THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Our Legal Duty

   [Your Pharmacy Name] (“we,” “our,” or “the Pharmacy”) is required by law to maintain the privacy of your protected health information (“PHI”) and to provide you with this Notice of our legal duties and privacy practices. We are required to abide by the terms of this Notice while it is in effect and to notify you following a breach of your unsecured PHI. We reserve the right to change the terms of this Notice at any time as permitted by law, and to make changes effective for PHI we already hold. A current copy of this Notice is posted in our pharmacy and on our website. You may request a paper copy at any time.

   • Connecticut Law: Under Connecticut General Statutes (C.G.S.) § 4-190 et seq. (Connecticut Privacy Act) and § 38a-988 et seq., Connecticut residents have additional rights regarding the privacy of personal data, including health information. Where Connecticut law affords greater protection than federal HIPAA, we comply with the stricter Connecticut standard.

2. How We May Use and Disclose Your Health Information

   The following categories describe the ways we may use and disclose your PHI. Not every use or disclosure will be listed, but all permitted uses and disclosures fall within one of these categories.

   • Treatment: We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services, including sharing medication information with your prescribing physician, specialist, or other pharmacies involved in your care.
   • Payment: We may use and disclose your PHI so that we or others may bill and receive payment for pharmacy services you receive, including disclosures to your health plan or insurer./li>
   • Healthcare Operations: We may use and disclose your PHI for internal pharmacy operations including quality assurance, staff training, compliance reviews, and general administration.
   • As Required by Law: We will disclose your PHI when required by federal, state, or local law, including court orders, lawful subpoenas, or law enforcement requests as permitted under HIPAA.
   • Public Health Activities: We may disclose your PHI to public health authorities for adverse drug event reporting, product recalls, communicable disease reporting, or FDA-required disclosures.
   • Health Oversight Activities: We may disclose your PHI to oversight agencies such as the Connecticut Department of Consumer Protection — Drug Control Division, the DEA, or the Connecticut Insurance Department for audits, inspections, and licensure.
   • Abuse or Neglect Reporting: We may disclose your PHI to appropriate authorities if we believe you are a victim of abuse, neglect, or domestic violence, as required or permitted by law.
   • Serious Threats to Health or Safety: We may use or disclose your PHI when necessary to prevent a serious and imminent threat to your health or safety or the health or safety of others.
   • Business Associates: We may disclose your PHI to third-party business associates performing services on our behalf. These entities are required to safeguard your PHI under HIPAA-compliant Business Associate Agreements.
   • Connecticut Law: Connecticut Prescription Monitoring Program (PMP): Under C.G.S. § 21a-254a, we are required to report all dispensed Schedule II–V controlled substance prescriptions to the Connecticut PMP administered by the Department of Consumer Protection. This reporting is required by law and does not require your separate authorization.
   • Connecticut Law: Confidentiality of Alcohol and Drug Treatment Records: Under C.G.S. § 17a-688 and federal 42 CFR Part 2, records related to substance use disorder treatment receive heightened protection and generally may not be disclosed without your specific written consent, except in limited circumstances (e.g., medical emergencies, court orders, or child abuse reporting).

3. Uses and Disclosures Requiring Your Authorization

   Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization, unless otherwise required by law. This includes: (a) most uses and disclosures of psychotherapy notes; (b) uses and disclosures for marketing purposes; and (c) disclosures that constitute a sale of PHI. You may revoke any authorization at any time in writing, except to the extent action has already been taken in reliance on it.

   • Connecticut Law: Mental Health Records — Connecticut Law: Under C.G.S. § 52-146d et seq. (Psychiatric Patient Advocate Act) and § 17a-688, mental health and substance use disorder records in Connecticut carry additional confidentiality protections beyond federal HIPAA. Disclosure of such records generally requires your specific written consent and may not be made based on a general HIPAA authorization alone.
   • Connecticut Law: HIV/AIDS-Related Information — Connecticut Law: Under C.G.S. § 19a-583, HIV-related test results and treatment information may not be disclosed without your specific written consent, with narrow exceptions (e.g., licensed healthcare provider treatment, court order). We will not disclose HIV-related PHI from your pharmacy records without your explicit written authorization except as required by law.

4. Your Rights Regarding Your Health Information

   You have the following rights with respect to your PHI. To exercise any right, please submit a written request to our Privacy Contact listed in Section 6.

   • Right to Inspect and Copy: You have the right to inspect and obtain a copy of your PHI in our designated record set, including prescription records. We may charge a reasonable, cost-based fee for copies and may deny requests in limited circumstances.
   • Right to Request an Amendment: You have the right to request amendment of your PHI if you believe it is incorrect or incomplete. We may deny your request if we determine the information is accurate and complete.
   • Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures of your PHI made in the six years prior to your request, excluding disclosures for treatment, payment, operations, or those you authorized.
   • Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures. We are not required to agree, except that if you pay out-of-pocket in full for a service, we must honor your request not to disclose information about that service to your health plan.
   • Right to Request Confidential Communications: You have the right to request we contact you through alternative means or at alternative locations. We will accommodate reasonable requests.
   • Right to a Paper Copy of This Notice: You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.
   • Right to Be Notified of a Breach: You have the right to be notified if there is a breach of your unsecured PHI, as required under the HITECH Act and applicable law.
   • Connecticut Law: Connecticut Data Breach Notification: Under C.G.S. § 36a-701b (Connecticut’s data breach notification law, as amended by Public Act 21-59), if a security breach involving your PHI or personal information occurs, we are required to notify you without unreasonable delay and no later than 60 days after discovery of the breach. Notification must include specific information about the breach and steps you can take to protect yourself. Credit monitoring services may also be required.
   • onnecticut Law: Right to Access Pharmacy Records: Under Connecticut pharmacy practice law (C.G.S. § 20-633b) and regulations of the Department of Consumer Protection, you have the right to access your prescription records maintained by this pharmacy. Requests may be made in writing to the pharmacist-in-charge.

5. Pharmacy-Specific Privacy Practices

   As a Connecticut licensed retail/community pharmacy, we are committed to protecting your privacy in all aspects of our operations:

   • Prescription Pick-Up: We take reasonable steps to limit incidental disclosures at the pharmacy counter, including the use of privacy screens, consultation areas, and trained staff.
   • Prescription Records: Your prescription history and related PHI are stored securely and accessible only to authorized pharmacy personnel on a need-to-know basis.
   • Electronic Prescribing: We handle electronically transmitted prescriptions in accordance with HIPAA Security Rule requirements and Connecticut e-prescribing regulations under C.G.S. § 20-619(g).
   • Online and Telepharmacy Refills: If you use our telephone refill line or online/mobile refill services, your PHI is protected using industry-standard security safeguards.
   • Controlled Substances: Dispensing of controlled substances is reported to the Connecticut PMP as required by law. Federal DEA and state DCP regulations govern all controlled substance records.
   • Connecticut Law: Connecticut Licensed Pharmacist Obligations: Under C.G.S. § 20-570 et seq. and Connecticut Pharmacy Practice Act regulations, licensed pharmacists in Connecticut are independently obligated to maintain patient confidentiality as a condition of licensure. Violations may be reported to the Connecticut Department of Consumer Protection, Drug Control Division.
   • Connecticut Law: Patient Counseling: Under Connecticut regulations (Conn. Agencies Regs. § 20-576-28), pharmacists are required to offer counseling on new prescriptions. Information shared during counseling is treated as confidential PHI and is protected under both HIPAA and Connecticut law.
   • Connecticut Law: Minor Patients: Connecticut law (C.G.S. § 19a-14c) permits minors to consent to certain healthcare services (e.g., sexual health, substance use treatment) without parental consent. When a minor has the right to consent independently, the corresponding PHI may be withheld from parents or guardians to the extent required or permitted by law.

6. Privacy Contact, Complaints, and State Resources

   If you have questions about this Notice or wish to exercise your rights, please contact:

   • Privacy / Compliance Contact Bristol Pharmacy 194 Main St. Bristol, CT 06010-6308 Phone: (860)-845-5634 Email: BristolpharmacyCT@outlook.com Hours: Monday to Friday: 8 am to 6 pm, Saturday: 8 am to 2 pm

   If you believe your privacy rights have been violated, you have the right to file a complaint with us, with the U.S. Department of Health and Human Services, or with the applicable Connecticut state agency — without fear of retaliation.

   • Federal — HHS Office for Civil Rights (HIPAA Complaints) 200 Independence Avenue, S.W., Washington, D.C. 20201 Toll-Free: 1-800-368-1019 | TDD: 1-800-537-7697 Website: www.hhs.gov/ocr/privacy/hipaa/complaints/
   • Connecticut — Department of Consumer Protection, Drug Control Division 450 Columbus Blvd., Suite 901, Hartford, CT 06103 Phone: (860) 713-6065 Website: portal.ct.gov/DCP
   • Connecticut — Office of the Attorney General (Data Privacy / Breach) 165 Capitol Avenue, Hartford, CT 06106 Phone: (860) 808-5420 Website: portal.ct.gov/AG

We will not retaliate against you in any way for filing a complaint with us or with any government agency.

This Notice is provided in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the HITECH Act of 2009; Connecticut General Statutes including C.G.S. §§ 4-190 et seq., 19a-583, 21a-254a, 36a-701b, 52-146d et seq.; and all applicable federal and Connecticut state regulations governing pharmacy practice and health information privacy. Connecticut Licensed Retail Pharmacy | [Your Pharmacy Name] | [City, CT]