SUPERVALU INC.

NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

SUPERVALU, including your pharmacy as a subsidiary or affiliated entity, is committed to protecting your privacy and understands the importance of safeguarding your personal health information. We are required by federal law to maintain the privacy of health information that identifies you or that could be used to identify you (known as “Protected Health Information”). We also are required to provide you with this Notice, which explains our legal duties and privacy practices with respect to Protected Health Information that we collect and maintain. This Notice describes your rights under federal law and state law, where applicable, relating to your Protected Health Information. SUPERVALU is required by federal law to abide by this Notice. However, we reserve the right to change the privacy practices outlined in this Notice and make the new practices effective for all Protected Health Information that we maintain. Should we make such a change, we will display the revised Notice at our pharmacies and make it available to you upon request.

Uses and Disclosures of Protected Health Information

Routine Uses and Disclosures of Protected Health Information For Treatment, Payment, or Health Care Operations

SUPERVALU is permitted under federal law to use and disclose Protected Health Information without your specific permission for three types of routine purposes: treatment, payment, and health care operations.

Your pharmacist will use or disclose your Protected Health Information as described below. Your Protected Health Information may be used and disclosed by your pharmacist, pharmacy staff, and others outside of the pharmacy that are involved in your care and treatment. Set out below are examples of the uses and disclosures of your Protected Health Information we are permitted to make for these routine purposes. While this list is not meant to be exhaustive, it should give you an idea of the everyday uses and disclosures “behind the scenes” that are essential to the care you receive.

Treatment.  Your Protected Health Information can be used and disclosed by SUPERVALU for treatment purposes. For example, your Protected Health Information will be used by our pharmacists to fill your prescription and to counsel you about the appropriate use of your medication.

We also may use and disclose your Protected Health Information to provide you with information regarding possible alternative treatment options and other health-related benefits and services that we believe might interest you. For example, we may send you reminders to refill your prescription, information about the availability of cheaper generic alternatives for your prescription, or information about new or updated products that may enhance or improve your treatment.

Payment.  Your Protected Health Information can be used and disclosed for payment purposes. For example, we may communicate your Protected Health Information to your insurance company so that it can process payment for your prescription.

Health Care Operations.  Your Protected Health Information can be used and disclosed to allow us to conduct health care operations, which generally are the administrative activities that we undertake in order to operate our pharmacies. For example, we may use your Protected Health Information to evaluate the performance of our pharmacists and to engage in other quality assurance activities.

Other Uses and Disclosures of Protected Health Information SUPERVALU is Permitted or Required to Make Without Your Authorization

In general, we are required to obtain your specific written authorization to use or disclose your Protected Health Information for purposes unrelated to treatment, payment, or health care operations. However, there are exceptions to this general rule under which we are permitted or required to make certain uses and disclosures of such information without your authorization. These situations include:

Required by the Secretary of Health and Human Services.  We may be required to disclose your Protected Health Information to the Secretary of Health and Human Services to investigate or determine our compliance with the federal privacy law.

Required by Law.  We may use or disclose your Protected Health Information to the extent that the use or disclosure is otherwise required by state or federal law.

Public Health.  We may disclose your Protected Health Information for public health activities, such as disclosures to a public health authority or other government agency that is permitted by law to collect or receive the information (e.g., the Food and Drug Administration).

Abuse or Neglect.  If you have been a victim of abuse, neglect, or domestic violence, we may disclose your Protected Health Information to the government agency authorized to receive such information.

Health Oversight.  We may disclose Protected Health Information to a health oversight agency for activities authorized by law, such as: civil or criminal investigations; inspections; licensure or disciplinary actions; or other activities necessary for appropriate oversight of retail pharmacies, governmental health benefit programs, or compliance with laws.

Judicial and Administrative Proceedings.  We may disclose Protected Health Information in response to a court or agency order, and in some cases, in response to a subpoena or other lawful process not accompanied by a court order.

Law Enforcement.  We may disclose Protected Health Information for law enforcement purposes, such as providing information to the police about the victim of a crime.

Coroners, Medical Examiners, and Funeral Directors.  We may disclose Protected Health Information to a coroner, medical examiner, or funeral director if it is needed to carry out their duties.

Research.  We may disclose your Protected Health Information to researchers when the research is being conducted under established protocols to ensure the privacy of your information.

Serious Threat to Health or Safety.  Your Protected Health Information may be disclosed if we believe it is necessary to prevent a serious and imminent threat to the public health or safety and it is to someone we reasonably believe is able to prevent or lessen the threat.

Specialized Government Functions.  We may disclose Protected Health Information for purposes related to military or national security concerns, such as for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits.

Domestic Armed Forces Personnel.  We may use and disclose your protected health information for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission, if the authority has published proper notice in the Federal Register stating the purposes for which such information may be used or disclosed.

Inmates.  Under certain circumstances, we may disclose the Protected Health Information of inmates of a correctional institution.

Workers’ Compensation.  Your Protected Health Information may be disclosed to comply with workers’ compensation laws and other similar programs.

Other Restrictions on Uses and Disclosures of Protected Health Information

The uses and disclosures of your Protected Health Information described above are permitted or required by federal law. Some states have laws that require additional privacy safeguards above and beyond the federal requirements. Thus, if a state law is more restrictive regarding uses and disclosures of your Protected Health Information or provides you with greater rights with respect to your Protected Health Information, SUPERVALU will comply with the state law. If your state has enacted a more stringent law, we have attached as an addendum to this Notice our privacy practices regarding your Protected Health Information in that state.

Notice to Minors :  If you are a minor who has lawfully provided consent for treatment and you wish that we treat you as an adult for purposes of access to and disclosure of records related to such treatment, please notify a pharmacist or our privacy office.

Disclosures to Other Parties for Conducting Permitted Activities

SUPERVALU may conduct the above-described activities ourselves, or we may use non-SUPERVALU entities to perform those operations. In those instances where we disclose your Protected Health Information to a third party acting on our behalf, we will protect your Protected Health Information through an appropriate privacy agreement.

Other Uses and Disclosures of Protected Health Information Based Upon Your Written Authorization

Other uses and disclosures of your Protected Health Information, not described above, will be made only with your written authorization. You may revoke this authorization at any time, in writing, except to the extent that we have taken action in reliance on the authorization.

Your Rights

As a patient, you have certain rights regarding your Protected Health Information.   We may ask that you submit a written request to exercise your patient rights.  These rights include:

You have the right to request a restriction on certain uses and disclosures of your Protected Health Information. This means that you may ask us not to use or disclose any part of your Protected Health Information for purposes of treatment, payment, or health care operations. You may also request that any part of your Protected Health Information not be disclosed to family members or friends who may be involved in your care. Your request must state the specific restriction requested and state to whom you want the restriction to apply.

SUPERVALU is not required to agree to such a restriction. If we do agree, we will abide by your restriction unless we need to use your Protected Health Information to provide emergency treatment. In addition, we may elect to terminate the restriction at any time.

You have the right to request to receive information from us by an alternative means or at an alternative location if you believe it would enhance your privacy. For example, you may request that we send written communications to an alternative address. We will attempt to accommodate all reasonable requests and will not request an explanation from you as to the basis for your request.

You have the right to inspect and copy your Protected Health Information. If you would like to see or copy your Protected Health Information, we are required to provide you access to your Protected Health Information for inspection and copying within 30 days after receipt of your request (60 days if the information is stored off-site).

We may charge you a reasonable fee to cover duplicating costs. In addition, there may be situations where we may decide to deny your request for access. For example, we may deny your request if we believe the disclosure will endanger your life or health or that of another person. Depending on the circumstances of the denial, you may have a right to have this decision reviewed.

You have the right to amend your Protected Health Information. This means you may request an amendment of your Protected Health Information in our records for as long as we maintain this information. We will respond to your request within 60 days (with up to a 30-day extension, if needed). We may deny your request if, for example, we determine that your Protected Health Information is accurate and complete. If we deny your request, we will send you a written explanation and allow you to submit a written statement of disagreement.

You have the right to receive an accounting of certain disclosures we have made of your Protected Health Information. An accounting is a record of the disclosures that have been made of Protected Health Information. This right generally applies to non-routine disclosures, i.e., for purposes other than treatment, payment, or health care operations, as described in this Notice, made in the six-year period prior to your request (although you are free to request an accounting for a shorter period). We are required to provide the accounting within 60 days (with one 30-day extension, if needed) and to provide one accounting free of charge in any 12-month period.  (For more frequent requests, a reasonable fee may be charged.)

You have the right to obtain a paper copy of this notice from SUPERVALU.

Complaints

If you believe your privacy rights have been violated, you have the right to report such alleged violations to SUPERVALU, and we will promptly investigate the matter. You may file a complaint with SUPERVALU by contacting our Corporate HIPAA Privacy Office. Rest assured we will not retaliate against you in any way for filing a complaint about our privacy practices. You may also contact the Secretary of Health and Human Services.

You may contact SUPERVALU’s Corporate HIPAA Privacy Office at (208) 395-4455 or at P.O. Box 20, Boise, Idaho 83726 for further information about the complaint process or any other information covered by this Notice.

This notice is effective on June 2, 2006.   

CALIFORNIA

California law limits disclosure of your medical information in ways that would otherwise be permitted under federal law.  In the situations described below, the pharmacy will disclose your medical information as follows:

(a)      the information may be disclosed to providers of health care, health care service plans, contractors or other health care professionals or facilities for purposes of diagnosis or treatment of the patient.  This includes, in an emergency situation, the communication of patient information by radio transmission or other means between licensed emergency medical personnel at the scene of an emergency, or in an emergency medical transport vehicle, and licensed emergency medical personnel at a health facility;
(b)     the information may be disclosed to an insurer, employer, health care service plan, hospital service plan, employee benefit plan, governmental authority, contractor or any other person or entity responsible for paying for health care services rendered to the patient to the extent necessary to allow responsibility for payment to be determined and payment to be made.  If the patient is, by reason of a comatose or other disabling medical condition, unable to consent to the disclosure or medical information and no other arrangements have been made to pay for the health care services being rendered to the patient, the information may also be disclosed to a governmental authority to the extent necessary to determine the patient’s eligibility for, and to obtain, payment under a governmental program for health care services provided to the patient.  The information may also be disclosed to another provider of health care or health care service plan as necessary to assist the other provider or health care service plan in obtaining payment for health care services rendered by that provider of health care or health care service plan to the patient;
(c)      the information may be disclosed to any person or entity that provides billing, claims management, medical data processing, or other administrative services for providers of health care or health care service plans or for any of the persons or entities specified above in paragraph (b).  However, no information so disclosed may be further disclosed by the recipient in any way that would be violative of California laws governing the use and disclosure of medical information without authorization from the patient;
(d)      the information may be disclosed to organized committees and agents of professional societies or of medical staffs of licensed hospitals, licensed health care service plans, professional standards review organizations, independent medical review organizations and their selected reviewers, utilization and quality control peer review organizations, contractor’s or persons or organizations insuring, responsible for, or defending professional liability that a provider may incur, if the committees, agents, health care service plans, organizations, reviewers, contractors or persons are engaged in reviewing the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges;
(e)      a provider of health care or health care service plan that has created medical information as a result of employment-related health care services to an employee conducted at the specific prior written request and expense of the employer may disclose to the employee’s employer that:
(1)     is relevant in a law suit, arbitration, grievance, or other claim or challenge to which the employer and the employee are parties and in which the patient has placed in issue his or her medical history, mental or physical condition, or treatment, provided that information may only be used or disclosed in connection with that proceeding;
(2)     describes functional limitations of the patient that may entitle the patient to leave from work for medical reasons or limit the patient’s fitness to perform his or her present employment, provided that no statement of medical cause is included in the information disclosed;
(f)      unless the provider of health care or health care service plan is notified in writing of an agreement by the sponsor, insurer, or administrator to the contrary, the information may be disclosed to a sponsor, insurer, or administrator of a group or individual insured or uninsured plan or policy that the patient seeks coverage by or benefits from, if the information was created by the provider of health care or health care service plan as the result of services conducted at the specific prior written request and expense of the sponsor, insurer, or administrator for the purpose of evaluating the application for coverage or benefits;
(g)      the information may be disclosed to a health care service plan by providers of health care that contract with the health care service plan and may be transferred among providers of health care that contract with the health care service plan, for the purpose of administering the health care service plan.  Medical information may not otherwise be disclosed by a health care service plan except in accordance with the provisions of this part;
(h)      the information may be disclosed to an insurance institution, agent or support organization of medical information if the insurance institution, agent, or support organization has complied with all requirements for obtaining the information pursuant to the requirements of the California Insurance Code provisions.
(i)    the information may be disclosed to an organ procurement organization or a tissue bank processing the tissue of a decedent for transplantation into the body of another person, but only with respect to the donating decedent for the purpose of aiding the transplant;
(j)      the information may be disclosed to a third party for purposes of encoding, encrypting, or otherwise anonymizing data.  However, no information may be further disclosed by the recipient in any way that would be unauthorized manipulation of coded or encrypted medical information that reveals individually identifiable medical information;
(k)      for purposes of disease management programs and services, information may be disclosed to any entity contracting with a health care service plan or the health care service plan’s contractors to monitor or administer care of enrollees for a covered benefit, provided that the disease management services and care are authorized by a treating physician or to any disease management organization that complies fully with the physician authorization requirements, provided that the health care service plan or its contractor provides or has provided a description of the disease management services to a treating physician or to the health care service plan’s or contractor’s network of physicians.