Benefit Plans Administrative Services BPAS 3/9/2020

(c) Report to the Plan any Security Incident of which it becomes aware; and (d) Implement reasonable and appropriate security measures to ensure that only those persons identified in Section 7.4 have access to ePHI and that such access is limited to the purposes identified in Section 7.5. 7.4 Adequate separation between the Plan and the Adopting Employer must be maintained. In accordance with HIPAA, only the following employees or classes of employees may be given access to PHI: (a) the person employed in the position that is given primary responsibility for performing the Adopting Employer's duties as the Plan Administrator of the Plan; and (b) staff designated by the person described in (a) above. 7.5 Limitation of PHI and ePHI Access and Disclosure. The persons described in Section 7.4 above may only have access to, and use and disclose, PHI and ePHI for Plan administration functions that the Adopting Employer performs for the Plan. 7.6 Noncompliance Issues. If the person(s) described in Section 7.4 above does not comply with this Plan document, the Adopting Employer shall provide a mechanism for resolving issues of noncompliance, including, but not limited to, disciplinary action against such person. ©2017 Hitesman&Wold,P.A. 24 Funded Post-Employment HRA Basic Plan Document(Single Employer Non-ERSA)