Consent Preferences

Medication History Data Addendum

This Medication History Data Addendum (the “Addendum”) governs your access to and use of medication history data made available through the CareFlowIQ platform. It supplements, and is incorporated into, the agreement between you (the “Healthcare Customer”) and Milliman Solutions, LLC (“Milliman”) for access to the CareFlowIQ services (the “Service Agreement”). Capitalized terms not defined here have the meaning given in the Service Agreement.

The medication history data described here is supplied by a third-party data network. The terms below are required flow-down conditions imposed by that network and its data sources, and you agree to them as a condition of accessing medication history data. By accessing or using medication history data through CareFlowIQ, you agree to be bound by this Addendum.

1. Definitions

“Data Sources” means the pharmacy benefit managers, payers, pharmacies, and other entities that supply medication history data through the network.

“End User” means an individual who is employed by, on the medical staff of, or a legally authorized representative of the Healthcare Customer, who is providing healthcare services and, where required by law, is duly licensed and holds a National Provider Identifier (NPI).

“Medication History Data” means prescription and medication history information delivered to the Healthcare Customer through CareFlowIQ from the Data Sources.

“Network Materials” means the technical, certification, and operational materials made available to enable use of Medication History Data, all of which are confidential and proprietary to the data network.

2. Eligibility — Who May Access Medication History Data

Only eligible End Users at an eligible Healthcare Customer may access Medication History Data. The Healthcare Customer must confirm, on an ongoing basis, that each End User meets the End User definition above and satisfies applicable identity-proofing and authentication requirements before granting access.

The following are never permitted to access Medication History Data: the general public; individual patients; pharmacies; pharmaceutical manufacturers; pharmacists engaged in dispensing medications; and anyone engaged in fraud, identity theft, or impersonation of a provider.

A Healthcare Customer must have a signed Business Associate Agreement (BAA) with Milliman. Health plans, pharmacies, health information exchanges (HIEs), patients, pharmaceutical companies, and technology vendors that resell CareFlowIQ are not eligible to be Healthcare Customers for purposes of Medication History Data.

3. Required Provisions

The Healthcare Customer and its End Users agree to each of the following:

  1. Confidentiality. You will keep confidential all proprietary and confidential information of the data network and its participants, including the Network Materials, and will not disclose or use it except as permitted under this Addendum.
  2. Adherence to Applicable Law. You will comply with all applicable law, including HIPAA and HITECH, and will obtain all patient consents and authorizations required by law in connection with Medication History Data.
  3. Disclaimers. You acknowledge the disclaimers in Section 6 below regarding the limitations, accuracy, and completeness of Medication History Data, and you accept the associated responsibilities.
  4. Audit. You will allow Milliman and the data network to access, inspect, and audit your records relating to the use of Medication History Data and the related services, on reasonable prior notice.
  5. Network Materials. Where Network Materials are provided to you, you will comply with them on the same terms that apply to Milliman, subject to the confidentiality obligations in this Addendum.
  6. Privacy and Security. You will comply with the privacy and security requirements in Section 5 below.
  7. Medication History Release. You agree to the medication history release and hold-harmless terms in Section 6(d) below, which run for the benefit of the data network and the Data Sources.
  8. Safeguards. You will (a) establish and maintain safeguards against the destruction, loss, or alteration of Medication History Data that are no less rigorous than those you maintain for your own information of a similar nature, and no less than reasonable; (b) have in place appropriate administrative, technical, and physical safeguards to protect the privacy of Medication History Data; and (c) reasonably safeguard Medication History Data from any intentional or unintentional use or disclosure in violation of the HIPAA Privacy Rule, and limit incidental uses and disclosures.

4. Patient Consent — Mandatory Before Any Request

Before requesting Medication History Data for any patient, you must obtain a signed election from that patient that (a) affirms the patient’s decision to opt in to (or opt out of) the service, and (b) authorizes retrieval of that patient’s medication history. This consent must be in place before the first request for that patient. You must retain evidence of consent and comply with any additional patient-consent policies imposed by the Data Sources.

5. Permitted Use and Restrictions

  • Treatment only. You may request Medication History Data only on behalf of a provider currently treating the patient, and may use the result only for that patient’s treatment.
  • No commercial use. You will not capture, examine, repackage, redistribute, license, sell, or otherwise commercially exploit Medication History Data beyond the permitted treatment use.
  • Data stays in the U.S. You will not store or send Medication History Data, or any individually identifiable information derived from it, outside the United States.
  • Pharmacy firewall. If you have pharmacy operations, you will keep Medication History Data walled off from those operations, and will not use it to promote your dispensing services or to augment your own medication history records.

6. Disclaimers and Associated Responsibilities

(a) Availability of Data Sources

No representation or warranty is made regarding the availability of any particular Data Source. Data Sources may be added, removed, or may limit access at any time, potentially without prior notice.

(b) Limitations of the Data

Patient identities are matched using available technology across many sources, not all of which are accessible or maintained consistently. False matches, errors, and omissions are possible. It is the responsibility of the treating provider — not the data network or any Data Source — to verify medication history through other means with the patient before relying on it for diagnosis or treatment.

(c) No Substitution for Professional Judgment

Use of Medication History Data is not a substitute for a provider’s standard practice or professional judgment. Any decision about the appropriateness of treatment, or the validity or reliability of information, is the sole responsibility of the patient’s provider.

(d) Release and Hold Harmless

You release and hold harmless the data network, the Data Sources, and any entity providing medication history information from any liability, cause of action, or claim related to the completeness of, or any lack of completeness in, the Medication History Data. The data network and the Data Sources are intended third-party beneficiaries of this Section 6.

7. General

This Addendum supplements the Service Agreement. If there is a conflict between this Addendum and the Service Agreement with respect to Medication History Data, this Addendum controls as to that data. Your right to access Medication History Data may be suspended or terminated if you, or any of your End Users, fail to comply with this Addendum. The disclaimers, release, and confidentiality obligations survive termination.