As part of the federal Health Insurance Portability and Accountability Act of 1996, known as HIPAA, Van's Institutional Pharmacy ("Van's") has created this Notice of Privacy Practices (Notice). This Notice describes Van's privacy practices and the rights you, the individual, have as they relate to the privacy of your Protected Health Information (PHI). Your PHI is information about you, or that could be used to identify you, as it relates to your past and present physical and mental health care services. The HIPAA regulations require that Van's protect the privacy of your PHI that Van's has received or created.

Our Legal Duties

Van's is required by law to:

• Maintain the privacy of your PHI.
• Provide you with this Notice of its legal duties and privacy practices with respect to your PHI.
• Notify you if you are affected by a breach of your unsecured PHI.
• Abide by the terms of the Notice currently in effect.

For any uses or disclosures that are not listed below (including Psychotherapy Notes, Marketing, and Selling of PHI), Van's will obtain a written authorization from you for that use or disclosure, which you will have the right to revoke at any time, as explained in more detail below. Van's reserves the right to change its privacy practices and this Notice. Where state law provides greater privacy protection than HIPAA, Van's will follow the more protective law.

How We May Use and Disclose Your PHI

The following is an accounting of the ways that Van's is permitted by law to use and disclose your PHI.

Treatment. Van's will use the PHI that it receives from you to fill your prescription and coordinate or manage your health care.

Payment. Van's will disclose your PHI to obtain payment or reimbursement from insurers for your health care services.

Health Care Operations. Van's may use the minimum necessary amount of your PHI to conduct quality assessments, improvement activities, and evaluate Van's workforce.

Other uses and disclosures permitted or required without your written authorization

As required by law. Van's is required to use or disclose PHI about you as required and as limited by law.

Public health activities. Van's may use or disclose PHI about you to a public health authority that is authorized by law to collect it for the purpose of preventing or controlling disease, injury, or disability. This includes the FDA so that it may monitor any adverse effects of drugs, foods, nutritional supplements and other products as required by law.

Victims of abuse, neglect or domestic violence. Van's may use or disclose PHI about you to a government authority if it is reasonably believed you are a victim of abuse, neglect or domestic violence.

Health oversight activities. Van's may use or disclose PHI about you to a health oversight agency for oversight activities which may include audits, investigations, inspections as necessary for licensure, compliance with civil laws, or other activities the health oversight agency is authorized by law to conduct.

Individuals involved in your care or payment for your care. Van's may disclose PHI about you to individuals involved in your care or in payment for your care.

Judicial and administrative proceedings. Van's may disclose PHI about you in the course of any judicial or administrative proceedings, provided that proper documentation is presented to Van's.

Law enforcement purposes. Van's may disclose PHI about you to law enforcement officials for authorized purposes as required by law or in response to a court order or subpoena.

Decedents. Van's may disclose PHI about a deceased individual, or prior to, and in reasonable anticipation of, an individual's death, to coroners, medical examiners, and funeral directors.

Organ, eye or tissue donation. Van's may use and disclose PHI for the purpose of procurement, banking, or transplantation of cadaveric organs, eyes, or tissues for donation purposes.

Research. Van's may use and disclose PHI about you for research purposes with a valid waiver of authorization approved by an institutional review board or a privacy board. Otherwise, Van's will request a signed authorization by the individual for all other research purposes.

To avert a serious threat to health or safety. Van's may use or disclose PHI about you if it believes in good faith, consistent with any applicable law and standards of ethical conduct, that doing so is necessary to avert a serious threat to health or safety.

Specialized government functions. Van's may use or disclose PHI about you for specialized government functions including military and veterans' activities, national security and intelligence, protective services, Department of State functions, and correctional institutions and law enforcement custodial situations.

Workers' compensation. Van's may disclose PHI about you as authorized by and to the extent necessary to comply with workers' compensation laws or programs established by law.

Disaster relief. Van's may disclose PHI about you as authorized by law to a public or private entity to assist in disaster relief efforts and for family and personal representative notification.

Business associates. Van's may disclose PHI about you to its business associates for services that they may provide to or for Van's to assist in providing quality health care. To ensure the privacy of your PHI, Van's requires all business associates to apply appropriate safeguards to any PHI they receive or create.

Van's may also contact you for the following purposes

Treatment alternatives. Van's may contact you to notify you of alternative treatments and/or products.

Health-related benefits or services. Van's may use your PHI to notify you of benefits and services Van's provides.

Fundraising. If Van's participates in a fundraising activity, it may use demographic PHI to send you a fundraising packet, or it may disclose demographic PHI about you to its business associate or an institutionally related foundation to send you a fundraising packet. No further disclosure will be allowed by the business associates or an institutionally related foundation without your written authorization. You will be provided with an opportunity to opt out of all future fundraising activities.

All Other Uses and Disclosures

Van's will obtain a written authorization from you for all other uses and disclosures of PHI, and will only use or disclose PHI pursuant to such an authorization. You may revoke such an authorization in writing at any time. To revoke a previously given authorization, please submit a written revocation to the Privacy Officer.

Your Health Information Rights

The following is a list of your rights with respect to your PHI. Please contact the Privacy Officer for more information about any of these rights.

Request restrictions on certain uses and disclosures. You have the right to request additional restrictions on Van's uses and disclosures of your PHI. Van's is not required to agree to a request, except that it must agree to a request to restrict disclosure of your PHI to your health plan for payment or health care operations purposes, unless the disclosure is required by law, when the PHI relates solely to a product or service for which you, or someone on your behalf, have paid Van's in full out of pocket.

Confidential communications by alternative means or locations. You have the right to request that Van's communicate with you confidentially using an alternative address, phone number, or other method. Van's will accommodate reasonable requests and will not ask you to explain the reason for your request. Van's may ask how payment will be handled and for an alternative address or other method of contact.

Inspect and/or obtain a copy of your PHI. You have the right to request access to and/or obtain a copy (paper or electronic) of your PHI that is contained in Van's records for as long as it maintains PHI about you. There may be a reasonable cost-based charge for photocopying documents. You will be notified in advance of incurring such charges, if any.

Amend your PHI. You have the right to request an amendment of the PHI Van's maintains about you if you feel that it is incorrect or incomplete. Under certain circumstances Van's may deny your request for amendment. If Van's denies the request, you will have the right to have the denial reviewed by someone Van's designates who was not involved in the initial review. You may also ask the Secretary of the United States Department of Health and Human Services ("HHS"), or their appropriate designee, to review such a denial.

Receive an accounting of disclosures. You have the right to receive an accounting of certain disclosures of your PHI made by Van's.

Receive additional copies of this Notice. You have the right to receive additional paper copies of this Notice upon request, even if you initially agreed to receive the Notice electronically.

Notification of breaches. You will be notified of any breach that has compromised the privacy of your unsecured PHI.

Revisions to This Notice

Van's reserves the right to change and/or revise this Notice and make the new revised version applicable to all PHI it maintains, including PHI received prior to the revised Notice's effective date. Van's will post the revised version of the Notice at its pharmacy and on its website (www.vansltc.com), and a copy will be available upon request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with Van's and/or with the Secretary of HHS, or their designee. Van's will not take any adverse action against you as a result of your filing a complaint.

With Van's: contact the Privacy Officer (see below).

With the U.S. Department of Health and Human Services, Office for Civil Rights: write to 200 Independence Avenue, S.W., Washington, D.C. 20201; call 1-877-696-6775; or visit www.hhs.gov/ocr/complaints.