Legal Notices for 2025 NOTICE OF PRIVACY PRACTICES: This notice described how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. Certain employer-sponsored health plans are required by the privacy regulations issued under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) to maintain the privacy of your health information that the plan creates, requests, or is created on the Plan’s behalf, called Protected Health Information (“PHI”) and to provide you, as the participant, covered dependent, or qualified beneficiary, with notice of the plan’s legal duties and privacy practices concerning Protected Health Information. The terms of this Notice of Privacy Practices (“Notice”) apply to the following plans (collective and individually referenced in this Notice as the “Plan”): Group Medical and Prescription Drug Plans, Voluntary Dental Plans, and Voluntary Vision Plan This Notice describes how the Plan may use and disclose your PHI to carry-out payment and health care operations, and for other purposes that are permitted or required by law. The Plan is required to abide by the terms of this Notice so long as the Plan remains in effect. The Plan Reserves the right to change the terms of this Notice as necessary and to make the new Notice effective for all PHI maintained by the Plan. Copies of revised Notices in which there has been a material change will be mailed to all participants then covered by the Plan. Copies of our current Notices may be obtained by calling the plan administrator. DEFINITIONS Plan Sponsor means Employer Entity defined on page one and any other employer that maintains the Plan for the benefit of its associates. Protected health Information (“PHI”) means individually identifiable health information, which is defined under the law as information that is a subset of health information, including demographic information, that is created or received by the Plan and that relates to your past, present or future physical mental health or condition; the health care services you receive, or the past, present, or future payment for health care services you receive; and that identifies you, or which there is a reasonable basis to believe the information can be used to identify you. USES AND DISCLOSURES OF YOUR PROTECTED HEALTH INFORMATION The following categories describe different ways that the Plan may use and disclose your PHI. For each category of uses and disclosures we will explain what we mean and, when appropriate, provide examples for illustrative purposes. Not every use or disclosure in a category will be listed. However, all the ways we are permitted or required to use and disclose PHI will fall within one of the categories. Your Authorization – Except as outlined below or otherwise permitted by law, the Plan will not use or disclose your PHI unless you have signed a form authorizing the Plan to use or disclose specific PHI for an explicit purpose to a specific person or group of persons. Uses and disclosures of your PHI for marketing purposes and/or for the sale of your PHI require your authorization. You have the right to revoke any authorization in writing except to the extent that the Plan has taken action in reliance upon the authorizations. Uses and Disclosures for Payment – The Plan may use and disclose your PHI as necessary for benefit payment purposes without obtaining an authorization from you. The persons to whom the Plan may disclose your PHI for payment purposes include your health care providers that are billing for or requesting a prior authorization for their services and treatments of you, other health plans providing benefits to you, and your approved family member or guardian responsible for amounts, such as deductibles and co-insurance, not covered by the Plan. For example, the Plan may use or disclose your PHI, including information about any medical procedures and treatments you have received, are receiving, or will receive, to your doctor, your spouse’s doctor or other health plan under which you are covered, and your spouse or other family members, unless you object, in order to process your benefits under the Plan. Examples of other payment activities include determinations of your eligibility or coverage under the Plan, annual premium calculations based on health status and demographic characteristics of persons covered under the Plan, billing, claims management, reinsurance claim, and review of health care services with respect to medical necessity, utilization review activities, and disclosures to consumer reporting agencies. Page 4 | DePauw University | Plan Year 2025 This Compliance Overview is not intended to be exhaustive nor should any discussion or opinions be construed as legal advice. Readers should contact legal counsel for legal advice.