HIPAA & HITECH Notice

Version 1.0 · Effective November 8, 2026

Purpose of this notice

This notice explains how AccuMix Pharmacy, LLC, an Illinois limited liability company doing business as AccuRx Allergy Services ("AccuRx", "we", "us") protects individually identifiable health information ("protected health information" or "PHI") that is created, received, stored or transmitted through the AccuRx Allergy Services portal and related services, and how we meet our obligations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), and their implementing regulations at 45 CFR Parts 160 and 164. It supplements, and does not replace, the Business Associate Agreement (BAA) between AccuRx and each practice (new.accu-rx.us/legal/baa/) and the practice's own Notice of Privacy Practices given to patients.

Our roles

• Business associate. When a practice uses the portal to record skin-test results, diagnoses, pre-test checks, superbills and patient consents, AccuRx acts as the practice's business associate. We use and disclose that PHI only as the BAA and this notice permit, or as required by law.
• Covered entity. When AccuMix Pharmacy, LLC receives a prescription and compounds and dispenses allergen immunotherapy, it acts as a pharmacy and a HIPAA covered entity in its own right, and the pharmacy's Notice of Privacy Practices applies to that dispensing record.

How we use and disclose PHI

We use and disclose PHI only:

• to provide the services the practice has requested: documenting tests, generating reports and superbills, obtaining and storing consents, transmitting prescriptions to the pharmacy, compounding and shipping medication, and supporting the practice's billing;
• for payment, including charging the practice or, where permitted, the patient for immunotherapy and supplies;
• for our own proper management and administration, such as quality review, audit logging and legal compliance, and to carry out our legal responsibilities;
• to subcontractors that help us deliver the services (described below), each bound by a written agreement to the same protections;
• as required by law, including to the U.S. Department of Health and Human Services (HHS) to show compliance;
• to create de-identified information as defined in 45 CFR 164.514, which is no longer PHI.

We do not sell PHI, use it for marketing, or disclose it for any purpose not permitted by the practice's BAA.

Minimum necessary and role-based access

Access inside the portal is limited by role. Practice users see only patients of their own practice. Billers have read-only access. Pharmacy users see what is needed to compound and dispense. Purchasing details such as supplier item numbers are visible only to pharmacy and administrative roles. Every user has a unique login; shared logins are prohibited. When a practice is deactivated, every one of its logins is terminated and any open sessions are ended immediately.

Safeguards

• Administrative: a designated Privacy & Compliance Officer; workforce HIPAA training before access and annually; written policies; sanctions for violations; periodic risk analysis; vendor (subcontractor) management with BAAs.
• Physical: hosting in access-controlled data centers operated by our cloud provider; no PHI stored on removable media; clinic devices used for consent signing hold no PHI after the page is closed.
• Technical: encryption of data in transit (TLS) and at rest; unique user IDs and strong passwords; automatic sign-out; role-based authorization checked on every request; audit logs of record creation, changes, status changes and downloads; secured backups; electronic consents sealed with a cryptographic fingerprint (SHA-256) so later alteration can be detected.

Subcontractors

We use a small number of service providers to operate the portal, each under a Business Associate Agreement or equivalent confidentiality terms: cloud hosting and storage (Amazon Web Services), card payment processing (Stripe, Inc., which receives payment details but not clinical records), and transactional email delivery. We do not permit subcontractors to use PHI for their own purposes.

Electronic signatures and consents

Patient consents signed in the portal capture the signer's typed name, hand-drawn signature, each acknowledgement checked, the date and time, the device type (patient's own phone or the clinic device) and network address, and are sealed into a PDF with a document fingerprint. Prescriber attestations on orders are recorded with the signer's name, the user who submitted the order, the time, and the version of these terms accepted. These records are retained with the patient's chart and are made available to the practice on request.

Breach notification (HITECH)

If we discover a breach of unsecured PHI, or a security incident that we reasonably believe has compromised PHI, we will:

• contain the incident and begin an investigation immediately;
• notify the affected practice without unreasonable delay and within the time stated in the BAA, and in no case later than 60 calendar days after discovery, with the information the practice needs to notify patients, HHS and, where required, the media under 45 CFR 164.404 to 164.410;
• cooperate with the practice's investigation and risk assessment, and take steps to prevent recurrence.

Notification responsibilities to individuals rest with the covered entity unless the BAA assigns them to AccuRx.

Patient rights

Patients have rights under HIPAA to access and receive a copy of their PHI, request amendment, receive an accounting of certain disclosures, request restrictions and confidential communications, and receive a copy of the practice's Notice of Privacy Practices. Patients exercise these rights through the practice that treated them. On the practice's instruction, AccuRx will make PHI available in electronic form within 15 business days, incorporate amendments, and provide the information needed for an accounting of disclosures, as required by 45 CFR 164.524, 164.526 and 164.528.

Retention, return and destruction

We retain PHI for as long as needed to provide the services and as required by law. Prescription, compounding, dispensing and consent records are kept for the period required by Illinois pharmacy law and federal law. When a practice relationship ends, we return or securely destroy PHI as the BAA provides, except for records we are legally required to keep, which remain protected by this notice for as long as we hold them.

Questions and complaints

Questions about this notice or a privacy concern may be directed to: Privacy & Compliance Officer, AccuRx Allergy Services, 655 W. Grand Ave, Suite 240, Elmhurst, IL 60126 · phone 630-749-2771 · or the Help Desk inside the portal. Practices and patients may also file a complaint with the Secretary of HHS, Office for Civil Rights. We will not retaliate against anyone for raising a concern or filing a complaint.

Changes

We may revise this notice as our practices or the law change. The current version is always available at new.accu-rx.us/legal/hipaa/ and shows its version number and effective date.