NOTICE OF PHARMACY PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

SpartanNash and its subsidiaries Econofoods, Family Fresh Market, Family Thrift Center and Sunmart Foods ("The Company") are dedicated to protecting your protected health information (PHI). We are required by law to maintain the privacy of PHI and to provide you with this Notice of our legal duties and privacy practices with respect to PHI. The Company is required by law to abide by the terms of this Notice.

HOW YOUR PHI WILL BE USED AND DISCLOSED

We will use your PHI as part of rendering patient care, which includes your treatment, obtaining payment for your treatment, and our healthcare operations. For example, your PHI may be used by the pharmacist in contacting your doctor or clinic for prescription information, to process payment from your medical plan for your medication, and by administrative personnel reviewing the quality of the care you receive.

We may also use and/or disclose your PHI when required by law, or when permitted under federal and state laws for the following purposes:

• Prescription Refill Reminders - We may contact you to provide prescription refill reminders.
• Health Information - We may contact you with information about treatment alternatives or other health-related benefits and services that may be of interest to you.
• Disclosure to Department of Health and Human Services - We may disclose PHI when required by the United States Department of Health and Human Services as part of an investigation or determination of our compliance with relevant laws.
• Family and Friends - We may disclose your PHI to family members, other relatives, personal representatives or close personal friends when the PHI is directly relevant to that person's involvement with your care or the payment for your care, but not if you tell us that you object to us doing so.
• Notification - We may use or disclose your PHI to notify a family member, a personal representative or another person responsible for your care of your location, general condition or death.
• Disaster Relief - We may disclose your PHI to a public or private entity, such as the American Red Cross, for the purpose of coordinating with that entity to assist in disaster relief efforts.
• Health Oversight Activities - We may use or disclose your PHI for public health activities, including the reporting of disease, injury, vital events and the conduct of public health surveillance, investigation and/or intervention. We may disclose your PHI to a health oversight agency for oversight activities authorized by law, including audits, investigations, inspections, licensure or disciplinary actions, administrative and/or legal proceedings.
• Abuse or Neglect - We may disclose your PHI when it concerns abuse, neglect or violence to you in accordance with federal and state law.
• Legal Proceedings - We may disclose your PHI in the course of certain judicial, administrative or other legal proceedings.
• Law Enforcement - We may disclose your PHI for law enforcement purposes or other specialized governmental functions.
• Public Safety - We may use or disclose your medical information to prevent or lessen a serious threat to the health or safety of another person or to the public,
• Workers’ Compensation - We may disclose your PHI as authorized by laws relating to workers' compensation or similar programs.
• Business Associates - We may disclose your PHI to a business associate with whom we contract to provide services on our behalf. To protect your PHI, we require our business associates to appropriately safeguard the PHI of our patients.
• Coroners, Medical Examiners and Funeral Directors - We may disclose your PHI to a coroner, medical examiner or a funeral director.
• Organ Donation - If you are an organ donor, we may disclose your PHI to an organ donation and procurement organization,
• Research - We may use or disclose your PHI for certain research purposes if an Institutional Review Board or a privacy board has altered or waived individual authorization, the review is preparatory to research or the research is on only decedent's information.

If you receive pharmacy services from us in any state that prohibits or materially limits any use or disclosure stated above, we will abide by the applicable state law, regulation, or requirement. More restrictive state requirements are described at the end of this notice.

AUTHORIZATIONS

We will not use or disclose your PHI for any purpose not described in this notice without your written authorization.  Disclosures of your PHI for marketing purposes, and disclosures that constitute the sale of PHI, require your authorization.  There are some limited exceptions to this rule, such as, under certain circumstances, communications regarding refill reminders about a drug that is currently being prescribed.  Once given, you may revoke your authorization in writing at any time, except to the extent that we have taken action in reliance on your authorization.

YOUR RIGHTS REGARDING YOUR PHI

Under federal law, you have the following rights:

• Request restrictions - You may ask us to restrict certain uses and disclosures of your PHI. Your request must be in writing and be specific as to the restriction requested and to whom it applies.  We are not required to agree to a requested restriction, except when the request is to restrict disclosure of PHI to a health plan and the PHI pertains solely to a health care item or service for which you have paid in full.  If we agree to your request for a restriction, we may still disclose your PHI for an emergency.
• Request confidential communications - You have the right to request to receive communications from us in a confidential manner, in a different manner, or at a different place such as a post office box.  To request confidential communication of your PHI, you must submit a request in writing to the Privacy Officer at the address listed below.  Your request must tell us how or where you would like to be contacted. We will honor all reasonable requests.
• Inspect or obtain a copy of your PHI - SpartanNash keeps a designated record set of pharmacy records, billing records and other PHI. You have the right to inspect and get a copy of your PHI maintained in this designated record set.  If the designated record set is maintained in an electronic health record, you may request a copy of it in electronic form.  You may be charged a reasonable amount for copies.  You should know that not all the information SpartanNash maintains is available to you.
• Request a change to your PHI - If you think there is a mistake in your PHI or information is missing, you may send a written request to make a correction or addition to the Privacy Officer at the address listed below.  We may not be able to agree to make the change.  For example, if we received the information from a clinic, we cannot change the clinic information—only the clinic can. If we deny your request, we will provide you with a written explanation for the denial and information regarding further rights you may have at that point
• Request an accounting of disclosures - You have the right to receive a list of disclosures we have made of your PHI.  Requests for the accounting must be made in writing to the Privacy Officer at the address listed below.  There are certain disclosures we are not required to track.  For example, we are not required to list the times we disclosed your PHI when you gave us permission to disclose it.  We are also not required to identify disclosures that were made more than six (6) years from the date of your request.  You may be charged a reasonable fee for the accounting, except for the first accounting in any 12-month period.
• Receive a notice in the event of a breach - We will notify you, as required under federal regulations, of an unauthorized release, access, use or disclosure of your PHI.  “Unauthorized” means that the release, access, use or disclosure was not authorized by you or permitted by law without your authorization.  The federal regulations further define what is and what is not a “breach.”  Every violation of HIPAA, therefore, will not constitute a breach requiring a notice.
• Request a copy of this notice - You may request a paper copy of this Notice of Pharmacy Privacy Practices.  If you would like this form electronically, please visit our websites at www.familythriftctr.com; www.sunmartfoods.com; or www.econofoods.com.

TO EXERCISE ANY OF THESE RIGHTS, PLEASE CONTACT THE PRIVACY OFFICER C/O INTERNAL AUDIT, SpartanNash, P.O. BOX 355, MINNEAPOLIS, MN 55440 (952) 832-0534.

File a complaint or grievance about privacy practices.  If you feel your privacy rights have been violated by SpartanNash, you may file a complaint. You will not be retaliated against for filing a complaint. To file a complaint with SpartanNash, please contact the Privacy Officer at the contact information listed above. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. To do so, write to the Office for Civil Rights, U.S. Department of Health & Human Services, 233 N. Michigan Ave Suite 240, Chicago, IL 60601.

About this notice.  SpartanNash is required by law to maintain the privacy of PHI and to provide this notice. We are required to follow the terms and conditions of this notice.  However, we may change this notice and its privacy practices and new notice provisions will be effective for all PHI that we maintain, as long as any changes are consistent with state and federal law.  If we revise the terms of this Notice, we will post a revised notice at The Company's Retail Pharmacies and on the websites listed above, and will make paper copies of the revised Notice of Privacy Practices available upon request.

PRIVACY PRACTICES REQUIRED BY CERTAIN STATES

Iowa

We will not disclose any HIV/AIDS-related information, except in situations where the subject of the information has provided us with a written authorization allowing the release or where we are authorized or required by state or federal law to make the disclosure.

Minnesota

We will not disclose your health records without your consent, specific authorization in law, or a representation from a provider that holds a signed and dated consent authorizing the release, except:

(a)        for a medical emergency when the provider is unable to obtain your consent due to your condition or the nature of the medical emergency; or

(b)        to other providers within related health care entities when necessary for your current treatment.

We will not disclose your prescription orders or the contents thereof, except to:

(a)        you, your agent, or another pharmacist acting on your behalf or your agent’s behalf;

(b)        the licensed practitioner who issued the prescription;

(c)        the licensed practitioner who is currently treating you;

(d)        a member, inspector, or investigator of the board or any federal, state, county, or municipal officer whose duty it is to enforce the laws of Minnesota or the United States relating to drugs and who is engaged in a specific investigation involving a designated person or drug;

(e)        an agency of government charged with the responsibility of providing medical care for you;

(f)         an insurance carrier or attorney on receipt of written authorization signed by you or your legal representative, authorizing the release of such information; and

(g)        any person duly authorized by a court order.

We may release your health records to the Minnesota Commissioner of Health or the Health Data Institute under the MinnesotaCare Act, provided that the Commissioner of Health encrypts the patient identifier upon receipt of the data.

Unless we have obtained your oral or written consent, we will not disclose the nature of pharmaceutical services rendered to you, except as follows:

(a)        pursuant to an order or direction of a court;

(b)        to other pharmacies;

(c)        to you; or

(d)        drug therapy information to your physician.

South Dakota

We will only use information concerning applicants and recipients of medical assistance for purposes directly connected to the administration of the medical assistance program.  If you are a recipient of medical assistance, we will not release your information without obtaining your approval.

Wisconsin

Without your written authorization, your patient health care records, including prescription records, will only be released to you, to your personal representatives, and to those persons and entities specified in Section 146.82 of the Wisconsin Statutes.  While the releases required or allowed by Section 146.82 include a number of the situations described in this Notice, there are several exceptions.  For example, we may not release your health care records to your family and friends or to our business associates without your written authorization.