2024-1600-0345_1624-084 Attachment 4 - Example Standard Contract Form for Goods and Non-Professional Services.pdf

STANDARD CONTRACT FORM FOR GOODS AND NON-PROFESSIONAL SERVICES

The parties’ contract comprises this Standard Contract Form, as well as its referenced Articles and their associated Appendices.

1. Agency Contract Number 2. Contract Title

3. Vendor Number 4. IRIS GAE Number (if used) 5. Alaska Business License Number

This contract is between the State of Alaska,

6. Department of Division Health hereafter the State, and

7. Contractor hereafter the Contractor

Mailing Address Street or P.O. Box City State ZIP+4

8.

ARTICLE 1. Appendices: Appendices referred to in this contract and attached to it are considered part of it.

ARTICLE 2. Performance of Service:

2.1 Appendix A (General Provisions), Articles 1 through 18, governs the performance of services under this contract.

2.2 Appendix B sets forth the liability and insurance provisions of this contract.

2.3 Appendix C sets forth the services to be performed by the contractor.

2.4 Appendix D sets forth the provisions for payment.

2.5 Appendix E governs the use of Protected Health Information under this contract.

ARTICLE 3. Period of Performance: The period of performance for this contract begins , and ends .

ARTICLE 4. Considerations:

4.1 In full consideration of the contractor's performance under this contract, the State shall pay the contractor a sum not to exceed $ in accordance with the provisions of Appendix D.

NOTICE: By signature on this contract, the contractor certifies that neither it nor its principles are not currently debarred, suspended, proposed for debarment, or declared ineligible for award by any federal or other government entity.

9. CONTRACTOR 10. CONTRACTING AGENCY

Name of Firm Department/Division

Signature of Authorized Representative Signature of Procurement Officer

Typed or Printed Name of Authorized Representative Typed or Printed Name of Procurement Officer

Date Date

NOTICE: This contract has no effect until signed by the head of contracting agency or designee.

APPENDIX A

GENERAL PROVISIONS

1. Inspections and Reports:

The department may inspect, in the manner and at reasonable times it considers appropriate, all of the contractor's facilities and activities under this contract. The contractor shall make progress and other reports in the manner and at the times the department reasonably requires.

2. Suitable Materials, Etc.:

Unless otherwise specified, all materials, supplies or equipment offered by the contractor shall be new, unused, and of the latest edition, version, model, or crop and of recent manufacture.

3. Disputes:

If the contractor has a claim arising in connection with the contract that it cannot resolve with the State by mutual agreement, it shall pursue the claim, if at all, in accordance with the provisions of AS 36.30.620-AS 36.30.632

4. Default:

In case of default by the contractor, for any reason whatsoever, the State of Alaska may procure the goods or services from another source and hold the contractor responsible for any resulting excess cost and may seek other remedies under law or equity.

5. No Assignment or Delegation:

The contractor may not assign or delegate this contract, or any part of it, or any right to any of the money to be paid under it, except with the written consent of the Procurement Officer.

6. No Additional Work or Material:

No claim for additional supplies or services, not specifically provided in this contract, performed, or furnished by the contractor, will be allowed, nor may the contractor do any work or furnish any material not covered by the contract unless the work or material is ordered in writing by the Procurement Officer.

7. Independent Contractor:

The contractor and any agents and employees of the contractor act in an independent capacity and are not officers or employees or agents of the State in the performance of this contract.

8. Payment of Taxes:

As a condition of performance of this contract, the contractor shall pay all federal, State, and local taxes incurred by the contractor and shall require their payment by any subcontractor or any other persons in the performance of this contract. Satisfactory performance of this paragraph is a condition precedent to payment by the State under this contract.

9. Compliance:

In the performance of this contract, the contractor must comply with all applicable federal, state, and borough regulations, codes, and laws, and be liable for all required insurance, licenses, permits and bonds.

10. Conflicting Provisions:

Unless specifically amended and approved by the Department of Law, the terms of this contract supersede any provisions the contractor may seek to add. The contractor may not add additional or different terms to this contract; AS 45.02.207(b)(1). The contractor specifically acknowledges and agrees that, among other things, provisions in any documents it sees to append hereto that purport to (1) waive the State of Alaska’s sovereign immunity, (2) impose indemnification obligations on the State of Alaska, or (3) seek to limit liability of the contractor for acts of contractor negligence, are expressly superseded by this contract and are void.

11. Officials Not to Benefit:

Contractor must comply with all applicable federal or State laws regulating ethical conduct of public officers and employees.

12. Contract Prices:

Contract prices for commodities must be in U.S. funds and include applicable federal duty, brokerage fees, packaging, and transportation cost to the F.O.B. point so that upon transfer of title the commodity can be utilized without further cost. Prices for services must be in U.S. funds and include applicable federal duty, brokerage fee, packaging, and transportation cost so that the services can be provided without further cost.

13. Contract Funding:

Contractors are advised that funds are available for the initial purchase and/or the first term of the contract. Payment and performance obligations for succeeding purchases and/or additional terms of the contract are subject to the availability and appropriation of funds.

14. Force Majeure:

The parties to this contract are not liable for the consequences of any failure to perform, or default in performing, any of their obligations under this Agreement, if that failure or default is caused by any unforeseeable Force Majeure, beyond the control of, and without the fault or negligence of, the respective party. For the purposes of this Agreement, Force Majeure will mean war (whether declared or not); revolution;

invasion; insurrection; riot; civil commotion; sabotage; military or usurped power; lightning; explosion; fire; storm; drought; flood; earthquake;

epidemic; quarantine; strikes; acts or restraints of governmental authorities affecting the project or directly or indirectly prohibiting or restricting the furnishing or use of materials or labor required; inability to secure materials, machinery, equipment or labor because of priority, allocation or other regulations of any governmental authorities.

15. Severability:

If any provision of the contract is declared by a court to be illegal or in conflict with any law, the validity of the remaining terms and provisions will not be affected; and the rights and obligations of the parties will be construed and enforced as if the contract did not contain the particular provision held to be invalid.

16. Continuing Obligation of Contractor:

Notwithstanding the expiration date of this contract, the contractor is obligated to fulfill its responsibilities until warranty, guarantee, maintenance, and parts availability requirements have completely expired.

17. Termination.

a. The Procurement Officer, by written notice, may terminate this contract, in whole or in part, when it is in the best interest of the State. In the absence of breach of contract by the contractor, the State is liable only for payment in accordance with the payment provisions of this contract for services rendered before the effective date of termination.

b. The Procurement Officer may also, by written notice, terminate this contract under Administrative Order 352 if the contractor supports or participates in a boycott of the State of Israel.

18. Governing Law; Forum Selection

This contract is governed by the laws of the State of Alaska. To the extent not otherwise governed by Article 3 of this Appendix, any claim concerning this contract shall be brought only in the Superior Court of the State of Alaska and not elsewhere.

Appendix B Indemnity and Insurance

Article 1. Indemnification The contractor shall indemnify, hold harmless, and defend the contracting agency from and against any claim of, or liability for error, omission or negligent act of the contractor under this agreement. The contractor shall not be required to indemnify the contracting agency for a claim of, or liability for, the independent negligence of the contracting agency.

If there is a claim of, or liability for, the joint negligent error or omission of the contractor and the independent negligence of the contracting agency, the indemnification and hold harmless obligation shall be apportioned on a comparative fault basis. “Contractor” and “contracting agency”, as used within this and the following article, include the employees, agents and other contractors who are directly responsible, respectively, to each. The term “independent negligence” is negligence other than in the contracting agency’s selection, administration, monitoring, or controlling of the contractor and in approving or accepting the contractor’s work.

Article 2. Insurance Without limiting contractor's indemnification, it is agreed that contractor shall purchase at its own expense and maintain in force at all times during the performance of services under this agreement the following policies of insurance. Where specific limits are shown, it is understood that they shall be the minimum acceptable limits. If the contractor's policy contains higher limits, the state shall be entitled to coverage to the extent of such higher limits.

Certificates of Insurance must be furnished to the contracting officer prior to beginning work and must provide for a notice of cancellation, non-renewal, or material change of conditions in accordance with policy provisions. Failure to furnish satisfactory evidence of insurance or lapse of the policy is a material breach of this contract and shall be grounds for termination of the contractor's services. All insurance policies shall comply with and be issued by insurers licensed to transact the business of insurance under AS 21.

2.1 Workers' Compensation Insurance: The contractor shall provide and maintain, for all employees engaged in work under this contract, coverage as required by AS 23.30.045, and; where applicable, any other statutory obligations including but not limited to Federal U.S.L. & H. and Jones Act requirements. The policy must waive subrogation against the State.

2.2 Commercial General Liability Insurance: covering all business premises and operations used by the Contractor in the performance of services under this agreement with minimum coverage limits of $300,000 combined single limit per claim.

2.3 Commercial Automobile Liability Insurance: covering all vehicles used by the contractor in the performance of services under this agreement with minimum coverage limits of $300,000 combined single limit per claim.

Appendix C Description of Services

Scope of Work

Deliverables

Appendix D Payment for Services

Payment for services provided shall not exceed $XXX,000.00 for the initial period of performance of this contract.

The contractor shall bill …

State Approved Travel Guidelines:

The State will cover costs associated with pre-approved travel per the criteria listed below.

Expenses above these criteria must be approved in advance by the Program Manager.

• Air Travel: copies of receipts and boarding passes for flights must be submitted with the invoice. The State will reimburse for coach travel only.

• Hotel: copies of original hotel receipts at commercial facilities must be submitted with the invoice. Actual lodging expenses that exceed $300 room rate per night, excluding taxes, must be approved in advance by the Program Manager.

• Rental Car: copies of the rental car receipt and agreement must be submitted with the invoice. Rental should be for a mid-size or less car (unless approved in advance) and the rental period is to cover the business travel period only.

• Ground Transportation: between the Contractor’s home and the airport, and the destination airport and hotel; via airport shuttle, courtesy van, or taxi service.

• Per Diem: the maximum amount for food and all other travel related incidentals in Alaska is $60 per day, per person.

Note: Costs of parking violations will not be reimbursed.

Invoicing The contractor will submit monthly invoices detailing services performed in accordance with Appendix C.

The invoice must:

• Reference the contractor’s name, address and phone number

• Reference the contract number: 1624-0xx

• Include an invoice number

• Reference the Department of Health, Division of

• Itemize the contractual services provided during the period invoiced as described in Appendix C

The contractor shall submit invoices to the address specified below no later than 30 days after the end the period for which services were performed. Failure to include the required information on the invoice may cause an unavoidable delay to the payment process. The State will pay all invoices within thirty (30) days of invoice approval by the Project Director.

Email invoices to:

doh.dph.invoices@alaska.gov (please reference the contract in the subject line)

Notwithstanding any other provision of this contract, it is understood and agreed that the State shall withhold payment at any time the contractor fails to perform work as required under this contract.

mailto:doh.dph.invoices@alaska.gov

APPENDIX E

STATE OF ALASKA DEPARTMENT OF HEALTH

HEALTH INSURANCE PORTABILITY ANDACCOUNTABILITY ACT OF 1996 ("HIPAA")

BUSINESS ASSOCIATE AGREEMENT

This HIPAA Business Associate Agreement is between the State of Alaska, Department of Health (“Covered Entity” or “CE”) and the Contractor (“Business Associate” or “BA”).

RECITALS

Whereas, A. CE wishes to disclose certain information to BA, some of which may constitute Protected Health Information

("PHI");

B. It is the goal of CE and BA to protect the privacy and provide for the security of PHI owned by CE that is disclosed to BA or accessed, received, stored, maintained, modified or retained by BA in compliance with HIPAA (42 U.S.C.

1320d – 3120d-8) and its implementing regulations at 45 C.F.R. 160 and 45 C.F.R. 164 (the “Privacy and Security Rule”), the Health Information Technology for Economic and Clinical Health Act of 2009 (P.L. 111-5) (the “HITECH Act”), and with other applicable laws;

C. The purpose and goal of the HIPAA Business Associate Agreement ("BAA") is to satisfy certain standards and requirements of HIPAA, HITECH Act, and the Privacy and Security Rule, including but not limited to 45 C.F.R.

164.502(e) and 45 C.F.R. 164.504(e), as may be amended from time to time;

D. CE may operate a drug and alcohol treatment program that must comply with the Federal Confidentiality of

Alcohol and Drug Abuse Patient Records law and regulations, 42 U.S.C. 290dd-2 and 42 C.F.R. Part 2 (collectively “Part 2”); and

E. BA may be a Qualified Service Organization (“QSO”) under Part 2 and therefore must agree to certain mandatory provisions regarding the use and disclosure of substance abuse treatment information.

Therefore, in consideration of mutual promises below and the exchange of information pursuant to the BAA, CE and BA agree as follows:

1. Definitions.

a. General: As used in this BAA, the terms "Protected Health Information," "Health Care Operations," and other capitalized terms have the same meaning given to those terms by HIPAA, the HITECH Act and the Privacy and Security Rule. In the event of any conflict between the mandatory provisions of HIPAA, the HITECH Act or the Privacy and Security Rule, and the provisions of this BAA, HIPAA, the HITECH Act or the Privacy and Security Rule shall control. Where the provisions of this BAA differ from those mandated by HIPAA, the HITECH Act or the Privacy and Security Rule but are nonetheless permitted by HIPAA, the HITECH Act or the Privacy and Security Rule, the provisions of the BAA shall control.

b. Specific:

1) Business Associate: “Business Associate” or “BA” shall generally have the same meaning as the term

“business associate” at 45 C.F.R. 160.103.

2) Covered Entity: “Covered Entity” or “CE” shall have the same meaning as the term “covered entity” at 45 C.F.R. 160.103.

3) Privacy and Security Rule: “Privacy and Security Rule” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Part 160 and Part 164.

4) Triennially: “Triennially” shall mean once every three years.

2. Statement of Work and Responsibilities.

As provided by AS 44.21.020 and AS 44.21.160, The BA provides automatic data processing services to the CE. These services include storage, transmission, security, and recovery of electronic information owned by CE. BA is responsible for ensuring continuity of service, delivery, and access to CE electronic information at all times including in the event of a disaster.

3. Permitted Uses and Disclosures by Business Associate.

a. BA may only use or disclose PHI for the following purposes:

1) BA may use or disclose PHI as required by law.

2) BA agrees to make uses and disclosures and requests for PHI consistent with CE’s minimum necessary policies and procedures.

3) BA may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by

CE, except for the specific uses and disclosures set out below.

4) BA may disclose PHI for the proper management and administration of BA or to carry out the legal responsibilities of BA, provided the disclosures are required by law, or BA obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notified BA of any instances of which it is aware in which the confidentiality of the information has been breached.

5) BA may provide data aggregation services related to the health care operations of CE.

4. Obligations of Business Associate.

a. Permitted uses and disclosures: BA may only use and disclose PHI owned by the CE that it creates, receives, maintains, or transmits if the use or disclosure is in compliance with each applicable requirement of 45 C.F.R. 164.504(e) of the Privacy Rule or this BAA. The additional requirements of Subtitle D of the HITECH Act contained in Public Law 111-5 that relate to privacy and that are made applicable with respect to Covered Entities shall also be applicable to BA and are incorporated into this BAA.

To the extent that BA discloses CE’s PHI to a subcontractor, BA must obtain, prior to making any such disclosure: (1) reasonable assurances from the subcontractor that it will agree to the same restrictions, conditions, and requirements that apply to the BA with respect to such information; and (2) an agreement from the subcontractor to notify BA of any Breach of confidentiality, or security incident, within three business days of when it becomes aware of such Breach or incident.

b. Safeguards: 45 C.F.R. 164.308 (administrative safeguards), 164.310 (physical safeguards), 164.312 (technical safeguards), and 164.316 (policies, procedures, and documentation requirements) shall apply to BA in the same manner that such sections apply to CE, and shall be implemented in accordance with HIPAA, the HITECH Act, and the Privacy and Security Rule. The additional requirements of Title XIII of the HITECH Act contained in Public Law 111-5 that relate to security and that are made applicable to Covered Entities shall also apply to BA and are incorporated into this BAA.

Unless CE agrees in writing that this requirement is infeasible with respect to certain data, BA shall secure all paper and electronic PHI by encryption or destruction such that the PHI is rendered unusable, unreadable or indecipherable to unauthorized individuals; or secure paper, film and electronic PHI in a manner that is consistent with guidance issued by the Secretary of the United States Department of Health and Human Services specifying the technologies and methodologies that render PHI unusable, unreadable or indecipherable to unauthorized individuals, including the use of standards developed under Section 3002(b)(2)(B)(vi) of the Public Health Service Act, as added by Section 13101 of the HITECH Act contained in Public Law 111-5.

BA shall not use personally owned devices to create, receive, maintain, or transmit PHI. Devices the BA uses to create, receive, maintain, or transmit CE’s electronic PHI shall be owned and managed by BA or CE.

BA shall patch its operating systems and all applications within two weeks of the release of any patch. BA shall keep its antivirus and antimalware installed and active. BA shall limit its use of administrative accounts for necessary IT operations only.

c. Reporting Unauthorized Disclosures and Breaches: During the term of this BAA, BA shall notify CE within 72 hours of discovering a Breach of security; intrusion; or unauthorized acquisition, access, use or disclosure of CE’s PHI in violation of any applicable federal or state law, including security incidents. BA shall identify for the CE the individuals whose unsecured PHI has been, or is reasonably believed to have been, breached so that CE can comply with any notification requirements if necessary. BA shall also indicate whether the PHI subject to the Breach; intrusion; or unauthorized acquisition, access, use, or disclosure was encrypted or destroyed at the time. BA shall take prompt corrective action to cure any deficiencies that result in Breaches of security; intrusion; or unauthorized acquisition, access, use, and disclosure. BA shall fulfill all breach notice requirements unless CE notifies BA that CE will take over the notice requirements. BA shall reimburse CE for all costs incurred by CE that are associated with any mitigation, investigation and notice of Breach CE undertakes or provides under HIPAA, HITECH Act, and the Privacy and Security Rule as a result of a Breach of CE’s PHI caused by BA or BA’s subcontractor or agent.

If the unauthorized acquisition, access, use or disclosure of CE’s PHI involves only Secured PHI, BA shall notify CE within 10 days of discovering the Breach but is not required to notify CE of the names of the individuals affected.

d. BA is not an agent of CE.

e. BA’s Agents: If BA uses a subcontractor or agent to provide services under this BAA, and the subcontractor or agent creates, receives, maintains, or transmits CE’s PHI, the subcontractor or agent shall sign an agreement with BA containing substantially the same provisions as this BAA and further identifying CE as a third-party beneficiary with rights of enforcement and indemnification from the subcontractor or agent in the event of any violation of the subcontractor or agent agreement. BA shall mitigate the effects of any violation of that agreement.

f. Availability of Information to CE: Within 15 days after the date of a written request by CE, BA shall provide any information necessary to fulfill CE's obligations to provide access to PHI under HIPAA, the HITECH Act, or the Privacy and Security Rule.

g. Accountability of Disclosures: If BA is required by HIPAA, the HITECH Act, or the Privacy or Security Rule to document a disclosure of PHI, BA shall make that documentation. If CE is required to document a disclosure of PHI made by BA, BA shall assist CE in documenting disclosures of PHI made by BA so that CE may respond to a request for an accounting in accordance with HIPAA, the HITECH Act, and the Privacy and Security Rule.

Accounting records shall include the date of the disclosure, the name and if known, the address of the recipient of the PHI, the name of the individual who is subject of the PHI, a brief description of the PHI disclosed and the purpose of the disclosure. Within 15 days of a written request by CE, BA shall make the accounting record available to CE.

h. Amendment of PHI: Within 30 days of a written request by CE, BA shall amend PHI maintained, transmitted, created, or received by BA on behalf of CE as directed by CE when required by HIPAA, the HITECH Act or the Privacy and Security Rule, or take other measures as necessary to satisfy CE’s obligations under 45 C.F.R.

164.526.

i. Internal Practices: BA shall make its internal practices, books and records relating to the use and disclosure of CE's PHI available to CE and all appropriate federal agencies to determine CE's and BA's compliance with HIPAA, the HITECH Act and the Privacy and Security Rule.

j. Risk Assessment: Upon agreement execution and triennially thereafter, or upon changes that occur which significantly affect the security posture of the system (whichever comes first), BA shall comply and complete CE’s security assessment. Upon receipt of the security assessment, CE will review BA’s responses prior to granting authority to operate, and provide any necessary instruction to ensure the confidentiality, integrity, and availability of CE’s PHI. BA shall triennially, or upon changes that occur which significantly affect the security posture of the system (whichever comes first), review and update CE security assessment, as required, in order to comply with BA’s current system controls. BA must provide an implementation response for each specific system control. Upon receipt of the updated assessment, CE will review the changes to the system for renewal of authority to operate.

k. To the extent BA is to carry out one or more of CE’s obligations under Subpart E of 45 C.F.R. Part 164, BA must comply with the requirements of that Subpart that apply to CE in the performance of such obligations.

l. Audits, Inspection and Enforcement: CE may, after providing 10 days’ notice to the BA, conduct an inspection of the facilities, systems, books, logs, and records of BA that relate to BA’s use of CE’s PHI, including inspecting logs showing the creation, modification, viewing, and deleting of PHI at BA’s level.

Failure by CE to inspect does not waive any rights of the CE or relieve BA of its responsibility to comply with this BAA. CE's failure to detect or failure to require remediation does not constitute acceptance of any practice or waive any rights of CE to enforce this BAA.

Notwithstanding BA’s obligation to report under paragraph 3.c of this BAA, BA shall provide a monthly report to CE detailing the unauthorized, or reasonable belief of unauthorized, acquisition, access, use, or disclosure of CE’s PHI, including any unauthorized creation, modification, or destruction of PHI and unauthorized login attempts. BA shall include privileged and nonprivileged accounts in its audit and report, indicating the unique individual using the privileged account. BA shall also indicate whether CE’s PHI subject to unauthorized activity was encrypted or destroyed at the time of the unauthorized activity.

BA shall provide a yearly report to CE that lists the names of all individuals with technical or physical access to CE’s PHI and the scope of that access.

m. Restrictions and Confidential Communications: Within 10 business days of notice by CE of a restriction upon use or disclosure or request for confidential communications pursuant to 45 C.F.R.164.522, BA shall restrict the use or disclosure of an individual’s PHI. BA may not respond directly to an individual’s request to restrict the use or disclosure of PHI or to send all communication of PHI to an alternate address. BA shall refer such requests to the CE so that the CE can coordinate and prepare a timely response to the requesting individual and provide direction to the BA.

n. Indemnification: BA shall indemnify and hold harmless CE for any civil or criminal monetary penalty or fine imposed on CE for acts or omissions in violation of HIPAA, the HITECH Act, or the Privacy or Security Rule that are committed by BA, a member of its workforce, its agent, or its subcontractor.

5. Obligations of CE. CE will be responsible for using legally appropriate safeguards to maintain and ensure the confidentiality, privacy and security of PHI transmitted to BA under the BAA until the PHI is received by BA. CE will not request BA to use or disclose PHI in any manner that would not be permissible under HIPAA, the HITECH Act or the Privacy and Security Rule if done by CE.

6. Termination.

a. Breach: A breach of a material term of the BAA by BA that is not cured within a reasonable period of time will provide grounds for the immediate termination of the contract.

b. Reasonable Steps to Cure: In accordance with 45 C.F.R. 164.504(e)(1)(ii), CE and BA agree that, if it knows of a pattern of activity or practice of the other party that constitutes a material breach or violation of the other party’s obligation under the BAA, the nonbreaching party will take reasonable steps to get the breaching party to cure the breach or end the violation and, if the steps taken are unsuccessful, terminate the BAA if feasible, and if not feasible, report the problem to the Secretary of the U.S. Department of Health and Human Services.

c. Effect of Termination: Upon termination of the contract, BA will, at the direction of the CE, either return or destroy all PHI received from CE or created, maintained, or transmitted on CE’s behalf by BA in any form.

Unless otherwise directed, BA is prohibited from retaining any copies of PHI received from CE or created, maintained, or transmitted by BA on behalf of CE. If destruction or return of PHI is not feasible, BA must continue to extend the protections of this BAA to PHI and limit the further use and disclosure of the PHI.

The obligations in this BAA shall continue until all of the PHI provided by CE to BA is either destroyed or returned to CE.

7. Amendment. The parties acknowledge that state and federal laws relating to electronic data security and privacy are evolving, and that the parties may be required to further amend this BAA to ensure compliance with applicable changes in law. Upon receipt of a notification from CE that an applicable change in law affecting this BAA has occurred, BA will promptly agree to enter into negotiations with CE to amend this BAA to ensure compliance with changes in law.

8. Ownership of PHI. For purposes of this BAA, CE owns the data that contains the PHI it transmits to BA or that BA receives, creates, maintains, or transmits on behalf of CE.

9. Litigation Assistance. Except when it would constitute a direct conflict of interest for BA, BA will make itself available to assist CE in any administrative or judicial proceeding by testifying as witness as to an alleged violation of HIPAA, the HITECH Act, the Privacy or Security Rule, or other law relating to security or privacy.

10. Regulatory References. Any reference in this BAA to federal or state law means the section that is in effect or as amended.

11. Interpretation. This BAA shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HITECH Act, the Privacy and Security Rule and applicable state and federal laws. The parties agree that any ambiguity in BAA will be resolved in favor of a meaning that permits the CE to comply with and be consistent with HIPAA, the HITECH Act, and the Privacy and Security Rule. The parties further agree that where this BAA conflicts with a contemporaneously executed confidentiality agreement between the parties, this BAA controls.

12. No Private Right of Action Created. This BAA does not create any right of action or benefits for individuals whose

PHI is disclosed in violation of HIPAA, the HITECH Act, the Privacy and Security Rule or other law relating to security or privacy.

13. Privacy and Security Point of Contact. All communications occurring because of this BAA shall be sent to doh.its.dso@alaska.gov in addition to the CE.

mailto:doh.its.dso@alaska.gov

In witness thereof, the parties hereto have duly executed this BAA as of the effective date of this contract.