Legal Notices for 2025 Uses and Disclosures for Health Care Operations – The Plan may use and disclose your PHI as necessary for health care operations without obtaining an authorization from you. Health care operations are those functions of the Plan it needs to operate on a day-to-day basis and those activities that help it to evaluate its performance. Examples of health care operations include underwriting, premium rating or other activities relating to the creation, amendment or termination of the Plan, and obtaining reinsurance coverage. Other functions considered to be health care operations include business planning and development; conducting or arranging for quality assessment and improvement activities, medical review, and legal services and auditing functions; and performing business management and general administrative duties of the Plan, including the provision of customer services to you and your covered dependents. Use or Disclosure of Genetic Information Prohibited – the Genetic Information Nondiscrimination Act of 2009 (GINA), and regulations promulgated thereunder, specific prohibit the use, disclosure or request of PHI that is genetic information for underwriting purposes. Genetic information is defined as (1) your genetic tests; (2) genetic tests of your family member; (3) family medical history, or (4) any request of or receipt by you or your family members’ genetic services. This means that your genetic information cannot be used for enrollment, continued eligibility, computation of premiums, or other activities related to underwriting, even if those activities are for purposes of health care operations or being performed pursuant to your written authorization. Family and Friends Involved in Your Care – If you are available and do not object, the Plan may disclose your PHI to your family, friends, and others who are involved in your care or payment of a claim. If you are unavailable or incapacitated and the Plan determines that a limited disclosure is in your best interest, the Plan, may share limited PHI with such individuals. For example, the Plan may use its professional judgment to disclose PHI to your spouse concerning the processing of a claim. If you do not wish us to share PHI with your spouse or others, you may exercise your right to request a restriction on your disclosure of your PHI (see below), including having correspondence the Plan sends to you mailed to an alternative address. The Plan is also required to abide by certain state laws that are more stringent than the HIPAA Privacy Standards, for example, some states give a minor child the right to consent to his or her own treatment and, under HIPAA, to direct who may know about the care he or she receives. There may be an instance when your minor child would request for you not to be informed of his or her treatment and the Plan would be required to honor that request. Business Associates – Certain aspects and components of the Plan’s services are performed through contracts with outside persons or organizations. Examples of these outside persons and organizations include our third-party administrator, reinsurance carrier, agents, attorney, accountants, banks and consultants. At times it may be necessary for use to provide certain of your PHI to one or more of these outside persons or organizations. However, if the Plan does provide your PHI to any or all of these outside persons or organizations, they will be required, though contract or by law, to follow the same policies and procedures with your PHI as detailed in this Notice. Plan Sponsor – The Plan may disclose a subset of your PHI, called summary health information, to Plan Sponsor in certain situations. Summary health information summarizes claims history, claim expenses, and types of claims experience by individuals under the Plan, but all information that could effectively identify whose claims history has been summarized has been removed. Summary health information may be given to the Plan Sponsor when requested for the purpose of obtain premium bids, for providing coverage under the Plan, or for modifying, amending or terminating the Plan. The Plan may also disclose to the Plan Sponsor whether you are enrolled in or have disenrolled from the Plan. Other Products and Services – The Plan may contact you to provide information about other health-related products and services that may be of interest to you without obtaining your authorizations. For example, the Plan may use and disclose your PHI for the purpose of communicating to you about the health benefit products or services that could enhance or substitute for existing coverage under the Plan, such as long-term health benefits for flexible spending accounts. The Plan may also contact you about health-related products and services, like disease management programs that may add value to you, as a covered person under the Plan. However, the Plan must obtain your authorization before the Plan sends you information regarding non-health related products or services, such as information concerning movie passes, life insurance products, or other discounts or services offered to the general public at large. Other Uses and Disclosures – Unless otherwise prohibited by the law, the Plan may make certain other uses and disclosures of your PHI without your authorization, including the following: The Plan may use or disclose your PHI to the extent that the use or disclosure is required by law. The Plan may disclose your PHI to the proper authorities if the Plan suspects child abuse or neglect; the Plan may also disclose your PHI if we believe you to be a victim of abuse, neglect, or domestic violence. The Plan may disclose your PHI if authorized by law to a government oversight agency (e.g., a state insurance department) conducting audits, investigations, or a civil or criminal proceeding. The Plan may disclose your PHI in response to a court order specifically authorizing the disclosure, or in the course of a judicial or administrative proceeding (e.g. to response to a subpoena or discovery request), provided written and documented efforts by the requesting party have been made to (1) notify you of the disclosure and the purpose of the litigation, or (2) obtain a qualified protective order prohibiting the use or disclosure of your PHI for any other purpose than the litigation or proceeding for which it was requested. Page 5 | DePauw University | Plan Year 2025 This Compliance Overview is not intended to be exhaustive nor should any discussion or opinions be construed as legal advice. Readers should contact legal counsel for legal advice.