2026.1.14. SAMPLE DDS BAA.pdf

MASSACHUSETTS DEPARTMENT OF DEVELOPMENTAL SERVICES

Business Associate Agreement

Standard Terms and Conditions Addendum

I. GENERAL PROVISIONS

Section 1. Department. The Department of Developmental Services (“the Department” or

“DDS”) is a Covered Entity under the Health Insurance Portability and Accountability Act

(“HIPAA”) and therefore subject to the HIPAA Privacy and Security Rules.

Section 2. Business Associate. The Department and [ ] (Vendor) acknowledge that the Vendor in its performance of [CONTRACT] and the Statement of Work (if applicable) to which these

Business Associate Agreement Standard Terms and Conditions are attached (the Master

Agreement, the contract awarded as a result of Master Agreement and the Statement of Work are referred to collectively as the Contract) is a Business Associate of the Department as the term is defined in 45 C.F.R. § 160.103. Business Associate workforce members with access to unencrypted PI or an encryption key used to secure such PI must sign the Confidentiality

Acknowledgement attached hereto as Appendix A prior to being granted such access.

Section 3. Business Associate Terms and Conditions. These are intended to protect the privacy and security of all Personal Data, including Protected Health Information (“PHI”), that the Vendor may receive from and/or create on behalf of the Department in the performance of its duties and responsibilities under the Contract, and to ensure that the Department complies with the requirements of the Health Insurance Portability and Accountability Act of 1996

(“HIPAA”), the HIPAA Privacy and Security Rules, 45 C.F.R. Parts 160 and 164, and the

HITECH Act; the Fair Information Practices Act (“FIPA”), M.G.L. c. 66A; M.G.L. c. 93H and

State confidentiality requirements governing the records of the Department (M.G.L c. 123B, §

17; 115 CMR 4.00 et seq.).

II. DEFINITIONS FOR USE IN THIS SECTION

All terms used, but not otherwise defined herein shall be construed in a manner consistent with the

HIPAA Privacy and Security Rules, The Fair Information Practices Act, and other applicable state or federal privacy or confidentiality laws.

“Breach” means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under HIPAA or M.G.L. c. 93H which compromises the security or privacy of the PHI.

“Business Associate” means a person or entity, who, on behalf of a the Department, and other than in the capacity of a workforce member, performs or assists in the performance of a function or activity that involves the use or disclosure of protected health information; or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services, where the provision of the service involves the use or disclosure of PHI.

“Data Subject” means an individual to whom Personal Data or Protected Health Information refers.

“Electronic Media” means:

• Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card; or

• Transmission media used to exchange information already in electronic storage media.

Transmission media include, for example, the internet (wide-open), extranet (using internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Faxes sent directly from one fax machine to another, person-to-person telephone calls, video teleconferencing, and messages left on voice-mail are not considered transmission media. However, any faxes sent from a computer, including those made by a fax-back system, are considered transmission media.

“Electronic Protected Health Information” (“EPHI”) means PHI that is created, accessed, stored, or transmitted by electronic media.

“The Health Insurance Portability and Accountability Act” (“HIPAA”) means Public Law 104-

191.

“The HITECH Act” means Title XIII of the American Recovery and Reinvestment Act of

2009, specifically the provisions of Subtitle D – Privacy, which shall hereinafter be included under references to HIPAA.

“Personal Data” (“PD”) means any information in any medium concerning an individual, which because of name, identifying number, mark or description can be associated with a particular individual. PHI and EPHI as defined herein, constitute subsets of PD.

“Privacy Rule” means the privacy regulations set forth in 45 C.F.R. Parts 160 and 164 and as amended.

“Protected Health Information” (“PHI”) means information in any form or medium that relates to the past, present or future, physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe can be used to identify the individual, that the Vendor receives, creates or uses under the Agreement. The terms “Protected Health Information” and “PHI” apply to the original data and to any data derived or extracted from the original data. PHI includes EPHI and is a subset of Personal Data.

“Required By Law” means a mandate contained in law that compels an entity to make a use or disclosure of PHI as set forth at 45 C.F.R. 164.103.

“Secretary” means the Secretary for the Office of Health and Human Services or his designee.

“Security Rule” means the Security standards for the protection of EPHI as set forth at 45

C.F.R. Parts 160, 162 and 164 and as amended.

“Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

III. OBLIGATIONS OF THE VENDOR

Section 1. Compliance with State and Federal Law. The Vendor acknowledges that in the performance of this Contract, it may receive PHI from the Department. The Vendor acknowledges that by accepting the PHI it becomes a “holder” within the meaning of M.G.L.

c. 66A and that it must comply with the requirements of that law in addition to HIPAA. Vendor also acknowledges that it must comply with all other applicable state or federal laws governing the privacy or security of any PHI received or created under the Contract. This includes, but is not limited to: the State confidentiality requirements governing the records of the

Department’s (M.G.L. c. 123B § 17; 115 CMR 4.00 et seq.; 115 CMR 9.19), M.G.L. c. 93H, and implementing regulations at 201 CMR 17.00. Vendor acknowledges that to the extent that

Vendor holds any PD, as defined by M.G.L. c. 66A, that is received from the Department which does not constitute PHI, the PD shall also be covered under all the terms of this agreement that refer to PHI.

Section 2. Ownership of PHI. Vendor shall at all times recognize the Department as sole owner of the PHI. As owner of the PHI, the Department shall at all times have complete control over the access, use, disclosure and disposition of the PHI including, if relevant, editorial control over the output.

Section 3. Agreements by Third Parties. The Vendor shall not engage a subcontractor or agent that will receive PHI originating from the Department or create or receive PHI on behalf of the Department without prior authorization from the Department. If the Department authorizes the Vendor in advance to engage such a subcontractor or an agent, the Department shall obtain and maintain a written agreement with each agent or subcontractor. The agreement shall provide that such agent or subcontractor agrees to be bound by the same restrictions, terms and conditions that apply to the Vendor pursuant to this Contract with respect to such

PHI, including but not limited to implementing reasonable and appropriate safeguards to protect the information. All provisions of the Contract apply to all such PHI, whether in the possession of the Vendor or any agent or subcontractor. The Vendor is responsible for ensuring each agent’s and subcontractor’s compliance with all applicable provisions of the Contract.

Upon request, the Vendor shall provide the Department with a copy of the written terms between the Vendor and the subcontractor or agent.

Section 4. Compliance with Use and Disclosure Provisions. Vendor agrees to comply with the use and disclosure provisions of HIPAA as established in 45 C.F.R. §164.502 and the requirements of §164.504 shall apply to Vendor in the same way they apply to the Department.

Section 5. Security: Appropriate Safeguards. 45 C.F.R. §§164.308, 164.310, 164.312 and

164.316 shall apply to the Vendor. As of the Contract effective date, the Vendor shall implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of PI and that prevent use or disclosure of such PI other than as provided for by this Agreement. All such safeguards must meet, at a minimum, and the Vendor shall otherwise comply with, all standards set forth in the Contract, Privacy and Security Rules, as applicable to a Business Associate, and all applicable

Massachusetts Executive Office of Health and Human Services (EOHHS), Executive Office of Technology Services and Security (EOTSS), and other Commonwealth security and information technology resource policies, processes and mechanisms, including the EOHHS

Acceptable Use Policy and the EOTSS Enterprise Information Security Policies and Standards and Acceptable Use Policy1, and any standards contained in any applicable Third Party

Agreement (collectively, the “Standards”). Vendor shall comply with any new or updated

Standards issued by federal, state, or other issuing agency or entity.

The Vendor shall notify DDS of any change in its administrative, technical, or operational environments that compromise or otherwise impact the confidentiality, integrity, or availability of PI or any changes to the Vendor’s information controls which alters its conformance with the Standards.

Section 6. Destruction of PI and Commonwealth Security Information during Contract

Term. The Vendor shall retain PI and Commonwealth Security Information during the course of the Contract in accordance with the terms of this Contract and all applicable state and federal retention laws and regulations. If, in accordance with such requirements, Vendor determines that, during the course of the Contract, it is appropriate to destroy PI or Commonwealth

Security Information, it shall do so only after obtaining DDS’ written permission. In the event destruction is permitted, Vendor shall destroy PI in accord with standards set forth in NIST

Special Publication 800-88, Guidelines for Media Sanitization, M.G.L. c. 93I and other

Applicable Laws relating to the destruction of confidential information, including PI, all applicable state and federal retention laws and regulations, and all state data security policies including policies issued by EOHHS and EOTSS. Within five (5) days of destroying PI or

Commonwealth Security Information in accordance with the requirements of this paragraph, Vendor shall provide DDS with a written certification that destruction has been completed in accord with the required standards set forth herein.

Section 7. Non-Secure Transmissions Prohibited. The Vendor agrees that it will not transmit the PHI over any unsecured network or over any wireless communication device without the prior written permission of the designated representative of the Department

1 https://www.mass.gov/policy-advisory/acceptable-use-of-information-technology-policy.

https://www.mass.gov/policy-advisory/acceptable-use-of-information-technology-policy accessing the Vendor services under this Agreement. Transmissions over the Internet must be limited to secure transmission protocols and methods. The Vendor is expected to comply with

NIST standard for secure transmission when transmitting PHI over the Internet.

Section 8. Reporting of Breach or Security Incident. The Vendor shall notify the DDS

Privacy Office, both orally and in writing, within five days following the discovery of any breach of PHI, including but not limited to any use or disclosure of unsecured PHI not permitted by the contract or any security incident involving or potentially involving the

Department’s PHI. The contact information for the Department’s Privacy Office is:

DDS Legal Office

Attn: Privacy Officer

Department of Developmental Services

40 Broad Street, 4th Floor

Boston, MA 02118

Phone: (857) 321-0189

DDS.privacy.officer@mass.gov

The Vendor shall cooperate in the Department’s Breach analysis procedures, including risk assessment, if requested.

Section 9. Responsibility for Breach Notification. The Vendor shall pay the full cost of breach notification for any notification required under HIPAA and/or M.G.L. c. 93H, for any breach for which Vendor, its agents or employees is responsible or any breach that occurred through its information system(s), whether the notice is given by the Department or Vendor.

Section 10. Mitigation. Immediately upon becoming aware of an Event, the Vendor shall take all reasonable and appropriate action necessary to:

a. retrieve, to the extent practicable, any PI or Commonwealth Security Information involved in the Event;

b. mitigate, to the extent practicable, any harmful effect of the Event known to the

Vendor; and

c. take such other action(s) as may be required in connection with the Event to comply with any Applicable Law.

Upon request, the Vendor shall take such further actions as DDS may reasonably request, or shall take such reasonable additional action to assist DDS, to further mitigate any harmful effect of the Event. Any actions to mitigate harmful effects of such Event undertaken by the

Vendor on its own initiative or pursuant to DDS’ request shall not relieve the Vendor of its obligations to report such Event or otherwise comply with this Section, any other provisions of this Agreement or the Contract or Applicable Law.

Section 11. Notification and Reporting Activities. As soon as possible, but no later than twenty-four (24) hours after Vendor becomes aware of the Event, the Vendor shall verbally report the Event to DDS with as much of the details listed below as possible, and shall follow mailto:DDS.privacy.officer@mass.gov such verbal report within three (3) business days with a written report outlining the Event with the following information:

a. The date of the Event or the estimated date (if date unknown);

b. The date of the discovery of the Event;

c. The nature of the Event, including a root cause analysis, containing as much specific detail as possible (e.g., cause, contributing factors, chronology of events);

d. The nature of the PI or Commonwealth Security Information involved in the Event

(e.g., the types of identifiers and other information involved), together with samples of any forms or documents that were involved in the Event to illustrate the type of

PI involved (with personal identifiers removed or redacted);

e. The exact number of individuals whose PI was involved in the Event if known or, if unknown, a reasonable estimate based on known facts (categorized according to the type of PI involved, if different types of PI was involved for different individuals), together with a description of how the number of individuals was determined;

f. A summary of the nature and scope of the Vendor’s investigation into the Event;

g. The harmful effects of the Event known to the Vendor, all actions the Vendor has taken or plans to take to mitigate such effects, and the results of all mitigation actions already taken;

h. A summary of steps taken to prevent such Event in the future, including copies of revised policies and procedures, changes in business processes and staff training;

and

i. Any additional information and/or documentation that the Vendor is required to provide to DDS under 45 CFR §164.410, M.G.L. c. 93H, §3(a) or other similar

Applicable Law.

If an Event is the result of a Security Incident, such as hacking, ransomware, or other related

Event, the Vendor shall prepare and provide a written forensics report to DDS that shall, at a minimum, describes the attack, security vulnerabilities, and any other information DDS deems necessary. Such information, documents, and deliverables shall not be redacted or withheld by the Vendor.

To the extent that any such information is not available at the time of the report, the Vendor shall provide such information to DDS as such information becomes available in one or more subsequent written reports. The Vendor shall provide DDS with such additional information regarding the Event as DDS may reasonably request, which additional information may include a written risk analysis rebutting any presumption that the Event constituted a breach for purposes of the Breach Notification Rule. Notwithstanding the foregoing, any Event involving

“return information” (as defined in 26 U.S.C. §6103(b)(2)) must be reported to DDS within one (1) hour of discovery.

Section 12. Obligations under Consumer Notification Laws. If DDS determines, in its sole discretion, that it is required to provide notifications to consumers or state or federal agencies under the Breach Notification Rule, M.G.L. c. 93H, other Applicable Law, or Third Party

Agreement as a result of the Event, the Vendor shall, at DDS’ request, assist DDS in drafting such notices for DDS’ review and approval, and shall take such other action(s) as DDS may reasonably request in connection with DDS’ compliance with the Breach Notification Rule, M.G.L. c. 93H, other Applicable Law, or Third Party Agreement, but in no event shall the

Vendor have the authority to give any such notifications on DDS’ behalf unless DDS authorizes and directs the Vendor to do so in writing. Additionally, at DDS’ direction, the

Vendor shall provide credit monitoring services to affected Individuals as required under

M.G.L. c. 93H, §3A or other Applicable Law.

Section 13. Reimbursement for Costs. The Vendor shall reimburse and indemnify, defend and hold harmless DDS for all costs incurred or sustained by DDS in responding to, and mitigating damages caused by, any Event or third party claims or causes of action brought or asserted against DDS involving:

a. the Vendor’s failure to meet its responsibilities under, or in violation of, any provision of this Agreement or the Contract;

b. the Vendor’s violation of Applicable Law;

c. the Vendor’s negligence;

d. the Vendor’s failure to protect data under its control with encryption or other security measures that constitute an explicit safe-harbor or exception to any requirement to give notice under Applicable Law; or

e. any activity or omission of the Vendor resulting in or contributing to an Event.

Such costs may include, for example and without limitation, losses, damages, liabilities, deficiencies, awards, penalties, fines, costs or expenses, including reasonable attorneys' fees and the costs associated with any notification required under subsection 3, above, including staffing and materials costs. Alternatively, at DDS’ direction, in lieu of reimbursing DDS for such any such costs the Vendor shall, at Vendor’s expense, conduct any such notification or other mitigation related activity on DDS’ behalf. This provision shall apply in addition and separate to any generally applicable indemnification provision applicable to the Vendor.

Section 14. Red Flags Rule. To the extent applicable, and at the direction of the Department, Vendor shall implement and maintain appropriate identity theft management programs in compliance with the federal Red Flags Rule. See Identity Theft Red Flags and Address

Discrepancies under the Fair and Accurate Credit Transactions Act of 2003, 72 FR 63718

(Nov. 9, 2007).

Section 15. Notice of Request for Data. The Vendor agrees to notify the Department Privacy

Officer within five (5) days of the Vendor’s receipt of any legal request, court order, or subpoena for PHI. To the extent that the Department decides to assume responsibility for challenging the validity of such requests, the Vendor agrees to cooperate fully with the

Department in such challenge.

Section 16. Access to PHI.

A. The Vendor shall provide the Department with access to or copies of any PHI, which it maintains pursuant to the Contract;

B. The Vendor shall, in consultation with DDS, also provide access directly to an individual’s PHI, unless otherwise restricted by law, if the individual makes a request directly to the Vendor, as shall be necessary to meet its obligation under 45 C.F.R. §

164.524 and M.G.L. c. 66A.

C. Such access or copies shall be provided to the Department or individual within five (5) days of a request.

Section 17. Availability of PHI for Amendment. The Vendor, in consultation with DDS, shall allow an individual to make requests to amend his or her PHI that the Vendor maintains and for which the Vendor is the source. The Vendor shall also make any amendment(s) to PHI that it received from or created or received on behalf of the Department that the Department directs, in order for the Department to meet its obligations under 45 C.F.R. § 164.526 and

M.G.L. c. 66A. All such amendments shall be made within ten (10) days of receipt of the request from the Department.

Section 18. Accounting of Disclosures. The Vendor shall document PHI disclosures and required information related to such disclosures, as is necessary for the Department to respond to an individual’s request for an accounting of disclosures of PHI under 45 C.F.R. § 164.528 and M.G.L. c. 66A. The Vendor agrees to provide to the Department or the individual at the

Department’s direction, within ten (10) days of the request, an accounting of disclosures of

PHI. At a minimum, the Vendor will provide the following information: (i) the date of the disclosure, (ii) the name of the entity or person who received the PHI, and if known, the address of such entity or person, (iii) a brief description of the PHI disclosed, and (iv) a brief statement of the purpose of such disclosure which includes an explanation of the basis for such disclosure.

The Vendor agrees to implement an appropriate record keeping process to enable it to comply with the requirements of this Section and to provide upon the Department’s request documentation of its method of tracking disclosures and a list of all accountings of disclosures provided under this Section.

Section 19. Access by Secretary to Records. The Vendor shall make available to the

Department or the Secretary its internal practices, books, and records including policies and procedures relating to the use and disclosure of the PHI received from the Department, or created or received by the Vendor on behalf of the Department, as well as policies and procedures relating to the confidentiality and security of the data. The Department or the

Secretary shall determine the time and manner for making such material available for purposes of the Secretary determining the Department’s compliance with the Privacy and Security

Rules.

Section 20. Prohibition on the Sale of PHI or Electronic Health Records. The Vendor shall comply with 45 C.F.R. § 164.502(a)(5)(ii), which relates to the prohibition on the sale of electronic health records and PHI.

Section 21. Prohibition on the Use or Disclosure of PHI Relating to Reproductive

Healthcare. The Vendor shall comply with 45 C.F.R. § 164.502(a)(5)(iii), which relates to the prohibition of the use or disclosure of PHI relating to reproductive healthcare.

Section 22. Indemnification. The Vendor shall indemnify, defend and hold the Department harmless from and against all claims, actions, damages, losses, liabilities, fines, penalties, costs or expenses (including, without limitation, reasonable attorneys’ fees) suffered by the

Department arising from or in connection with any breach of this Agreement, or any negligent or wrongful acts or omissions in connection with the Agreement, by Vendor or by its employees, directors, officers, subcontractors, or agents.

IV. PERMITTED USES AND DISCLOSURES BY THE VENDOR

Section 1. Uses and Disclosures of PHI. The Vendor agrees to use or disclose PHI that it receives from and/or creates or receives on behalf of the Department only as specified in this Section IV or as required by law.

A. To Perform the Contract. The Vendor may use or disclose PHI, or create PHI on behalf of the Department, as is necessary for the Vendor to administer or perform the functions, activities and services that are required to satisfy its obligations under the

Contract. This shall include providing the Secretary and the Department with full access to such PHI for purposes of auditing the performance of the Vendor under the Contract and as the Department determines is otherwise necessary for: (1) providing treatment to individuals receiving services under the contract; (2) the payment for or reimbursement of those services; and/or (3) health care operations. Operations shall include reporting to the

Department to fulfill state or federal reporting requirements. If the Vendor concludes that a client authorization is required for the release of PHI to the Department as required in this section, the Vendor agrees to timely secure client authorizations.

B. For Research or Publication. The Vendor agrees that it shall not conduct any research utilizing the PHI received from the Department or created or derived from the contracted data for research purposes without application to and the written approval of the

Department’s Research Review Committee (its Institutional Review Board) for the specific research. Further, the Vendor agrees that it shall not utilize the PHI received from or created or derived from the contracted data without the written approval of the Department for the specific publication.

C. For Management and Administration. The Vendor may use PHI that it receives from and/or creates or receives on behalf of the Department for the proper management and administration of the Vendor as provided for by 45 C.F.R. § 164.504(e)(4), provided that such use complies with the requirements of the Contract, this Business Associate

Agreement, and all other applicable state or federal privacy or confidentiality laws.

D. Use and Disclosure Limitations. Notwithstanding anything in this Section IV to the contrary, the Vendor may not Use or Disclose PHI received or created by it in performing its duties and responsibilities under the Contract if:

1. The Use or Disclosure would violate the HIPAA if done by the Department.

2. The Use or Disclosure would conflict with a statement made in the Department of

Developmental Services’ Notice of Privacy Practices, which may be changed from time to time. A current copy of the Privacy Notice may be found on the

Department’s website at: https://www.mass.gov/lists/dds-notice-of-privacy-practices

3. The Use or Disclosure would conflict with a restriction on Use or Disclosure of

PHI to which the Department agreed pursuant to 45 C.F.R § 164.522 and of which the Department informed the Vendor of in writing.

Section 2. Minimum Necessary. The Vendor agrees to take reasonable steps to limit the amount of PHI used and/or disclosed pursuant to Section 1 above to the minimum necessary to achieve the purpose of the use and disclosure.

V. OBLIGATIONS OF THE DEPARTMENT

Section 1. Notice of Privacy Practices. The Department shall notify the Vendor of any limitation(s) in its notice of privacy practices in accordance with 45 C.F.R. § 164.520, to the extent that such limitation may affect the Vendor’s use or disclosure of PHI.

Section 2. Revocation of Permission to Use PHI. The Department shall notify the Vendor of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent that such changes may affect the Vendor’s use or disclosure of PHI.

Section 3. Restriction to Use or Disclose PHI. The Department shall notify the Vendor of any restriction to the use or disclosure of PHI that the Department has agreed to in accordance with 45 C.F.R. § 164.522, to the extent that such changes may affect the Vendor’s use or disclosure of PHI.

Section 4. Notice of Changes and Restrictions. The Department shall notify Vendor of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent such changes affect Vendor’s permitted or required uses and disclosures. Such notification shall include any restriction that the Department has agreed to in accordance with 45 C.F.R. §

164.522. If Vendor receives a request to restrict the disclosure of PHI directly from an individual, Vendor shall notify the Department of such request and the Department shall be responsible for making the determination, in accordance with the Privacy Rule, as to whether

Vendor shall comply with the individual's request.

VI. TERMINATION OR COMPLETION OF CONTRACT WITH THE VENDOR

Section 1. This Agreement shall be effective upon execution by each party and shall terminate upon the termination or expiration of the Contract, unless earlier terminated by DDS in accordance with subsection 2, below.

Section 2. If DDS determines, in its sole discretion, that the Vendor has violated any material term of this Agreement or the Contract pertaining to the privacy or security of PI, DDS may terminate this Agreement and the Contract immediately upon written notice to the Vendor. For purposes of the termination provisions set forth in the Commonwealth Terms and Conditions https://www.mass.gov/lists/dds-notice-of-privacy-practices https://www.mass.gov/lists/dds-notice-of-privacy-practices for Human and Social Services, if applicable to the Contract, such a breach shall be considered to be one that poses an immediate threat to the life, health or safety of a client.

Section 3. Termination is Not Feasible. In the event that termination of this Contract is not feasible, in the Department’s sole discretion, the Vendor hereby acknowledges that the

Department will have the right to report this breach to the Secretary, notwithstanding any other provisions of this Agreement to the contrary.

Section 4. Effect of Termination or Completion.

A. Except as provided in subsection B immediately below, upon termination of this

Agreement for any reason whatsoever (including expiration), the Vendor shall, at DDS’ direction, either return or destroy all PI and Commonwealth Security Information, and the

Vendor shall not retain any copies of such PI or Commonwealth Security Information in any form. In no event shall the Vendor destroy any PI or Commonwealth Security

Information without first obtaining DDS’ approval. In the event destruction is permitted, the Vendor shall destroy PI and Commonwealth Security Information in accord with standards set forth in NIST Special Publication 800-88, Guidelines for Media Sanitization, all Applicable Laws and applicable retention laws and regulations and all data security policies including policies issued by DDS, EOHHS and EOTSS. This provision shall apply to all PI and Commonwealth Security Information in the possession of the Vendor’s subcontractors, and the Vendor shall require that all such information in the possession of its subcontractors and agents be returned or destroyed and that no subcontractor or agent shall be permitted to retain any copies of such information in any form, in accord with

DDS’ instructions. The Vendor shall, within three (3) business days of the return or destruction of PI and Commonwealth Security Information, certify to EOHHS in writing that all PI and Commonwealth Security Information has been returned or destroyed in accordance with this Section 4 and neither the Vendor nor any of its subcontractors or agents retains any PI or Commonwealth Security Information.

B. If the Vendor determines that returning or destroying PI or Commonwealth Security

Information is not feasible, the Vendor shall provide DDS written notification of the conditions that make return or destruction not feasible. If, based on the Vendor’s representations, DDS concurs that return or destruction is not feasible, the Vendor shall extend all protections pertaining to PI and/or Commonwealth Security Information set forth in this Agreement to all such information and shall limit further uses and disclosures of such information to those purposes that make its return or destruction not feasible, for as long as the Vendor (or any of its subcontractors) maintains any PI or Commonwealth

Security Information.

Section 5. Transition Assistance. Following the termination of this Contract for any reason, the Vendor agrees to provide transition services for the benefit of the Department, including the continued provision of its services required under this contract until notified by the

Department that an alternative provider of services is able to take over the provision of such services and the transfer of PHI and other data held by the Vendor related to its services under this Contract.

VII. MISCELLANEOUS PROVISIONS

Section 1. Regulatory References. A reference in this Agreement to a section of the Privacy or Security Rule means the section as in effect or as amended.

Section 2. Survival. The obligations of the Vendor under Part VI of this Agreement shall survive the termination of this agreement.

Section 3. Amendment. The Vendor and the Department agree to negotiate to amend this

Business Associate Agreement Addendum to the extent necessary to allow either party to comply with amendments to the Privacy or Security Rules or the Standards for Electronic

Transactions.

Section 4. Remedies. Nothing in this Agreement shall be construed to waive or limit any of the Department’s legal rights or remedies that may arise from the Vendor’s unauthorized use or disclosure of PHI or security breach. The Department’s exercise or non-exercise of any authority under the Agreement including, for example, any rights of inspection or approval of privacy or security practices or approval of subcontractors, shall not relieve the Vendor of any obligations as set forth herein nor be construed as a waiver of any of the Vendor’s obligations, or as an acceptance of any unsatisfactory practices, or privacy or security failures by the

Vendor.

Section 5. Interpretation. Any ambiguity in this Agreement shall be resolved to permit the

Department to comply with HIPAA’s Privacy or Security Rules, M.G.L. c. 66A, M.G.L. c.

93H, and any other law pertaining to the privacy or security of PHI.

[SIGNATURE PAGE TO FOLLOW]

The parties hereto have caused their duly authorized representatives to execute this Agreement.

DEPARTMENT OF DEVELOPMENTAL SERVICES

By ________________________________

Title ________________________________

Date ________________________________

(Insert Name of the Vendor)

By ________________________________

Title ________________________________

Date ________________________________

APPENDIX A

ACKNOWLEDGMENT REGARDING CONFIDENTIALITY OF PROTECTED

INFORMATION

I, the undersigned, understand that in the course of my work for ___________________, (name or organization) relating to a contract with the Department of Developmental Services, a constituent agency of the Executive Office of Health and Human Services (EOHHS), I may have access to protected information- (“PI”)-including protected health information, other personally identifiable information or security information--either provided by DDS/EOHHS or created or obtained on its behalf.

I understand that PI is confidential and access to, use of and disclosure of PI is regulated by federal and state law including, without limitation, the privacy and security regulations promulgated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and M.G.L. c. 66A, and the terms of the DDS/EOHHS contract.

I recognize that the unauthorized access, use or disclosure of PI may cause serious harm to individuals. Unauthorized access, use or disclosure of PI may also violate the terms of the

EOHHS contract and/or federal or state law, which may result in civil or criminal penalty including, without limitation, fines and imprisonment.

Acknowledged and agreed:

Protected Information User’s name (printed or typed):

Protected Information User’s Signature:

Date:

Vendor:

NOTE: Appendix A to the BAA need not be submitted to DDS. Appendix A must be retained by the Vendor and made available to DDS upon request.