Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

By law, Alto must protect the privacy of your identifiable medical and other health information ("health information"). Alto also is required by law to give you this notice to tell you how we may use and give out ("disclose") your health information. Alto must follow the terms of this notice when using or disclosing your health information.

As a general rule, you must give written permission before Alto can use or release your health information. There are certain situations where Alto is not required to obtain your permission. This section explains those situations where Alto may use or disclose your health information without your permission.

Except with respect to Highly Confidential Information (described below), Alto is permitted to use your health information for the following purposes:

Treatment: We use and disclose your health information to provide you with medical treatment or services. This includes uses and disclosures to:

• treat your illness or injury, including disclosures to other doctors, practitioners, nurses, technicians or medical personnel involved in your treatment, or
• contact you to provide appointment reminders, or
• give you information about treatment options or other health related benefits and services that may interest you.

Payment: We may use and disclose your health information to obtain payment for health care services that we or others provide to you. This includes uses and disclosures to:

• submit health information and receive payment from your health insurer, HMO, or other company that pays the cost of some or all of your health care (payer), or
• verify that your payer will pay for your health care.

However, we will comply with your request not to disclose health information to your health plan if the information relates solely to a healthcare item or service for which we have been paid out of pocket in full.

Health Care Operations: We may use and disclose your health information for our health care operations, such as internal administration and planning that improve the quality and cost effectiveness of the care we provide you. This also include uses and disclosures to:

• evaluate the quality and competence of our health care providers, nurses and other health care workers,
• to other health care providers to help them conduct their own quality reviews, compliance activities or other health care operations,
• train students, residents and fellows, or
• identify health-related services and products that may be beneficial to your health and then contact you about the services and products.

We may also disclose your health information to third parties to assist us in these activities (but only if they agree in writing to maintain the confidentiality of your health information). In addition, Alto may use and disclose your health information under the following circumstances:

Organized Health Care Arrangement: Alto may share information with its OHCA members for treatment, payment and joint health care operations.

Directory: Alto may include your name, location in its hospitals, general health condition and religious affiliation in a patient directory without obtaining your authorization unless you object to inclusion in the directory. Information in the directory may be disclosed to anyone who asks for you by name or members of the clergy; provided, however, that your religious affiliation will only be disclosed to members of the clergy.

Relatives, Caregivers and Personal Representatives: Under appropriate circumstances, including emergencies, we may disclose your health information to family members, caregivers or personal representatives who are with you or appear on your behalf (for example, to pick up a prescription). We may also need to notify such persons of your location in our facility and general condition. If you object to such disclosures, please notify your Alto health care provider. If you are not present, or the opportunity to agree or object to a use or disclosure cannot practicably be provided because of your incapacity or an emergency circumstance, we may exercise professional judgment to determine whether a disclosure is in your best interests. If information is disclosed to a family member, other relative or a close personal friend, we would disclose only information believed to be directly relevant to the person’s involvement with your health care or payment related to your health care.

Public Health Activities: We may disclose your health information for the following public health activities:

• To report to public health authorities for the purpose of preventing or controlling disease, injury or disability;
• To report child abuse and neglect to public health authorities or other government authorities authorized by law to receive such reports;
• To report information to the U.S. Food and Drug Administration (FDA) about products and services under its jurisdiction;
• To alert a person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease; or
• To report information to your employer as required under laws addressing work-related illnesses and injuries or workplace medical surveillance.

Victims of Abuse, Neglect or Domestic Violence: If we reasonably believe that you are a victim of abuse, neglect or domestic violence, we may disclose your health information as required by law to a social services or other governmental agency authorized by law to receive such reports.

Health Oversight Activities: We may disclose your health information to a health oversight agency that is charged with responsibility for ensuring compliance with the rules of government health programs such as Medicare or Medicaid.

Specialized Government Functions: We may use and disclose your health information to units of the government with special functions, such as the U.S. military, under certain circumstances required by law.

Law Enforcement Officials, Judicial and Administrative Proceedings: We may disclose health information to police or other law enforcement officials. We also may disclose health information in judicial or administrative proceedings, such as in response to a subpoena.

Coroners or Medical Examiners: We may disclose health information to a coroner or a medical examiner as required by law.

Organ and Tissue Donation: We may disclose health information to organizations that assist with organ, eye or tissue donation, banking or transplant.

Health or Safety: We may disclose health information to prevent a serious threat to your health and safety or the health and safety of the public or another person.

Development Activities: We may contact you to request a contribution to support important Alto activities. For fundraising, we may disclose to our fundraising staff demographic information about you (for example, your name, address and phone number), dates on which we provided health care to you, information about the department of service or treating physician, outcome information or health insurance status without your written permission. We also may share such information about you with closely related foundations that assist us in our development activities. We will provide you an opportunity to opt-out of receiving fundraising communications. We will not disclose your diagnosis or treatment, however, unless we have your written authorization to do so.

Marketing Activities: We may conduct the following activities without obtaining your authorization:

• Provide you with marketing materials in a face-to-face encounter;
• Give you a promotional gift of nominal value;
• Provide refill reminders or otherwise communicate about a drug or biologic that is currently prescribed to you, so long as any payments we receive for making the communication are reasonably related to our costs;
• Tell you about Alto’s own health care products and services If we accept payments from other organizations or individuals in exchange for telling you about their health care products or services, we will ask for your authorization, except as described above or unless the communications are permitted by law without your permission. We will ask your permission to use your health information for any other marketing activities. Also, from time to time, Alto receives letters from patients, their family members and friends describing the experience and care they received at Alto. Where possible, we share these letters with our Alto employees and patients. Prior to sharing your letter, we will remove your name and other identifying information from the letter to protect your privacy.

Workers’ Compensation: We may disclose health information as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs or as required under laws relating to workplace injury and illness.

As Required by Law: We may disclose health information when required to do so by any other law not already referred to in the preceding categories.

For any purpose other than the ones described above we may only use or disclose your protected health information when you give us your written authorization.

Highly confidential information

Federal and state law require special privacy protections for certain highly confidential information about you (“Highly Confidential Information”), including your health information that is maintained in psychotherapy notes or is about: (1) mental health and developmental disabilities services; (2) alcohol and drug abuse prevention, treatment and referral; (3) HIV/AIDS testing, diagnosis or treatment; (4) communicable disease(s); (5) genetic testing; (6) child abuse and neglect; (7) domestic or elder abuse; or (8) sexual assault. In order for your Highly Confidential Information to be disclosed for a purpose other than those permitted by law, your written authorization is required.

Sale of health information

We will not make any disclosure that is considered a sale of your protected health information without your written authorization unless the disclosure is for a purpose permitted by law.

Right to Request Access to Your Health Information: You have the right to inspect and maintain a copy of the patient records we maintain to make decisions about your treatment and care, including billing records. All requests for access must be made in writing. Under limited circumstances, we may deny you access to your records. If you would like access to your records, please ask your healthcare provider for the appropriate form to complete. If you request copies, we will charge you a reasonable fee for copies. We also will charge you for our postage costs, if you request that we mail the copies to you. If you are a parent or legal guardian of minor, certain portions of the minor’s medical record may not be accessible to you under California law.

Right to Request Amendments to Your Health Information: You have the right to request that we amend your health information maintained in your medical record file or billing records. If you wish to amend your records, please obtain an amendment request form from your healthcare provider. All requests for amendments must be in writing. We will comply with your request unless we believe that the information that would be amended is already accurate and complete or other special circumstances apply.

Right to Revoke Your Authorization: You may revoke (take back) any written authorization obtained by us for use and disclosure of your protected health information, except to the extent that we have taken action in reliance upon it. Your revocation must be in writing and sent to the Alto Office of Compliance or to whoever is indicated on your authorization.

Right to An Accounting of Disclosures of Your Health Information: Upon written request, you may obtain a list (accounting) of certain disclosures of health information made by us. The period of your request cannot exceed six years. If you request an accounting more than once during a twelve (12) month period, we will charge you a reasonable fee.

Right to Request how Information is Provided to You: You may request, and we will try to accommodate, any reasonable written request for you to receive health information by alternative means of communication or at a different address or location.

Right to Request Restrictions on the use of your Health Information: You may request that we restrict the use or disclosure of your protected health information. All requests for such restrictions must be made in writing. While we will consider a request for additional restrictions carefully, we are not required to agree to a requested restriction, except for requests to restrict disclosure of information to a health plan in cases where you have paid for the service out of pocket and in full.

Right to be Notified of Breach: You have the right to be notified by us if we discover a breach of your unsecured protected health information.

Right to a Paper Copy of this Notice: Upon request, you may obtain a paper copy of this Notice, even if you have agreed to receive such information electronically.

We may change the terms of this notice at any time. If we change this notice, we may make the new notice terms effective for all health information that we hold, including any information created or received prior to issuing the new notice. If we change this notice, we will post the revised notice in our practice areas and on our website. You may also obtain any revised notice by contacting the Alto Office of Compliance.

If you would like additional information about your privacy rights, are concerned that we have violated your privacy rights or disagree with a decision that we made about access to health information, you may contact our Alto Office of Compliance. You may also file written complaints with the Director, Office for Civil Rights of the U.S. Department of Health and Human Services. Upon request, the Alto Office of Compliance will provide you with the current address for the Director. We will not retaliate against you if you file a complaint with us or the Director.

Alto Office of Compliance

Amil Patel, PharmD
Pharmacist-in-charge
Alto Pharmacy
1400 Tennessee St, Unit 2
San Francisco, California 94107

Email Address: privacy@alto.com

Telephone number: 1 (800) 874-5881