Benefit Plans Administrative Services BPAS 3/9/2020

ARTICLE VII. HIPAA PRIVACY AND SECURITY PROVISIONS The Privacy Rules and Security Rules under HIPAA apply to the Plan. 7.1 Use and Disclosure of PHI. The Plan will use PHI to the extent allowed by, and in accordance with,the uses and disclosures permitted by HIPAA. Specifically,the Plan will use and disclose PHI for purposes related to health care treatment, payment for health care and health care operations. The Plan will also use and disclose PHI as required by law and as permitted by authorization of the subject of PHI. If the Plan discloses PHI to the Adopting Employer in accordance with this Article VII, the Adopting Employer may use and further disclosure PHI for the same purposes and in the same situations as the Plan may use and disclose PHI, provided that such use or disclosure is for Plan administration functions performed by the Adopting Employer for the Plan or is required by law or permitted by authorization. All uses and disclosures of PHI, whether by the Plan or by Adopting Employer, shall be limited to the minimum PHI necessary to accomplish the intended purpose of the use or disclosure in accordance with HIPAA. Notwithstanding the foregoing, neither the Plan nor the Adopting Employer shall use PHI that is genetic information in a manner that is prohibited by the Genetic Information Nondiscrimination Act of 2008. (a) Payment includes activities undertaken by the Plan to obtain premiums or determine or fulfill its responsibility for coverage and provision of Plan benefits that relate to an individual to whom health care is provided. These activities include, but are not limited to, the following: (1) Determination of eligibility, coverage and cost sharing amounts(for example,cost of a benefit, plan maximums and co-payments as determined for an individual's claim); (2) Coordination of benefits; (3) Adjudication of health benefits claims (including appeals and other payment disputes); (4) Subrogation of health benefit claims; (5) Establishing employee contributions; (6) Risk adjusting amounts due based on enrollee health status and demographic characteristics; (7) Billing, collection activities, and related health care data processing; (8) Claims management and related health care data processing, including auditing payments, investigating and resolving payment disputes and responding to participant inquiries about payments; (9) Obtaining payment under a contract for reinsurance (including stop-loss and excess of loss insurance); (10) Medical necessity reviews or reviews of appropriateness of care or justification of charges; ©2017 Hitesman&Wold,P.A. 21 Funded Post-Employment HRA Basic Plan Document(Single Employer Non-ERSA)