Specialty Pharmacy Welcome Booklet 2025 | Page 22

2. A court order is issued after you have been given notice and an opportunity to be heard, and the court order is accompanied by a subpoena or other legal process compelling disclosure, as required under Part 2.

� Limitation on redisclosure. If we or a permitted recipient disclose your SUD records under a Part 2- compliant consent for treatment, payment, or health care operations, that recipient( if a covered entity or business associate) may only redisclose those records consistent with the HIPAA rules and the limitations imposed by Part 2( i. e., not for legal proceedings against you absent separate consent or court order).

�

�

�

�

Fundraising communications. We( or a covered entity that receives SUD records) will not use your SUD-related information for fundraising purposes.

Right to request restrictions. You may request that we restrict certain uses or disclosures of your SUD records for treatment, payment, or health care operations consistent with Part 2 and HIPAA. We are not obligated to agree to every request, but if Part 2 grants you the right to restrict such uses or disclosures, we will follow the restriction( unless otherwise required by law).

Right to an accounting of disclosures. You have the right to receive an accounting of certain disclosures of your SUD records made in the past three years, to the extent required by Part 2.

Right to file a complaint. You may file a complaint with us or with the Secretary of Health and Human Services if you believe your Part 2 confidentiality rights have been violated. We will not retaliate against you for filing a complaint.

How to Exercise These Rights To request any of the above, or for more information, please contact an Entity Privacy Coordinator using the information provided below. We will provide you with a written response in accordance with applicable law and within required timeframes.

� Individuals Involved in Your Care or Payment for Your Care. We may release health information about you to a friend, family member, or other person identified by you who is involved in your medical care or helps pay for your care. We may also share information with family or friends to let them know your condition and that you are receiving care at our facility. In addition, we may disclose your health information to a public or private organization authorized to assist in disaster relief efforts so that your family or others responsible for your care can be notified about your condition, status, and location. You have the right to request that we not disclose your health information to your friends or family members. We will consider your request and honor it when possible, unless disclosure is otherwise permitted or required by law, such as when you are unable to agree or object and we determine that disclosure is in your best interest.

� Appointment Reminders and Health-Related Benefits and Services. We may use and disclose health information to contact you about appointments, treatment options, and other health-related benefits or services available from UAB Medicine Enterprise. We may contact you by mail, telephone, text, or email or through the patient portal. For example, we may leave a voice message or send a text reminder to you about upcoming appointments at the telephone number you provide, send a secure message through the patient portal regarding a prescription sent to your pharmacy, or mail you information about services or programs that may be of interest to you. We will not send you communications that constitute marketing under the HIPAA Privacy Rule without your written authorization, except as permitted by law( for example, face-to-face communications or promotional gifts of nominal value).

� Research. We may use and disclose your health information for medical research. All research involving patient information must go through a special review process required by law to protect patient privacy, such as review and approval by an Institutional Review Board or Privacy Board. In most cases, patient authorization is required before health information is used for research. However, in certain circumstances your authorization is not required – for example, when the research involves reviewing patient records to compare the outcomes of different treatments for the same condition, without contacting the patients directly. Some research may also use health information that has been de-identified or provided as a limited data set that does not directly identify you.