C. SPECIAL RULES-FEDERAL MANDATE

1. Women’s Health and Cancer Rights Act of 1998.

On October 21, 1998, President Clinton signed a federal law called the Women’s Health and Cancer Rights Act of 1998. Under this federal law, group health plans, insurers and HMOs that provide medical and surgical benefits in connection with a mastectomy must provide benefits for certain reconstructive breast surgery. For a Participant or beneficiary who is receiving benefits under the Plan in connection with a mastectomy and who elects breast reconstruction, the law requires coverage in a manner determined in consultation with the attending Physician and the patient for (a) reconstruction of the breast on which the mastectomy was performed, (b) surgery and reconstruction on the other breast to produce a symmetrical appearance, and (c) prostheses and physical complications of all stages of mastectomy, including lymphedemas. This coverage is subject to the Plan’s annual deductibles and coinsurance provisions.

2. Newborn’s and Mother’s Health Protection Act.

Group health plans and health insurance issuers generally may not, under federal law, restrict benefits for any hospital length of stay in connection with childbirth for the mother or newborn child less than 48 hours following a normal delivery, or less than 96 hours following a Cesarean section. (Federal law does not, however, prohibit the mother’s or newborn’s attending provider, after consulting with the mother, from discharging the mother and her newborn earlier than the 48 hours, or 96 hours as applicable.) In any event, Plans and issuers may not, under federal law, require that a provider obtain authorization from the Plan or the issuer for prescribing a length of stay not in excess of 48 hours (or 96 hours).

3. Health Insurance Portability & Accountability Act.

1. Certificate of Coverage. The Health Insurance Portability Accountability Act of 1996 (“HIPAA”) provides that group health plans must limit the time for which coverage is not provided for pre-existing conditions. (This Plan has no such exclusions but some other plans do.) The law also provides that your coverage under this Plan will reduce the pre-existing condition limitation period of another plan for which you become eligible. For example, if the other plan has a 12-month pre-existing condition limitation and you have been eligible under this Plan for 12 consecutive months prior to becoming eligible under the other plan, the pre-existing condition limitation of the other plan will not apply to you.
   
   When you experience a qualifying event under this Plan, the Plan Office will transmit to you, along with your initial COBRA notice, a certification of the number of months for which you and your Dependents have been eligible for benefits under this Plan. The certificate of former group health plan coverage provides evidence of your health coverage under this Plan. You may also need this certificate to buy, for yourself or your family, an insurance policy that does not exclude coverage for medical conditions that are present before you enroll. If you are eligible for coverage due to new employment, you may want to furnish a copy of this certificate to your new employer in order that you can become eligible for the greatest number of benefits due to employment as quickly as is possible.
   
   You and/or your new employer should contact the Plan Office if any additional information certifying your coverage under this Plan is required. Once you become eligible under another plan that has no pre-existing condition limitation which limits the coverage available to you, your rights to continue coverage under this Plan pursuant to COBRA terminates.


2. Privacy and Security. This section explains the Plan’s use and disclosure of health information protected by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Protected health information (“PHI”) that is transmitted electronically is “Electronic PHI”. The Plan is a “Hybrid Entity” under HIPAA because it provides health benefits and non-health benefits. The privacy and security rules apply only to health benefits.
   
   The Plan (through EISB) will use PHI and Electronic PHI only to the extent, and in accordance with, the uses and disclosures related to health care treatment, payment for health care and health care operations. The Plan will also use and disclose PHI and Electronic PHI as required by law and as permitted by authorization. “Payment” involves Plan activities to obtain premiums or determine or fulfill coverage or benefit responsibilities including, but not limited to, eligibility determinations, enrollment, coordination of benefits, claims adjudication, subrogation, employee contributions, risk adjusting, billing, collection (including reports to consumer reporting agencies related to collection), claims management and related data processing, obtaining payment under a reinsurance contract, reviews of medical necessity, care or charges, and utilization review. “Health care operations” include, but are not limited to, quality assessment, population-based activities to improve health or reduce health care costs, protocol development, case management, care coordination, disease management, communication regarding treatment alternatives, rating providers, rating plan performance, accreditation, certification, licensing, credentialing activities, underwriting, premium rating, creation, renewal or replacement of insurance including reinsurance, stop-loss and excess loss insurance, medical reviews, obtaining legal or auditing services, fraud and abuse detection, business planning, development and management, compliance with HIPAA administrative simplification, customer service, internal grievance resolution and compliance with ERISA (including preparation of required documents, such as Forms 5500 and SARs).
   
   The Plan (through EISB) will disclose PHI to the Board of Trustees only pursuant to an authorization or for Plan administration after receipt of a certification from the Board of Trustees that this document contains these provisions. Any Trustee that does not comply with these provisions will receive appropriate sanctions. With respect to PHI and Electronic PHI, the Board of Trustees agrees to:
   
   • not use or further disclose the information other than as permitted or required by the Plan document or law;
   • ensure that any agents, including EISB, to whom the Board of Trustees provides PHI and Electronic PHI agree to these restrictions and conditions;
   • not use or disclose the information for employment-related actions or decisions unless the use or disclosure is pursuant to an authorization;
   • not use or disclose the information in connection with any other benefit or employee benefit plan unless the use or disclosure is pursuant to an authorization;
   • report to the Plan any use or disclosure of the information that the Board of Trustees is aware of and that is inconsistent with the allowable uses and disclosures;
   • make PHI and Electronic PHI available to the individual, for amendment, or for an accounting of nonroutine disclosures in accordance with the requirements of HIPAA;
   • incorporate amendments to PHI and Electronic PHI in accordance with HIPAA;
   • make internal practices, books, and records relating to the use and disclosure of PHI and Electronic PHI received from the Plan available to the Secretary of Health and Human Services for the purpose of determining the Plan’s compliance with HIPAA;
   • ensure that the adequate separation between the Plan and the Board (i.e., the firewall), required by 45 CFR §504(f)(2)(iii) is established; and
   • if feasible, return or destroy all PHI and Electronic PHI received from the Plan (or copies) when the information is no longer needed; if not feasible, limit further use or disclosure to the purposes that make the return or destruction infeasible.
   The Board of Trustees further agrees that if it creates, receives, maintains, or transmits any Electronic PHI (other than information disclosed pursuant to a signed authorization that complies with the requirements of 45 CFR §164.508, which are not subject to these restrictions) on behalf of the Plan, it will:
   • implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic PHI that it creates, receives, maintains, or transmits on behalf of the Plan;
   • ensure that the firewall required by 45 CFR §504(f)(2)(iii) is supported by reasonable and appropriate security measures;
   • ensure that any agent, including a subcontractor, to whom it provides Electronic PHI agrees to implement reasonable and appropriate security measures to protect the information; and
   • appropriately address any security incident of which it becomes aware