HIPAA Notice

1. Who holds your protected health information

Your medical care, medical records, and protected health information ("PHI") are held by MDI Medical Group PC, the covered entity that provides physician services through this platform, along with its network of independently licensed, board-certified physicians. When you complete the medical intake form, you interact with MDI's HIPAA-compliant platform, and your PHI is stored and protected there.

Therisse handles marketing, billing, and customer support, and works with MDI to give you access to care. In that role Therisse is not itself a HIPAA-covered entity and does not store PHI on its own systems, so the medical records described in this notice are held and protected by MDI.

2. MDI's Notice of Privacy Practices

The Health Insurance Portability and Accountability Act (HIPAA) requires the covered entity that holds your PHI to give you a Notice of Privacy Practices describing how your medical information is used and disclosed and how you can access it. MDI Medical Group PC maintains its own Notice of Privacy Practices for the medical records it holds. You can request a copy from MDI directly, using the contact information below or through the patient portal accessible from any clinician message you receive. That notice, not this page, governs the handling of your medical records.

3. Your rights under HIPAA

As a patient of MDI Medical Group PC, you generally have the right to:

• Access and obtain a copy of your medical records
• Request corrections or amendments to your medical records
• Receive an accounting of certain disclosures of your PHI
• Request restrictions on how your PHI is used or disclosed
• Request that communications reach you by a specific method or at a specific location
• Receive a paper copy of the Notice of Privacy Practices on request
• Be notified if the security of your medical information is ever affected, as required by law

4. How to exercise your rights

Because MDI Medical Group PC holds your PHI, requests to access, amend, or restrict your medical records are directed to MDI, using the contact information in MDI's Notice of Privacy Practices or through the patient portal.

For personal information held by Therisse (such as your name, email, billing records, and account history, none of which is PHI), email support@therisse.com. See our Privacy Policy for how Therisse handles that information.

5. Filing a complaint

You have the right to file a complaint if you believe your privacy rights have been violated, without fear of retaliation. Complaints about the handling of your medical records may be filed with MDI Medical Group PC and with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints. Questions about the Therisse service can be sent to support@therisse.com.