HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

THIS NOTICE APPLIES TO SELF-INSURED GROUP HEALTH PLANS OF STRIVE HEALTH, LLC, AS WELL AS ANY HEALTH PLAN INFORMATION THAT STRIVE HEALTH, LLC MAINTAINS OR HANDLES IN ITS OFFICES IN CONNECTION WITH ITS FULLY-INSURED GROUP HEALTH PLANS.

This Notice of Privacy Practices (“Notice”) informs you of the privacy practices followed by the Strive Health, LLC Group Health Plan (“the Plan”) and the Plan’s legal obligations regarding your protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations. We are required by law to maintain the privacy of your PHI and to provide you with this Notice, which describes how we may use and share your PHI and your rights regarding that information. This Notice applies to the Plan and the members of Strive Health, LLC’s workforce who perform Plan administration functions. It does not apply to Strive Health, LLC in its capacity as a health care provider or as the business associate of another covered entity.

Your Protected Health Information

Your PHI is protected by the HIPAA Privacy Rule, as amended, and other applicable federal privacy regulations. Generally, PHI is information that identifies an individual created or received by a health care provider, health plan, or an employer on behalf of a group health plan that relates to physical or mental health conditions, provision of health care, or payment for health care, whether past, present, or future. When using or disclosing your PHI, we will make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose, as required by law.

Our Uses and Disclosures of Your Protected Health Information.
We are permitted or required to use or disclose your PHI as outlined in this section. Some uses and disclosures described below may be further restricted by state or federal laws, including 42 CFR Part 2.

For Treatment. Although the law allows use and disclosure of your PHI for purposes of treatment, as a health plan we generally do not need to disclose your PHI for treatment purposes. Your physician or health care provider is required to provide you with an explanation of how they use and disclose your PHI for purposes of treatment, payment, and health care operations.

For Payment. We use or disclose your PHI without your written authorization to determine eligibility for benefits, pay claims, seek reimbursement from a third party, or coordinate benefits with another health plan under which you are covered. For example, a health care provider that provided treatment to you will provide us with your PHI. We use this information to determine whether those services are eligible for payment.

For Health Care Operations. We use and disclose your PHI to conduct Plan administration activities, such as quality assurance, resolving internal grievances, and evaluating Plan performance. For example, we may review claims experience to understand participant utilization and make Plan design changes intended to manage health care costs. We will not use or disclose genetic information for underwriting purposes related to the Plan. This restriction does not apply to long-term care plans.

To Business Associates. Some of the services provided to you are performed on our behalf by outside vendors called Business Associates. We may disclose your PHI with our Business Associates to allow them to perform services for us. For example, we may disclose your PHI to a third-party administrator that processes claims and determines eligibility for benefits, or with a claims administrator that reviews and resolves medical or pharmacy claims. Business Associates are required by law to safeguard your PHI.

To the Plan Sponsor for Plan Administration. We may disclose PHI to certain employees of Strive Health, LLC for the purpose of administering the Plan. These employees will use or disclose the PHI only as necessary to perform Plan administration functions or as otherwise required by HIPAA, unless you have authorized additional disclosures. Your PHI cannot be used for employment purposes without your specific authorization.

For Public Health and Safety. We may disclose your PHI to a health oversight agency for certain circumstances, such as preventing disease or injury; reporting adverse reactions to medications, medical devices, or supplements; assisting with product recalls; reporting suspected abuse, neglect, or domestic violence; and preventing or reducing a serious threat to anyone’s health or safety. Some of these disclosures may be required by law.

For Organ and Tissue Donation Requests. We can disclose your PHI with organ procurement organizations or with a coroner, medical examiner, or funeral director after your death, as permitted by law.

For Workers’ Compensation, Health Oversight, and to Government Authorities. We can use or disclose your PHI for workers’ compensation claims, for law enforcement purposes or with a law enforcement official, with health oversight agencies for activities authorized by law, and for special government functions such as military, national security, and presidential protective services.

To Law Enforcement. We may disclose your PHI with law enforcement in limited circumstances, such as to identify or locate suspects, fugitives, witnesses, or victims of a crime; to report deaths from a crime; and to report crimes that occur on Strive property. If you are in custody, we may disclose PHI to correctional institutions or law enforcement officials under certain circumstances.

For Judicial and Administrative Proceedings. We may disclose your PHI in response to a valid court or administrative order and certain subpoenas, discovery requests, or other lawful processes. 42 CFR Part 2 (“Part 2”) restricts the use of substance use disorder (“SUD”) records, or testimony relaying the content of SUD records, in civil, criminal, administrative, and legislative proceedings against you without your written consent or a valid court order.

For Research. We may use and disclose your PHI for research purposes, but only when researchers meet all state and federal requirements to protect your privacy. We may contact you to request that you participate in a research study.

Contacting You For Fundraising Efforts. We may contact you to provide information about fundraising efforts related to the Plan or its wellness programs. You have the right to opt out of these communications at any time by following the instructions included in the materials we send you. This includes communications that may involve information about substance use disorder (SUD) treatment, when permitted by law.

Sharing PHI with Family, Friends, and Others. We may share limited health information with family members, friends, or other individuals who are involved in your care or in paying for your care. You have the right to object to these disclosures in certain situations. When sharing this information, we will only disclose what is necessary and follow your instructions whenever possible.

Pursuant to Your Authorization. When required by law, we will ask for your written authorization before using or disclosing your PHI. Uses and disclosures not described in this Notice will only be made with your written authorization. Subject to some limited exceptions, your written authorization is required for the sale of PHI or the use or disclosure of PHI for marketing purposes. If you choose to sign an authorization to use or disclose PHI, you can later revoke that authorization to prevent any future uses or disclosures. Revocations must be submitted in writing to the Privacy Officer.

As Permitted or Required By Law. We may use or disclose your PHI for any other purpose permitted or required by applicable law, consistent with HIPAA and other federal or state privacy requirements.

Our Responsibilities

Adhering to this Notice. We must follow the privacy practices described in this Notice and provide you with a copy upon enrollment. We will notify you at least once every three years of the availability of this Notice and how to obtain a copy. We will not use or share your PHI other than as described in this Notice unless you tell us in writing that we can. If you tell us we can, you may change your mind anytime by writing to the Privacy Officer.

Notifying You of a Breach. We will notify you promptly if a breach may have compromised the privacy or security of your PHI.

When Your Authorization is Required. We will not use or disclose your PHI for certain purposes unless we have your written authorization. This includes uses and disclosures for marketing purposes, except when we talk with you in person or provide a small promotional gift from a company we partner with; for the sale of your PHI; and for sharing psychotherapy notes, which are private notes kept separately from your health record by a mental health professional. You may revoke your authorization at any time in writing, except to the extent that the Plan has already acted on it.

Changes to This Notice. We reserve the right to change the terms of this Notice and make the provisions of the new Notice effective for all PHI that we maintain. If we change the privacy practices in this Notice, it will be provided to you, posted on our website, and made available upon request, as required by law.

Your Rights

Receive a Copy of This Notice. The Plan is required by law to follow the privacy practices described in this Notice and to provide you with a copy of this Notice. It may change these practices and the terms of this Notice at any time and make those new terms effective for all PHI that it maintains. If it does so, and the change is material, you will receive a revised version of this Notice. This Notice will also be provided to you upon your request, even if you have agreed to receive it electronically. You may print or view a copy by visiting https://strivehealth.com/privacy/healthplannoticeofprivacypractices/.

View and/or Receive a Copy of Your PHI. You have the right to view and/or receive a paper or electronic copy of your PHI maintained in our designated record set. If your PHI is maintained electronically, you have the right to request an electronic copy in the form and format you request, if it is readily producible in that form and format. We may deny your request in certain limited circumstances and will inform you in writing of the reason and your review rights, if applicable. We will provide you with a copy of your PHI or a summary if you prefer. We may require you to submit the request in writing by contacting the Privacy Officer. We may charge you a reasonable, cost-based fee as permitted by law.

Request an Amendment. If you believe that PHI within your records is incorrect or if important information is missing, you have the right to request that we correct the existing information or add the missing information. Your request to amend your PHI must be submitted in writing to the person listed below. In some circumstances, we may deny your request to amend your PHI. If we deny your request, you may file a statement of disagreement with us for inclusion in any future disclosures of the disputed information.

Obtain an Accounting of Disclosures. You have the right to receive an accounting of certain disclosures of your PHI. The accounting will not include disclosures that were made: for purposes of treatment, payment, or health care operations; to you; pursuant to your authorization; to your friends or family in your presence or because of an emergency; for national security purposes; or incidental to otherwise permissible disclosures. Your request for an accounting must be submitted in writing to the person listed below. You may request an accounting of disclosures made within the last six years. You may request one accounting free of charge within a 12-month period.

Request a Restriction. You have the right to request that we not use or disclose PHI for treatment, payment, or other administrative purposes except when specifically authorized by you, when required by law, or in emergency circumstances. You also have the right to request that we limit the PHI that we disclose to someone involved in your care or the payment for your care, such as a family member or friend. Your request for restrictions must be submitted in writing to the person listed below. We will consider your request, but in most cases are not legally obligated to agree to those restrictions.

Request Confidential Communications. You have the right to receive confidential communications containing your PHI. Your request for restrictions must be submitted in writing to the person listed below. We are required to accommodate reasonable requests. For example, you may ask that we contact you at your place of employment or send communications regarding treatment to an alternate address.

Choose Someone to Act for You. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will make sure the person has this authority and can act for you before we take any action.

Protect Your Substance Use Disorder Records. In rare circumstances, we may receive, maintain, use, or disclose your PHI from programs that provide treatment or payment for SUD and are subject to federal confidentiality protections under Part 2. These SUD records are subject to heightened privacy protections and may only be used or disclosed in accordance with both HIPAA and Part 2 regulations. If we receive your SUD records as permitted by law or with your written consent, we may use and disclose that information for payment and health care operations, consistent with applicable law.

Ask a Question, Make a Request, or File a Complaint

To ask us questions, make a request, express concerns, or file a complaint, you may contact our Privacy Officer by emailing Privacy@strivehealth.com; by sending a letter to:  Strive Health, Attn: Privacy Officer, 1125 17th St, Ste #1000, Denver, CO 80202; or by calling 720-729-8885. We will not retaliate against you for filing a complaint or exercising your rights under this Notice. You may file a privacy complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights by sending a letter to: 200 Independence Avenue, S.W., Washington, D.C. 20201; by calling 1-877-696-6775; or by or visiting https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf. Complaints to the Office for Civil Rights must be filed within 180 days of when you learn of or should have known about a potential violation. You will not be penalized or retaliated against for filing a complaint with the Office of Civil Rights or with us.

Effective Date: February 13, 2026