NOTICE OF PRIVACY PRACTICES (HIPAA)
Pyramids Pharmacy · Pyramids Infusion Center · Lotus
Privacy Officer contact information:
Email: privacy@pyramidspharmacy.com
Privacy Officer phone: 888-201-2825 (TTY 711)
Effective date: October 9, 2026
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. PLEASE REVIEW IT CAREFULLY.
This notice applies to Sphinx Pharmacy Group, LLC, doing business as Pyramids Infusion Center, Pearland Unicare, LLC, doing business as Pyramids Pharmacy, and Nature Health and Wellness Clinic, LLC, doing business as Lotus Health, separate legal entities under common ownership that provide pharmacy and infusion services. These companies operate as a single “affiliated covered entity” for purposes of HIPAA and are referred to collectively as (“Pyramids,” “we” or “us”). The members of the affiliated covered entity will share medical information with each other for treatment, payment and health care operations and as permitted by HIPAA and this Notice. For example, Pyramids Pharmacy may dispense the medication you receive at a Lotus Health infusion suite and share your records with Lotus Health nurses. For a list of members, contact our Privacy Officer.
This Notice of Privacy Practices (“Notice”) describes how we may use and disclose your medical information, also called protected health information (PHI), and your rights concerning it. It is provided to you under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”), federal rules for substance use disorder records (42 C.F.R. Part 2), and applicable state law.
Generally, when this Notice uses the words “you” or “your,” it refers to the patient who is the subject of the PHI. When this Notice discusses rights regarding PHI, “you” and “your” may also refer to a patient’s parent, legal guardian or other personal representative.
OUR RESPONSIBILITIES
We are required to (i) maintain the privacy and security of your medical information as required by law; (ii) provide you with this Notice of our legal duties and privacy practices; (iii) abide by the terms of the Notice currently in effect; (iv) notify you following a breach of your unsecured medical information; and (v) use or disclose only the minimum information needed, except where the law allows otherwise. We protect your information with administrative, physical and technical safeguards, and our business associates must sign agreements to protect it.
We reserve the right to change the terms of this Notice and to make the new Notice effective for all medical information we maintain, including information created or received before the change. If we change this Notice, the revised Notice will be posted at our locations and on our website and made available upon request. Copies of the current Notice may be obtained from our Privacy Officer using the contact information at the end of this Notice.
USES AND DISCLOSURES WITHOUT YOUR AUTHORIZATION
The following categories describe ways we use and disclose medical information without your written HIPAA authorization, subject to 42 C.F.R. Part 2, as applicable, and other more strict applicable laws. For each category, we explain what we mean and try to give an example. Not every use or disclosure in a category is listed, but all of the ways we are permitted to use and disclose medical information without authorization fall within one of the categories.
Treatment
We may use and disclose your medical information to dispense your medications, provide infusion therapy at home or in our infusion suites, and coordinate and manage your care.
For example: Our pharmacist may talk with your prescriber about your dose, lab results or side effects, and share your medication record with the nurse administering your infusion. We may also share information with your home health agency, hospital, laboratory, or another pharmacy you ask us to transfer your prescriptions to.
Payment
We may use and disclose your medical information as needed to bill and obtain payment for the medications and services we provide.
For example: We may contact your health plan, Medicare or Medicaid to confirm coverage, obtain prior authorization or submit a claim. We may share information with manufacturer or foundation assistance programs you enroll in or ask us to enroll you in.
Health Care Operations
We may use and disclose your medical information to run our pharmacy and infusion services, including quality assessment and improvement, patient safety, staff training, accreditation, licensing, audits, compliance and business planning.
For example: We may review records to evaluate the quality and safety of the care we provide.
Health-Related Communications
We may contact you with refill reminders, delivery and appointment information, and information about treatment alternatives or health-related services related to your care. If a third party pays us to send you a communication, we will get your authorization first, except as HIPAA allows (for example, a refill reminder for a drug you currently take).
Health Information Exchange (HIE)
We may share your medical information electronically through health information exchanges and e-prescribing networks so your other health care providers can see your medication history and better coordinate your care.
For example: If you are taken to an emergency room, the treating team can see which medications you take. If you do not wish your information to be shared through an HIE, contact our Privacy Officer at 888-201-2825 or privacy@pyramidspharmacy.com.
De-identified Data and Limited Data Sets
We may remove information that identifies you and use or share the result as HIPAA allows; de-identified data is no longer PHI. We may also create a “limited data set” (information with direct identifiers such as your name and address removed) and share it with those who sign an agreement to use it only for research, public health or health care operations and to protect it.
Demographic Information
We may collect or receive information about your race, ethnicity, preferred language, sexual orientation and gender identity. We use it to understand your needs, offer interpreters and translated materials, and improve our programs. We protect it like all PHI and do not use it to deny you services.
Family, Friends and Others Involved in Your Care
Unless you tell us otherwise, we may disclose your medical information to a family member, friend, caregiver or other person involved in your care or who helps pay for it, including people you authorize to receive or sign for deliveries on our Medication Release form. If you cannot agree because of an emergency, we may share needed information based on our professional judgment of your best interest, and give you a chance to object as soon as you can. After your death, we may share relevant information with those involved in your care unless you told us otherwise.
Disaster Relief Efforts
We may disclose limited medical information to an authorized public or private entity assisting in disaster relief so your family can be notified of your location and condition. You may object unless doing so would impede our emergency response.
Business Associates
We may disclose your medical information to companies we contract with to perform services on our behalf, such as billing, delivery and courier, software, accreditation and records-storage vendors. They must sign an agreement to safeguard your information.
Required by Law
We may use or disclose your medical information when federal, state or local law requires it, limited to what the law requires, such as reporting controlled substance prescriptions to state prescription drug monitoring programs.
Public Health Activities
We may disclose your medical information for public health activities, including:
- To prevent or control disease, injury or disability
- To report adverse reactions to medications or problems with products to the FDA
- To notify people of recalls of products they may be using
- To notify a person who may have been exposed to or be at risk of spreading a disease
- To report deaths
- To report findings to your employer about work-related illness or injury when the law allows
Abuse, Neglect or Domestic Violence
We may notify an authorized government agency if we believe you are a victim of abuse, neglect or domestic violence. We will make this disclosure only if you agree or when the law requires or allows it.
Health Oversight Activities
We may disclose your medical information to health oversight agencies for activities authorized by law.
For example: State boards of pharmacy, HHS, CMS and accrediting organizations conduct audits, inspections, investigations and licensing reviews.
Law Enforcement
We may disclose your medical information to law enforcement as the law allows, such as to comply with a warrant or court order, identify or locate a suspect, fugitive, witness or missing person, or report a crime on our premises.
Judicial and Administrative Proceedings
We may disclose your medical information in response to a court or administrative order. We may also respond to a subpoena or other lawful request if efforts were made to tell you or to obtain a protective order.
To Avert a Serious Threat to Health or Safety
We may use or disclose your medical information when necessary to prevent or lessen a serious and imminent threat to you, another person or the public. Any disclosure will be only to someone able to help prevent the threat.
Coroners, Medical Examiners and Funeral Directors
We may disclose medical information to identify a person, determine cause of death, or help them carry out their duties.
Organ and Tissue Donation
We may disclose medical information to organizations that handle organ, eye or tissue donation and transplantation.
Research
We may use and disclose your information for research approved by an institutional review board or privacy board with protections for your privacy, or as otherwise allowed by HIPAA.
Workers’ Compensation
We may disclose your medical information as authorized by law for workers’ compensation or similar programs.
Military, Veterans, National Security and Other Government Purposes
If you are a member of the armed forces, we may release your information as required by military command authorities. We may also disclose information to authorized federal officials for intelligence, counterintelligence and protective services for the President and others.
Correctional Institutions
If you are an inmate or in the custody of a law enforcement official, we may disclose information needed for your care, your health and safety, or the health and safety of others.
HHS Compliance
We may disclose your information to the Secretary of Health and Human Services to investigate or confirm our compliance with HIPAA.
OTHER USES AND DISCLOSURES REQUIRING YOUR AUTHORIZATION OR CONSENT
If we wish to use or disclose your medical information for a purpose not set forth in this Notice, we will seek your written authorization. Specific examples include: (i) most uses and disclosures for marketing purposes, except face-to-face communications and promotional gifts of nominal value; (ii) disclosures that constitute a sale of your medical information; and (iii) most uses and disclosures of psychotherapy notes. We generally do not keep psychotherapy notes; if we receive them, we will use or share them only with your authorization or in the narrow cases HIPAA allows, such as defending a legal action you bring or when the law requires it.
You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.
Substance use disorder (SUD) records subject to 42 C.F.R. Part 2. We may receive records from federally assisted SUD treatment programs. When we receive these records with your written consent for treatment, payment and health care operations, we may use and disclose them for those purposes as HIPAA and Part 2 allow; other uses follow Part 2 limits. We will not use or disclose Part 2 records, or testimony relaying their content, in any civil, criminal, administrative or legislative investigation or proceeding against you unless you give specific written consent, or a court issues an order meeting Part 2 requirements after notice and an opportunity to be heard is provided to you or the holder of the record, together with a subpoena or other legal mandate compelling disclosure. You may revoke your Part 2 consent in writing at any time, except for actions already taken in reliance on it. We do not use Part 2 records for fundraising.
YOUR MEDICAL INFORMATION RIGHTS
Inspect and/or obtain a copy of your medical information
You have the right to inspect and obtain a paper or electronic copy of your medical, prescription and billing records, or to ask us to send a copy to a person or organization you choose. Submit a written request to our Privacy Officer. We will respond within 30 days, or within 15 business days for electronic health records requested by Texas patients, unless a stricter state rule applies; we may take one 30-day extension if we tell you why in writing. We may charge a reasonable, cost-based fee for copying labor, supplies and postage, and will tell you the fee in advance. We will not unreasonably block or delay access to your electronic health information. If we deny access, we will explain why in writing, and in some cases you may request review by a licensed health professional not involved in the denial.
Request a restriction on certain uses and disclosures
You have the right to ask us not to use or disclose part of your medical information for treatment, payment or health care operations, or not to share it with people involved in your care. We will consider your request but are not required to agree. If we agree, we will follow the restriction unless the information is needed for emergency treatment. Submit a written request to our Privacy Officer.
Restrict disclosures to your health plan for items you pay for yourself
If you pay for a medication or service in full out of pocket, you may ask us not to disclose that information to your health plan for payment or health care operations. We will agree unless a law requires the disclosure.
Request confidential communications
You have the right to ask that we communicate with you in a certain way or at a certain location. We will not ask why, and we will accommodate all reasonable requests, including requests made because you are concerned for your safety.
For example: You can ask that we contact you only on your cell phone or send mail to a different address.
Request an amendment to your medical information
If you believe information in your record is incorrect or incomplete, you may submit a written request to our Privacy Officer explaining why. We will respond within 60 days, with one 30-day extension if we tell you in writing. If we deny your request, we will explain why in writing, and you may file a statement of disagreement that we will add to your record.
Request an accounting of certain disclosures
You have the right to receive a list of certain disclosures we made of your medical information during the six years before your request, excluding disclosures for treatment, payment or operations, disclosures to you or that you authorized, and others the law excludes. Submit a written request to our Privacy Officer. We will respond within 60 days, with one 30-day extension if we tell you in writing. The first accounting in a 12-month period is free; we may charge a reasonable, cost-based fee for additional requests.
Receive notice of a breach
You have the right to be notified if a breach of your unsecured medical information occurs. We will notify you without unreasonable delay and no later than 60 days after discovery.
Choose someone to act for you
If you have given someone medical power of attorney or someone is your legal guardian, that person may exercise your rights. For minors, a parent or guardian usually acts for the child, except where state law lets a minor consent to their own care. We will confirm the person’s authority first.
Obtain a paper copy of this Notice
You have the right to a paper copy of this Notice upon request, even if you agreed to receive it electronically. It is also posted at: www.pyramidsinfusion.com/privacy-policy.
STATE LAW
We will not use or share your information if state law prohibits it. Some states have laws that are stricter than federal privacy rules. If a state law applies to you and gives you more protection, we will follow it. Some states require your specific authorization before we share information about HIV/AIDS, mental and behavioral health, substance use disorder, genetic testing, sexually transmitted infections, reproductive health care, or care provided to minors who consented to their own treatment.
Texas patients: Your PHI may be subject to electronic disclosure (Tex. Health & Safety Code §181.154). We will not disclose your PHI electronically without your authorization except for treatment, payment, health care operations, insurance purposes or as the law requires. You may request your electronic health records, and we will provide them within 15 business days of your written request (§181.102).
If you would like to know more about applicable state laws, please ask our Privacy Officer.
HOW WE CONTACT YOU
Calls and texts. We, or vendors working for us, may call or text you about refills, deliveries, appointments, treatment and benefits, including by automated dialing or prerecorded message, as the Telephone Consumer Protection Act allows. You may revoke consent at any time in any reasonable way, such as telling the caller, replying STOP to a text, or calling 855-889-9964.
Email and texting risk. Regular email and text messages are not encrypted and could be read by others. We will ask your preference before sending PHI this way and confirm you accept the risk before sending records by unencrypted email.
NONDISCRIMINATION AND NOTICE OF AVAILABILITY OF LANGUAGE ASSISTANCE
Pyramids complies with federal civil rights laws and does not discriminate, exclude people or treat them differently because of race, color, national origin, age, disability or sex. Appropriate auxiliary aids and services, such as large print and accessible formats, and free language assistance services, including qualified interpreters and translated materials, are available at no cost. To request help or file a grievance, contact our Privacy Officer at 888-201-2825 (TTY 711). You may also file a civil rights complaint with HHS OCR at ocrportal.hhs.gov or 1-800-368-1019 (TDD 1-800-537-7697).
ATENCIÓN: si habla español, tiene a su disposición servicios gratuitos de asistencia lingüística. Llame al 855-889-9964 (TTY 711).
QUESTIONS, CONCERNS OR COMPLAINTS
If you have questions, want more information about this Notice, or want to exercise your rights, contact our Privacy Officer:
Mail: Privacy Officer, Pyramids Pharmacy, 3569 Business Center Dr., Suite 110, Pearland, TX 77584
Phone: 888-201-2825 (TTY 711)
Fax: 855-889-9965
Email: privacy@pyramidspharmacy.com
Monday–Friday, 8:30 AM–5:00 PM Central.
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Office for Civil Rights: Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Room 509F HHH Bldg., Washington, D.C. 20201 · 1-800-368-1019 (TDD 1-800-537-7697) · OCRComplaint@hhs.gov · www.hhs.gov/hipaa/filing-a-complaint. We will not retaliate against you or take action against you for filing a complaint.