to Minors: If you are a minor who has lawfully provided consent for treatment and you wish that we treat you as an adult for purposes of access to and disclosure of records related to such treatment, please notify a pharmacist or our Privacy Office.
Disclosures to Other Parties for Conducting Permitted Activities
SUPERVALU may conduct the above-described activities ourselves, or we may use non-SUPERVALU entities to perform those operations. In those instances where we disclose your PHI to a third party acting on our behalf, we will protect your PHI through an appropriate privacy agreement, referred to as a Business Associate Agreement.
Other Uses and Disclosures of Protected Health Information Based Upon Your Written Authorization
Other uses and disclosures of your PHI, not described above, will be made only with your written authorization. You may revoke this authorization at any time, in writing, except to the extent that we have taken action in reliance on the authorization.
YOUR RIGHTS
As a patient, you have certain rights regarding your PHI. We may ask that you submit a written request to exercise your patient rights. These rights include:
You have the right to request a restriction on certain uses and disclosures of your Protected Health Information. This means that you may ask us not to use or disclose any part of your PHI for purposes of treatment, payment, or health care operations. You may also request that any part of your PHI not be disclosed to family members or friends who may be involved in your care. Your request must state the specific restriction requested and state to whom you want the restriction to apply.
SUPERVALU is not required to agree to such a restriction. If we do agree, we will abide by your restriction unless we need to use your PHI to provide emergency treatment. In addition, we may elect to terminate the restriction at any time. We will honor requests to restrict disclosures to health plans or insurers for payment or health care operations purposes if you pay for the full amount of your health care item or service out-of-pocket unless the disclosure is permitted by law.
You have the right to request to receive information from us by an alternative means or at an alternative location if you believe it would enhance your privacy. For example, you may request that we send written communications to an alternative address. We will attempt to accommodate all reasonable requests and will not request an explanation from you as to the basis for your request.
You have the right to inspect and obtain copies of your Protected Health Information. If you would like to see or obtain copies of your PHI, we are required to provide you access to your PHI for inspection and copying within 30 days after receipt of your request (with up to a 30-day extension, if needed). We may charge you a reasonable fee to cover duplicating costs. In addition, there may be situations where we may decide to deny your request for access. For example, we may deny your request if we believe the disclosure will endanger your life or health or that of another person. Depending on the circumstances of the denial, you may have a right to have this decision reviewed.
You have the right to amend your Protected Health Information. This means you may request an amendment of your PHI in our records for as long as we maintain this information. We will respond to your request within 60 days (with up to a 30-day extension, if needed). We may deny your request if, for example, we determine that your PHI is accurate and complete. If we deny your request, we will send you a written explanation and allow you to submit a written statement of disagreement.
You have the right to receive an accounting of certain disclosures we have made of your Protected Health Information. An accounting is a record of the disclosures that have been made of PHI. This right generally applies to non-routine disclosures, i.e., for purposes other than treatment, payment, or health care operations, as described in this Notice, made in the six-year period prior to your request (although you are free to request an accounting for a shorter period). We are required to provide the accounting within 60 days (with one 30-day extension, if needed) and to provide one accounting free of charge in any 12-month period. (For more frequent requests, a reasonable fee may be charged.)
You have the right to obtain a paper copy of this Notice from SUPERVALU.
You have a right to or will receive notifications of any breach of your unsecured Protected Health Information.
COMPLAINTS
If you believe your privacy rights have been violated, you have the right to report such alleged violations to SUPERVALU, and we will promptly investigate the matter. You may file a complaint with SUPERVALU by contacting our Corporate HIPAA Privacy Office. Rest assured we will not retaliate against you in any way for filing a complaint about our privacy practices. You may also contact the Secretary of Health and Human Services.
You may contact our Corporate HIPAA Privacy Office at (952) 828-4230 or at P.O. Box 990, Minneapolis, Minnesota 55440-0990 for further information about the complaint process or any other information covered by this Notice.
CHANGES TO THIS NOTICE
We reserve the right to change the terms of this Notice and make the new Notice provisions effective for all PHI that we maintain. The new Notice will be available upon request in all our pharmacies and on Cub.com.
Effective Date: September 1, 2013.
Revised: November 1, 2016, August 31, 2021.
MINNESOTA STATE LAW ADDENDUM
Disclosure
We will not disclose your pharmacy records except:
- as specfically authorized in law;
- for a medical emergency when we are unable to obtain your consent due to the nature of the emergency or your medical condition;
- to other providers within related health care entities when necessary for your current treatment;
- to a health care facility licensed by the state or a similar facility licensed by another state when you are returning to the facility and unable to provide consent;
- to you, your agent, or another pharmacist acting on behalf of you or your agent;
- to the licensed practitioner who issued your prescription;
- to the licensed practitioner who is currently treating you;
- to a member, inspector, or investigator of the board or any federal, state, county, or municipal officer whose duty it is to enforce the laws of this state or the United States relating to drugs and who is engaged in a specific investigation involving a designated person or drug;
- to an agency of government charged with the responsibility of providing medical care for you;
- to any person duly authorized by a court order. All other uses and disclosures of PHI require your specific consent.
Effective Date: September 1, 2013.
Revised: August 31, 2021.