THIS NOTICE OF PRIVACY PRACTICES DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This Notice of Privacy Practices (“Notice”) describes the privacy practices of KPH Healthcare Services, Inc. d/b/a Kinney Drugs (“Kinney Drugs”). In this Notice, we may also refer to Kinney Drugs as “we”, “us”, or “our”.
Kinney Drugs is required by law to maintain the privacy of Protected Health Information (“PHI”), to provide individuals with notice of our legal duties and privacy practices with respect to PHI, and to notify you in the event there is a breach of your PHI. PHI is information that may identify you and that relates to your past, present, or future physical or mental health or condition, the provision of health care products and services to you, or payment for such services. This Notice describes how we may use and disclose PHI to carry out treatment, payment or health care operations and for other specified purposes that are permitted or required by law. It also describes your rights with respect to your PHI. This Notice does not apply to health information that does not directly identify you and cannot reasonably be used indirectly to identify you.
Kinney Drugs is required to provide you this Notice by the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”) and its implementing regulations. Some state or federal laws may require additional privacy protections for certain types of PHI. For example, some types of sensitive PHI, such as HIV information, genetic information, alcohol and substance abuse records, reproductive health care, and mental health records may be subject to additional confidentiality protections. It is the intention of Kinney Drugs to follow the most restrictive laws which are applicable to us. If you would like additional information on the use or disclosure of sensitive categories of PHI, please contact the Kinney Drugs Privacy Office.
Kinney Drugs, and all of our employees and workforce members who have access to your PHI and/or are involved in the provision of services to you, are required to follow the terms of this Notice. We will not use or disclose PHI about you without your written authorization, except as described in this Notice. We reserve the right to change our practices and this Notice and to make the new Notice effective for all PHI we maintain. If we do so, the updated Notice will be posted on our website and be available at our pharmacy locations. Upon request, we will provide any revised Notice to you.
YOUR RIGHTS REGARDING YOUR PHI:
You have the following rights with respect to your PHI:
Obtain a copy of this Notice upon request. You have the right to obtain a paper or electronic copy of this Notice at any time. Even if you have agreed to receive the Notice electronically, you are still entitled to a paper copy. You may obtain a paper copy at any Kinney Drugs location or by contacting our Privacy Office. You may also obtain a copy of the Notice from our website: https://www.kinneydrugs.com/contact-us/KD-NPP/).
Inspect and obtain a copy of PHI. You have the right to access, inspect, and obtain a copy of your PHI contained in a designated record set for as long as we maintain the PHI with limited exceptions. If we maintain an electronic health record containing your PHI, you have the right to request that we send a copy of your PHI in electronic form to you or a third party that you identify. To inspect or obtain a copy of your PHI, you must send a written request to our Privacy Office. We may charge you a reasonable, cost-based fee for the costs of copying, mailing, and supplies that are necessary to fulfill your request. We may deny your request to inspect and copy your PHI in certain limited circumstances. If we do, we will notify you in writing and let you know if you may request a review of the denial.
Request a restriction on certain uses and disclosures of PHI. You have the right to request additional restrictions on our use or disclosure of your PHI by sending a written request to our Privacy Office. We are not required to agree to those restrictions. However, you have the right to ask us to restrict the disclosure of PHI to your health plan for a service we provide to you where you have directly paid us (out of pocket, in full) for that service, in which case we must honor your request unless state or federal law requires us to share that information. Future services without a restriction request and for which no out-of-pocket payment is received will be billed per Kinney Drugs policy and may include information that references prior services previously restricted.
Request an amendment of PHI. If you feel that PHI we maintain about you is incomplete or incorrect, you may request that we amend it. To request an amendment, you must send a written request to our Privacy Office. You must include a reason that supports your request. In certain cases, we may deny your request for amendment. If we deny your request for amendment, you have the right to file a statement of disagreement with the decision, and we may give a rebuttal to your statement.
Receive an accounting of disclosures of PHI. You have the right to request a list of certain disclosures we have made of your PHI for most purposes other than treatment, payment, or health care operations. This list is called an “accounting.” The accounting will exclude certain disclosures, such as disclosures made directly to you, disclosures you authorize, disclosures to friends or family members involved in your care, and disclosures for notification purposes. The right to receive an accounting is subject to certain other exceptions, restrictions, and limitations. To request an accounting, you must submit a request in writing to our Privacy Office. Your request must specify the time period but may not be longer than six years prior to the date of your request. The first accounting you request within a 12-month period will be provided free of charge, but you may be charged for the cost of providing additional accountings within the same 12-month period. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time.
Request confidential communications of PHI. You have the right to request that we communicate your health information to you in a specific way (such as by email or text message) or at an alternative address. To request confidential communications, please submit a written request to our Privacy Office stating how or where you would prefer to be contacted. We will accommodate reasonable requests. If you have a digital account, you may manage your communication preferences there. Please note that messages sent by unencrypted email, text message, or through a connection you authorize with a third‑party app or service (sometimes called an application programming interface, or “API”) may not be secure or confidential. Your information could be accessible to your internet service provider, mobile carrier, the app or service you chose to connect, or anyone who has access to your device.
If you direct us to send your PHI electronically or through an app or third‑party service that connects to your pharmacy information through an API, you understand that your information may no longer be protected by HIPAA once it leaves our systems and may not be subject to the same privacy or security requirements. You accept the risks associated with these transmission methods. We encourage you to review the privacy and security practices of any app or service before asking us to send PHI using these methods.
Request someone to make these requests on your behalf. If you have given someone the authority to make medical decisions for you or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI.
USES AND DISCLOSURES OF PHI
WITHOUT YOUR PRIOR AUTHORIZATION:
Except where prohibited by federal or state laws that require special privacy protections, the following are descriptions and examples of ways we use and disclose PHI without your prior authorization; however, not every permissible use or disclosure will be listed in this Notice. In all cases, including those listed below, if we have substance use disorder patient records about you, subject to 42 CFR Part 2, we cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without your consent or a court order that complies with Part 2 requirements.
Treatment. We may use and share your PHI for treatment purposes, including helping you access medication and services. For example, we will use PHI to dispense prescription medications to you.
Payment. We may use and share your PHI for payment of prescription medications. For example, we will contact your insurer, pharmacy benefit manager, or other health care payor to determine whether it will pay for your prescription and the amount of your co-payment.
Health care operations. We may use and share your PHI for our health care operations, such as performing quality checks or internal audits and for other activities related to our healthcare business. For example, we may use information in your health record to monitor the performance of the pharmacists providing treatment to you.
OTHER USES OR DISCLOSURES OF YOUR PHI:
Your PHI may be used and disclosed without your prior authorization in connection with the following specified purposes:
Other members of our Affiliated Covered Entity: Kinney Drugs is part of an Affiliated Covered Entity (the “KPH ACE”). The KPH ACE is a group of legally separate health care providers and organizations that have designated themselves as a single entity under the HIPAA Privacy Rule. Although Kinney Drugs is a member of the KPH ACE and may share your PHI with other members of the KPH ACE as permitted by HIPAA for treatment, payment, and health care operations, this Notice describes only the privacy practices of Kinney Drugs. Other members of the KPH ACE may maintain separate Notices of Privacy Practices that apply to their own privacy practices.
Business Associates: We may provide your PHI to other companies or individuals to assist us in providing specific services. These other entities, known as “business associates,” are required by law and their agreements with us to maintain the privacy, integrity and security of PHI in accordance with HIPAA regulations. Examples of business associates include billing services, collection agencies, and pharmacy software and system providers.
Communication with individuals involved in your care or payment for your care: Health professionals such as pharmacists, using their professional judgment, may disclose to a family member, other relative, close personal friend or any person you identify, PHI relevant to that person's involvement in your care or payment related to your care. For example, we may allow a friend or family member to pick up a prescription on your behalf. In addition, we may disclose health information of minor children to their parents or guardians unless such disclosure is otherwise prohibited by law.
Automated Communications: When you provide your telephone number to us, we may send automated pharmacy notification and reminder services including artificial and/or pre-recorded voice calls and/or text messages (SMS, MMS, and RCS) regarding your prescriptions, refill reminders, vaccines and other pharmacy related subjects. Both calls and texts may include PHI, including the name of your medication, and may be accessible to your carrier and anyone who has access to your phone, and therefore not confidential. You may opt-out of the notifications by following the process set forth by us or our business associate in your digital account, or by asking your local Kinney Drugs pharmacy how to do this.
Food and Drug Administration (FDA): We may disclose to the FDA, or persons under the jurisdiction of the FDA, PHI relative to adverse events with respect to drugs, foods, supplements, products and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.
Worker's compensation: We may disclose your PHI as authorized by and as necessary to comply with laws relating to workers’ compensation or similar programs established by law.
Public health and safety purposes: As required or permitted by law, we may disclose your PHI to public health or legal authorities charged with preventing or controlling disease, injury, or disability.
As required by law: We must disclose your PHI when required to do so by federal, state or local law.
Health oversight activities: We may disclose your PHI to an oversight agency for activities authorized by law. These oversight activities include audits, investigations, and inspections, as necessary for our licensure and for the government to monitor the health care system, government programs, and compliance with civil rights laws.
Law enforcement and judicial or administrative proceedings: If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose your PHI in response to a valid subpoena, discovery request, or other lawful process as authorized or required by law. Substance use disorder records are subject to additional protections described above.
Research: We may disclose your PHI to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your information.
Coroners, medical examiners, and funeral directors: We may release your PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also disclose PHI to funeral directors consistent with applicable law to carry out their duties.
Organ or tissue procurement organizations: Consistent with applicable law, we may disclose your PHI to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.
Fundraising: We may use or disclose your limited PHI for fundraising activities. If you receive a fundraising communication from us or a foundation on our behalf, the communication will contain a clear and conspicuous opportunity for you to elect not to receive any further fundraising communications. Your decision will have no impact on the services you receive from us. If we have your substance use disorder patient records, subject to 42 CFR Part 2, we will give you clear and obvious notice in advance and a choice about whether to receive fundraising communications that use information in those records.
Notification: We may use or disclose PHI about you to notify or assist in notifying a family member, personal representative, or another person responsible for your care, your location, and your general condition.
Correctional institution: If you are or become an inmate of a correctional institution, we may disclose PHI to the institution or its agents when necessary for your health or the health and safety of others.
To avert a serious threat to health or safety: We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person.
Military and veterans: If you are a member of the armed forces, we may release PHI about you as required by military command authorities as authorized or required by law. We may also release PHI about foreign military personnel to the appropriate military authority as authorized or required by law.
National security and intelligence activities: We may release your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized or required by law.
Victims of abuse, neglect, or domestic violence: We may disclose your PHI to a government authority, such as a social service or protective services agency, if we reasonably believe you are a victim of abuse, neglect, or domestic violence. We will only make this disclosure as authorized or required by law.
Incidental Uses/Disclosures. In order to ensure that communications essential to providing quality pharmacy services are not hindered, incidental disclosures may occur. For example, we may need to use your name and birthdate to identify you when picking up your prescription and other individuals in the same area may overhear this information. We will make reasonable efforts to limit these incidental disclosures.
Use of Artificial Intelligence (AI). We may use your PHI in AI tools and models to facilitate your treatment and care, run and improve our operations, and for other reasons allowed by law and set forth in this notice. If we use your PHI in an AI tool or model, we will use appropriate safeguards to protect the privacy, security and integrity of your PHI. We will seek your additional consent when required by law.
USES AND DISCLOSURES OF PHI REQUIRING YOUR AUTHORIZATION:
We will obtain your written authorization before using or disclosing your PHI for purposes other than those provided for above or as otherwise permitted or required by law.
We will obtain your written authorization before using or disclosing your PHI for marketing purposes (as defined in HIPAA), except in limited cases where applicable law allows the use or disclosure without your authorization. We are prohibited from selling your PHI without your prior authorization.
If you do authorize us to use or disclose your PHI for another purpose, you may revoke an authorization in writing at any time by writing to the Privacy Officer identified below. Upon receipt of the written revocation, we will stop using or disclosing your PHI, except to the extent that we have already taken action in reliance on the authorization.
NOTICE TO MINORS
If you are a minor who has lawfully provided consent for treatment and you wish that we treat you as an adult for purposes of access to, and disclosure of, records related to such treatment, please notify a pharmacist at your local Kinney Drugs pharmacy or our Privacy Office.
ADDITIONAL RIGHTS FOR RESIDENTS OF NEW YORK:
If you are a New York State resident, we are required to obtain your consent to fill your current and future prescriptions through a shared pharmacy arrangement. In such an arrangement, the pharmacist who prepares your medication may be different from the pharmacist who ultimately dispenses it to you. Upon request, the pharmacy can provide additional information about how shared pharmacy arrangements work.
By signing to acknowledge receipt of this Notice, you are providing consent for your prescriptions to be filled through a shared pharmacy arrangement. You are not required to give this consent and may opt out of shared pharmacy services at any time by contacting: privacyofficer@kphhealthcareservices.com
TO SUBMIT REQUESTS, ASK FOR MORE INFORMATION OR TO REPORT A PROBLEM:
To make requests, or if you have questions or would like additional information about Kinney Drugs’s privacy practices, you may contact us at our Privacy Office:
KPH Healthcare Services, Inc. (d/b/a Kinney Drugs)
6333 State Route 298, Suite 208,
East Syracuse, NY 13057
Attn: Privacy Officer
privacyofficer@kphhealthcareservices.com
If you believe your privacy rights have been violated, you can file a complaint with the Privacy Officer at the address or email provided above. There will be no retaliation for filing a complaint.
You may also file a complaint with the DHHS using the following contact information:
Centralized Case Management Operations
U.S. Department of Health and Human Services
200 Independence Avenue, S.W.
Room 509F HHH Building
Washington, DC 20201
Website: https://www.hhs.gov/civil-rights/filing-a-complaint/index.html
Email: OCRComplaint@hhs.gov
Effective Date
This Notice is effective as of May 19, 2026
