Your Health Information,
Your Rights, Our Duties

Identity of Covered Entity

Community Chemists (hereinafter “the Pharmacy”) is an independent retail pharmacy located at 436 Avenue P, Brooklyn, New York 11223. The Pharmacy provides prescription dispensing services, compounding, immunizations, durable medical equipment (DME) supply, home delivery, and health consultations to the communities of Brooklyn and the greater New York metropolitan area.

The Pharmacy constitutes a Covered Entity as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 42 U.S.C. § 1320d et seq., and the implementing regulations promulgated thereunder at 45 C.F.R. Parts 160 and 164. As a Covered Entity, the Pharmacy is subject to the HIPAA Privacy Rule, the HIPAA Security Rule, the HIPAA Breach Notification Rule, and all applicable amendments thereto, including those effectuated by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), Pub. L. 111–17, and the 2026 HIPAA Privacy Rule Amendments effective February 16, 2026.

Key Definitions

As used in this Notice, the following terms shall have the meanings ascribed herein:

Permitted Uses and Disclosures of Protected Health Information

Pursuant to 45 C.F.R. § 164.502, the Pharmacy may use and disclose PHI, without your written authorization, for the following purposes:

A. Treatment

The Pharmacy may use and disclose your PHI to provide, coordinate, or manage your pharmaceutical care and any related health care services.

B. Payment

The Pharmacy may use and disclose your PHI to obtain reimbursement for pharmaceutical products and services, to determine coverage eligibility, and to coordinate benefits.

C. Health Care Operations

The Pharmacy may use and disclose your PHI for internal administrative, quality assurance, compliance, and business management purposes.

D. Additional Legally Permitted Disclosures

In addition to the foregoing, the Pharmacy may use or disclose your PHI without your written authorization in the following circumstances, subject to applicable legal requirements and the minimum necessary standard:

• Public Health and Safety Activities: Reporting to the New York City Department of Health and Mental Hygiene, the New York State Department of Health, or the Centers for Disease Control and Prevention (CDC) for communicable disease surveillance, adverse drug event monitoring, child or elder abuse reporting, and similar public health functions, as required or authorized by law.
• Health Oversight Activities: Disclosure to federal or state agencies, including the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), the Drug Enforcement Administration (DEA), or the New York State Division of Consumer Protection, conducting authorized audits, investigations, inspections, or licensure proceedings.
• Judicial and Administrative Proceedings: Disclosure in response to a valid court order, subpoena, or administrative order, provided appropriate procedural safeguards are in place.
• Law Enforcement: Disclosure to law enforcement officials pursuant to a lawful process, including court-ordered warrants, subpoenas, or requests meeting specific HIPAA criteria. 45 C.F.R. § 164.512(f).
• Coroners, Medical Examiners, and Funeral Directors: To identify a deceased individual or to determine the cause of death, to the extent permitted by law.
• Organ, Eye, and Tissue Donation: To organ procurement organizations and similar entities to facilitate organ transplantation.
• Research: To approved research programs that have obtained a proper waiver of authorization from an Institutional Review Board (IRB) or Privacy Board, or that meet other applicable HIPAA research exceptions.
• Serious Threats to Health or Safety: To prevent or lessen a serious and imminent threat to the health or safety of a person or the public, consistent with ethical and legal standards. 45 C.F.R. § 164.512(j).
• Specialized Government Functions: For military and veterans’ activities, national security and intelligence operations, and protective services for the President, as authorized by applicable law.
• Workers’ Compensation: As required by New York Workers’ Compensation Law, to the extent necessary for compliance with such programs.
• Inmates and Correctional Institutions: If you are an inmate, to a correctional facility or law enforcement official, to the extent required for the provision of health care.
• Required by Law: Any disclosure expressly mandated by applicable federal, state, or local statute or regulation.

Uses and Disclosures Requiring Your Written Authorization

Except as otherwise permitted by applicable law, the Pharmacy will not use or disclose your PHI for the following purposes without obtaining your valid, written authorization pursuant to 45 C.F.R. § 164.508:

• Marketing communications involving any financial remuneration to the Pharmacy from a third party in connection with such communications;
• Sale of your PHI to any third party;
• Psychotherapy notes, except as authorized under 45 C.F.R. § 164.508(a)(2);
• Any use or disclosure not otherwise described in this Notice or permitted by applicable law.

Right to Revoke Authorization

You have the right to revoke any authorization you have previously provided to the Pharmacy at any time, in writing, delivered to the Privacy Officer identified in Section VIII of this Notice. A revocation of authorization will be effective prospectively from the date of receipt; it shall not affect any uses or disclosures made in reliance upon the authorization prior to receipt of the written revocation, nor shall it apply where the Pharmacy has taken action in reliance thereon.

Your Rights with Respect to Your Protected Health Information

Pursuant to the HIPAA Privacy Rule, 45 C.F.R. §§ 164.522–164.528, you have the following rights with respect to your PHI maintained by the Pharmacy. All requests must be submitted in writing to the Privacy Officer. The Pharmacy will respond within the time periods mandated by federal law.

A. Right of Access (45 C.F.R. § 164.524)

You have the right to inspect and obtain a copy of your PHI maintained by the Pharmacy in a designated record set. We will provide access within thirty (30) days of receiving your written request (with one permissible thirty (30)-day extension upon written notice to you). We may charge a reasonable, cost-based fee for copying, postage, and summarizing costs. The Pharmacy may deny access in limited circumstances prescribed by law; in such event, you may request review of the denial by a licensed health care professional designated by the Pharmacy.

B. Right to Amend (45 C.F.R. § 164.526)

You have the right to request amendment of PHI you believe to be inaccurate or incomplete for as long as the PHI is maintained by the Pharmacy. The Pharmacy may deny your request if: (i) the Pharmacy did not create the PHI, unless the originating party is no longer available; (ii) the PHI is not part of a designated record set; (iii) the PHI is not available for inspection under applicable law; or (iv) the PHI is determined to be accurate and complete. If denied, you may submit a written statement of disagreement.

C. Right to an Accounting of Disclosures (45 C.F.R. § 164.528)

You have the right to receive an accounting of certain disclosures of your PHI made by the Pharmacy during the six (6) years preceding the date of your request. This right does not extend to disclosures made for treatment, payment, health care operations, or pursuant to your authorization, among other exceptions specified in 45 C.F.R. § 164.528(a)(1). The Pharmacy will provide the first accounting in any twelve (12)-month period at no charge; subsequent requests within that period may be subject to a reasonable cost-based fee.

D. Right to Request Restrictions (45 C.F.R. § 164.522)

You have the right to request that the Pharmacy restrict uses or disclosures of your PHI for treatment, payment, or health care operations purposes, or disclosures to persons involved in your care. The Pharmacy is not required to agree to requested restrictions, except that it must honor a request to restrict disclosure to a health plan where: (i) the disclosure is for the purpose of carrying out payment or health care operations; and (ii) you or another person on your behalf has paid for the item or service in full, out of pocket, at the time of service.

E. Right to Confidential Communications (45 C.F.R. § 164.522(b))

You have the right to request that the Pharmacy communicate your PHI through a specific means or to a specific location (e.g., by telephone only, at a specified address). The Pharmacy will accommodate all reasonable requests without requiring an explanation. Requests should specify the alternative means or location and include a statement that disclosure at the standard address or by standard means could endanger the requestor.

F. Right to a Paper Copy of This Notice (45 C.F.R. § 164.520(c))

You have the right to obtain a printed copy of the current version of this Notice at any time, upon request, even if you have previously acknowledged receipt of the Notice or received it electronically. Current and prior versions of this Notice are available at the Pharmacy and on the Pharmacy’s website at communitychemists.com.

G. Right to Notification of Breach (45 C.F.R. §§ 164.404–164.412)

In the event the Pharmacy discovers a breach of your unsecured PHI, you will be notified without unreasonable delay and in no event later than sixty (60) calendar days after discovery of the breach, by first-class mail or electronic mail (with your prior agreement). Notification will include: a description of the breach, the types of PHI involved, the steps you should take to protect yourself, the Pharmacy’s mitigation efforts, and contact information for the Privacy Officer.

Website and Electronic Communications Privacy

A. Website Data Collection

The Pharmacy’s website (communitychemists.com) may automatically collect standard server log data, including Internet Protocol (IP) addresses, browser type, referring URLs, and page access timestamps. This information is collected solely for purposes of website administration, security, and service improvement. The Pharmacy does not sell, trade, rent, or otherwise transfer this information to third parties for commercial purposes.

B. Online Prescription Refill Services

Where the Pharmacy offers online prescription refill submission, any PHI transmitted through such services is encrypted using industry-standard Transport Layer Security (TLS) protocols and stored on access-controlled, secured servers. Access to transmitted information is restricted to authorized Pharmacy personnel for the purpose of processing prescription requests.

C. Electronic and SMS Communications

Where you elect to receive prescription notifications, medication reminders, or health communications via electronic mail or Short Message Service (SMS), you acknowledge that such channels may not provide end-to-end encryption equivalent to secure health care portals. You are strongly advised not to include sensitive clinical information in standard electronic mail or SMS communications directed to the Pharmacy. You may withdraw consent to receive such communications at any time by notifying pharmacy staff in person, by telephone at (718) 339-8118, or by electronic mail at communitychemists@gmail.com.

D. Cookies and Web Technologies

The Pharmacy’s website may employ cookies and similar technologies for session management and user preference storage. The Pharmacy does not employ behavioral advertising technologies, cross-site tracking, or share cookie data with third-party advertisers. Users may configure browser settings to decline cookies, with the understanding that certain website functionalities may be affected.

E. Third-Party Websites

The Pharmacy’s website may contain hyperlinks to third-party websites, including insurance carrier portals, government health resources, and pharmaceutical information services. The Pharmacy assumes no responsibility for the privacy practices or content of such third-party websites and encourages patients to review the applicable privacy notices before submitting any personal or health information.

Legal Duties of the Pharmacy

The Pharmacy is required by federal law to:

• Maintain the privacy and security of your PHI in accordance with the HIPAA Privacy Rule and Security Rule;
• Provide you with this Notice of Privacy Practices upon your first request for pharmacy services and make the Notice available at the Pharmacy and on the Pharmacy’s website at all times;
• Abide by the terms of the Notice currently in effect;
• Notify you in the event of a breach of your unsecured PHI in accordance with the HIPAA Breach Notification Rule, 45 C.F.R. Part 164, Subpart D;
• Train all members of the workforce who handle PHI on applicable HIPAA privacy and security policies and procedures.

The Pharmacy reserves the right to amend this Notice at any time in accordance with applicable law. Any material revision to this Notice will be posted at the Pharmacy, published on the Pharmacy’s website (communitychemists.com), and made available in paper form upon request. Revisions shall apply prospectively to all PHI in the Pharmacy’s possession. The effective date of any revision will be reflected on the face of the updated Notice.

Privacy Officer and Contact Information

To submit a request to exercise any of your rights under this Notice, to obtain a paper copy of this Notice, or to report a concern regarding the Pharmacy’s privacy practices, please contact the Privacy Officer:

Filing a Complaint with the Federal Government

If you believe that the Pharmacy has violated your rights under the HIPAA Privacy Rule, you are entitled to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR), without retaliation or adverse action by the Pharmacy. Complaints may be filed as follows:

Effective Date and Amendments

This Notice is effective as of April 23, 2026, and supersedes all prior versions of the Pharmacy’s Notice of Privacy Practices. The Pharmacy reserves the right to modify the terms of this Notice at any time, consistent with applicable law. Such modifications shall be effective with respect to all PHI maintained by the Pharmacy, including PHI created or received prior to the effective date of the amendment.