I acknowledge receipt of and have had the opportunity to read MyRxWallet's Notice of Privacy Practices (NPP) as required by the HIPAA Privacy Rule. I understand that MyRxWallet may use and disclose my Protected Health Information (PHI) for Treatment, Payment, and Healthcare Operations (TPO) purposes without additional authorization, consistent with 45 CFR § 164.506. I understand I have the following rights under HIPAA:

(a) Right to access and receive a copy of my health records [45 CFR § 164.524];
(b) Right to request amendment of inaccurate records [45 CFR § 164.526];
(c) Right to an accounting of disclosures [45 CFR § 164.528];
(d) Right to request restrictions on certain uses and disclosures [45 CFR § 164.522];
(e) Right to revoke this authorization at any time in writing without penalty [45 CFR § 164.508(b)(5)], except to the extent that action has already been taken in reliance on it.

I hereby authorize MyRxWallet North America Corporation to act as my personal representative and authorized agent for the sole purpose of retrieving my health records from:

(a) My healthcare providers (physicians, hospitals, pharmacies, laboratories) under my direction;
(b) My health insurers and payers through CMS Blue Button 2.0, CARIN Alliance APIs, or direct payer APIs;
(c) Health information exchanges (HIEs) and TEFCA Qualified Health Information Networks (QHINs) via the patient-as-requester model;
(d) Federal government health programs (Medicare, Medicaid, VA, TriCare) through authorized APIs.

This authorization is granted under the 21st Century Cures Act § 4004 (information blocking prohibition — my right to access my data electronically), 45 CFR § 164.524 (HIPAA right of access), and 42 CFR § 422.119 / 423.152 (CMS interoperability rules). I understand that denial of this right of access by any covered entity may constitute an information blocking violation reportable to the ONC.

I authorize MyRxWallet to encrypt my retrieved health records using patient-controlled encryption keys and store the encrypted ciphertext in my personal MyRx-Vault — a blockchain-anchored storage node assigned exclusively to my account. I understand:

(a) MyRxWallet holds only encrypted ciphertext — the company cannot read, access, or decrypt my records without my encryption key, which I alone possess;
(b) Under the HIPAA conduit exception (45 CFR § 164.501), a conduit that transmits or stores only encrypted information that it cannot access does not constitute a covered entity holding my PHI for breach reporting purposes;
(c) My records are anchored to my personal MyRx-ID NFT on the MyRx-Chain blockchain — a permissioned Hyperledger Fabric network owned entirely by MyRxWallet North America Corporation, with zero third-party access;
(d) Data at rest is encrypted per NIST SP 800-111 standards; data in transit uses TLS 1.3 per 45 CFR § 164.312(e)(2)(ii).

I understand and authorize that no provider, insurer, employer, researcher, or any other party may access my health records stored in my MyRx-Vault without:

(a) A valid, unexpired consent token that I have personally issued (via QR scan approval, NFC tap, or in-app approval);
(b) A stated purpose at the time of the access request (Treatment / Payment / Operations / Research / Legal / Other);
(c) My real-time notification with the right to approve or deny before access is granted.

Every consent grant and revocation is recorded on the MyRx-DAO consent ledger on MyRx-Chain and is immutable and time-stamped. Any unauthorized access to my data without a valid consent token constitutes a violation of the HIPAA Privacy Rule (45 CFR § 164.502), the Computer Fraud and Abuse Act (18 U.S.C. § 1030), and applicable state computer crime statutes — and full liability rests with the violating party, not MyRxWallet.

I acknowledge and MyRxWallet expressly warrants that:

(a) HITECH Act § 13405(d) (45 CFR § 164.502(a)(5)(ii)): MyRxWallet shall not receive direct or indirect remuneration in exchange for my PHI without my valid written authorization that specifically states the purpose is for remuneration to the covered entity;
(b) 42 CFR Part 2: If my health records contain substance use disorder (SUD) treatment information, I understand those records receive heightened federal protections and may not be disclosed without my separate, specific written consent, even to other treating providers — except in medical emergencies or as otherwise permitted by 42 CFR § 2.51;
(c) HITECH Act § 13405(a): MyRxWallet may not use my PHI for marketing or fundraising purposes without my separate written authorization;
(d) I have the right to opt out of fundraising communications at any time [45 CFR § 164.514(f)].

I understand that my medication records may include controlled substance prescriptions regulated by the Drug Enforcement Administration (DEA) under the Controlled Substances Act (21 U.S.C. § 801 et seq.) and DEA regulations (21 CFR Part 1300). I authorize MyRxWallet to:

(a) Retrieve and display my controlled substance prescription history as part of my complete medication record, with the same protections as all other PHI;
(b) Support drug provenance verification for medications I have been dispensed, consistent with the Drug Supply Chain Security Act (DSCSA) (21 U.S.C. § 360eee et seq.) for patient safety purposes;
(c) Generate alerts if a dispensed drug appears on an FDA drug recall or safety alert, using FDA EDDS data — I authorize receipt of such safety notifications.

Explicit restriction: MyRxWallet shall not transmit controlled substance prescription information to any party (including law enforcement) without a valid court order, subpoena, or my written authorization — except as required by 21 U.S.C. § 827 (recordkeeping and reporting required of registrants).

I authorize MyRxWallet to act as my authorized individual representative for the purpose of submitting patient-initiated health record queries through the Trusted Exchange Framework and Common Agreement (TEFCA) network and connected Qualified Health Information Networks (QHINs), in accordance with the Common Agreement v2.0 and ONC's TEFCA framework (45 CFR § 170.401).

I understand that MyRxWallet's proprietary AI automation agents will:

(a) Automatically initiate TEFCA queries on my behalf upon account activation — I will not need to manually initiate record requests;
(b) Automatically encrypt retrieved records and store them in my MyRx-Vault with zero human review of my PHI by any MyRxWallet employee;
(c) Monitor my health data continuously for abnormal lab values, medication interaction alerts, care gaps, and prescription refill reminders — and send me proactive health notifications (not promotional communications);
(d) Operate only within the scope of this signed authorization — the AI agents do not share, sell, or monetize my data under any circumstances.

This AI automation operates under the NIST AI Risk Management Framework (AI RMF) and applicable sections of the FDA's Predetermined Change Control Plan guidance for AI/ML-based health software.

I hereby consent to the use of electronic records and electronic signatures for all communications with MyRxWallet, pursuant to the Electronic Signatures in Global and National Commerce Act (E-SIGN Act, 15 U.S.C. § 7001 et seq.) and the Uniform Electronic Transactions Act (UETA) as adopted in my state. Specifically:

(a) This electronic consent form, including my digital signature and IP address timestamp, constitutes a valid written authorization under 45 CFR § 164.508(b) and shall have the same legal force as a handwritten signature on paper;
(b) My consent event will be recorded under 21 CFR Part 11 (FDA electronic records and electronic signatures) standards — an audit trail entry will be written to the MyRx-Chain blockchain ledger, recording: my patient ID, timestamp, IP address hash, consent version number, and a SHA-256 hash of the specific consent text I agreed to;
(c) I consent to receive health-related electronic communications (notifications, alerts, consent requests) from MyRxWallet via my registered email and, if I provide it, SMS — pursuant to TCPA (47 U.S.C. § 227) and ECPA (18 U.S.C. § 2510) compliance;
(d) I may revoke consent to electronic communications at any time by updating my account settings or replying STOP to any SMS.

This checkbox is entirely optional and has no effect on your ability to use MyRxWallet services.

I optionally authorize MyRxWallet to contribute a de-identified, aggregated version of my health data to healthcare research — for example, population health studies, public health surveillance, or FDA post-market safety monitoring. De-identification will be performed in accordance with 45 CFR § 164.514(b) (Expert Determination method) such that there is "no reasonable basis to believe that the information can be used to identify an individual."

If I check this box, I understand: (a) no personally identifiable information is shared; (b) I may revoke this authorization at any time without affecting my other services; (c) I may receive MRT token rewards for my data contribution as described in MyRxWallet's Token Economics disclosure; (d) this authorization complies with Common Rule requirements (45 CFR Part 46) for research ethics.