HIPAA PRIVACY NOTICE

You may obtain a copy of the HIPAA form online at The Benefit Connection
or by clicking here.

The AutoNation Medical Benefits Plan/AutoNation Medical Wraparound Benefits Plan, AutoNation Dental Benefits Plan, AutoNation Flexible Spending Accounts Plan and AutoNation Vision Benefits Plan (the “Plans”) understand that medical information about you and your health is personal. The Plans are committed to protecting your protected health information, as defined by the privacy regulations under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This Notice will tell you about the ways in which the Plans may use and disclose your protected health information. The Plans also describe your rights and certain obligations the Plans have regarding the use and disclosure of protected health information. The Plans are required BY LAW to: (1) make sure that protected health information that identifies you is kept private; (2) give you Notice of their legal duties and privacy practices with respect to protected health information about you; and (3) follow the terms of the notice that is currently in effect.

Uses and Disclosures of Your Protected Health Information

The Plans may use or disclose your protected health information for the purposes of routine treatment, payment and health care operations; or they may share health information with each other as necessary to carry out the routine treatment, payment and health care operations relating to the Plans. For example, the Plans may use your protected health information for management activities related to the Plans, including auditing, fraud and abuse detection, and customer service. The Plans also may use or disclose your protected health information to pay your claims for benefits, to make eligibility determinations, and for billing and claims management purposes. In addition, the Plans may disclose your protected health information to AutoNation, Inc. (the Plan sponsor and Employer) so that AutoNation, Inc. can perform administrative functions on behalf of the Plans. Note that the Genetic Information Nondiscrimination ACT (GINA) prohibits using protected health information that is genetic information for underwriting purposes.

The Plans also may use or disclose your protected health information where required or permitted by law. HIPAA generally permits health plans to use or disclose protected health information for the following purposes: where required by law; for public health activities; to report child domestic abuse; for governmental oversight activities; pursuant to judicial or administrative proceedings; for certain law enforcement purposes; for a coroner, medical examiner or funeral director to obtain information about a deceased individual; for organ, eye or tissue donation purposes; for certain approved research activities; to avert a serious threat to an individual’s or the public’s health or safety; for other government functions, such as related to military service or national security; or to comply with Workers Compensation laws.

In addition, the Plans may disclose your protected health information to a family member or close friend that you have identified and who is directly involved in your care or payment for your care. The Plans also may notify a family member or other individual involved in your care, of your location, general condition, or death, or to a public or private entity authorized by law or its charter to assist in disaster relief efforts to make such notifications.

For any other uses and disclosures of your protected health information, the Plans will obtain your written authorization. The Plans will obtain your written authorization to use or disclose your protected health information for marketing purposes where the Plans receive financial remuneration, for the sale of your protected health information, or with respect to psychotherapy notes, where required by HIPAA. You may revoke this authorization in writing at any time, provided the Plans have not taken action in reliance on your authorization.

Substance Use Disorder Treatment Records

If you were treated by a health care provider or program that is subject to the federal privacy laws under 42 CFR Part 2 and you give consent for your Part 2 treatment records to be used and disclosed for purposes of treatment, payment, or health care operations, the Plans may rely on such consent for its own future uses and disclosures of such records for treatment, payment, or health care operations under the Plans.
Substance use disorder treatment records received from a programs subject to 42 CFR Part 2, or testimony relaying the content of such records, may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless: (1) you provide written consent; or (2) the Plans receive a court order accompanied by a subpoena or other legal requirement compelling disclosure and you, or the holder of your substance use disorder treatment record, are provided notice and an opportunity to be heard.

Other Privacy Laws

Under HIPAA, the Plans may be required to comply with other more stringent state or federal privacy laws that require greater limits on disclosure of your PHI, such as 42 CFR Part 2 related to substance use disorder treatment records.

Your Rights With Respect to Your Protected Health Information

You have several rights with respect to your health information, which are described below.

• Right to Request Restrictions. You have the right to request restrictions on how your protected health information may be used or disclosed. The Plans generally are not required to agree to your requested restrictions unless you have paid out of pocket in full for such services. If the Plans agree with the requested restrictions, they will comply with your request unless the information is needed to provide emergency treatment for you. To request restrictions, you must submit a request form, as provided in the Questions and Requests/Forms section of this Notice below, to the Plan’s Office of Privacy Governance.

• Right to Request Confidential Communications. You have the right to receive plan information confidentially in a certain way or at a certain location, such as at a location other than your home, if you state in writing that disclosing the information through normal means could endanger you. To request confidential communications, you must submit a request form to the Plan’s Office of Privacy Governance.

• Right to Inspect and Copy. You have the right to inspect and copy your protected health information that is maintained by the Plans in a designated record set, including an electronic copy. To inspect and copy your information, you must submit a request form to the Plan’s Office of Privacy Governance. The Plans may charge a reasonable, fee, including mailing costs (labor and postage), for such copies.

The Plans may deny your request to inspect and copy your protected health information in certain very limited circumstances provided by the law. If you are denied access to your protected health information, you may request that the denial be reviewed.

• Right to Amend. You have the right to request an amendment to your protected health information that the Plans maintain in a designated record set. To request an amendment, you must submit a request form to the Plan’s Office of Privacy Governance. The Plans may deny your request for an amendment if: (1) it is not in writing or does not include a reason to support your request; (2) the Plans believe your information is accurate and complete; (3) the information is not part of the protected health information kept by or for the Plans; (4) the information is not part of the information which you would be permitted to inspect or copy; or (5) the information was created by a party other than the Plans, unless the person or entity that created the information is no longer available to make the amendment.

• Right to an Accounting of Disclosures. You have the right to request an accounting of disclosures the Plans have made of your protected health information for the six years prior to your request, except for disclosures you have authorized or disclosures for routine treatment, payment or health care operations of the Plans. To request an accounting of disclosures, you must submit a request form to the Plan’s Office of Privacy Governance. The first accounting you request within a 12-month period will be free, but for additional accountings the Plans may charge a reasonable, cost-based fee, including mailing costs (labor and postage). The Plans will notify you of the costs involved and you may choose to withdraw or modify your request at that time before any costs are incurred.

• Right to a Paper Copy of This Notice. You have the right to request a paper copy of this Notice at any time, even if you have agreed to receive this Notice electronically. You may obtain a copy of this Notice online at The Benefit Connection. To obtain a paper copy of this Notice, you must submit a request form to the Plan’s Office of Privacy Governance.

The Plan’s Duties With Respect to Your Protected Health Information

The Plans are required by law to maintain the privacy of your protected health information, and to provide you with a notice of their legal duties and privacy practices with respect to your protected health information. The Plans are required to abide by the terms of this Notice and to make the new notice provisions effective for all protected health information that they maintain, including the information that the Plans currently have as well as any information they receive in the future. The Plans are required to notify you if there is a breach of your unsecured protected health information. If there is a material change to any of the provisions of this Notice, the Plans will provide a revised privacy notice.

Questions and Requests/Forms

If you have questions, would like more information about the Plans’ privacy policies, or want to request a form to exercise any of your rights listed above, you may contact the Plan’s Office of Privacy Governance at 200 SW 1st Ave, Fort Lauderdale, FL 33301.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Plans or the Secretary of U.S. Department of Health and Human Services. To file a complaint with the Plans, contact the Plan’s Office of Privacy Governance as set forth above. You cannot be retaliated against for filing such a complaint.

Effective Date: February 16, 2026