HIPAA Notice

1. Who Holds Your Health Information

When you request care through Tor Health, the information you give in your intake, your messages with your clinician, your prescriptions, and your laboratory results become protected health information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). That information is held by the affiliated professional medical group that treats you (LFG Medical of CA, P.C., LFG Medical of KS, P.A., LFG Medical of TX, P.C., and LFG Medical of NJ, P.C., each a "Medical Group"). The Medical Group is the HIPAA covered entity responsible for your medical record, and it issues the Notice of Privacy Practices that governs how your PHI is used and disclosed.

If a clinician prescribes medication, the partner pharmacy that fills it holds the PHI it needs to dispense and ship your order and has its own Notice of Privacy Practices. Empower Capital Group LLC ("Tor Health") and its technology platform provider, Medstra Inc DBA Cuvo Health, handle PHI on the Medical Group's behalf only to operate the platform, process your order, and provide non-clinical support, and only as HIPAA permits.

Getting a Copy of the Notice of Privacy Practices

The treating Medical Group's Notice of Privacy Practices is provided to you as part of your care. You can ask for a paper or electronic copy at any time by emailing privacy@bytorhealth.com, even if you have already agreed to receive it electronically.

2. How Your Health Information May Be Used and Disclosed

HIPAA allows your PHI to be used and disclosed without your written authorization for the following purposes:

• Treatment. To evaluate you, prescribe and adjust treatment, order and review laboratory tests, and coordinate your care, including sending a prescription to the partner pharmacy that fills it and a test order to the laboratory that runs it.
• Payment. To process payment for the services and medication you buy. Services are cash-pay only, so no claim is submitted to any insurer, Medicare, or Medicaid.
• Health care operations. To run the practice and the platform: quality review, clinician oversight, compliance audits, customer support, and security.
• Reminders and care communications. To remind you about follow-ups, refills, and shipments, and to tell you about treatment options related to your care.
• People involved in your care. To share relevant information with a family member or other person you identify, unless you object.
• As required or permitted by law. For public health reporting (such as adverse drug events), health oversight audits and inspections, judicial and administrative proceedings, law enforcement purposes allowed by HIPAA, to avert a serious threat to health or safety, to coroners and medical examiners, for workers’ compensation, and for specialized government functions.

Uses That Need Your Written Authorization

Any other use or disclosure of your PHI is made only with your written authorization, which you may revoke in writing at any time (a revocation does not undo a disclosure already made in reliance on it). Your PHI is never sold, and it is not used or disclosed for marketing or advertising, without your written authorization.

3. Your Rights

Under HIPAA you have the right to:

• See and get a copy of your medical record, in paper or electronic form. A reasonable, cost-based fee may apply to copies.
• Ask for a correction of information in your record that you believe is wrong or incomplete. A request may be denied in writing, with the reason, and you may then file a statement of disagreement.
• Ask for confidential communications, for example by a different email address, phone number, or mailing address. Reasonable requests will be accommodated.
• Ask to limit what is used or shared. The Medical Group is not required to agree, except that it must agree not to share information with a health plan about a service you paid for in full out of pocket.
• Get a list of disclosures (an accounting) of your PHI made in the six years before your request, other than those for treatment, payment, health care operations, and certain others. One list a year is free.
• Get a paper copy of this notice and of the Medical Group’s Notice of Privacy Practices at any time.
• Choose someone to act for you, such as a person with your medical power of attorney or a legal guardian.
• Be notified if a breach compromises the privacy of your unsecured PHI.
• File a complaint if you believe your privacy rights have been violated, without retaliation.

4. How to Use Your Rights

To ask for a copy of your record, a correction, an accounting, a restriction, or confidential communications, send your request to the privacy contact below. Tor Health will route it to the Medical Group that treats you and help you complete it. You may need to verify your identity before records are released.

Privacy contact: Empower Capital Group LLC, Attn: Privacy Officer, 900 Church St, Apt 610, Nashville, TN 37203; email privacy@bytorhealth.com.

5. Complaints

If you believe your privacy rights have been violated, you may file a complaint with the privacy contact above or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, by calling 1-877-696-6775, or online at www.hhs.gov/ocr/complaints. You will not be retaliated against for filing a complaint.

6. Changes to This Notice

This notice may change, and a change applies to all health information already held. The current version is always posted at bytorhealth.com/hipaa with its effective date, and the Medical Group’s current Notice of Privacy Practices is available on request. For how Tor Health handles personal information outside your medical record, see our Privacy Policy.