Notice of Privacy Practices

Uses and disclosures of protected health information

Treatment, payment, and health care operations

We will use your health information to provide treatment. This may involve receiving or sharing information with other health care providers such as your physician. This information may be written, verbal, or electronic. This includes receiving prescription orders so that we may dispense or compound prescription medications. We may also share information with other health care providers treating you to coordinate the different things you need, such as medications, lab work, or other appointments. We may also contact you to provide treatment-related services, such as reminders about your medication, information about treatment alternatives, and notices about a medication recall. We may contact you, and your prescriber, if a medication dispensed to you is recalled.

We may use your health information to obtain payment. For example, we may share information with you, your prescriber, or another payer to receive payment for your medication.

We will use your health information for our health care operations necessary to run the pharmacy. This may include monitoring the quality of care that our employees provide to you and for training purposes.

Permitted or required uses and disclosures

Our pharmacists, using their professional judgment, may disclose your protected health information to a family member, other relative, close personal friend, or other person you identify as being involved in your health care. This includes allowing such individuals to receive filled prescriptions, medical supplies, or medical records on your behalf. If you are present, we will give you the chance to object first.

We also have contracts with entities called Business Associates that provide some services for us that require access to your protected health information. We require our Business Associates to safeguard any protected health information appropriately.

Under certain circumstances, Harmony may be required to disclose health information as required or permitted by federal or state laws. These include, but are not limited to:

• Food and Drug Administration (FDA) reports relating to adverse events regarding drugs, foods, supplements, and other health products, or for post-marketing surveillance to enable product recalls, repairs, or replacement.
• Public health or legal authorities charged with preventing or controlling disease, injury, or disability.
• Law enforcement agencies as required by law or in response to a valid subpoena or other legal process.
• Health oversight agencies (such as licensing boards) for activities authorized by law such as audits, investigations, and inspections necessary for Harmony's licensure and for monitoring of health care systems.
• Court or administrative process, in response to a court order, administrative order, subpoena, discovery request, or other lawful process by another person involved in a dispute involving a patient, but only if efforts have been made to tell the patient about the request or to obtain an order protecting the requested health information.
• Workers' compensation, as authorized by and as necessary to comply with laws relating to workers' compensation or similar programs established by law.
• Other legal mandates, whenever required to do so by law.
• Coroner or Medical Examiner when necessary, for example to identify a deceased person or determine a cause of death.
• Funeral Directors to carry out their duties.
• Organ procurement organizations or other entities engaged in procurement, banking, or transplantation of organs for the purpose of tissue donation and transplant.
• Notification of family members or persons responsible for the patient's care, including the patient's location or general condition.
• Correctional institutions or their agents if a patient is or becomes an inmate of such an institution, when necessary for the patient's health or the health and safety of others.
• Serious threats to health or safety, when necessary to prevent a serious threat to the patient's health and safety or the health and safety of the public or another person.
• Military command authorities when the patient is a member of the armed forces, and to appropriate military authority about foreign military personnel.
• National security, to authorized officials for intelligence, counterintelligence, and other national security activities authorized by law.
• Protective services, to authorized federal officials so they may provide protection to the President, other authorized persons, or foreign heads of state, or to conduct special investigations.
• Abuse, neglect, or domestic violence, to a government authority such as a social service or protective services agency, if Harmony reasonably believes the patient to be a victim of abuse, neglect, or domestic violence, but only to the extent required by law, if the patient agrees to the disclosure, or if the disclosure is allowed by law and we believe it is necessary to prevent serious harm.
• Research, under rules that protect your privacy.
• Disaster relief organizations, to coordinate notifications about your location and condition.

Your health information may be shared electronically as permitted by law.

Authorized use and disclosure

We will not use or disclose your health information for marketing purposes, and we will not sell your health information, without your written authorization. Most uses and disclosures of psychotherapy notes also require your written authorization; Harmony does not ordinarily keep psychotherapy notes.

Use or disclosure other than those previously listed or as permitted or required by law will not be made unless we obtain your written authorization in advance. You may revoke any such authorization in writing at any time. Upon receipt of a revocation, we will cease using or disclosing protected health information about you, except to the extent that we have already acted in reliance on your authorization.

More stringent laws

If a state law gives your health information more protection than federal law, we follow the more protective law.

Patient rights

Restriction requests

You have the right to request a restriction be placed on the use and disclosure of your protected health information for purposes of carrying out treatment, payment, or health care operations. Restrictions may include requests for not submitting claims to your insurance or third-party payer,.

We are not required to agree to your request, except that we must agree if you ask us not to share information with your health plan about a medication or service you paid for in full out of pocket, unless the law requires the disclosure.

If we do agree to the requested restrictions, they shall be binding until you request that they be terminated.

Requests for restrictions or termination of restrictions must be submitted in writing to the Privacy Officer listed in Section D (Contacting us).

Alternative means of communication

You have the right to receive confidential communications of protected health information by alternate methods or at alternate locations upon reasonable request. Examples may include sending information to a phone or mailing address other than your home.

Harmony shall make reasonable accommodation to honor requests.

Requests must be submitted in writing to the Privacy Officer listed in Section D (Contacting us).

Access to health information

You have the right to inspect and copy your protected health information. The designated record set will usually include prescription and billing records. You have the right to request the protected health information in the designated record set for as long as we maintain your records.

You have the right to request that your protected health information be provided to you in an electronic format if available. If you ask for an electronic copy of records we keep electronically, we will provide it within 15 business days as Texas law requires.

Requests must be submitted in writing to the Privacy Officer listed in Section D (Contacting us).

We may charge a reasonable, cost-based fee for copies, and we will tell you the amount first.

Harmony may deny your request for records in limited circumstances. In case of denial, you may request a review of the denial for most reasons. Requests for review of a denial must also be submitted to the Privacy Officer listed in Section D (Contacting us).

Amendments to health information

If you believe that your protected health information is incomplete or incorrect, you may request an amendment to your records. You may request amendment to any records for as long as we maintain your records.

Requests must be submitted in writing to the Privacy Officer listed in Section D (Contacting us).

Requests must include a reason that supports the amendment to your health information.

Harmony may deny amendment requests in certain cases. In the case of denial, you have the right to submit a Statement of Disagreement. We have the right to provide a rebuttal to your statement.

Accounting of uses and disclosures

You have the right to request an accounting of uses and disclosures that are not for treatment, payment, or health care operations. This accounting may include up to the six years prior to the date of request and will not include an accounting of disclosures to yourself, your personal representatives, or anything authorized by you in writing. Other restrictions may apply as required in the Privacy Rule.

Requests must be submitted in writing to the Privacy Officer listed in Section D (Contacting us).

The first accounting in any 12-month period will be provided to you at no cost. Any additional requests within the same 12-month period will be charged a fee to cover the cost of providing the accounting.

The amount will be provided to you prior to completing the request. You may choose to withdraw your request to avoid paying this fee.

Notice of Privacy Practices

You have the right to receive a paper copy of this Notice even if you previously agreed to receive a copy electronically.

Please submit a request to the Privacy Officer listed in Section D (Contacting us).

Breach notification

You have the right to be notified if a breach compromises the privacy or security of your unsecured PHI. If a breach occurs, we will notify you as required by the HIPAA Breach Notification Rule, 45 CFR Part 164, Subpart D.

Harmony's duties

Harmony is required by law to maintain the privacy of protected health information, to provide individuals with notice of its legal duties and privacy practices with respect to protected health information, and to notify affected individuals following a breach of unsecured protected health information.

We must follow the terms of the Notice currently in effect. We can change this Notice, and the change will apply to all information we have about you. The new Notice will be posted in our pharmacy and on our website, and a copy will be available on request.

Contacting us

Additional questions, submitting requests, or complaints

If you have questions about this Notice or how Harmony uses and discloses your protected health information, please contact our Privacy Officer below.

You may obtain forms needed for request submission from our Privacy Officer.

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of Health and Human Services. You will not be retaliated against for filing a complaint.

Privacy Officer

Please contact our Privacy Officer by email at privacy@harmonyinfusionrx.com, by phone at +1 (346) 649-6888, or by mail to Harmony Infusion Pharmacy, LLC, Attn: Privacy Officer, 7447 Harwin Dr, Suite 111, Houston, TX 77036.

Secretary of Health and Human Services, Office for Civil Rights

For online complaint forms and contact information for the Regional OCR offices, visit www.hhs.gov/ocr. You may also call 1-800-368-1019, write to the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue S.W., Washington, D.C. 20201, or email OCRComplaint@hhs.gov for assistance or questions about complaint forms.

Effective date

This Notice of Privacy Practices is effective as of October 1, 2026.