Legal Notices for 2025 The Plan may disclose your PHI to the proper authorities for law enforcement purposes, including the disclosure of certain identifying information requested by police officers for the purpose of identifying or locating a suspect, fugitive, material witness or missing person; the disclosure of your PHI if you are suspected to be a victim of a crime and you are incapacitated; or if you are suspected of committing a crime on the Plan (e.g., fraud). The Plan may use or disclose PHI to avert a serious threat to health or safety. The Plan may use or disclose your PHI if you are a member of the military, as required by armed forces services, and the Plan may also disclose your PHI for other specialized government functions such as national security or intelligence activities. The Plan may disclose your PHI to state or federal workers’ compensation agencies for your workers’ compensation benefit determination. The Plan may, as required by law, release your PHI to the Secretary of Department Health and Human Services for enforcement of HIPAA Privacy Rules. Verification Requirement – Before the Plan discloses your PHI to anyone requesting it, the Plan is required to verify the identity of the requester’s authority to access your PHI. The Plan may rely on reasonable evidence of authority such as a badge, official credentials, written statements on appropriate government letterhead, written or oral statements of legal authority, warrants, subpoenas, or court orders. RIGHTS THAT YOU HAVE To request to inspect, copy, amend or get accounting of PHI pertaining to your PHI in the Plan, you may contact the plan administrator. Right to Inspect and Copy your PHI – You have the right to request a copy of and/or to inspect your PHI that the Plan maintains, unless the PHI was compiled in reasonable anticipation of litigation or contains psychotherapy notes. In certain limited circumstances, the Plan may deny your request to copy and/or inspect your PHI. In most of those limited circumstances, a licensed health care provider must determine that the release of the PHI to you or a person authorized by you, as your “personal representative,” may cause you or someone else identified in the PHI harm. If your request is denied, you may have the right to have the denial reviewed by a designated licensed health care professional that did not participate in the original decision. Request for access to your PHI must be in writing and signed by you or your personal representative. You must ask for a Participant PHI Inspection Form from the Plan through the plan administrator. If you request that the Plan copy or mail your PHI to you, the Plan may charge you a fee for the cost of copying your PHI and the postage for mailing your PHI to you. If you as the Plan to prepare a summary of PHI, and the Plan agrees to provide that explanation, the Plan may also charge you for the cost associated with the preparation of the summary. Right to Request Amendments to Your PHI – You have the right to request that PHI the Plan maintains about you be amended or corrected. The Plan is not obligated to make requested amendments to PHI that is not created by the Plan, not maintained by the Plan, not available for inspection, or that is accurate and complete. The Plan will give each request careful consideration. To be considered, your amendment request must be in writing, must be signed by you or your personal representative, must state the reasons for the amendment request, and must be sent to the Privacy Office at the address below. If the Plan denies your amendment request, the Plan will provide you with its basis for the denial, advise you of your right to prepare a statement of disagreement which it will place with your PHI, and describe how you may file a complaint with the Plan or the Secretary of the US Department of Health and Human Services. The Plan may limit the length of your statement of disagreement and submit its own rebuttal to accompany your statement of disagreement. If the Plan accepts your amendment request, it must make a reasonable effort to provide the amendment to persons you identify as needing the amendment or persons it believes would rely on your unamended PHI to your detriment. Right to Request an Accounting for Disclosures of Your PHI – You have the right to request an accounting of disclosures of your PHI that the Plan makes. Your request for an accounting of disclosures must state a time period that may not be longer than six years and may not include dates before April 14, 2004. Not all disclosures of your PHI must be included in the accounting of the disclosures. Examples of disclosures that the Plan is required to account for include those pursuant to valid legal process, or for law enforcement purposes. Examples of disclosures that are not subject to an accounting include those made to carry out the Plan’s payment or health care operations, or those made with your authorization. To be considered, your accounting requests must be in writing and signed by you or your personal representative, and sent to the Privacy Office at the address below. The first accounting in any 12-month period is free; however, the Plan may charge you a fee for each subsequent accounting you request within the same 12-month period. Right to Place Restrictions on the Use and Disclosure of Your PHI – You have the right to request restrictions on certain of the Plan’s uses and disclosures of your PHI for payment or health care operations, disclosures made to persons involved in your care, and disclosures for disaster relief purposes. For example, you may request that the Plan not disclose your PHI to your spouse. Your request must describe in detail the restriction you are requesting. The Plan is not required to agree to your request, but will attempt to accommodate reasonable requests when appropriate. The Plan retains the right to terminate an agreed-to restriction if it believes such termination is appropriate. In the event of a termination by the Plan, it will notify you of the termination. You also have the right to terminate, in writing or orally, any agreed-to restriction. Requests for a restriction (or termination of an existing restriction) may be made by contacting the Plan through the Privacy Office at the telephone number or address below. Page 6 | DePauw University | Plan Year 2025 This Compliance Overview is not intended to be exhaustive nor should any discussion or opinions be construed as legal advice. Readers should contact legal counsel for legal advice.