Specific Personal Information Protection
Assessment Report (Basic Report)
Assessment
Report No.
1Assessment Report Name
Bosch Health Insurance Society
Basic report on application, payment and collection relatedaffairs

Declaration on protection of rights and interests such as personal privacy

Bosch Health Insurance Society (referred to below as “RBHI”) declares that itrecognizes how handling specific personal information files during collection relatedaffairs such as application, insurance benefits, insurance premiums, and so on could
affect rights and interests such as personal privacy, and that it is addressing theprotection of such rights and interests through appropriate measures to reduce the riskof leaks of specific personal information or others.

• In obtaining the Privacy Mark from JIPDEC, RBHI has been recognized as an operator that maintains
and operates a system of suitable protective measures for personal information in compliance withJapanese Industrial Standard JIS Q 15001:2017.

Special note

･RBHI limits its society emploees who can handle specific personal information and takes measuressystematically so that other employees and outsiders cannot access specific personal information.
･RBHI makes it possible for the system to keep the operation record of "by whom", "from where" and"when" specific personal information was accessed in case that such an operation was performed.

Name of assessed organization
Bosch Health Insurance SocietyPublication date

October 1, 2022

[ January, 2019 Format2]

Ⅰ Related information
1. Affairs of Handling Specific Personal Information Files① Title of affairs

Application, payment and collection related affairs＜System details＞
RBHI is aiming to streamline its health insurance operation, rationalize benefits and the burdenof costs, maintaining and enhance the health of members, and improve the quality of healthcare
received by members in accordance with the Health Insurance Act (Act No. 70 of 1922) and theAct on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (Act No.
27 of 2013, referred to below as the “Number Use Act”).

This aim is to be achieved through RBHI's various work such as formulating activities andoperation plans by representatives of employers and insured persons, collecting insurance
premiums, paying out insurance benefits, verifying the details of medical consultation fees,
conducting health activities such as medical check-ups and fitness training, providing health careand walfare information to members, running medical and dental clinics and fitness facilities, andso on.
Furthermore, the provisions have been incorporated into the Health Insurance Act that enables“affairs related to the collection and organization of information on insured persons” and “affairs
related to the use and provision of information on insured persons” to be entrusted to Health
Insurance Claims Review & Reimbursement Services (referred to below as “Payment Fund”) incollaboration with other medical insurers. This enables us to entrust the Payment Fund in an
integrated manner with the management of unique index numbers of members’ qualification
history and insured persons’ sub-numbers, the inquiries about personal information from local
governments and the provision of such information for them through an information providing
network system, the affairs for verifying the identity of members, and the operation andmanagement of intermediary servers etc. for medical insurers to connect with an information
providing network system required for processing such affairs (referred to below as “intermediaryserver, etc.”) and servers for connecting to Basic Resident Register Network System.

RBHI’s members are either [1] insured persons who are employees at the business sites ofBosch Corporation or one of its group companies or affiliates, or their non-working dependents(ordinary members) or [2] people who have been insured persons for at least two months before
retirement from the business sites of those companies and have voluntarily applied to rejoin, or
their non-working dependents (voluntarily continuing members), and both of them lose theirmembers qualification when they reach the age of 75, as applied to the medical insurance system
for the elderly.
<Content of affairs >Among the affairs carried out by RBHI, concerning "the affairs handling the payment ofinsurance benefits, the implementation of healthcare work or welfare work, and the collection ofinsurance premiums in accordance with the Health Insurance Act” in Appended Table 1.2 of theNumbers Act, which are affairs stipulated by the ordinances of competent ministries, RBHI uses
specific personal information of members such as their individual number within the following
In the meanwhile, concerning some of notifications or applications from business sites requiredfor health insurance affairs, business sites can convert them into electronic data and apply online
via Myna Portal (social insurance, tax procedures online one-stop service) so that RBHI canaccept them online from November, 2020 (※１).
1. Application affairs (handling qualifcation related information, etc. applied when paying
insurance benefits to members or collecting their insurance premiums)

(1) Approving qualification according to the acquisition of qualification by insured persons, loss ofqualification, changes in non-working dependents, etc., verifying individual numbers inqualification related information amendment affairs, and inquiring about qualification related
information using individual numbers(2) In cases where an individual number cannot be obtained from a company or a member, or
where it is necessary to verify an individual number or the four basic items of information (name,gender, address,and date of birth), obtaining such information from Japan Agency for Local
Authority Information Systems via Payment Fund pursuant to the provisions of Article 30-9 of theBasic Resident Registration Act (※2)(3) From May 2017, registering individual numbers or qualification related information of members
on an intermediary server in order to share information, acquiring the sub-numbers of insured
persons, and, in cases where qualification related information has changed such as loss orchange of qualification, updating registered information on an intermediary server, etc.

② Outlines of affairs(4) In cases where verification information is needed to authorize the qualification of insured
persons who have taken out a new policy after being transferred from other medical insurers or of
their non-working dependents, inquiring about personal information from such previous insurers,etc., within a intermediary server, etc., verifying loss of qualification. In addition, the information
required for qualification approval of dependents such as taxation certificates, resident's cards,
and public benefit payment account information used for payment of benefits and refunds(hereinafter referred to as "public benefit receiving account information") (limited to cases where
the insured person wants) can be confirmed by inquiring from the relevant information holding
organization through an information providing network system (※3).
(5) Verifying the target persons who engage in affairs of issuing and managing such as reissuinghealth insurance cards and issuing aged recepient proofs and referring to their qualification
related information, etc. by using the individual numbers(6) Referring to qualification related information concerning the notification about standard
remuneration such as monthly salary changes, calculations, and bonuses, etc.
(※1) Myna Portal is an online service operated by the government, and RBHI online network
connected to Myna Portal uses the online billing network (referred to below as "online billing
NW") that has been utilized by connecting to Payment Fund. The operating main body of theMyna Portal is controlled on the system so that it cannot view the contents of the application data.
(※2) Personal number acquisition and basic 4 information acquisition from the Japan Agency forLocal Authority Information Systems are made by immediate inquiries via Payment Fund throughan intermediary server or by file batch inquiries.
(※3) Inquiries about personal information from previous insurers, etc. is made within aintermediary server, etc. of Payment Fund using insured person's sub-number, and inquiries
about information from related information holding institution through an information provision
network system is made by convering the reference data which have the insured person's subnumber to the inquiry data which have institutional codes using an intermediary server, etc. of
Payment Fund.
2. Affairs of paying insurance benefits (affairs handling qualification related information, etc.
concerning payment decision for members)(1) Verifying an individual number and reference to qualification-related information using theindividual number in cases where an individual number appears on an application form forpayment of statutory benefits such as injury and sickness allowance, childborth and childcare
lump-sum grant, funeral expenses, etc.
(2) Indexing information such as calculation conditions by individual numbers pertaining to thecalculation of statutory benefits and additional benefits

(3) In cases where it is necessary to verify benefit requirements in the determination of benefits,inquiring about such benefit requirements from other information holding bodies and veryfying
them using an information providing network system (※3)(4) Reginstering members' benefit related information on an intermediary server etc. for
information sharing(5) Verifying the target persons who engage in affairs of issuing and managing such as reissuinghealth insurance cards and issuing aged recepient proofs and referring to their qualification
related information, etc. by using the individual numbers when conducting affairs of issuing andmanaging limited amount application certificates and other benefit related certificates,
notifications of medical care allowances, etc.
3. Affairs of collecting insurance premiums (affairs handling qualification related information, etc.
concerning collection of premiums, etc.)(1) Indexing information such as calculation conditions by individual numbers pertaining to thecalculation of insurance premiums etc. of voluntarily continuing insured persons(2) Referring to qualification related information by using individual numbers in affairs pertaining
to insurance premium collection, such as the collection of insurance premiums of voluntarily
continuing insured persons, management of payment default, refunds upon loss of qualification,etc.
(Appendix) Regarding the payment of such as benefits and refunds, the "Law concerning
Registration, etc. of Deposit and Savings Accounts for the Prompt and Sure Implementation ofPayment of Public Benefits" came into effect in January 2022, only when the insured person
wants to use the public benefit receiving account information, the information inquiry has been
made possible through the information provision network system, and such insured person canobtain the public benefit receiving account information from the account information registration
system (Digital Agency) so as to utilize it for the administrative processing such as moneytransfer, etc.

③ Title of systems

1. Core system for health insurance society affairs (referred to below as “core system”)
2. Intermediary server etc. for medical insurers
3. Electronic application data. Download AP (referred to below as "Download AP")

2. Specific Personal Inforation File Name

Health insuance key information file
3. Use of individual numbers

Legal basis• Numbers Act, Article 9-1 (Range of Use) Appended Table 1, Item 2
Orders Stipulating Affairs as Prescribed by the Ordinances of Competent Ministries in the Numbers Act,
Appended Table 1 Article 2• Basic Resident Registration Act, Article 30-9 (Provision of identity verification information to a nationalorgan)

4. Information Sharing by Information Providing Network System① Implemented or not[ Implemented ]<Select from following options>(1) Implemented(2) Not implemented(3) Undecided• Numbers Act, Article 19-7 (Restrictions on the Provision of Specific Individual Information)(Referring) Appended Table 2, Item 3
Mi i t i

Orders Stipulating Affairs and Information as Prescribed by the Ordinances of Competenti Competent Ministries in the Numbers Act, Appended Table 2 Article 3(Providing) Appended Table 2, Items 1, 2, 3, 4, 5, 9, 12, 15, 17, 22, 26, 27, 33, 39, 42, 43, 58,
Od② Legal basis

62, 78, 80, 87, 93, 97, 106, 109, 119, 120
Sti Ordersl ti AffStipulatingi
P Affairsib dandb Information
O diC
t t byMi Ordinancesi t i i th ofN
asf Prescribedb

Competent Ministries in the Numbers Act, Appended Table 2
Articles 1, 2, 3, 4, 5, 8, 10-2, 11-2, 12-3, 15, 19, 20, 22-2, 24-2, 25, 25-2, 31-2, 33,
41-2,43, 44, 46, 49, 53, 55-2, 59-3
(Basis for entrusting) Health Insurance Act, Article 205-4-1, -2
RBHI entrusts the affairs of informaton enquring and providing through an information providing network
system to Payment Fund, pursuant to the provisions of the Health Insurance Act. RBHI uses information
obtained through the information providing network system in affairs such as health insurance benefit
payments, but the body that connects to the information providing network system is the Payment Fund.

5. Department Concerned within Assessment Implementing Body
① Department

General Affairs Section, Bosch Health Insurance Society② Title of Supevisor

Chief Administrative Officer (CAO)

6. Other Assessment Implementing Bodies
None
7. Requests to Disclose, Amend, or Prevent Use of Specific Personal Information
Contact

General Affairs Section, Bosch Health Insurance Society Executive Office
2-5-5 Yakyucho, Higashimatsuyama, Saitama 355-0028
Tel: 0493-22-0890

8. Inquiries about Handling of Specific Personal Information Files
Contact

General Affairs Section, Bosch Health Insurance Society Executive Office
2-5-5 Yakyucho, Higashimatsuyama, Saitama 355-0028
Tel: 0493-22-0890

Ⅱ Threshold Determing Items
1. No. of target people

How many target people do assessment target[10,000 to 99,999]
affairs?

Date of count?

<Select from following options>(1) Under 1,000 (arbitrary implementation)(2) 1,000 to 9,999(3) 10,000 to 99,999(4) 100,000 to 299,999(5) 300,000 or more

As of June 28, 2019

2. No. of handlers<Select from following options>(1) 500 or more (2) Under 500

Are there 500 or more people handling specific[ Under 500 ]personal information files?
Date of count?

As of June 28, 2019

3. Serious accidents
Did any serious accidents related to specificpersonal information occur in assessment
agencies over the last year?

[ No ]<Select from following options>(1) Yes (2) No

Ⅲ Threshold Determing Results
Threshold determing results
Implementation of basic assessment is obligatory.
Ⅳ Risk Measures1. Types of specific personal information protection assessment report to be submitted[ Basic Assessment Report ]<Select from following options>
1) Basic Assessment Report2) Basic Assessment Report and Focused Assessment Report3) Basic Assessment Report and Full Assessment Report

For the organization that selected either 2) or 3), details of risk mreasures are described in Forcused Assessment Report or FullAssessment Report respectively.
2. Obtaining specific personal information (except for obtaining through an information providing network system)
Are the measures against
the risk of acquisition otherthan the intended purposesufficient?

[ Putting special effort ]<Select from following options>
1) Putting special effort2) Sufficient3) Still remain issues

3. Use of specific personal information
Are the measures against
the risk of linking beyond thepurpose or linking withinformation not necessary
for affairs sufficient?

[ Putting special effort ]<Select from following options>
1) Putting special effort2) Sufficient3) Still remain issues

Are the measures against
the risk of unauthorized use
by unauthorized persons(former staff, staff without
access right, etc.) sufficient?

[ Putting special effort ]<Select from following options>
1) Putting special effort2) Sufficient3) Still remain issues

4. Outsourcing of handling specific personal information
Are the measures against
the risk of unauthorized use,etc. by entrustees sufficient?

[[ Don't outsource ]<Select from following options>
1) Putting special effort2) Sufficient3) Still remain issues]

5. Provision / transfer of specific personal information (excluding entrustment and provision through an information
provision network system)[ Don't provide / transfer ]Are the measures againstthe risk of unauthorized
provision / transfer
sufficient?

[<Select from following options>
1) Putting special effort2) Sufficient3) Still remain issues]

6. Connection to an info. providing network system [ ] Don't connect (acquisition), [○] Don't connect ( provision )Are the measures against
the risk of acquisition otherthan the intended purpose
sufficient?
Are the measures against
the risk of unauthorized
provision sufficient?

[ Putting special effort ]<Select from following options>
1) Putting special effort2) Sufficient3) Still remain issues[]<Select from following options>
1) Putting special effort2) Sufficient3) Still remain issues[ Putting special effort ]<Select from following options>
1) Putting special effort2) Sufficient3) Still remain issues

7. Storage / deletion of specific personal information
Are the measures against
the risk of leakage / loss /damage of specific personal
information sufficient?
8. Audit

Implemented or not?

[ ○] Self-check[] Internal audit

9. Training and awareness raising for employees
Training and awarenessraising for employees[ Putting special effort ]<Select from following options>
1) Putting special effort2) Sufficient3) Still remain issues[] External audit

Changes
Change date

Description before change

Description after change

June 28, 2019

I 1.
Affairs HandlingSpecific Personal
Information Files②
Outlines of affairs<Content of Affairs>
I 1.（1）
From October 2016, conducting
affairs of gathering and registering
individual numbers of insured
persons from companies ormembers(2)-(7)(※1), (* 2)"(The full text of item number (1)related to initial collection wasdeleted, and the following item
numbers were reassigned to (1) to(6).
In addition, the description related tothe initial collection was deleted /corrected, and the text notation wascorrected according to the actuallyoperation situation of affairs"

Afterwords

The initial collection was done temporarily inthe past, and since some that had already
ended in 2016 still remained in description,such description was deleted, and other text
expresssions have been corrected.

June 28, 2019

I 4.
Information Sharing
by Information
Provision NetworkSystem②
Legal basis"・Number Act, Article 19-7
(Restrictions on the provision of(Provided) Appendix 2 Item No. 120
specific personal information)
was changed to 119.
(Provision) Appendix 2 Item Nos. 1,2, 3 ... 120 "Afterwords

The change is only the item number due tothe revision of the Number Act.

ⅣRisk Measures, ingeneral

The implementation status ofmeasures against the risks in newly
added evaluation items (1. Types of
specific personal information
protection assessment reports to besubmitted- 6. Connection with an information
providing network system) isdescribed.

Afterwords

Declarare that it
addressing theSeptember 30, 2020 protection of rights
and interests such as
personal privacy(Special notes) Added that the risk is
reduced by "connection betweenservers".

Afterwords

October 1, 2022

Ⅰ1. Affairs ofHandling Specific
Personal Information
File➁
Outlines of affairs

Deletion of 3. (1), (2) special
retirement insured person ofcollection affairs and addition(Attachment)
6.Addition of 2 related to Article 31-2
legal basis when sharing theinformation through information
provision network.

Afterwords

April 1, 2023

Ⅰ2. Affairs ofHandling Specific
Personal Information
File➁
Outlines of affairs

Addition of wording about
dependents to
1. Application affairs, (4)and partial deletion from 3.
(Appendix)

Afterwords

June 28, 2019

Item

Submission time Explanation regarding the submission time

The types of assessment reports to besubmitted and the judgment of measuresagainst the risks implemented aredescribed.