HIPAA Privacy Policy

Your Information. Your Rights. Our Responsibilities.


Effective Date: August 1, 2021

The terms of this Notice of Privacy Practices (“Notice”) apply to Cresco Labs, LLC, and its employees (collectively “Cresco Labs,” “we,” “us”). Cresco Labs will share protected health information (“PHI”) of patients as necessary to carry out treatment, payment, and health care operations as permitted by law and for the purposes described below. We are required by law to abide by the terms of this Notice for as long as it remains in effect. We reserve the right to change the terms of this Notice as necessary and to make a new Notice effective for all PHI collected by Cresco Labs. We are also required to inform you that there may be a provision of State law that relates to the privacy of your health information that may be stricter (or more protective of you) than a standard or requirement under HIPAA, and we will comply with the stricter (or more protective) standard. A copy of any revised Notice or information pertaining to a specific State law may be obtained by mailing a request to the HIPAA Privacy Officer, Cresco Labs, LLC

600 W Fulton #800
Chicago, IL 60661.

Your Rights

 You have the right to:

  • Get a copy of your paper or electronic medical record (e.g. medical marijuana purchase history)
  • Correct your paper or electronic medical record
  • Request confidential communication
  • Ask us to limit the information we share
  • Get a list of those with whom we’ve shared your information
  • Get a copy of this Notice
  • Choose someone to act for you
  • File a complaint if you believe your privacy rights have been violated
  • Receive notice if there is a Breach as defined under HIPAA
  • In the case of a Breach, you should contact the Illinois Department of Financial and Professional Regulation at FPR@medicalcannabis@illinois.gov and the Illinois Department of Public Health at medicalcannabis@illinois.gov.

 Your Choices 

You have some choices in the manner that we use and share information as we:

  • Tell family and friends about your condition or status as a medical marijuana patient
  • Provide disaster relief
  • Share your information as detailed in the full Notice of Privacy Practices

 Our Uses and Disclosures 

We may use and share your information as we:

  • Treat you
  • Run our organization
  • Get paid for your medical marijuana
  • Help with public health and safety issues
  • Do research
  • Comply with the law
  • Respond to organ and tissue donation requests
  • Work with a medical examiner or funeral director
  • Address workers’ compensation, law enforcement, and other government requests
  • Respond to lawsuits and legal actions

Our Responsibilities

  • We are required by law to maintain the privacy and security of your PHI.
  • We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information. We will also let state and federal regulators know as required by applicable laws and regulations.
  • We must follow the duties and privacy practices described in this Notice and give you a copy of it.
  • We will not use or share your information other than as described herein unless you tell us we can in writing. If you tell us we can, you may change your mind at any time. Let us know in writing if you change your mind.
    • We never market or sell personal information without your written permission.
    • We will not share any substance abuse treatment records without your written permission, except in extremely limited situations such as research activities if certain conditions are met, medical emergencies, audit evaluation activities, and by court order.
  • For more information see: www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/noticepp.html.

 Changes to the Terms of this Notice.

 We can change the terms of this Notice, and the changes will apply to all information we have about you. The new notice will be available upon request, in the dispensary, and on our website.

For Further Information.

 To exercise your rights, for questions, or further assistance regarding this Notice, you may contact the HIPAA Privacy Officer by email at Vatsala.Dubey@crescolabs.com, by telephone at (312) 929-0993, or by writing to the HIPAA Privacy Officer at HIPAA Privacy Officer, Cresco Labs, LLC

600 W Fulton #800
Chicago, IL 60661.