Benefit Plans Administrative Services BPAS 3/9/2020

include certain conditions to the Adopting Employer's receipt of PHI and that Adopting Employer agrees to those conditions. By adopting this Plan document, the Adopting Employer certifies that the Plan has been amended as required by the Privacy Rules and that it agrees to the following conditions, thereby allowing the Plan to disclose PHI to the Adopting Employer. The Adopting Employer agrees to: (a) Not use or further disclose PHI other than as permitted or required by the Plan document or as required by law; (b) Ensure that any agents,including a subcontractor,to whom the Plan provides PHI received from the Plan agree to the same restrictions and conditions that apply to the Adopting Employer with respect to such PHI; (c) Not use or disclose PHI for employment related actions and decisions unless authorized by an individual; (d) Not use or disclose PHI in connection with any other benefit or employee benefit plan of the Adopting Employer unless authorized by an individual; (e) Report to the Plan any PHI use or disclosure of which it becomes aware that is inconsistent with the uses or disclosures permitted hereunder and/or may constitute a"breach"as that term is defined in HIPAA; (f) Make PHI available for access by the individual who is the subject of the PHI in accordance with HIPAA; (g) Make PHI available for amendment and incorporate any amendments to PHI in accordance with HIPAA; (h) Make available the information required to provide an accounting of disclosures in accordance with HIPAA; (i) Make internal practices, books and records relating to the use and disclosure of PHI received from Plan available to the HHS Secretary for the purposes of determining the Plan's compliance with HIPAA; and (j) If feasible, return or destroy all PHI received for the Plan that the Adopting Employer still maintains in any form, and retain no copies of such PHI when no longer needed for the purpose for which disclosure was made (or if return or destruction is not feasible, limit further uses and disclosures to those purposes that make the return or destruction infeasible). 7.3 Adopting Employer's Obligations under Security Rules. If the Adopting Employer creates, receives, maintains, or transmits ePHI (other than enrollment and disenrollment information and Summary Health Information, which are not subject to these restrictions), the Adopting Employer will: (a) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI; (b) Ensure that any agents, including subcontractors, who create, receive, maintain, or transmit ePHI on behalf of the Plan implement reasonable and appropriate security measures to protect the ePHI; ©2017 Hitesman&Wold,P.A. 23 Funded Post-Employment HRA Basic Plan Document(Single Employer Non-ERSA)