Privacy Policy

STATEMENT OF PRIVACY PRACTICES OF SCL 340B CARE

Effective Date: July 31, 2026

THIS STATEMENT DESCRIBES HOW PROTECTED HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED BY SCL 340B CARE ("SCL 340B Care") IN CONNECTION WITH THE 340B DRUG PRICING PROGRAM SERVICES WE PROVIDE ON BEHALF OF YOUR COVERED ENTITY. IT ALSO DESCRIBES YOUR RIGHTS WITH RESPECT TO YOUR PROTECTED HEALTH INFORMATION AND HOW YOU CAN EXERCISE THOSE RIGHTS. PLEASE REVIEW IT CAREFULLY.

SCL 340B Care recognizes that your health information is personal, and we are committed to protecting it. SCL 340B Care is a business associate that performs 340B program administration services on behalf of your covered entity (your healthcare provider, pharmacy, health plan, or other 340B covered entity). SCL 340B Care's use and disclosure of your health information is important to supporting the quality care provided by your covered entity, and to comply with certain laws. This Statement applies to SCL 340B Care's uses and disclosures of individually identifiable Protected Health Information ("PHI") received or created by SCL 340B Care in the course of providing these services, under the Standards for Privacy of Protected Health Information and the Security Standards for the Protection of Electronic Protected Health Information disseminated under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 ("HITECH Act"), and the regulations promulgated thereunder (collectively, the "HIPAA Rules"), subject to applicable state law, including the Texas Medical Records Privacy Act, Texas Health and Safety Code Chapter 181.

Questions about this Statement or SCL 340B Care's privacy practices may be directed to our Privacy Officer at 6380 Folsom Dr, Beaumont, TX 77706.

I. We Are Legally Required to Safeguard Your PHI and Electronic PHI.

SCL 340B Care is required by applicable federal and state law to:

Maintain the privacy of your PHI;
Use appropriate administrative, physical, and technical safeguards, and comply with the HIPAA Security Rule (45 CFR Part 164, Subpart C), to prevent the use or disclosure of your PHI other than as provided for by this Statement and our agreements with your covered entity;
Notify your covered entity without unreasonable delay, and in no case later than sixty (60) calendar days after discovery, if we discover a breach of unsecured PHI, so that your covered entity can notify you as required by law;
Provide you with this Statement; and
Comply with this Statement.

II. Future Changes to Our Privacy Practices and This Statement.

SCL 340B Care reserves the right to change its privacy practices and to make any such change applicable to your PHI obtained before the change. If a change in our practices is material, we will revise this Statement to reflect the change and will post the revised Statement prominently on our website with a new effective date. You may obtain a copy of any revised Statement by contacting SCL 340B Care's Customer Service Department at 6380 Folsom Dr, Beaumont, TX 77706, or on our website at www.scriptcare.com.

III. Our Uses and Disclosures of Your PHI.

The law permits us to use and disclose your PHI, on behalf of your covered entity, for purposes of providing treatment, obtaining payment and for certain operations related to healthcare. When using or disclosing your PHI, or when requesting your PHI from another covered entity, we will make reasonable efforts to limit the PHI used, disclosed, or requested to the minimum necessary to accomplish the intended purpose, except as otherwise permitted by law. This Section III provides some examples of each of these permitted uses and disclosures.

Permitted Uses and Disclosures.

We may use and disclose your PHI to provide treatment to you or for the treatment activities of another healthcare provider. Some examples include:

We may disclose your PHI to physicians, pharmacists, contract pharmacies, nurses, and other healthcare providers and suppliers who are involved in your care for purposes of your treatment.
We may disclose your PHI to the contract pharmacy dispensing your prescription and to your prescriber as necessary to fill your prescription under your covered entity's 340B program.

We may also use or disclose your PHI in order to obtain payment for the prescriptions provided to you under your covered entity's 340B program or for the payment activities of another entity. For example:

We may use your PHI to create the bills that we submit to the insurance company or other third party payer to receive payment for the prescriptions dispensed to you.
We may use your PHI to determine if you are eligible for 340B pricing under your covered entity's 340B program, and to identify and code your prescription as 340B eligible at the time the claim is processed.
We may use your PHI to apply your covered entity's sliding fee scale and program design, including prior authorization and step therapy requirements, maximum dollar limitations and tiered copay structures, in order to determine the amount you owe for a prescription.
We may disclose certain portions of your PHI to your covered entity or your insurance or health plan for payment audit purposes or to our subcontractors who perform billing, adjudication, claims processing or other related services for us.
We may use and disclose your PHI to collect payment from third party payers and to remit those funds to your covered entity and its contract pharmacies.
We may use de-identified, aggregate drug utilization data to generate replenishment orders and invoices among your covered entity, its contract pharmacies and its wholesalers.
We may use your PHI during payment-related data processing.

We may also use or disclose your PHI for our operations related to healthcare. For example:

We may use your PHI to evaluate the performance of the contract pharmacies and other participants in your covered entity's 340B program.
We may use and disclose your PHI to provide utilization reports and other data analyses to your covered entity for purposes of 340B program administration.
We may also use and disclose your PHI to perform periodic quality assurance reviews and audits, to develop protocols, and for purposes of 340B program compliance monitoring and responding to HRSA program integrity audits, manufacturer audits, and audits by the Secretary of HHS.
PHI may be provided to our subcontractors who perform services on our behalf, such as billing, adjudication, or claims processing, under a written agreement that imposes the same restrictions and conditions on the subcontractor's use and disclosure of your PHI as apply to SCL 340B Care, including compliance with the HIPAA Security Rule for electronic PHI. PHI may also be provided to our internal auditors, attorneys, accountants, and other consultants to make sure we are complying with the laws that affect us.
We may use and disclose de-identified or aggregate data derived from your PHI, in accordance with the de-identification standards set forth in 45 CFR § 164.514, in conducting data analysis for purposes of providing information and data to your covered entity, new program development, and providing services to improve outcomes and effectively manage prescription drug costs. De-identified data is not PHI and is not subject to the protections of this Statement.

In addition, we may also disclose your PHI to another healthcare provider, health insurance plan, or healthcare clearinghouse for purposes of their operations related to healthcare. However, we will only do so if they have or have had a relationship with you and if the PHI they request pertains to that relationship. In addition, we will disclose your PHI to these third parties for limited purposes only, such as conducting quality improvement activities, reviewing the performance of a healthcare provider, or training purposes.

IV. Uses and Disclosures That Require Us to Give You the Opportunity to Object.

Unless you object, we may provide relevant portions of your PHI to a family member, friend, or other person you indicate is involved in your healthcare or in helping you get payment for your healthcare. In an emergency or when you are not capable of agreeing or objecting to these disclosures, we will disclose PHI as we determine is in your best interest, but will advise you of such use and disclosure after the emergency, and give you the opportunity to object to future disclosures to family and friends. Unless you object, we may also disclose your PHI to persons performing disaster relief notification activities.

V. Certain Other Uses and Disclosures Which Do Not Require Your Authorization.

The law allows us to use and disclose PHI without your authorization in the following circumstances:

When Required by Law. We use and disclose PHI when we are required to do so by federal, state or local law.
For Public Health Activities. We use and disclose PHI when we are so required to by public health and other government authorities. For example, we may be required to disclose information to the Federal Food and Drug Administration (FDA) relative to adverse events with respect to medications, products, product recalls, defects or replacements. We also use and disclose PHI as necessary to report suspected child, elder, or disabled-person abuse, neglect, or exploitation, as required by law.
For Reports About Victims of Abuse, Neglect or Domestic Violence. We will use and disclose your PHI in reports about victims of abuse, neglect, or domestic violence only if we are required or authorized by law to do so, or if you otherwise agree.
To Health Oversight Agencies. We will use and disclose PHI as requested by government agencies who have authority to audit or investigate our operations.
For Lawsuits and Disputes. If you are involved in a lawsuit or dispute, we may use and disclose your PHI in response to a subpoena or other lawful request, but only if efforts have been made to tell you about the request or to obtain a court order that will protect the PHI requested.
To Law Enforcement. We may use and disclose PHI if asked to do so by a law enforcement official, in the following circumstances:
- in response to a court order, subpoena, warrant, summons or similar process;
- to identify or locate a suspect, fugitive, material witness or missing person;
- to provide information about the victim of a crime if, under certain limited circumstances, we are unable to obtain the person's agreement;
- about a death we believe may be due to criminal conduct;
- about criminal conduct at our facility;
- in emergency circumstances, to report a crime, its location or victims, or the identity, description or location of the person who committed the crime.
To Coroners, Medical Examiners and Funeral Directors. We may use and disclose PHI to facilitate the duties of coroners, medical examiners and funeral directors.
To Organ Procurement Organizations. We may use and disclose PHI to facilitate organ donation and transplantation.
For Medical Research. We may use and disclose your PHI to medical researchers who request it for approved medical research projects; however, with very limited exceptions, such uses and disclosures must be approved by an Institutional Review Board or a Privacy Board before any PHI is used and disclosed to the researchers, who will be required to safeguard the PHI they receive.
To Avert a Serious Threat to Health or Safety. We may use and disclose your PHI to someone who can help prevent a serious threat to your health and safety or the health and safety of another person or the public.
For Specialized Government Functions. We may use and disclose your PHI for specialized government functions. For example, we may use and disclose your PHI to authorized federal officials for intelligence and national security activities that are authorized by law, or so that they may provide protective services to the President or foreign heads of state or conduct special investigations authorized by law.
To Workers' Compensation or Similar Programs. We may use and disclose your PHI to workers' compensation or similar programs in order for you to obtain benefits for work-related injuries or illness.

VI. Other Uses and Disclosures of Your Protected Health Information.

Other uses and disclosures of your PHI that are not covered by this Statement or permitted by the laws that apply to us will be made only with your written authorization. This includes most uses and disclosures of your PHI for marketing purposes, and any disclosure that would constitute a sale of your PHI. If you give us written authorization for a use or disclosure of your PHI, you may revoke that authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose your PHI for the purposes specified in the written authorization, except that we are unable to take back any disclosures we have already made with your permission. In addition, we can use or disclose your PHI after you have revoked your authorization for actions we have already taken in reliance upon your authorization. We are also required to retain certain records of the uses and disclosures made when the authorization was in effect.

VII. Your Rights Related to Your Protected Health Information.

Because SCL 340B Care provides its services on behalf of your covered entity, many of the rights below are rights you hold with respect to your covered entity, which is ultimately responsible for fulfilling them. You may submit any request below to us, and we will forward it to your covered entity or otherwise assist in responding as directed by your covered entity, or you may contact your covered entity directly using the contact information in its own notice of privacy practices. You have the following rights:

The Right to Request Limits on Uses and Disclosures of Your PHI. You have the right to ask us to limit how we use and disclose your PHI. If you paid for a specific item or service in full, out of pocket, you have the right to request that we not disclose information about that item or service to a health plan for payment or health care operations purposes, and we must agree to that request. For other requests, we are not required to agree, except that we may not limit disclosures that we are required by law to make, including disclosures to the Secretary of the Federal Department of Health and Human Services to investigate our compliance with the law. Any such request must be submitted in writing to our Privacy Officer. If we agree to a requested restriction, we will put it in writing and will abide by the agreement, except when you require emergency treatment. You may ask us to terminate a restriction at any time.
The Right to Choose How We Communicate With You. You have the right to ask that we send information to you at a specific address (for example, at work rather than at home) or in a specific manner (for example, by email rather than by regular mail, or never by telephone). We must agree to your request as long as it would not be disruptive to our operations to do so. You must make any such request in writing, addressed to our Privacy Officer.
The Right to See and Copy Your PHI. Except for limited circumstances, you may look at and copy your PHI if you ask in writing to do so. Any such request must be addressed to our Customer Service Department at 6380 Folsom Dr, Beaumont, TX 77706, which will respond to your request within 30 days (or 60 days if the extra time is needed). In certain situations we may deny your request, but if we do, we will tell you in writing of the reasons for the denial and explain your rights with regard to having the denial reviewed. If you ask us to copy your PHI, we may charge you a reasonable, cost-based amount for copying, as allowed by law. If our records are maintained electronically, you may request an electronic copy in the form and format you request, if readily producible, or ask that we send the copy directly to a third party you designate in writing. Alternatively, we may provide you with a summary or explanation of your PHI, as long as you agree to that and to the cost, in advance.
The Right to Correct or Update Your PHI. If you believe that the PHI we have about you is incomplete or incorrect, you may ask us to amend it. Any such request must be made in writing and must be addressed to our Customer Service Department at 6380 Folsom Dr, Beaumont, TX 77706, and must tell us why you think the amendment is appropriate. We will not process your request if it is not in writing or does not tell us why you think the amendment is appropriate. We will act on your request within 60 days (or 90 days if the extra time is needed), and will inform you in writing as to whether the amendment will be made or denied. If we agree to make the amendment, we will ask you to tell us who else you would like us to notify of the amendment, and we will also notify persons we know have received your PHI and may rely on it to your detriment. We may deny your request if you ask us to amend information that:
- was not created by us, unless the person who created the information is no longer available to make the amendment;
- is not part of the PHI we keep about you;
- is not part of the PHI that you would be allowed to see or copy; or
- is determined by us to be accurate and complete.

If we deny the requested amendment, we will tell you in writing how to submit a statement of disagreement or complaint, or to request inclusion of your original amendment request in your PHI.

VII-A. Your Right to Receive Notification of a Breach.

If a breach of your unsecured PHI occurs, your covered entity is required to notify you in accordance with federal and state law. SCL 340B Care will notify your covered entity of any breach of your unsecured PHI without unreasonable delay, and in no case later than sixty (60) calendar days after discovery of the breach, so that your covered entity can provide you with timely notification.

The Right to Receive a List of the Disclosures We Have Made. You have the right to receive a list of instances in which we have disclosed your PHI. The list will not include disclosures we have made for treatment, payment, and healthcare operations purposes described in Section III, those made directly to you or your family or friends, for disaster notification purposes, or those that were made per an authorization from you. Neither will the list include disclosures we have made for national security or intelligence purposes, or to correctional institutions or law enforcement officials having lawful custody of an inmate or other individual, or disclosures made before April 14, 2003. Your request for a list of disclosures must be made in writing and be addressed to our Customer Service Department at 6380 Folsom Dr, Beaumont, TX 77706. We will respond to your request within 60 days (or 90 days if the extra time is needed). The list we provide will include disclosures made within the last six years unless you specify a shorter period. The first list you request within a 12-month period will be free. If a fee will apply to any additional list, we will notify you in advance and give you the opportunity to withdraw or modify your request to avoid or reduce the fee.

VIII. The Right to Receive a Paper Copy of This Statement.

Even if you have agreed to receive this Statement by email, you have the right to request a paper copy as well. You may obtain a paper copy of this Statement by contacting our Customer Service Department at 6380 Folsom Dr, Beaumont, TX 77706.

IX. Complaints.

If you believe your privacy has been violated, you may file a complaint with us, with the Secretary of the Federal Department of Health and Human Services, or with the Texas Attorney General. To file a complaint with us, put your complaint in writing and address it to our Chief Privacy Officer at SCL 340B Care, 6380 Folsom Dr, Beaumont, TX 77706. To file a complaint with the Secretary, contact the HHS Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, 1-800-368-1019, or www.hhs.gov/ocr. To file a complaint under Texas law, contact the Office of the Texas Attorney General at www.texasattorneygeneral.gov. We will not retaliate against you for filing a complaint. You may also contact our Privacy Officer if you have questions or comments about our privacy practices.

X. Electronic Disclosure of Your PHI.

Under Texas Health and Safety Code § 181.154, we are required to notify you that your PHI is subject to electronic disclosure. Your PHI may be disclosed electronically, including by email, fax, or electronic data transmission, for purposes of treatment, payment, or health care operations described in Section III above, or as otherwise authorized or required by law. Except as permitted by law, we will not electronically disclose your PHI to any other person without a separate written, electronic, or oral (if documented in writing) authorization from you for that specific disclosure. We use encryption and other appropriate safeguards when transmitting your PHI electronically.

XI. Government Access, Record Retention, and Disposition of PHI.

SCL 340B Care will make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received on behalf of, your covered entity available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance with the HIPAA Rules. SCL 340B Care will maintain all records relating to its use and disclosure of your PHI, and its compliance with the 340B program and the HIPAA Rules, for a minimum of six (6) years from the date of creation or the date when the record was last in effect, whichever is later, or such longer period as required by applicable law. Upon termination of our agreement with your covered entity, SCL 340B Care will, if feasible, return or destroy all PHI received from, or created or received on behalf of, your covered entity. If return or destruction is not feasible, SCL 340B Care will extend the protections of this Statement to the information and limit further uses and disclosures to those purposes that make the return or destruction infeasible.

Please refer to the notice of privacy practices of the hospital, health center, clinic or other provider whose 340B program we administer for additional information about the uses and disclosures of your PHI and your rights under HIPAA. Your covered entity's notice of privacy practices may provide additional protections or rights beyond those described in this Statement.

‍