What Is Protected Health Information (PHI)?
Protected Health Information (PHI) is any information about your health that can be linked to you. In the context of Generic Contacts, this includes:
- Your contact lens prescription (sphere, cylinder, axis, base curve, diameter)
- Your prescriber's name and information
- Prescription expiration dates
- Any notes or documentation about your vision correction needs
- Uploaded prescription documents (photos or PDFs)
PHI does not include de-identified information that cannot reasonably be used to identify you.
How We Use and Disclose Your PHI
We use and disclose your PHI only in the ways described in this notice. The following uses and disclosures do not require your specific authorization:
For Treatment Purposes (Order Fulfillment)
We use your prescription information to verify and fill your contact lens order. This is our primary reason for collecting PHI. We are required by federal law (the Fairness to Contact Lens Consumers Act) to verify your prescription with your prescriber before dispensing contact lenses.
For Healthcare Operations
We may use your PHI for internal business operations including:
- Training staff on proper prescription verification procedures
- Conducting quality assurance reviews
- Auditing compliance with HIPAA and FCLCA requirements
As Required by Law
We will disclose your PHI when required by federal, state, or local law, including in response to a valid court order, subpoena, or government investigation.
To Avert a Serious Threat
We may use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety, or the health or safety of others.
To Business Associates
We share PHI with vendors who perform services on our behalf and who have signed a HIPAA Business Associate Agreement (BAA). These vendors are contractually required to protect your PHI and may only use it as necessary to provide services to us. Our Business Associates include:
- Secure cloud storage providers (for storing uploaded prescription documents)
- Our software platform and hosting provider
Uses and Disclosures Requiring Your Authorization
For uses and disclosures not described above, we will ask for your written authorization. You may revoke an authorization at any time in writing, except where we have already taken action based on it. Uses requiring authorization include:
- Marketing communications that involve use of your PHI
- Sale of your PHI to any third party (we do not sell PHI)
- Sharing PHI with any person or organization not described in this notice
We do not sell your PHI. We do not use your prescription information for marketing purposes. Your health information will never be shared with advertisers, data brokers, or any third party for commercial purposes.
Your Rights Regarding Your PHI
You have the following rights with respect to your Protected Health Information. To exercise any of these rights, contact us at privacy@genericcontacts.com.
Right to Access & Copy
You may request a copy of your PHI that we maintain. We will provide it in a readable format within 30 days of your request.
Right to Amend
If you believe your PHI is incorrect or incomplete, you may request an amendment. We may deny the request in certain circumstances and will explain why.
Right to Accounting of Disclosures
You may request a list of disclosures of your PHI made in the past 6 years, other than disclosures for treatment or operations.
Right to Request Restrictions
You may ask us to limit how we use or disclose your PHI. We are not required to agree, but will tell you if we cannot honor your request.
Right to Confidential Communications
You may request that we communicate with you in a specific way (e.g., only by email, not phone). We will accommodate reasonable requests.
Right to a Paper Copy
You may request a paper copy of this notice at any time, even if you agreed to receive it electronically. Contact us and we will mail it to you.
Our Duties
Generic Contacts is required by law to:
- Maintain the privacy and security of your PHI
- Provide you with this notice describing our privacy practices
- Follow the terms of the notice currently in effect
- Notify you in the event of a breach of your unsecured PHI
We reserve the right to change our privacy practices and to make the new practices applicable to all PHI we maintain. If we make a material change, we will revise this notice and post the new version on our website. The new notice will apply to all PHI we maintain as of its effective date.
How to File a Complaint
If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). We will not retaliate against you for filing a complaint.
File a Complaint with Generic Contacts
Email us at privacy@genericcontacts.com with a description of your concern. We will acknowledge your complaint within 5 business days and work to resolve it.
File a Complaint with HHS OCR
You may also file a complaint directly with the U.S. Department of Health and Human Services:
- Online: hhs.gov/ocr/complaints
- Phone: 1-800-368-1019
- Mail: Hubert H. Humphrey Building, 200 Independence Avenue, S.W., Washington, D.C. 20201
Contact Our Privacy Office
For questions about this notice or to exercise any of your rights, please contact us:
Generic Contacts — Privacy Office
Email: privacy@genericcontacts.com
Website: genericcontacts.com
We aim to respond to all PHI-related requests within 5 business days.