Privacy Notice - Biologics by McKesson

PATIENT PRIVACY NOTICE

Biologics Notice of Privacy Practices Eﬀective Date: December 12, 2024

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

About us

In this Notice, we use terms like “we,” “us” or “our” to refer to Biologics and its pharmacists, employees, staﬀ and other personnel. All the sites and locations of Biologics by McKesson follow the terms of this Notice and may share health information with each other for treatment, payment or healthcare operations purposes as well as for other purposes as described in this Notice.

Purpose of this Notice

This Notice describes how we may use and disclose your health information to carry out treatment, payment or healthcare operations and for other purposes permitted or required by law. This Notice also outlines our legal duties for protecting the privacy of your health information and explains your rights to have your health information protected. We will create a record of the services we provide you, and this record will include your health information. We need to maintain this information to ensure that you receive quality care and to meet certain legal requirements related to providing your care. We understand that your health information is personal, and we are committed to protecting your privacy and ensuring that your health information is not used inappropriately.

Our responsibilities

We are required by law to maintain the privacy of your health information and to provide you notice of our legal duties and privacy practices with respect to your health information, including that if your health information is disclosed as permitted by the HIPAA Privacy Rule, it may be subject to redisclosure and no longer protected by the HIPAA Privacy Rule. We are also required to notify you of a breach of your unsecured health information. As a specialty pharmacy, Biologics does not intend to create or maintain substance abuse disorder information or records. To the extent Biologics receives such information, Biologics will appropriately safeguard such information. We will abide by the terms of this Notice.

How we may use or disclose your health information

The following categories describe examples of how we use and disclose health information, to the extent we may do so in accordance with applicable law, without your written authorization:

For treatment: We will use and disclose your health information to provide you with medical treatment or services. For example, we will contact you regarding medications, therapeutic substitution (e.g., the availability of generic products), counseling and drug utilization review (DUR), product recalls, reﬁll reminders, or disease-state management. We will disclose your health information to another pharmacist or to your physician for the purpose of a consultation. We will use and disclose your health information to contact you as a reminder that you have a reﬁll due. Please let us know if you don’t wish to have us contact you concerning your reﬁll or if you wish to have us use a diﬀerent telephone number or address to contact you for this purpose. We may mail you information about your health. Examples are information about living with complex diseases or information about managed care.

For payment: We may use and disclose your health information to others, so they will pay us or reimburse you for your treatment. For example, a bill may be sent to you, your insurance company, your pharmacy beneﬁts manager or another third-party payer. The bill may contain information that identiﬁes you, your diagnosis, and treatment or prescription medication used in the course of treatment. We may tell your health plan about a prescription medication you’re going to receive to obtain prior approval or to determine whether your health plan will cover the prescription medication.

For healthcare operations: We may use and disclose your health information in order to support our business activities. These use and disclosures are necessary to run Biologics and make sure our patients receive quality care. For example, we may use your health information for quality-assessment activities, reviewing the competence and qualiﬁcations of the pharmacists providing treatment to you, and for other essential activities.

We may also disclose your health information to third-party “business associates” that perform various services on our behalf, such as auditing, legal, billing and collection services. In these cases, we will enter into a written agreement with the business associate to ensure they protect the privacy of your health information.

As to individuals involved in your care or payment for your care, If you verbally agree to the use or disclosure and in certain other situations, we may make the following uses and disclosures of your health information:

We may disclose to your family and friends (and anyone else who you identify as involved in your medical care or who helps pay for your care) health information relevant to that person’s involvement in your care or paying for your We may also make these disclosures after your death.
We may use or disclose your information to notify or assist in notifying a family member, personal representative or any other person responsible for your care, your general condition or in the event of your death.
We may also use or disclose your health information to disaster-relief organizations so that your family or other persons responsible for your care can be notiﬁed about your condition, status and location.

We are also allowed, to the extent permitted by and in accordance with applicable law, to use and disclose your health information without your authorization for the following purposes:

As required by law: We may use and disclose your health information when required to do so by federal, state or local law.

Judicial and administrative proceedings: If you’re involved in a legal proceeding, we may disclose your health information in response to a court or administrative order. We may also release your health information in response to a subpoena, discovery request or other lawful process by someone else involved in the dispute — but only if eﬀorts have been made to tell you about the request or to obtain an order protecting the information requested. If the use or disclosure involves reproductive health information or substance use disorder information, applicable law may restrict our ability to disclose such information or may require us to take certain steps before using or disclosing such information.

Health oversight activities: We may use and disclose your health information to health oversight agencies for activities authorized by law. These oversight activities are necessary for the government to monitor the healthcare system, government beneﬁt programs, compliance with government regulatory programs, and compliance with civil rights laws. If the use or disclosure involves reproductive health information or substance use disorder information, applicable law may restrict our ability to disclose such information or may require us to take certain steps before using or disclosing such information.

Law enforcement: We may disclose your health information, within limitations, to law enforcement oﬃcials for several diﬀerent purposes:

To comply with a court order, warrant, subpoena, summons or other similar process;
To identify or locate a suspect, fugitive, material witness or missing person;
About the victim of a crime, if the victim agrees, or we’re unable to obtain the victim’s agreement;
About a death we suspect may have resulted from criminal conduct;
About criminal conduct we believe in good faith to have occurred on our premises; and
To report a crime not occurring on our premises, including the nature of the crime, the location of the crime, and the identity, description, and location of the individual who committed the crime in an emergency situation.
If the use or disclosure involves reproductive health information or substance use disorder information, applicable law may restrict our ability to disclose such information or may require us to take certain steps before using or disclosing such information.

Public health activities: We may use and disclose your health information for public health activities, including the following:

To prevent or control disease, injury or disability;
To report births or deaths;
To report child abuse or neglect;
To support activities related to the quality, safety or eﬀectiveness of FDA-regulated products;
To notify a person who may have been exposed to a communicable disease or may be at risk for contracting or spreading a disease or condition as authorized by law; and
To notify an employer of ﬁndings concerning work-related illness or injury or general medical surveillance that the employer needs to comply with the law if you are provided notice of such disclosure.

Serious threat to health or safety: If there is a serious threat to your health and safety, or the health and safety of the public or another person, we may use and disclose your health information to someone able to help prevent the threat or as necessary for law enforcement authorities to identify or apprehend an individual. If the use or disclosure involves reproductive health information or substance use disorder information, applicable law may restrict our ability to disclose such information or may require us to take certain steps before using or disclosing such information.

Organ/tissue donation: If you’re an organ donor, we may use and disclose your health information to organizations that handle procurement, transplantation or banking of organs, eyes or tissues.

Coroners, medical examiners and funeral directors: We may use and disclose health information to a coroner or medical examiner.

This disclosure may be necessary to identify a deceased person or determine the cause of death. We may also disclose health information, as necessary, to funeral directors to assist them in performing their duties. If the use or disclosure involves reproductive health information or substance use disorder information, applicable law may restrict our ability to disclose such information or may require us to take certain steps before using or disclosing such information.

Workers’ compensation: We may disclose your health information as authorized by and to the extent necessary to comply with laws related to workers’ compensation or similar programs that provide beneﬁts for work-related injuries or illness.

Victims of abuse, neglect or domestic violence: We may disclose health information to the appropriate government authority if we believe a patient has been the victim of abuse, neglect or domestic violence. We’ll only make this disclosure if you agree, or when required or authorized by law.

Military and veterans’ activities: If you’re a member of the Armed Forces, we may disclose your health information to military command authorities. Health information about foreign military personnel may be disclosed to foreign military authorities.

National security and intelligence activities: We may disclose your health information to authorized federal oﬃcials for intelligence, counterintelligence and other national security activities authorized by law.

Protective services for the president and other specialized government functions: We may disclose your health information to authorized federal oﬃcials, so they may provide protective services for the president, or appropriate military command authorities, and others, including foreign heads of state, to the extent permitted by applicable law.

Inmates: If you’re an inmate of a correctional institution or under the custody of a law enforcement oﬃcial, we may disclose your health information to the correctional institution or law enforcement oﬃcial to assist them in providing your healthcare; protecting your health and safety, or the health and safety of others; or for the safety of the correctional institution.

Research: We may use and disclose your health information for certain research activities without your written authorization. For example, we might use some of your health information to decide if we have enough patients to conduct a research study. For certain research activities, an Institutional Review Board (IRB) or Privacy Board may approve uses and disclosures of your health information without your authorization.

Other uses and disclosures of your health information that require written authorization: Other uses and disclosures of your health information not covered by this Notice will be made only with your written authorization. Some examples include:

Psychotherapy notes: We usually do not maintain psychotherapy notes about you. If we do, we will only use and disclose them with your written authorization, except in limited situations.
Marketing: We may only use and disclose your health information for marketing purposes with your written authorization. This would include making treatment communications to you when we receive a ﬁnancial beneﬁt for doing so.
Sale of your health information: We may sell your health information only with your written authorization.

If you authorize us to use or disclose your health information, you may revoke your authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your health information as speciﬁed by your revocation, except to the extent that we have already taken action in reliance on your authorization.

Reproductive Health Care: To the extent we have information about a your reproductive health care, we may be prohibited from using or disclosing such information for any of the following activities: (1) investigations of you when you are merely seeking, obtaining, providing, or facilitating reproductive health care; (2) imposition of liability on you for merely seeking, obtaining, providing, or facilitating reproductive health care; and (3) identifying you for any of the purposes described in (1) and (2) immediately above.

However, applicable law may permit the use or disclosure of such information in certain instances. If we have information about your reproductive health care, our use or disclosure of such information will be as permitted by applicable law. For example, certain requestors, such as law enforcement, may need to provide a valid attestation to us before we can use or disclose your reproductive health care information for a health oversight activity, judicial or administrative proceeding, or, among others, law enforcement purposes.

Substance Use Disorder: To the extent we have information about your substance use disorder, including treatment records, we may be prohibited from using or disclosing such information. If a request for such information is related to a civil, criminal, administrative or legislative proceeding, we may be required to take certain steps before using or disclosing such information.

If we intend to use or disclose your substance use disorder information for fundraising purposes, we will provide you with a clear and conspicuous opportunity to opt-out or not receive such communications.

Your rights regarding your health information

You have the following rights regarding the health information we maintain about you:

Right to request restrictions: You have the right to request restrictions on how we use and disclose your health information for treatment, payment or healthcare operations. In most circumstances, we’re not required to agree to your request.

If we do agree, we’ll comply with your request unless the information is needed to provide you emergency treatment. To request restrictions, you must make your request in writing and submit it to Biologics by McKesson, c/o McKesson, Attn: HIPAA Privacy Oﬃcer, 11800 Weston Parkway, Cary, NC 27513.

We’re required to agree to a request that we restrict a disclosure made to a health plan for payment or healthcare operations purposes that is not otherwise required by law, if you, or someone other than the health plan on your behalf, paid for the service or item in question out-of-pocket in full.

Right to request conﬁdential communications: You have the right to request that we communicate with you in a certain manner or at a certain location regarding the services you receive from us. For example, you may ask that we only contact you at work or only by mail. To request conﬁdential communications, you must make your request in writing and submit it to Biologics by McKesson, c/o McKesson, Attn: HIPAA Privacy Oﬃcer, 11800 Weston Parkway, Cary, NC 27513. We will not ask you the reason for your request. We will attempt to accommodate all reasonable requests.

Right to inspect and copy: You have the right to inspect and copy health information that may be used to make decisions about your care. To inspect and copy your health information, you must make your request in writing by ﬁlling out the appropriate form provided by us and submitting it to Biologics by McKesson,

c/o McKesson, Attn: HIPAA Privacy Oﬃcer, 11800 Weston Parkway, Cary, NC 27513. You may request access to your medical information in a certain electronic form and format if readily producible or, if not readily producible, in a mutually agreeable electronic form and format.

Further, you may request in writing that we transmit a copy of your health information to any person or entity you designate. Your written, signed request must clearly identify such designated person or entity and where you would like us to send the copy.

If you request a copy of your health information, we may charge a cost-based fee for the labor, supplies and postage required to meet your request.

We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to your health information, you may request that the denial be reviewed by a licensed healthcare professional chosen by us. The person conducting the review will not be the person who denied your request. We will comply with the outcome of the review.

Right to amend: If you feel that your health information is incorrect or incomplete, you may request that we amend your information. You have the right to request an amendment for as long as the information is kept by or for us. To request an amendment, you must make your request in writing by ﬁlling out the appropriate form, provided by us, and submitting it to Biologics by McKesson, c/o McKesson, Attn: HIPAA Privacy Oﬃcer, 11800 Weston Parkway, Cary, NC, 27513. We may deny your request for an amendment. If this occurs, you will be notiﬁed of the reason for the denial and given the opportunity to ﬁle a written statement of disagreement with us that will become part of your medical record.

Right to an accounting of disclosures: You have the right to request an accounting of disclosures we make of your health information. Please note that certain disclosures need not be included in the accounting we provide to you. To request an accounting of disclosures, you must make your request in writing by ﬁlling out the appropriate form, provided by us, and submitting it to Biologics by McKesson, c/o McKesson, Attn: HIPAA Privacy Oﬃcer11800 Weston Parkway, Cary, NC. Your request must state a time period which may not be longer than six years, and which may not include dates before April 14, 2003. The ﬁrst accounting you request within a 12-month period will be free. For additional accountings, we may charge you for the costs of providing the accounting. We will notify you of the costs involved and give you an opportunity to withdraw or modify your request before any costs have been incurred.

Right to a paper copy of this Notice: You have the right to a paper copy of this Notice at any time, even if you previously agreed to receive this Notice electronically. To obtain a paper copy of this Notice, please contact Biologics by McKesson at 800.856.1984.

You may also obtain a paper copy of this Notice at our website, https://biologics.mckesson.com/privacy-practices.

Changes to this Notice

We reserve the right to change the terms of this Notice at any time. We reserve the right to make the new Notice provisions eﬀective for all health information we currently maintain, as well as any health information we receive in the future. If we make material or important changes to our privacy practices, we’ll promptly revise our Notice. We’ll post a copy of the current Notice at our location. Each version of the Notice will have an eﬀective date listed on the ﬁrst page. Updates to this Notice are also available at our website, https://biologics.mckesson.com/ privacy-practices.

Complaints

If you have any questions about this Notice or would like to ﬁle a complaint about our privacy practices, please direct your inquiries to: Biologics by McKesson, c/o McKesson, Attn: HIPAA Privacy Oﬃcer, 11800 Weston Parkway, Cary, NC, 27513 or ProviderSolutionsCompliance@McKesson.com. You may also ﬁle a complaint with the Secretary of the Department of Health and Human Services. You will not be retaliated against or penalized for ﬁling a complaint.

Questions

If you have questions about this Notice, please contact the HIPAA Privacy Oﬃcer at ProviderSolutionsCompliance@McKesson.com