Employer/Plan Administrator: Kalamazoo College, G-1013
Employer State of Situs: Michigan
Employer Plan Name: Health Benefit Plan for Kalamazoo College
Plan Year: January 1, 2025 through December 31, 2025

If you or your children are eligible for Medicaid or CHIP and you’re eligible for health coverage from your employer, your state may have a premium assistance program that can help pay for coverage, using funds from their Medicaid or CHIP programs. If you or your children aren’t eligible for Medicaid or CHIP, you won’t be eligible for these premium assistance programs but you may be able to buy individual insurance coverage through the Health Insurance Marketplace. For more information, visit www.healthcare.gov.

If you or your dependents are already enrolled in Medicaid or CHIP and you live in a state listed below, contact your state Medicaid or CHIP office to find out if premium assistance is available.

If you or your dependents are NOT currently enrolled in Medicaid or CHIP, and you think you or any of your dependents might be eligible for either of these programs, contact your state Medicaid or CHIP office or dial 1-877-KIDS NOW or www.insurekidsnow.gov to find out how to apply. If you qualify, ask your state if it has a program that might help you pay the premiums for an employer-sponsored plan.

If you or your dependents are eligible for premium assistance under Medicaid or CHIP, as well as eligible under your employer plan, your employer must allow you to enroll in your employer plan if you aren’t already enrolled. This is called a “special enrollment” opportunity, and you must request coverage within 60 days of being determined eligible for premium assistance. If you have questions about enrolling in your employer plan, contact the Department of Labor at www.askebsa.dol.gov or call 1-866-444-EBSA (3272).

If you live in one of the following states, you may be eligible for assistance paying your employer health plan premiums. The following list of states is current as of July 31, 2024. Contact your state for more information on eligibility.

To see if any other states have added a premium assistance program since July 31, 2024, or for more information on special enrollment rights, contact either:

PART A: General Information
Even if you are offered health coverage through your employment, you may have other coverage options through the Health Insurance Marketplace (“Marketplace”). To assist you as you evaluate options for you and your family, this notice provides some basic information about the Health Insurance Marketplace and health coverage offered through your employment.

PART B: Information About Health Coverage Offered by Your Employer
This section contains information about any health coverage offered by your employer. If you decide to complete an application for coverage in the Marketplace, you will be asked to provide this information. This information is numbered to correspond to the Marketplace application.

Marketplace Application

Basic Information

Here is some basic information about health coverage offered by this employer:

• As your employer, we offer a health plan to: Some employees. Eligible employees are:
  • Individuals working in full-time employment for at least 40 hours or more per week or part-time employment for at least 20 hours or more per week. Such individuals must complete any required waiting period for plan coverage and must submit any required application for health plan coverage on a form that is acceptable to the employer.
• With respect to dependents: We do offer coverage. Eligible dependents are:
  • The employee’s legal spouse. However, working spouses with other available employer-basedcoverage are generally not eligible to enroll for coverage under the plan (an exception based onthe spouse’s share of the premium cost may apply).
  • The employee’s domestic partner (some restrictions apply). However, working domesticpartners with other available employer-based coverage are generally not eligible to enroll forcoverage under the plan (an exception based on the domestic partner’s share of the premiumcost may apply).
  • The employee’s or enrolled domestic partner’s natural child, stepchild, legally adopted child,or a child placed with the employee or domestic partner for adoption (age limits apply).
  • A child who has been placed under the legal guardianship of the employee or enrolled domesticpartner and is considered a “dependent” of the employee or domestic partner for tax exemptionpurposes under Section 152 of the Internal Revenue Code of 1986, as amended (age limitsapply).
  • A child for whom the employee or enrolled domestic partner is obligated to provide medicalcare coverage under an order or judgment of a court of competent jurisdiction and could beconsidered a “dependent” of the employee for tax exemption purposes under Section 152 of theInternal Revenue Code of 1986, as amended (age limits apply).
  • A child for whom the employee or enrolled domestic partner is obligated to provide medicalcoverage under a Qualified Medical Child Support Order (age limits apply).
• If checked, this coverage meets the minimum-value standard, and the cost of this coverage to you is intended to be affordable, based on employee wages.

Even if your employer intends your coverage to be affordable, you may still be eligible for a premium discount through the Marketplace. The Marketplace will use your household income, along with other factors, to determine whether you may be eligible for a premium discount. If, for example, your wages vary from week to week (perhaps you are an hourly employee or you work on a commission basis), if you are newly employed mid-year, or if you have other income losses, you may still qualify for a premium discount.

If you decide to shop for coverage in the Marketplace, HealthCare.gov will guide you through the process. Here’s the employer information you’ll enter when you visit HealthCare.gov to find out if you can get a tax credit to lower your monthly premiums.

The information below corresponds to the Marketplace Employer Coverage Tool. Completing this section is optional for employers, but will help ensure employees understand their coverage choices.

If you are declining enrollment for yourself or your dependents (including your spouse) because of other health insurance or group health plan coverage, you may be able to enroll yourself and your dependents in this plan if you or your dependents lose eligibility for that other coverage (or if the employer stops contributing toward your or your dependents’ other coverage).

In general, you must request enrollment within 30 days after your or your dependents’ other coverage ends (or after the employer stops contributing toward the other coverage). However, if you or your dependents lose coverage under Medicaid or a state’s Children Health Insurance Program (CHIP), or if you or your dependents become eligible for a premium-assistance subsidy under Medicaid or a CHIP, you have 60 days from the loss of coverage or the date of eligibility to request enrollment. In addition, if you acquire a new dependent as a result of marriage, birth, adoption, or placement for adoption, you may be able to enroll yourself and your dependents in this plan. However, you must request enrollment within 30 days after the marriage, birth, adoption, or placement for adoption. To request special enrollment or obtain more information, contact ASR Health Benefits at (616) 957-1751 or (800) 968-2449.

Did you know that your health plan, as required by the Women’s Health and Cancer Rights Act of 1998, provides benefits for mastectomy-related services? These services include reconstruction and surgery to achieve symmetry between the breasts, prostheses, and treatment of complications resulting from a mastectomy (including lymphedema). Call your Claim Administrator at (616) 957-1751 or 1-800-968-2449 for more information.

Your right to continued participation in the Plan during leaves of absence for active military duty is protected by the Uniformed Services Employment and Reemployment Rights Act (USERRA). Accordingly, if you are absent from work due to a period of active duty in the military for less than 31 days, your Plan participation will not be interrupted. If the absence is for more than 31 days and not more than 12 weeks, you may continue to maintain your coverage under the Plan by paying the premium. If you do not elect to continue to participate in the Plan during an absence for military duty that is more than 31 days, or if you revoke a prior election to continue to participate for up to 12 weeks after your military leave began, you and your covered family members will have the opportunity to elect COBRA Continuation Coverage only under the medical insurance policy for the 24-month period (18-month period if you elected coverage prior to December 10, 2004) that begins on the first day of your leave of absence. You must pay the premiums for Continuation Coverage with after-tax funds, subject to the rules that are set out in that plan.

This Notice contains important information that you’ll need to know when you purchase or renew an auto insurance policy in the State of Michigan. You should show this Notice to your auto insurance agent so that he or she can help you construct a policy that meets your needs.

Under Michigan no-fault auto law, when you purchase or renew your auto insurance policy after July 1, 2020 you won’t automatically receive unlimited, lifetime Personal Insurance Protection (PIP) medical coverage. Instead, you’ll be able to choose from a menu of PIP medical coverage levels. Your auto insurance agent will be able to explain the pros and cons of each one. When considering how much PIP medical coverage to purchase, it’s critical to keep these points in mind:

• Kalamazoo College’s health plan (the “Plan”) pays primary on Michigan enrollees’ auto-related claims, and given current deductible requirements constitutes
“qualified health coverage” as defined in Michigan Compiled Laws 500.3107d(7)(b)(i).

• Coverage of auto accident-related claims under any employment-based plan is available only as long as you remain employed/enrolled AND that plan continues to cover Michigan enrollees’ auto claims. In contrast, the amount of PIP medical coverage on your policy at the time of an auto accident remains available to you until the maximum payout per accident (if any) is exhausted, no matter how long that takes.

• Most types of care are covered under both the Plan and PIP medical. However, PIP medical covers additional services that employment-based plans typically do not. Your auto insurance agent can explain what those services are.

You’re urged to carry enough PIP coverage on your auto policy to protect yourself and your family from financial catastrophe in the event that there are claims for auto accident-related services that the Plan doesn’t cover, or if you or any of your family members cease to be enrolled in the Plan.

Contact your auto insurance agent immediately if you or any of your family members cease to be enrolled in the Plan, or if the Plan ceases to constitute “qualified health coverage.” An adjustment to your auto policy may be required, and you may have a limited amount of time to make it.

NOTE: This notice is correct at the time of this writing but may not reflect recent changes to plan coverage. For more information, call ASR Health Benefits at (616) 957-1751 or (800) 968-2449.

This Notice affects individuals who are enrolled in or eligible to enroll in Medicare. You or a family member may be enrolled in Medicare owing to age (on or after attaining age 65), a disability, or permanent kidney failure (end-stage renal disease). If no one in your family is enrolled in or eligible to enroll in Medicare, the information in this Notice does NOT apply to you.

This Notice provides information about your current prescription drug coverage under the Health Benefit Plan offered by Kalamazoo College (Employer) and the prescription drug coverage for people with Medicare. You may receive this Notice or an updated version of this Notice on an annual basis. You may also request an additional copy of this Notice at any time.

For further information about this Notice or your coverage under the Health Benefit Plan, you may contact Employer at the following address or telephone number:

Kalamazoo College
Renee Boelcke
1200 Academy Street
Kalamazoo, Michigan 49006
(269) 337-7248

If this Notice applies to you or a family member, you should read it carefully and keep it where you can find it.

This Privacy and Security Policy is designed to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA) and to safeguard the privacy and security of protected health information (PHI) maintained by Kalamazoo College.

This policy applies to all employees, volunteers, and any other individuals who have access to PHI within Kalamazoo College. Please Note: Contractors who come in control with PHI must be able to demonstrate completion of HIPAA training and provide a signed Business Associate’s Agreement for our files.

a. Use and Disclosure of PHI: PHI is only used or disclosed as permitted by HIPAA regulations and applicable state laws.

b. Minimum Necessary Standard: Access to PHI is limited to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

c. Individual Rights: Individuals have the right to access, inspect, and request amendments to their PHI. Kalamazoo College provides individuals with a notice of privacy practices outlining their rights and how their PHI is used and disclosed.

d. Notice of Privacy Practices: Kalamazoo College maintains and distributes a Notice of Privacy Practices as required by HIPAA regulations.

a. Administrative Safeguards: Kalamazoo College utilizes administrative safeguards, including security management processes, workforce training, and contingency planning, to protect the confidentiality, integrity, and availability of PHI.

b. Physical Safeguards: Kalamazoo College utilizes physical safeguards, such as facility access controls and workstation security, to protect electronic PHI (ePHI) and physical records containing PHI.

c. Technical Safeguards: Kalamazoo College utilizes technical safeguards, including access controls, encryption, and audit controls, to protect ePHI stored or transmitted electronically.

d. Breach Notification: Kalamazoo College utilizes established procedures for responding to and mitigating breaches of unsecured PHI, including notifying affected individuals, the Secretary of Health and Human Services, and, if necessary, the media – in the event of a breach affecting 500 or more individuals in a specific state or jurisdiction.

a. Monitoring and Enforcement: Kalamazoo College monitors compliance with this policy and takes appropriate disciplinary action against individuals who violate HIPAA regulations or organizational policies.

b. Training: Kalamazoo College provides HIPAA training to all employees, and volunteers who have access to PHI, and ensure that they understand their responsibilities for protecting PHI. Constractors must produce their Business Associate Agreement or demonstrate completion of HIPAA training.

Kalamazoo College maintains documentation of its HIPAA compliance efforts, including policies and procedures, training records, risk assessments, and breach response activities.

This policy will be reviewed periodically and updated as necessary to reflect changes in HIPAA regulations, organizational operations, or the security landscape.

For questions or concerns regarding this policy or HIPAA compliance, please contact the Privacy Officer, Renee Boelcke, at 269.337.7248.

• Employees, contractors, volunteers, or any individuals who suspect or become aware of a potential HIPAA violation must immediately report it to the designated Privacy Officer or Compliance Officer by completing the following HIPAA Violation Reporting Form.
• Examples of potential HIPAA violations include unauthorized access to protected health information (PHI), improper disclosure of PHI, failure to safeguard PHI, or violations of HIPAA privacy and security policies.

• Individuals reporting potential HIPAA violations should provide a detailed description of the incident, including:
  • Date, time, and location of the incident
  • Description of the incident and any individuals involved
  • Type of PHI involved (if known)
  • Any potential impact or consequences of the violation

• Upon receiving the report, the designated Privacy Officer or Compliance Officer will conduct an initial assessment of the potential HIPAA violation.
• The assessment may involve gathering additional information from the individual who reported the incident, reviewing relevant documentation, and conducting interviews with relevant parties.

• If the potential HIPAA violation is deemed credible, the Privacy Officer or Compliance Officer will initiate a formal investigation into the incident.
• The investigation will be conducted in accordance with established procedures and may involve interviewing witnesses, reviewing access logs, and analyzing relevant records.

• Based on the findings of the investigation, the Privacy Officer or Compliance Officer will determine whether a HIPAA violation has occurred.
• Factors considered in making this determination may include the nature and severity of the incident, the intent of the individuals involved, and any mitigating or aggravating circumstances.

• If a HIPAA violation is confirmed, Kalamazoo College must take appropriate steps to address the violation and mitigate any harm to affected individuals.
• Depending on the severity of the violation and applicable legal requirements, Kalamazoo College may be required to notify affected individuals, regulatory authorities, and other relevant parties in accordance with HIPAA regulations and state laws.

• In addition to addressing the immediate consequences of the HIPAA violation, Kalamazoo College must implement corrective action to prevent similar incidents from occurring in the future.
• This may include updating policies and procedures, providing additional training to employees, or enhancing security controls to better protect PHI.

• Throughout the process of reporting and investigating HIPAA violations, detailed records of all actions taken, findings, and outcomes should be documented.
• Documentation is crucial for demonstrating compliance with HIPAA regulations, facilitating audits and investigations, and identifying opportunities for improvement.

• After addressing the immediate consequences of the HIPAA violation, Kalamazoo College must conduct follow-up monitoring to ensure that corrective actions are effective and that similar violations do not occur in the future.
• Regular audits and risk assessments should be conducted to identify and address vulnerabilities in the organization’s privacy and security practices.

• All appropriate employees and volunteers must receive training on HIPAA regulations, policies, and procedures, including their responsibilities for reporting and preventing HIPAA violations.
• Contractors must have a Business Associate Agreement on file which outlines their HIPAA obligations.
• Ongoing awareness campaigns should be conducted to reinforce compliance with HIPAA regulations and promote a culture of privacy and security at Kalamazoo College.

a. Any employee, contractor, or volunteer who suspects or becomes aware of a breach of unsecured PHI must immediately report it to the designated Privacy Officer or Compliance Officer.

b. The Privacy Officer or Compliance Officer will promptly initiate an investigation to determine the scope and nature of the breach.

a. The Privacy Officer or Compliance Officer will assemble a response team consisting of key stakeholders, including legal counsel, IS personnel, and relevant department heads.

b. The response team will conduct a preliminary assessment to determine whether a breach has occurred, the type of PHI involved, and the individuals affected.

a. Upon confirmation of a breach, the response team will take immediate steps to contain the breach and prevent further unauthorized access to PHI.

b. IS personnel will disable or secure any compromised systems or devices to prevent additional unauthorized access.

c. The response team will assess the potential harm to individuals affected by the breach and implement mitigation measures to reduce the risk of harm.

a. The Privacy Officer or Compliance Officer will determine the appropriate individuals and authorities to notify based on the severity and scope of the breach.

b. Individuals affected by the breach will be notified in accordance with HIPAA regulations and applicable state laws. The notification will include a description of the breach, the type of PHI involved, and steps individuals can take to protect themselves.

c. If the breach affects 500 or more individuals, the organization must also notify the Secretary of Health and Human Services and, in some cases, the media, within the required time-frame.

a. The response team will work to remediate the breach by implementing corrective action to prevent similar incidents from occurring in the future.

b. This may include updating policies and procedures, providing additional training to employees, or enhancing security controls to better protect PHI.

a. Kalamazoo College will maintain documentation of the breach response efforts, including a description of the breach, actions taken to mitigate harm, and any remediation efforts.

b. A report of the breach and Kalamazoo College’s response will be submitted to the Secretary of Health and Human Services as required by HIPAA regulations.

a. The response team will conduct follow-up monitoring to ensure that corrective actions are effective and that similar breaches do not occur in the future.

b. Regular audits and risk assessments will be conducted to identify and address vulnerabilities in the organization’s security posture.

a. All employees and volunteers will receive training on breach response procedures and their responsibilities in protecting PHI. Contractor must follow the procedures specified within their Business Associate Agreements and notify the College immediately as outlined in the agreement.

b. Kalamazoo College will promote a culture of privacy and security awareness to minimize the risk of breaches and ensure prompt reporting of any suspected incidents.

a. This procedure will be reviewed periodically and updated as necessary to reflect changes in HIPAA regulations, organizational operations, or the security landscape.
b. Lessons learned from breach incidents will be used to improve breach response processes and strengthen the organization’s overall security posture.