Privacy Policy

Our Company’s Pledge To You

This notice is intended to inform you of the privacy practices followed by the RBA Health and Welfare Plan (the Plan) and the Plan’s legal obligations regarding your protected health information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The notice also explains the privacy rights you and your family members have as participants of the Plan. It is effective on 1/1/2022.

The Plan often needs access to your protected health information in order to provide payment for health services and perform plan administrative functions. We want to assure the participants covered under the Plan that we comply with federal privacy laws and respect your right to privacy. RBA requires all members of our workforce and third parties that are provided access to protected health information to comply with the privacy practices outlined below.

Protected Health Information

Your protected health information is protected by the HIPAA Privacy Rule. Generally, protected health information is information that identifies an individual created or received by a health care provider, health plan or an employer on behalf of a group health plan that relates to physical or mental health conditions, provision of health care, or payment for health care, whether past, present or future.

How We May Use Your Protected Health Information

Under the HIPAA Privacy Rule, we may use or disclose your protected health information for certain purposes without your permission. This section describes the ways we can use and disclose your protected health information.

Payment

We use or disclose your protected health information without your written authorization in order to determine eligibility for benefits, seek reimbursement from a third party, or coordinate benefits with another health plan under which you are covered. For example, a health care provider that provided treatment to you will provide us with your health information. We use that information in order to determine whether those services are eligible for payment under our group health plan.

Health Care Operations

We use and disclose your protected health information in order to perform plan administration functions such as quality assurance activities, resolution of internal
grievances, and evaluating plan performance. For example, we review claims experience in order to understand participant utilization and to make plan design changes that are intended to control health care costs.

However, we are prohibited from using or disclosing protected health information that is genetic information for our underwriting purposes.

Treatment

Although the law allows use and disclosure of your protected health information for purposes of treatment, as a health plan we generally do not need to disclose your information for treatment purposes. Your physician or health care provider is required to provide you with an explanation of how they use and share your health information for purposes of treatment, payment, and health care operations.

As permitted or Required by Law

We may also use or disclose your protected health information without your written
authorization for other reasons as permitted by law. We are permitted by law to share information, subject to certain requirements, in order to communicate information on health-related benefits or services that may be of interest to you, respond to a court order, or provide information to further public health activities (e.g., preventing the spread of disease) without your written authorization. We are also permitted to share protected health information during a corporate restructuring such as a merger, sale, or acquisition. We will also disclose health
information about you when required by law, for example, in order to prevent serious harm to you or others.

Pursuant to Your Authorization

When required by law, we will ask for your written authorization before using or disclosing your protected health information. Uses and disclosures not described
in this notice will only be made with your written authorization. Subject to some limited exceptions, your written authorization is required for the sale of protected health information and for the use or disclosure of protected health information for marketing purposes. If you choose to sign an authorization to disclose information, you can later revoke that authorization to prevent any future uses or disclosures.

To Business Associates

We may enter into contracts with entities known as Business Associates that provide services to or perform functions on behalf of the Plan. We may disclose
protected health information to Business Associates once they have agreed in writing to safeguard the protected health information. For example, we may disclose your protected health information to a Business Associate to administer claims. Business Associates are also required by law to protect protected
health information.

To the Plan Sponsor

We may disclose protected health information to certain employees of RBA for the purpose of administering the Plan. These employees will use or disclose the protected health information only as necessary to perform plan administration functions or as otherwise required by HIPAA, unless 24 you have authorized additional disclosures. Your protected health information cannot be used for employment purposes without your specific authorization.

Your Rights

Right to Inspect and Copy. In most cases, you have the right to inspect and copy the protected health information we maintain about you. If you request copies, we will charge you a reasonable fee to cover the costs of copying, mailing, or other expenses
associated with your request. Your request to inspect or review your health information must be submitted in writing to the person listed below. In some circumstances, we may deny your request to inspect and copy your health information. To the extent your information is held in an electronic health record, you may be able to receive the information in an electronic format.

Right to Amend

If you believe that information within your records is incorrect or if important information is missing, you have the right to request that we correct the existing information or add the missing information. Your request to amend your health information must be submitted in writing to the person listed below. In some circumstances, we may deny your request to amend your health information. If we deny your request, you may file a statement of disagreement with us for inclusion in any future disclosures of the disputed information.

Right to an Accounting of Disclosures

You have the right to receive an accounting of certain disclosures of your protected
health information. The accounting will not include disclosures that were made (1) for purposes of treatment, payment or health care operations; (2) to you; (3) pursuant to your authorization; (4) to your friends or family in your presence or because of an emergency; (5) for national security purposes; or (6) incidental to
otherwise permissible disclosures.

Your request for an accounting must be submitted in writing to the person listed below. You may request an accounting of disclosures made within the last six years. You may request one accounting free of charge within a 12-month period.

Right to Request Restrictions

You have the right to request that we not use or disclose information for treatment, payment, or other administrative purposes except when specifically authorized by you, when required by law, or in emergency circumstances. You also have the right to request that we limit the protected health information that we disclose to someone involved in your care or the payment for your care, such as a family member or friend. Your request for restrictions must be submitted in writing to the person listed below. We will consider your request, but in most cases are not legally obligated to agree to those restrictions.

Right to Request Confidential Communications

You have the right to receive confidential communications containing your health information. Your request for restrictions must be submitted in writing to the person listed below. We are required to accommodate reasonable requests. For example, you may ask that we contact you at your place of employment or send communications regarding treatment to an alternate address.

Right to be Notified of a Breach

You have the right to be notified in the event that we (or one of our Business Associates) discover a breach of your unsecured protected health information. Notice of any such breach will be made in accordance with federal requirements.

Right to Receive a Paper Copy of this Notice

If you have agreed to accept this notice electronically, you also have a right to obtain a paper copy of this notice from us upon request. To obtain a paper copy of this notice, please contact the person listed below.

Our Legal Responsibilities

We are required by law to maintain the privacy of your protected health information, provide you with this notice about our legal duties and privacy practices with respect to protected health information and notify affected individuals following a breach of unsecured protected health information.

We may change our policies at any time and reserve the right to make the change effective for all protective health information that we maintain. In the event that we make a significant change in our policies, we will provide you with a revised copy of this notice. You can also request a copy of our notice at any time. For more information about our privacy practices, contact the person listed below.

If you have any questions or complaints, please contact:

Benefits Department
Reformed Benefits Association
1700 28th St SE
Grand Rapids, MI 49508
800-701-8992 & benefits@reformedbenefits.org

Complaints
If you are concerned that we have violated your privacy rights, or you disagree with a decision we made about access to your records, you may contact the person listed above. You also may send a written complaint to the U.S. Department of Health and Human Services — Office of Civil Rights. The person listed above can provide you with the appropriate address upon request or you may visit www.hhs.gov/ocr for further information. You will not be penalized or retaliated against for filing a complaint with the Office of Civil Rights or with us.