HIPAA Notice of Privacy Practices

Last updated: July 29, 2026

When you use our pharmacy services, our website, or our forms (together, the “Services”), we collect health information about you. Individually identifiable health information is called protected health information, or PHI. Under the Health Insurance Portability and Accountability Act (HIPAA), we are required to give you this Notice describing how we may use and share your PHI, how you can get access to it, and what rights you have.

In this Notice, “we”, “us” and “our” mean Mega Health Rx Pharmacy, located at 64-51 108th Street, Forest Hills, NY 11375. We are a single independent pharmacy and a covered entity under HIPAA.

1. Our responsibilities

We are required by law to:

• Maintain the privacy and security of your PHI as HIPAA requires;
• Follow the duties and privacy practices described in this Notice;
• Use or share your PHI only as this Notice describes, unless you tell us in writing that we may use or share it another way; and
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your unsecured PHI.

2. How we typically use and share your health information

For treatment

We use and share your PHI to dispense your prescriptions, check them against your history for interactions and allergies, counsel you about your medications, and communicate with your prescribers, other pharmacies, clinics and hospitals involved in your care.

For payment

We use and share your PHI so that we can bill and receive payment from you, your insurance plan, or another third party for the medications and services you receive.

For health care operations

We use and share your PHI to run the pharmacy — quality assessment, staff training and review, licensing, business planning, and resolving complaints. We may share PHI with another entity that has a relationship with you, such as your health plan, for its own health care operations.

Reminders, treatment alternatives, and health-related benefits

We may contact you to tell you a prescription is ready or a refill is due, and to tell you about treatment alternatives or health-related products and services that may be relevant to you. You may ask us to stop these communications at any time.

People involved in your care

Unless you object, we may share PHI that is directly relevant with a family member, friend or other person you identify who is involved in your care or in paying for it — for example, a relative collecting a prescription for you. Tell us if you would prefer we did not.

Disaster relief

We may share your PHI with an authorized public or private disaster relief organization so that your family can be notified of your location and condition.

Business associates

We share PHI with third parties who perform services for us — for example, the company that hosts our website and receives your form submissions, or our pharmacy software provider. Each has signed a written agreement requiring them to protect your PHI and limiting what they may do with it.

De-identified information

We may remove the details that identify you, in the manner HIPAA requires. Once information is de-identified it is no longer PHI, and we may use it for purposes permitted by law.

3. Other ways we may use or share your health information

We may use or share your PHI in the following ways, generally without your authorization and subject to the conditions HIPAA imposes:

• Public health and safety. Reporting to immunization registries, reporting adverse drug reactions, assisting with product recalls, preventing the spread of disease, reporting suspected abuse or neglect, and preventing a serious threat to anyone’s health or safety.
• Health oversight. Audits, investigations, inspections and licensure by agencies that oversee health care.
• Security incidents and breach notification. Investigating potential privacy or security incidents and providing legally required notices.
• As required by law. Where federal, state or local law requires disclosure.
• Law enforcement. Where a law enforcement agency needs the information to carry out its duties, or where criminal conduct is suspected on our premises.
• Lawsuits and disputes. In response to a court or administrative order, subpoena, discovery request or other lawful process.
• Workers’ compensation. For workers’ compensation and similar programs providing benefits for work-related injury or illness.
• Organ and tissue donation. With organizations that handle organ, eye or tissue procurement, banking or transplantation.
• Coroners, medical examiners and funeral directors. As necessary for them to carry out their duties.
• Specialized government functions. Military and veterans’ activities, national security and intelligence activities authorized by law.
• Inmates and individuals in custody. With a correctional institution or law enforcement official having custody of you.

4. When your written permission is required

We do not need your written permission for the uses described in sections 2 and 3. In other situations we will not use or share your PHI unless you give us written authorization, including:

• Marketing. Most marketing uses of your PHI, as HIPAA defines marketing, require your written permission first.
• Sale of your information. We do not sell your PHI. HIPAA requires your written permission before any disclosure in exchange for payment, and we will not make one without it.
• Psychotherapy notes. Where we hold any, disclosure requires your authorization.
• Research. We will obtain your written authorization before using your PHI for research, other than the limited preparatory uses HIPAA permits.

If you give us permission, you may revoke it at any time by writing to our Privacy Officer. A revocation does not undo anything we already did while the permission was in effect.

5. Your rights

• Inspect and copy. You may see or get an electronic or paper copy of your prescription and billing records. We will respond within thirty days unless we need more time, and may charge a reasonable, cost-based fee.
• Correct your record. If you believe information we hold is wrong or incomplete, you may ask us in writing to amend it. We may say no, and if we do we will explain why in writing, usually within sixty days.
• Confidential communications. You may ask us to contact you in a specific way or at a specific number or address. We will accommodate reasonable requests.
• Request restrictions. You may ask us to limit how we use or share your PHI. We are not required to agree — with one exception: if you pay for a prescription in full out of pocket and ask us not to share that information with your health plan, we must agree.
• A list of disclosures. You may ask for a list of certain disclosures we made in the previous six years, who received the information and why. It excludes disclosures for treatment, payment and operations, and those you authorized. One list a year is free.
• Opt out of our communications. You may tell us to stop contacting you about refills, alternatives or health-related services.
• A paper copy of this Notice. At any time, even if you agreed to receive it electronically.
• Notification of a breach. We will tell you if a breach affects your unsecured PHI.

To exercise any of these rights, contact our Privacy Officer using the details in section 7.

6. Additional protections for certain information

Some categories of health information receive stronger protection than HIPAA alone provides, and we follow those laws where they apply.

• Substance use disorder records. Records of substance use disorder treatment received from a federally assisted program are separately protected under 42 CFR Part 2. Where we hold such records, we will not use or disclose them in civil, criminal, administrative or legislative proceedings against you without your written consent or a court order meeting Part 2’s requirements. You may revoke consent, and we will tell you how to complain about a suspected Part 2 violation.
• New York State protections. New York law provides additional confidentiality for information relating to HIV status, mental health treatment, and genetic testing. We protect that information according to those laws.

7. Other things you should know

Redisclosure

If you ask us to send your PHI to someone who is not covered by HIPAA, that person is not required to protect it the way we are.

Who follows this Notice

This Notice is followed by all pharmacists, technicians and staff of Mega Health Rx Pharmacy, and by anyone else who supports our health care activities on site.

Do not send health information by email

Ordinary email is not a secure channel. Please use the forms on this website, call us, or come in rather than emailing details about your health or medications.

Changes to this Notice

We may change this Notice at any time, and the changes will apply to information we already hold about you. The current version will always be posted in the pharmacy and on this website, and you may request a paper copy.

8. Privacy Officer

For more information about your privacy rights, to make any request described in this Notice, or if you believe we have violated your privacy, contact:

Shmuel Borukhov, Privacy Officer
Mega Health Rx Pharmacy
64-51 108th Street, Forest Hills, NY 11375
Phone (516) 304-5038 · Fax (516) 268-9311

9. Complaints

If you believe your privacy rights have been violated, you may complain to our Privacy Officer above, or directly to the federal government:

U.S. Department of Health and Human Services, Office for Civil Rights
200 Independence Avenue SW, Washington, D.C. 20201
1-877-696-6775 · OCRComplaint@hhs.gov
hhs.gov/hipaa/filing-a-complaint