1.4 - Sample Business Associate Agreement.docx

Business Associate Agreement

By and Between

State of Nevada on its own behalf and on behalf of the

Public Employees’ Benefits Program (PEBP) and

[VENDOR NAME]

Attachment EE

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“Agreement”) is effective [DATE] and made by and between the State of Nevada, acting by and through its Public Employees’ Benefits Program (together “PEBP” or “Covered Entity”), and [VENDOR NAME] (“Business Associate”), (collectively, the “Parties”). This Business Associate Agreement shall replace any prior Business Associates Agreement the Parties had entered into previously. Terms appearing below in the “Witnesseth” section with initial upper case letters shall have the respective meanings assigned to them in this introductory paragraph or in Section 1.02 of this Agreement, as applicable.

WITNESSETH:

WHEREAS, Business Associate has previously entered into an arrangement with the State of Nevada PEBP and/or the Covered Entity to provide Services to or on behalf of the Covered Entity;

WHEREAS, the Parties acknowledge and agree that in providing Services to or on behalf of the Covered Entity, Business Associate will create, receive, use, maintain, access, transmit, or disclose Protected Health Information;

WHEREAS, the Parties intend to enter into this Agreement to address the requirements of HIPAA, HITECH, the Privacy Rule, the Security Rule, the Breach Notification Standards, and the Enforcement Rule (including the applicable changes to the Privacy Rule, Security Rule, Breach Notification Standards, and Enforcement Rule as set forth in the omnibus final rules effective on March 26, 2013) as they apply to “business associates”, including the establishment of permitted and required uses and disclosures (and appropriate limitations and conditions on such uses and disclosures) of Protected Health Information by Business Associate that is created or received in the course of performing Services on behalf of the Covered Entity; and WHEREAS, the objective of this Agreement is to provide the State of Nevada and the Covered Entity with reasonable assurances that Business Associate will appropriately safeguard the Protected Health Information that it creates or receives in the course of providing Services to the Covered Entity;

NOW, THEREFORE, in connection with Business Associate’s creation, receipt, use or disclosure of Protected Health Information and in consideration for the mutual promises contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties hereby agree as follows:

ARTICLE I

Definitions

“Business Associate” shall have the same meaning as the term “business associate” at 45 C.F.R. § 160.103, and, in reference to the party to this Agreement, shall mean Healthscope Benefits, Inc.

(a) “Breach” shall mean the acquisition, access, use, or disclosure of Protected Health Information in a manner not permitted by HIPAA or 45 CFR Part 164, Subpart E which compromises the security or privacy of the Protected Health Information unless such acquisition, access, use, or disclosure is otherwise excluded under 45 C.F.R. § 164.402(1). For purposes of this Agreement, an acquisition, access, use or disclosure of Protected Health Information in a manner not permitted by HIPAA or 45 CFR Part 164, Subpart E is presumed to be a breach unless the Business Associate demonstrates to the satisfaction of the Covered Entity that there is a low probability that the Protected Health Information has been compromised based on the Business Associate’s risk assessment of at least the following factors: (i) the nature and extent of the Protected Health Information involved, including the types of identifiers and the likelihood of re-identification; (ii) the unauthorized person who used the Protected Health Information or to whom the disclosure was made; (iii) whether the Protected Health Information was actually acquired or viewed; and (iv) the extent to which the risk to the Protected Health Information has been mitigated.

(b) “Breach Notification Standards” shall mean the standards for notification of a breach of unsecured Protected Health Information by covered entities and business associates at 45 CFR Parts 160 and 164, Subparts A and D.

(c) “Covered Entity” shall mean the State of Nevada Public Employees’ Benefits Program (PEBP).

(d) “Data Aggregation” shall mean, with respect to Protected Health Information created or received by the Business Associate in its capacity as the Business Associate of the Covered Entity, the combining of such Protected Health Information by the Business Associate with the Protected Health Information received by the Business Associate in its capacity as business associate of another covered entity, to permit data analyses that relate to the health care operations of the respective entities and is within the meaning of 45 C.F.R. § 164.501.

(e) “Designated Record Set” shall mean a group of records maintained by or for the State of Nevada and/or the Covered Entity within the meaning of 45 C.F.R. § 164.501 that consists of: (i) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (ii) records that are used, in whole or in part, by or for the State of Nevada and/or the Covered Entity to make decisions about Individuals.

For purposes of this Section 1.02(f), the term “record” means any item, collection or grouping of information that includes Protected Health Information and is maintained, collected, used or disseminated by or for the Covered Entity.

(f) “Enforcement Rule” means the Enforcement Provisions at 45 CFR Part 160.

(g) “HHS-Approved Technology” shall mean, with respect to data in motion, the encryption guidelines in Federal Information Processing Standard 140-2. For data at rest, HHS-Approved Technology shall mean the encryption guidelines in National Institutes of Standards and Technology (NIST) Special Publication 800-111. With respect to the destruction of data containing Protected Health Information, an HHS-Approved Technology requires the destruction of the media on which the Protected Health Information is stored such that, for paper, film or other hard copy media, destruction requires shredding or otherwise destroying the media so that Protected Health Information cannot be read or reconstructed; for electronic media, destruction requires that the data be cleared, purged or destroyed consistent with NIST Special Publication 800-88 such that the information cannot be retrieved. HHS-Approved Technology may be updated from time to time based on guidance from the Secretary of HHS.

(h) “HIPAA” shall mean the Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191.

(i) “HITECH” shall mean the Health Information Technology for Economic and Clinical Health Act, Pub. L. 111-5.

(j) “Individual” shall have the same meaning as the term “individual” in 45 C.F.R. § 160.103, and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g).

(k) “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 160 and Part 164, Subparts A and E.

(l) “Protected Health Information/ Electronic Protected Health Information (PHI/EPHI)” shall mean individually identifiable health information that is transmitted by electronic media (within the meaning of 45 C.F.R. § 160.103), maintained in electronic media, or maintained or transmitted in any form or medium including, without limitation, all information (including demographic, medical, and financial information), data, documentation, and materials that are created or received by Business Associate from or on behalf of the Covered Entity in connection with the performance of Services, and relates to:

and that identifies or could reasonably be used to identify an Individual and shall otherwise have the meaning given to such term under the Privacy Rule including, but not limited to, 45 C.F.R. § 160.103. Protected Health Information does not include health information that has been de-identified in accordance with the standards for de-identification provided for in the Privacy Rule including, but not limited to, 45 C.F.R. § 164.514 or Individually Identifiable Health Information: (i) in education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) in records described at 20 U.S.C. 1232g(a)(4)(B)(iv); (iii) in employment records held by a Covered Entity in its role as employer; and (iv) regarding a person who has been deceased for more than 50 years.

(m) “Required By Law” shall have the same meaning as the term “required by law” in 45 C.F.R. § 164.103.

(n) “Secretary” shall mean the Secretary of the United States Department of Health and Human Services (“HHS”) or his designee.

(o) “Secured Protected Health Information” shall mean Protected Health Information to the extent that the information is protected by using an HHS-Approved Technology identified by HHS for rendering Protected Health Information unusable, unreadable or indecipherable to unauthorized individuals.

(p) “Security Rule” shall mean the Security Standards at 45 C.F.R. Part 160, Part 162, and Part 164.

(q) “Services” shall mean the functions, activities or services to be provided to the State of Nevada and/or the Covered Entity under the terms of an arrangement between the State of Nevada and/or the Covered Entity and Business Associate.

(r) “Subcontractor” shall mean a person to whom Business Associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of Business Associate.

(s) “Unsecured Protected Health Information” shall mean Protected Health Information that is not rendered unusable, unreadable or indecipherable to unauthorized individuals through the use of an HHS-Approved Technology.

ARTICLE II

Obligations and Activities of Business Associate

ARTICLE IIIPermitted Uses and Disclosures By Business Associate

ARTICLE IV

Obligations of the Covered Entity

ARTICLE V

Term and Termination

(b) Extension of Protections for Retained Protected Health Information. In the event that Business Associate determines that returning or destroying the Protected Health Information is infeasible, Business Associate shall provide to the Covered Entity notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of Protected Health Information is infeasible, Business Associate shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protected Health Information, and for as long as the Business Associates can access Protected Health Information. The obligations of the Business Associate under this Agreement shall survive termination of this Agreement with respect to that Protected Health Information that Business Associate is unable to return or destroy, or Protected Health Information that the Business Associate may continue to access.

ARTICLE VI

Miscellaneous

6.12 Governing Law. This Agreement shall be governed by and construed in accordance with the same internal laws governing the Services provided to the State of Nevada or the Covered Entity by Business Associate.

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their duly authorized representatives.

THE PARTIES ACKNOWLEDGE THAT THEY HAVE READ THIS AGREEMENT, UNDERSTAND IT, AND AGREE TO BE BOUND BY ITS TERMS.

[VENDOR NAME]

State of Nevada on behalf of the Public Employees Benefits Program (PEBP)

By:_______________________________ Signature By:________________________________ Signature

Print Name:________________________

Print Name: Laura Rich _

Date:_____________________________

Date:______________________________ image1.png