HIPAA Notice of Privacy Practices

Last updated: November 5, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective date: November 5, 2026
Covered entity: Tricom Health and Wellness, LLC, 2292 W Magee Rd, Suite 260, Tucson, AZ 85742

This Notice of Privacy Practices (the “Notice”) is required by the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, and their implementing regulations at 45 CFR Parts 160 and 164. It tells you how Tricom Health and Wellness, LLC (“Tricom,” “we,” “us,” or “our”) may use and disclose your protected health information, what rights you have regarding that information, and what legal duties we have to protect it. We wrote it in plain language. If anything is unclear, please call us at (520) 955-6690 and we will gladly explain it.

This Notice applies to the health information we create or receive about you in connection with the care and services we provide, including primary care, medical weight loss, peptide therapy, hormone replacement therapy, and aesthetic treatments. It applies to our physicians, nurse practitioners, medical assistants, administrative staff, and any trainees, students, or volunteers working under our direction.

In This Notice

1. What “protected health information” means
2. How we may use and disclose your information
3. Uses and disclosures that do not require your authorization
4. Uses and disclosures that require your written authorization
5. Substance use disorder records (42 CFR Part 2)
6. Information with extra legal protection
7. Your rights
8. Our duties
9. How to file a complaint
10. Contact us
11. Changes to this Notice
12. Acknowledgment of receipt
13. Our website, forms, and text messages

1. What “Protected Health Information” Means

“Protected health information” (“PHI”) is information about you, including demographic information, that we create or receive and that relates to your past, present, or future physical or mental health or condition, the care we provide to you, or the payment for that care, and that identifies you or could reasonably be used to identify you. PHI includes your medical record, laboratory and imaging results, prescriptions, treatment photographs, insurance and billing records, and your communications with us. It can be in paper, electronic, or oral form.

2. How We May Use and Disclose Your Information for Treatment, Payment, and Health Care Operations

HIPAA allows us to use and disclose your PHI for the following purposes without asking for your separate written permission.

Treatment

We use and share PHI to provide, coordinate, and manage your health care and related services. For example, your provider may review your lab results to adjust your hormone therapy, may share information with a pharmacy that fills your prescription, may refer you to a specialist and send your records to that specialist, or may consult with another clinician about your care. Staff may also use PHI to schedule your appointments and to remind you of them.

Payment

We use and share PHI to bill for and collect payment for the services we provide. For example, if you use health insurance, a health savings account, or a flexible spending account, we may send your health plan the information it needs to verify coverage, determine eligibility, process a claim, or review medical necessity. We may also share information with a billing service, a payment processor, or a collection agency if an account becomes past due.

Health Care Operations

We use and share PHI for the business activities needed to run our practice and to improve the care we deliver. For example, we may use PHI to review the quality of our services and the performance of our staff, to train clinical and administrative personnel, to conduct internal audits, to arrange for legal, accounting, consulting, or accreditation services, to resolve complaints, to plan for the growth of the practice, and to manage our information systems. We may also contact you to remind you of an appointment.

Other Uses Related to Your Care

• Appointment reminders and communications. We may contact you by telephone, text message, email, or mail to remind you of appointments, follow up on test results, or share information about your care. You may tell us how you prefer to be contacted (see “Confidential communications” below).
• Treatment alternatives and health-related benefits. We may tell you about treatment options, other services, or health-related products that may be of interest to you and that are part of your care. This is not marketing as long as we are not paid by a third party to make the communication.
• Family members and others involved in your care. If you are present and agree, or if we reasonably infer from the circumstances that you do not object, we may share relevant PHI with a family member, friend, or other person you identify who is involved in your care or its payment. If you are not able to agree or object (for example, in an emergency), we may share limited information if we determine in our professional judgment that doing so is in your best interest. We may also share information to notify or help locate a family member or personal representative about your location, general condition, or death, and to assist in disaster relief efforts.
• Business associates. We contract with outside companies that perform services for us, such as electronic health record vendors, billing and coding services, laboratories, IT and cloud providers, email and messaging providers, and professional advisers. These “business associates” may receive your PHI only as needed to do their work, and they are required by contract and by law to protect it.
• De-identified information. We may remove identifiers from your information so that it can no longer reasonably be used to identify you, and then use or share the de-identified information for any lawful purpose.
• Minimum necessary. When we use or disclose PHI, or request it from others, we make reasonable efforts to limit it to the minimum amount needed for the purpose. This standard does not apply to disclosures to a provider for treatment, to you or your personal representative, to disclosures you authorize, to disclosures to the Secretary of the U.S. Department of Health and Human Services (“HHS”), or to disclosures required by law.

3. Other Uses and Disclosures We May Make Without Your Written Authorization

HIPAA permits or requires us to use or disclose your PHI in the following situations without your authorization. In each case we share only what the law allows, and where Arizona law or another federal law is more protective, we follow the more protective rule.

• Required by law. When a federal, state, or local law requires us to make the use or disclosure, and we limit it to what the law requires.
• Public health activities. To public health authorities for preventing or controlling disease, injury, or disability; reporting births and deaths; reporting adverse events or product defects to the U.S. Food and Drug Administration and notifying people who may have been exposed to a communicable disease or who may be at risk of contracting or spreading a disease, as permitted by law; and, with limits, to an employer for work-related illness or injury surveillance when we provided the care at the employer’s request.
• Abuse, neglect, or domestic violence. To a government authority authorized to receive reports of child abuse or neglect, and, when we reasonably believe you are a victim of abuse, neglect, or domestic violence, to an authorized government agency as required or permitted by law, subject to the safeguards HIPAA places on those disclosures.
• Health oversight activities. To a health oversight agency for audits, inspections, investigations, licensure and disciplinary actions, and other activities necessary to oversee the health care system and government benefit programs, including the Arizona Medical Board, the Arizona State Board of Nursing, and the Arizona Board of Pharmacy where applicable.
• Judicial and administrative proceedings. In response to a court or administrative order, and, subject to HIPAA’s conditions, in response to a subpoena, discovery request, or other lawful process when we receive satisfactory assurance that you were notified or that a protective order is being sought.
• Law enforcement. To law enforcement officials for limited purposes permitted by HIPAA, such as responding to a court order, warrant, or grand jury subpoena; identifying or locating a suspect, fugitive, material witness, or missing person; providing information about a victim of a crime in limited circumstances; reporting a death we believe may result from criminal conduct; reporting crime on our premises; and reporting crimes in emergencies.
• Coroners, medical examiners, and funeral directors. To identify a deceased person, determine the cause of death, or allow funeral directors to carry out their duties.
• Organ, eye, and tissue donation. To organizations that handle procurement, banking, or transplantation of organs, eyes, or tissue.
• Research. For research that has been approved by an institutional review board or privacy board that has determined your authorization can be waived, or in other limited circumstances HIPAA allows, such as reviews preparatory to research or research on information of decedents.
• To avert a serious threat to health or safety. When we believe in good faith that a use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is to someone reasonably able to prevent or lessen the threat.
• Specialized government functions. For military and veterans activities, national security and intelligence activities, protective services for the President and others, medical suitability determinations, and correctional institutions or law enforcement custodial situations, as the regulations permit.
• Workers’ compensation. As authorized by and to the extent necessary to comply with workers’ compensation laws and similar programs that provide benefits for work-related injuries or illness.
• Personal representatives. To a person who has legal authority to act on your behalf in making health care decisions, such as a parent or legal guardian of a minor or a person holding a health care power of attorney, as permitted by Arizona law.
• Secretary of HHS. To the Secretary of HHS when required to investigate or determine our compliance with HIPAA.
• Incidental uses and disclosures. Incidental disclosures that happen despite our reasonable safeguards, such as a conversation overheard in a treatment area.

4. Uses and Disclosures That Require Your Written Authorization

We will use or disclose your PHI for purposes not described in this Notice only with your written authorization. In particular, we need your signed authorization before we:

• Use or disclose psychotherapy notes (to the extent we maintain any), except for limited purposes HIPAA allows, such as treatment by the originator of the notes, our own training programs, our defense in a legal action brought by you, as required by law, for health oversight of the originator, to coroners and medical examiners, and to prevent a serious threat.
• Use or disclose PHI for marketing, which means communications about a product or service that encourage you to buy or use it. An authorization is not required for face-to-face communications we make to you or for a promotional gift of nominal value. If we receive payment from a third party for a marketing communication, the authorization will say so.
• Sell your PHI, meaning we disclose it in exchange for payment. We do not sell PHI.
• Use your photographs, images, or testimonials in advertising, on our website, or on social media. Before-and-after photographs and treatment images are part of your medical record, and we will not publish them or any identifying information about you without your written authorization.

Any other use or disclosure not described in this Notice will be made only with your written authorization. You may revoke an authorization at any time by giving us written notice. Your revocation will not affect uses or disclosures we already made in reliance on your authorization, and it will not apply to the extent the law allows us to continue to use the information.

5. Substance Use Disorder Records (42 CFR Part 2)

Records of the identity, diagnosis, prognosis, or treatment of a patient that are maintained in connection with a federally assisted substance use disorder (“SUD”) program are protected by a separate federal law and regulations at 42 CFR Part 2 (“Part 2”), in addition to HIPAA. We are not a substance use disorder treatment program. If we receive or maintain Part 2 records, for example because a Part 2 program sent them to us with your consent, we will handle them as follows:

• Part 2 records, and testimony relaying their content, will not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you unless you give written consent, or a court issues an order after notice and an opportunity to be heard as Part 2 requires, accompanied by a subpoena or other legal requirement compelling disclosure.
• If you give a single written consent for all future uses and disclosures of your Part 2 records for treatment, payment, and health care operations, we may use and disclose those records for those purposes as HIPAA permits, and we may redisclose them in accordance with HIPAA, except for the proceedings limit described above. You may revoke that consent in writing at any time, which will not undo disclosures made before the revocation.
• Part 2 records may be disclosed without your consent only in the narrow circumstances Part 2 allows, such as certain medical emergencies, audits and evaluations, and reports of child abuse or neglect.
• If we ever use Part 2 records for fundraising for our own benefit, you will be given a clear and conspicuous opportunity to elect not to receive any fundraising communications.
• You have a right to an accounting of disclosures of Part 2 records and to file a complaint if you believe your Part 2 rights have been violated, as described in the sections below. Part 2 breaches of unsecured records are subject to the same breach-notification duties that apply under HIPAA.

Where Part 2 limits a use or disclosure more than HIPAA does, we follow Part 2.

6. Information With Extra Legal Protection

Some kinds of health information receive extra protection under federal or Arizona law. This can include HIV and other communicable-disease information, genetic testing information, mental health records, and records related to substance use disorder treatment. When a more protective law applies, we use and disclose that information only as that stricter law permits, which may mean we need your written authorization or a court order in situations where this Notice would otherwise allow a disclosure. We may also be required by law to disclose some of this information to public health officials.

7. Your Rights Regarding Your Health Information

You have the following rights. To exercise any of them, send us a written request using the contact information in the “Contact Us” section below. We may ask you to complete a short form so we can process your request accurately.

Right to inspect and receive a copy of your records

You may ask to see and receive a copy of your medical and billing records that we maintain in a “designated record set.” If we keep your records electronically, you may ask for an electronic copy in the form and format you request, if it is readily producible, and you may direct us in writing to send a copy to another person or entity you designate. We will respond within 30 days, and we may extend that period once by up to 30 more days if we tell you the reason. We may charge a reasonable, cost-based fee limited to labor for copying, supplies for creating a paper copy or portable media, postage if you ask us to mail the copy, and the cost of preparing an explanation or summary if you agree to one in advance. We may deny access in limited situations, such as for psychotherapy notes or information compiled for a legal proceeding. In some cases you have the right to have a denial reviewed by a licensed health care professional who was not involved in the original decision.

Right to request an amendment

If you believe information in your record is incorrect or incomplete, you may ask us to amend it for as long as we keep the record. Your request must be in writing and must give a reason. We will act within 60 days, with one possible 30-day extension. We may deny your request in certain cases, for example if we did not create the information or if we believe it is accurate and complete. If we deny your request, you may submit a written statement of disagreement, which we will attach to your record, and we will explain your other options.

Right to an accounting of disclosures

You may ask for a list of certain disclosures of your PHI that we made during the six years before your request. The list does not include disclosures for treatment, payment, and health care operations; disclosures made to you or that you authorized; disclosures to people involved in your care; incidental disclosures; and certain other exceptions. You may receive one accounting per 12-month period at no charge. We may charge a reasonable, cost-based fee for additional requests in the same period, and we will tell you the cost in advance so you can withdraw or modify your request.

Right to request restrictions

You may ask us to restrict how we use or disclose your PHI for treatment, payment, or health care operations, or to people involved in your care. We are not required to agree to your request, and we may decline if the restriction would affect your care. We will comply with a restriction we agree to, except in an emergency, and we may end it if we notify you. There is one exception: if you pay for a service or item out of pocket in full, and you ask us not to share information about it with your health plan for payment or health care operations, we must agree, unless the law requires us to disclose it.

Right to request confidential communications

You may ask us to communicate with you about your health information in a certain way or at a certain location, for example by calling only your mobile number or by mailing information to a different address. We will accommodate reasonable requests. We will not ask you why you are making the request, but we may ask how payment will be handled and for an alternative address or other way to contact you.

Right to a paper copy of this Notice

You may ask for a paper copy of this Notice at any time, even if you agreed to receive it electronically. A copy is also available on our website and at our office.

Right to be notified of a breach

You have the right to be notified if there is a breach of your unsecured PHI. We will notify you without unreasonable delay and no later than 60 days after we discover the breach, by first-class mail or by email if you have agreed to electronic notice. The notice will describe what happened, what information was involved, what steps you can take to protect yourself, what we are doing in response, and how to contact us.

Right to revoke an authorization

If you gave us written authorization to use or disclose your PHI, you may revoke it in writing at any time, as described above.

Right to choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legal guardian, that person may exercise your rights and make choices about your health information. We will verify that the person has this authority before we act.

Right to file a complaint

You have the right to file a complaint if you believe your privacy rights have been violated, as described below. We will never retaliate against you for filing a complaint.

8. Our Duties

• We are required by law to maintain the privacy and security of your protected health information, to provide you with this Notice of our legal duties and privacy practices with respect to your PHI, and to notify affected individuals following a breach of unsecured protected health information.
• We are required to abide by the terms of this Notice while it is in effect.
• We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI that we maintain, including information we created or received before the change. If we materially change this Notice, we will post the revised Notice on our website and in our office, make copies available on request, and make it available to you at your next visit.
• We use administrative, technical, and physical safeguards, such as access controls, encryption where appropriate, staff training, and written policies, to protect your PHI.
• We will not use or share your information other than as described in this Notice unless you tell us in writing that we may.

9. How to File a Complaint

If you believe we have violated your privacy rights, or you disagree with a decision we made about access to your records, you may complain to us and to the federal government. You will not be retaliated against for filing a complaint.

To file a complaint with us: contact our Privacy Officer using the information in the next section. Please describe what happened and when it occurred.

To file a complaint with the U.S. Department of Health and Human Services: send a written complaint to the Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Room 509F, HHH Building, Washington, D.C. 20201; call 1-877-696-6775; or file online at hhs.gov/hipaa/filing-a-complaint. Complaints to the Office for Civil Rights generally must be filed within 180 days of when you knew, or should have known, that the violation occurred. You may also file a Part 2 complaint with the Secretary of HHS if you believe your substance use disorder records were mishandled.

10. Contact Us

To exercise your rights, ask questions about this Notice, or file a complaint, please contact our Privacy Officer:

Privacy Officer
Tricom Health and Wellness, LLC
2292 W Magee Rd, Suite 260
Tucson, AZ 85742
Telephone: (520) 955-6690
Email: info@tricomhw.com

Please do not include sensitive medical details in an unencrypted email. For requests that involve your medical records, we may ask you to complete a form or verify your identity before we release information.

11. Changes to This Notice

We may change this Notice, and the changes will apply to all PHI we maintain. Each revised Notice will show its effective date at the top. We will promptly revise and distribute this Notice whenever there is a material change to the uses and disclosures, your rights, our legal duties, or other privacy practices it describes. We will not implement a material change before the effective date of the Notice that reflects it, except when the law requires. You can always request the current Notice from our front desk or read it at tricomhw.com/notice-of-privacy-practices/.

12. Acknowledgment of Receipt

As a health care provider that treats patients directly, we will give you this Notice no later than your first visit and ask you to sign an acknowledgment that you received it. If you do not sign, or if you receive the Notice in an emergency, we will still provide care, and we will document our good-faith efforts to obtain your acknowledgment. For services first provided electronically, we will send you the Notice automatically at the time of your first request. Your signature confirms only that you received this Notice. It does not mean you agree to anything, and it does not waive any of your rights.

13. Our Website, Online Forms, and Text Messages

Information you submit through our website, such as an appointment request or contact form, may become part of your PHI once it relates to your care, and in that case this Notice applies to it. Information collected from visitors for website operation, such as cookies and device data, is described in our Privacy Policy and Cookie Policy. If you give us your mobile number, we may send you text messages about your appointments, services, and care. These messages are transactional and healthcare-related, and we do not use your number for marketing without your authorization. Text messages and unencrypted email may not be secure, so please do not share sensitive details by those channels. You can tell us at any time that you prefer another way of communicating, and you can reply STOP to any text message to opt out.

This Notice is provided for informational purposes about our privacy practices. It is not legal advice.