EXHIBIT B TO

MASTER SERVICES AGREEMENT

CHAMBER BENEFIT ARRANGEMENT OF INDIANA NOTICE OF PRIVACY PRACTICES

THIS NOTICE OF PRIVACY PRACTICES DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (the “Notice”) describes the legal obligations of the Chamber Benefit Arrangement of Indiana (the “Arrangement”) and your legal rights regarding your protected health information held by the Arrangement under the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act. In this Notice, we refer to these two laws together as HIPAA. Among other things, this Notice describes how your protected health information may be used or disclosed to carry out treatment, payment, or health care operations, or for any other purposes that are permitted or required by law.

The HIPAA Privacy Rule applies to certain medical information known as “protected health information.” Protected health information means information that is created or received by the Arrangement and relates to the past, present, or future physical or mental health or condition of a participant; the provision of health care to a participant; or the past, present, or future payment for health care provided to a participant. The information must either identify the participant directly or be the type of information that can be used to identify the participant (such as a home address).

If you have any questions about this Notice or about our privacy practices, please contact the Privacy Official at (317) 684-5419.

Effective Date

This Notice is effective October 1, 2025.

Our Responsibilities

HIPAA requires us to:

• maintain the privacy of your protected health information;

• provide you with certain rights with respect to your protected health information;

• provide you with a copy of this Notice of our legal duties and privacy practices with respect to your protected health information; and

• follow the terms of the Notice that is currently in effect.

We reserve the right to change the terms of this Notice and to make new provisions regarding your protected health information that we maintain, as allowed or required by law. If we make any significant changes to this Notice, we will provide you with a copy of our revised Notice of Privacy Practices by email or mail.

How We May Use and Disclose Your Protected Health Information

Under HIPAA, we may use or disclose your protected health information under certain circumstances without your permission. The following categories describe the different ways that we may use and disclose your protected health information. For each category of uses or disclosures we will explain what we mean and present some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

For Treatment. We may use or disclose your protected health information to facilitate medical treatment or services by providers. We may disclose medical information about you to providers, including doctors, nurses, technicians, medical students, or other hospital personnel who are involved in taking care of you. For example, we might disclose information about your prior prescriptions to a pharmacist to determine if prior prescriptions contraindicate a pending prescription.

For Payment. We may use or disclose your protected health information to determine your eligibility for Arrangement benefits, to facilitate payment for the treatment and services you receive from health care providers, to determine benefit responsibility under the Arrangement, or to coordinate Arrangement coverage. For example, we may tell your health care provider about your medical history to determine whether a particular treatment is experimental, investigational, or medically necessary, or to determine whether the Arrangement will cover the treatment. We may also share your protected health information with a utilization review or precertification service provider. Likewise, we may share your protected health information with another entity to assist with the adjudication or subrogation of health claims or to another health plan to coordinate benefit payments.

For Health Care Operations. We may use and disclose your protected health information for other Arrangement operations. These uses and disclosures are necessary to run the Arrangement. For example, we may use medical information in connection with conducting quality assessment and improvement activities; care coordination and case management; underwriting, premium rating, and other activities relating to Arrangement coverage; submitting claims for stop-loss (or excess-loss) coverage; conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs; business planning and development such as cost management; and business management and general Arrangement administrative activities. However, we will not use your genetic information for underwriting purposes.

Treatment Alternatives or Health-Related Benefits and Services. We may use and disclose your protected health information to send you information about treatment alternatives or other health-related benefits and services that might be of interest to you.

To Business Associates. We may contract with individuals or entities known as Business Associates to perform various functions on our behalf or to provide certain types of services. In order to perform these functions or to provide these services, Business Associates will receive, create, maintain, transmit, use, and/or disclose your protected health information, but only after they agree in writing with us to implement appropriate safeguards regarding your protected health information. For example, we may disclose your protected health information to a Business Associate to process your claims for Arrangement benefits or to provide support services, such as utilization management, pharmacy benefit management, or subrogation, but only after the Business Associate enters into a Business Associate Agreement with us.

As Required by Law. We will disclose your protected health information when required to do so by Federal, State, or local law. For example, we may disclose your protected health information when required by national security laws or public health disclosure laws.

To Avert a Serious Threat to Health or Safety. We may use and disclose your protected health information when necessary to prevent a serious threat to your health and safety, or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat. For example, we may disclose your protected health information in a proceeding regarding the licensure of a physician.

Confidentiality of Substance Use Disorder (SUD) Patient Records. If we receive or maintain any information about you from a substance use disorder treatment program that is covered by 42 CFR Part 2 (a “Part 2 Program”) through a general consent you provide to the Part 2 Program to use and disclose the Part 2 Program record for purposes of treatment, payment or health care operations, we may use and disclose your Part 2 Program record for treatment, payment and health care operations purposes as described in this Notice. If we receive or maintain your Part 2 Program record through specific consent you provide to us or another third party, we will use and disclose your Part 2 Program record only as expressly permitted by you in your consent as provided to us.

In no event will we use or disclose your Part 2 Program record, or testimony that describes the information contained in your Part 2 Program record, in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, against you, unless authorized by your consent or the order of a court after it provides you notice of the court order.

To Health Plan Sponsors. In very limited circumstances, we may disclose protected health plan information to the health plan sponsor. Disclosures will only be permitted when the plan sponsor makes appropriate amendments to the plan in accordance with Federal law. Your protected health information cannot be used for employment purposes without your specific authorization.

Potential Impact of State Law. The HIPAA Privacy Rule regulations generally do not “preempt” (or take precedence over) State privacy or other applicable laws that provide individuals greater privacy protections. As a result, to the extent State law applies, the privacy laws of a particular State, or other Federal laws, rather than the HIPAA Privacy Rule regulations, might impose a privacy standard under which we will be required to operate. For example, where such laws have been enacted, we will follow more stringent State privacy laws that relate to uses and disclosures of protected health information concerning HIV or AIDS, mental health, substance abuse/chemical dependency, genetic testing, reproductive rights, etc.

Special Situations

In addition to the above, the following categories describe other possible ways that we may use and disclose your protected health information without your specific authorization. For each category of uses or disclosures, we will explain what we mean and present some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

Organ and Tissue Donation. If you are an organ donor, we may release your protected health information after your death to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation.

Military. If you are a member of the armed forces, we may release your protected health information as required by military command authorities. We may also release protected health information about foreign military personnel to the appropriate foreign military authority.

Workers’ Compensation. We may release your protected health information for workers’ compensation or similar programs, but only as authorized by, and to the extent necessary to comply with, laws relating to workers’ compensation and similar programs that provide benefits for work-related injuries or illness.

Public Health Risks. We may disclose your protected health information for public health activities. These activities generally include the following:

• to prevent or control disease, injury, or disability;

• to report births and deaths;

• to report child abuse or neglect;

• to report reactions to medications or problems with products;

• to notify people of recalls of products they may be using;

• to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition;

• to notify the appropriate government authority if we believe that a patient has been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree, or when required or authorized by law.

  Health Oversight Activities. We may disclose your protected health information to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

  Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose your protected health information in response to a court or administrative order. We may also disclose your protected health information in response to a subpoena, discovery request, or other lawful process by someone involved in a legal dispute, but only if efforts have been made to tell you about the request or to obtain a court or administrative order protecting the information requested.

  Law Enforcement. We may disclose your protected health information if asked to do so by a law-enforcement official -

• in response to a court order, subpoena, warrant, summons, or similar process;

• to identify or locate a suspect, fugitive, material witness, or missing person;

• about the victim of a crime if, under certain limited circumstances, we are unable to obtain

  the victim’s agreement;

• about a death that we believe may be the result of criminal conduct; and

• about criminal conduct.

Coroners, Medical Examiners, and Funeral Directors. We may release protected health information to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release medical information about patients to funeral directors, as necessary to carry out their duties.

National Security and Intelligence Activities. We may release your protected health information to authorized Federal officials for intelligence, counterintelligence, and other national security activities authorized by law.

Inmates. If you are an inmate of a correctional institution or are in the custody of a law-enforcement official, we may disclose your protected health information to the correctional institution or law-enforcement official if necessary (1) for the institution to provide you with health care; (2) to protect your health and safety or the health and safety of others; or (3) for the safety and security of the correctional institution.

Research. We may disclose your protected health information to researchers when:

1. the individual identifiers have been removed; or

2. when an institutional review board or privacy board has reviewed the research proposal and established protocols to ensure the privacy of the requested information and approves the research.

Required Disclosures

The following is a description of disclosures of your protected health information we are required to make.

Government Audits. We are required to disclose your protected health information to the Secretary of the United States Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA privacy rule.

Disclosures to You. When you request, we are required to disclose to you the portion of your protected health information that contains medical records, billing records, and any other records used to make decisions regarding your health care benefits. We are also required, when requested, to provide you with an accounting of most disclosures of your protected health information if the disclosure was for reasons other than for payment, treatment, or health care operations, and if the protected health information was not disclosed pursuant to your individual authorization.

Other Disclosures

Personal Representatives. We will disclose your protected health information to individuals authorized by you, or to an individual designated as your personal representative, attorney-in-fact, etc., so long as you provide us with a written notice/authorization and any supporting documents (i.e., power of attorney). Note: Under the HIPAA privacy rule, we do not have to disclose information to a personal representative if we have a reasonable belief that:

1. you have been, or may be, subjected to domestic violence, abuse, or neglect by such person; or

2. treating such person as your personal representative could endanger you; and

3. in the exercise of professional judgment, it is not in your best interest to treat the person as your personal representative.

Spouses and Other Family Members. With only limited exceptions, we will send all mail to the employee. This includes mail relating to the employee’s spouse and other family members who are covered under the Arrangement, and includes mail with information on the use of

Arrangement benefits by the employee’s spouse and other family members and information on the denial of any Arrangement benefits to the employee’s spouse and other family members. If a person covered under the Arrangement has requested Restrictions or Confidential Communications (see below under “Your Rights”), and if we have agreed to the request, we will send mail as provided by the request for Restrictions or Confidential Communications.

Authorizations. Other uses or disclosures of your protected health information not described above will only be made with your written authorization. For example, in general and subject to specific conditions, we will not use or disclose psychiatric notes about you; we will not use or disclose your protected health information for marketing; and we will not sell your protected health information. You may revoke written authorizations at any time, so long as the revocation is in writing. Once we receive your written revocation, it will only be effective for future uses and disclosures. It will not be effective for any information that may have been used or disclosed in reliance upon the written authorization and prior to receiving your written revocation.

Your Rights

You have the following rights with respect to your protected health information:

Right to Inspect and Copy. You have the right to inspect and copy certain protected health information that may be used to make decisions about your Arrangement benefits. If the information you request is maintained electronically, and you request an electronic copy, we will provide a copy in the electronic form and format you request, if the information can be readily produced in that form and format; if the information cannot be readily produced in that form and format, we will work with you to come to an agreement on form and format. If we cannot agree on an electronic form and format, we will provide you with a paper copy. You must submit your request to inspect or copy your protected health information in writing to the Chamber Benefit Arrangement of Indiana, Attn: Plan Administrator, 115 W Washington Street, Suite 850S, Indianapolis, IN 46204. The phone number of the Plan Administrator is (317) 264-6858. If you request a copy of the information, we may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with your request.

Generally, we will respond to your request within 30 days after we receive it; if we need more time, we will notify you within the original 30-day period. We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to your medical information, you may request that the denial be reviewed by submitting a written request to the Chamber Benefit Arrangement of Indiana, Attn: Privacy Official, 115 W Washington Street, Suite 850S, Indianapolis, IN 46204. The phone number of the Privacy Official is (317) 684-5419.

Right to Amend. If you believe that the protected health information we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for the Arrangement.

To request an amendment, your request must be made in writing and submitted to the Chamber Benefit Arrangement of Indiana, Attn: Plan Administrator, 115 W Washington Street, Suite 850S, Indianapolis, IN 46204. The phone number of the Plan Administrator is (317) 264-6858. In addition, you must provide a reason that supports your request.

Generally, we will respond to your request within 60 days. We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that:

• is not part of the medical information kept by or for the Arrangement;

• was not created by us, unless the person or entity that created the information is no longer available to make the amendment;

• is not part of the information that you would be permitted to inspect and copy; or

• is already accurate and complete.

If we deny your request, you have the right to file a statement of disagreement with us and any future disclosures of the disputed information will include your statement.

Right to an Accounting of Disclosures. You have the right to request a list (an “accounting”) of the times we have shared your protected health information with others. The accounting will not include (1) disclosures for purposes of treatment, payment, or health care operations; (2) disclosures made to you; (3) disclosures made pursuant to your authorization; (4) disclosures made to friends or family in your presence or because of an emergency; (5) disclosures for national security purposes; and (6) disclosures incidental to otherwise permissible disclosures.

To request this list or accounting of disclosures, you must submit your request in writing to the Chamber Benefit Arrangement of Indiana, Attn: Plan Administrator, 115 W Washington Street, Suite 850S, Indianapolis, IN 46204. The phone number of the Plan Administrator is (317) 264-6858. Your request must state the time period you want the accounting to cover, which may not be longer than six years before the date of the request. Your request should indicate in what form you want the list (for example, paper or electronic). Generally, we will respond to your request within 60 days. The first list you request within a 12-month period will be provided free of charge. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

Right to Request Restrictions.

You have the right to request a restriction on the protected health information we use or disclose about you for payment or health care operations. We are not required to agree to any restriction that you may request. If we do agree to the restriction, we will comply with the restriction unless the information is needed to provide emergency treatment to you. You may request a restriction by contacting SIHO Insurance Services, 417 Washington Street, Columbus, IN 47201, or by phone toll-free at (800) 443-2980 or, if local, at (812) 378-7070. It is important that you direct your request for restriction to the designated contact so that we can begin to process your request. Requests sent to persons or offices other than the designated contact might delay processing the request.

We will want to receive this information in writing and will instruct you where to send your request when you call. In your request, please tell us: (1) the information whose disclosure you want to limit; and (2) how you want to limit our use and/or disclosure of the information.

Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail.

To request confidential communications, you must make your request in writing to the Chamber Benefit Arrangement of Indiana, Attn: Privacy Official, 115 W Washington Street, Suite 850S, Indianapolis, IN 46204. We will not ask you the reason for your request. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests.

Right to Be Notified of a Breach. You have the right to be notified in the event that we (or a Business Associate) discover a breach of unsecured protected health information.

Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice.

To obtain a paper copy of this notice, contact the Plan Administrator is (317) 264-6858.

Complaints

If you believe that your privacy rights have been violated, you may file a complaint with the Arrangement or with the Office for Civil Rights of the United States Department of Health and Human Services. To file a complaint with the Arrangement, contact the Privacy Official, 115 W Washington Street, Suite 850S, Indianapolis, IN 46204. The phone number of the Privacy Official is (317) 684-5419. All complaints must be submitted in writing.

You will not be penalized, or in any other way retaliated against, for filing a complaint with the Office for Civil Rights or with us.

CHAMBER BENEFIT ARRANGEMENT OF INDIANA IS A MULTIPLE EMPLOYER WELFARE ARRANGEMENT PROVIDING BENEFITS TO PARTICIPANTS OF THE CHAMBER BENEFIT ARRANGEMENT OF INDIANA GROUP MEDICAL PLAN. THIS MULTIPLE EMPLOYER WELFARE ARRANGEMENT MAY NOT BE SUBJECT TO ALL OF THE INSURANCE LAWS AND REGULATIONS OF INDIANA. STATE INSURANCE GUARANTY FUNDS ARE NOT AVAILABLE FOR THIS MULTIPLE EMPLOYER WELFARE ARRANGEMENT.

Dated: October 1, 2025.