Page 7 | DePauw University | Plan Year 2026 This Compliance Overview is not intended to be exhaustive nor should any discussion or opinions be construed as legal advice. Readers should contact legal counsel for legal advice. Legal Notices for 2026 Request for Confidential Communications – You have the right to request that communications regarding your PHI be made by alternative means or at alternative locations. For example, you may request that messages not be left on voice mail or sent to a particular address. The Plan is required to accommodate reasonable requests if you inform the Plan that disclosure of all or part of your information could place you in danger. The Plan may grant other requests for confidential communications in its sole discretion. Requests for confidential communications must be in writing, signed by you or your personal representative, and sent to the Privacy Office at the address below. Uses and Disclosures Requiring Authorization – Our group health plan is required to comply with federal laws that provide additional privacy protections for records related to the diagnosis, treatment, or referral for treatment of a substance use disorder. These records are protected under 42 C.F.R. Part 2. In general, the Plan may not use or disclose substance use disorder records without your written authorization, except as permitted or required by law. When authorization is required, it must specifically permit the use or disclosure of substance use disorder records. Any authorization you provide may be revoked by you in writing at any time, except to the extent the Plan has already taken action in reliance on the authorization. Substance use disorder records disclosed with your authorization may not be re-disclosed by the recipient unless permitted by federal law. To operate the group health plan, certain health information may be disclosed to the Plan Sponsor for plan administration purposes as permitted by HIPAA. Substance use disorder records, however, will not be disclosed to the Plan Sponsor without your authorization unless such disclosure is permitted or required by federal law. Right to a Copy of the Notice – You have the right to a paper copy of this Notice upon request by contacting the Privacy Office at the telephone number or address below. Right to Notice of Breach - You have the right to receive notice if your PHI is improperly used or disclosed as a result of a breach of unsecured PHI. Complaints – If you believe your privacy rights have been violated, you can file a complaint with the Plan through the plan administrator in writing at the address below. You may also file a complaint in writing with the Secretary of the U.S. Department of Health and Human Services in Washington, D.C., within 180 days of a violation of your rights. There will be no retaliation for filing a complaint. FOR FURTHER INFORMATION If you have questions or need further assistance regarding this Notice, you may contact our plan administrator.