25CRW018_-_Exhibit_E.pdf

California Department of Veterans Affairs Agreement Number: 25CRW018 Exhibit E – HIPAA Business Associate Agreement TBD

1. Recitals – STANDARD RISK

A. This Contract (Agreement) has been determined to constitute a business associate relationship under the Health Insurance Portability and Accountability Act (“HIPAA”) and its implementing privacy and security regulations at 45 CFR Parts 160 and 164 (“the HIPAA regulations”).

B. The California Department of Veterans Affairs (CalVet) wishes to disclose to Business Associate (BA) certain information pursuant to the terms of this Agreement, some of which may constitute Protected Health Information (“PHI”) and confidential information protected by Federal and/or state laws.

C. “Business Associate” or “BA” shall generally have the same meaning as the term “business associate” at

45 CFR §160.103, and in reference to the party to this agreement, shall mean the Contractor. A “business associate” also is a subcontractor that creates, receives, maintains, or transmits protected health information on behalf of another business associate.

D. “Protected Health Information” or “PHI” means any information, whether oral or recorded in any form or medium that relates to the past, present, or future physical or mental condition of an individual, the provision of health and dental care to an individual, or the past, present, or future payment for the provision of health and dental care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual. PHI shall have the meaning given to such term under HIPAA and HIPAA regulations, as the same may be amended from time to time. “Confidential Information” means information protected by Federal and/or state laws identified in this Agreement.

E. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of PHI, or confidential data that is essential to the ongoing operation of the Business Associate’s organization and intended for internal use; or interference with system operations in an information system.

F. As set forth in this Agreement, the Contractor, herein after, is the Business Associate of CalVet that provides services, arranges, performs or assists in the performance of functions or activities on behalf of CalVet and creates, receives, maintains, transmits, uses or discloses PHI.

G. CalVet and Business Associate desire to protect the privacy and provide for the security of PHI created, received, maintained, transmitted, used or disclosed pursuant to this Agreement, in compliance with HIPAA and HIPAA regulations and other applicable laws.

H. The purpose of the Agreement is to satisfy certain standards and requirements of HIPAA and the HIPAA regulations.

I. The terms used in this Agreement, but not otherwise defined, shall have the same meanings as those terms in the HIPAA regulations.

In exchanging information pursuant to this Addendum, the parties agree as follows:

2. Permitted Uses and Disclosures of PHI by Business Associate

A. Permitted Uses and Disclosures. Except as otherwise indicated in this Agreement, Business Associate may use or disclose PHI only to perform functions, activities or services specified in this Agreement, for, or on behalf of CalVet, provided that such use or disclosure would not violate the HIPAA regulations, if done by CalVet.

B. Specific Use and Disclosure Provisions. Except as otherwise indicated in this Agreement, Business

Associate may:

1) Use and disclose for management and administration. Use and disclose PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and will be used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware that the confidentiality of the information has been breached.

2) Provision of Data Aggregation Services. Use PHI to provide data aggregation services to CalVet.

Data aggregation means the combining of PHI created or received by the Business Associate on behalf of CalVet with PHI received by the Business Associate in its capacity as the Business Associate of another covered entity, to permit data analyses that relate to the health care operations of CalVet.

3. Responsibilities of Business Associate

Business Associate agrees:

A. Nondisclosure. Not to use or disclose Protected Health Information (PHI) other than as permitted or required by this Agreement or as required by law.

B. Safeguards. To implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the PHI, including electronic PHI, that it creates, receives, maintains, uses or transmits on behalf of CalVet; and to prevent use or disclosure of PHI other than as provided for by this Agreement. Business Associate shall develop and maintain a written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of the Business Associate’s operations and the nature and scope of its activities, and which incorporates the requirements of Section C, Security, below.

Business Associate will provide CalVet with its current and updated policies.

C. Security. To take any and all steps necessary to ensure the continuous security of all computerized data systems containing PHI, and provide data security procedures for the use of CalVet at the end of the contract period. These steps shall include, at a minimum:

1) Complying with all of the data system security precautions listed in this Agreement or in an Exhibit incorporated into this Agreement; and

2) Complying with the safeguard provisions in the Department’s Information Security Policy, embodied in the Security and Risk Management Policy in the Information Technology Section of the State Administrative Manual (SAM), §4840 et seq., in so far as the security standards in these manuals apply to Business Associate’s operations. In case of a conflict between any of the security standards contained in any of these enumerated sources of security standards, the most stringent shall apply.

The most stringent means, safeguards which provide the highest level of protection to PHI from unauthorized disclosure. Further, Business Associate must comply with changes to these security standards that occur after the effective date of this Agreement.

Business Associate shall designate a Security Officer to oversee its data security program who shall be responsible for carrying out the requirements of this section and for communicating on security matters with CalVet.

D. Mitigation of Harmful Effects. To mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate or its subcontractors in violation of the requirements of this Agreement.

E. Business Associate’s Agents. To ensure that any agents, including subcontractors, to whom Business

Associate provides PHI received from or created or received by Business Associate on behalf of CalVet, agree to the same restrictions and conditions that apply to Business Associate with respect to such PHI, including implementation of reasonable and appropriate administrative, physical, and technical safeguards to protect such PHI; and to incorporate, when applicable, the relevant provisions of this Agreement into each subcontract with agents or subcontractors.

F. Availability of Information to CalVet and Individuals. To provide access as CalVet may require, and in the time and manner designated by CalVet (upon reasonable notice and during Business Associate’s normal business hours) to PHI in a Designated Record Set, to CalVet (or, as directed by CalVet), to an Individual, in accordance with 45 CFR §164.524. Designated Record Set means the group of records maintained for CalVet that includes medical, dental and billing records about individuals; enrollment, payment, claims adjudication, and case or medical management systems maintained for CalVet health plans; or those records used to make decisions about individuals on behalf of CalVet. Business Associate shall use the forms and processes developed by CalVet for this purpose and shall respond to requests for access to records transmitted by CalVet within fifteen (15) calendar days of receipt of the request by producing the records or verifying that there are none.

G. Amendment of PHI. To make any amendment(s) to PHI that CalVet directs or agrees to pursuant to 45

CFR §164.526, in the time and manner designated by CalVet.

H. Internal Practices. To make Business Associate’s internal practices, books and records relating to the use and disclosure of PHI received from CalVet, or created or received by Business Associate on behalf of CalVet, available to CalVet or to the Secretary of the U.S. Department of Health and Human Services in a time and manner designated by CalVet or by the Secretary, for purposes of determining CalVet’s compliance with the HIPAA regulations.

I. Documentation of Disclosures. To document and make available to CalVet or (at the direction of

CalVet to an Individual such disclosures of PHI, and information related to such disclosures, necessary to respond to a proper request by the subject Individual for an accounting of disclosures of PHI, in accordance with 45 CFR §164.528.

J. Notification of Patient Confidential Communications. Notify CalVet (within 2 days of request) of any patient (or patient’s representative) preferences (or changes to) regarding method of or how to communicate with the patient.

K. Notification of Breach. During the term of this Agreement:

1) Discovery of Breach. To notify CalVet immediately by telephone call plus email or fax upon the discovery of breach of security of PHI in computerized form if the PHI was, or is reasonably believed to have been, acquired by an unauthorized person, or within 24 hours by email or fax of any suspected security incident, intrusion or unauthorized use or disclosure of PHI in violation of this Agreement, or potential loss of confidential data affecting this Agreement. Notification shall be provided to the CalVet contract manager, the CalVet Privacy Officer and the CalVet Information Security Officer. If the incident occurs after business hours or on a weekend or holiday and involves electronic PHI, notification shall be provided by calling the CalVet ISD Help Desk at (916) 653-2521.

Business Associate shall take:

i. Prompt corrective action to mitigate any risks or damages involved with the breach and to protect the operating environment and

ii. Any action pertaining to such unauthorized disclosure required by applicable Federal and State laws and regulations.

2) Investigation of Breach. To immediately investigate such security incident, breach, or unauthorized use or disclosure of PHI or confidential data. Within 72 hours of the discovery, to notify the CalVet contract manager(s), the CalVet Privacy Officer, and the CalVet Information Security Officer of:

i. What data elements were involved and the extent of the data involved in the breach,

ii. A description of the unauthorized persons known or reasonably believed to have improperly used or disclosed PHI or confidential data,

iii. A description of where the PHI or confidential data is believed to have been improperly transmitted, sent, or utilized,

iv. A description of the probable causes of the improper use or disclosure; and

v. Whether Civil Code §1798.29 or §1798.82 or any other federal or state laws requiring individual notifications of breaches are triggered.

3) Written Report. To provide a written report of the investigation to the CalVet contract managers, the

CalVet Privacy Officer, and the CalVet Information Security Officer within ten (10) working days of the discovery of the breach or unauthorized use or disclosure. The report shall include, but not be limited to, the information specified above, as well as a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain the improper use or disclosure.

4) Notification of Individuals. To notify individuals of the breach or unauthorized use or disclosure when notification is required under state or federal law and to pay any costs of such notifications, as well as any costs associated with the breach. The CalVet contract managers, the CalVet Privacy Officer, and the CalVet Information Security Officer shall approve the time, manner and content of any such notifications.

5) CalVet Contact Information. To direct communications to the above referenced CalVet staff, the

Business Associate shall initiate contact as indicated herein. CalVet reserves the right to make changes to the contact information below by giving written notice to the Business Associate. Said changes shall not require an amendment to this Agreement.

CalVet Contract Manager

CalVet Privacy Officer

CalVet Information Security Officer

See Exhibit A for Contract Manager information

Privacy Officer 1227 O Street Sacramento, CA 95814 Email: PrivacyOfficer@calvet.ca.gov Telephone: (916) 657-0091

Information Security Officer 1227 O Street Sacramento, CA 95814 Email: ISO@calvet.ca.gov Telephone: (916) 651-2165

L. Employee Training and Discipline. To train and use reasonable measures to ensure compliance with the requirements of this Agreement by employees who assist in the performance of functions or activities on behalf of CalVet under this Agreement and use or disclose PHI; and discipline such employees who intentionally violate any provisions of this Agreement, including by termination of employment. In complying with the provisions of this Section K, Business Associate shall observe the following requirements:

1) Business Associate shall provide information privacy and security training, at least annually, at its own expense, to all its employees who assist in the performance of functions or activities on behalf of CalVet under this Agreement and use or disclose PHI.

2) Business Associate shall require each employee who receives information privacy and security training to sign a certification, indicating the employee’s name and the date on which the training was completed.

3) Business Associate shall retain each employee’s written certifications for CalVet inspection for a period of three years following contract termination.

4. Obligations of CalVet

CalVet agrees to:

A. Notice of Privacy Practices. Provide Business Associate with the Notice of Privacy Practices that CalVet produces in accordance with 45 CFR §164.520, as well as any changes to such notice. Visit this Internet address to view the most current Notice of Privacy Practices:

https://www.calvet.ca.gov/about-us/privacy

B. Permission by Individuals for Use and Disclosure of PHI. Provide the Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect the Business Associate’s permitted or required uses and disclosures.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.calvet.ca.gov%2Fabout-us%2Fprivacy&data=04%7C01%7CStacie.Kincaid%40Calvet.ca.gov%7Cf91a63a14f644baa187008d98cfa72d4%7C5b77b8ed547d427cbeb158a7d93b1f81%7C0%7C0%7C637695829550550783%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=WDITQ5n3lh7C%2BSNQC%2BcsdJ1wjPlfo9muHtWWT2h82BY%3D&reserved=0

C. Notification of Restrictions. Notify the Business Associate of any restriction to the use or disclosure of PHI that CalVet has agreed to in accordance with 45 CFR §164.522, to the extent that such restriction may affect the Business Associate’s use or disclosure of PHI.

D. Notification of Patient Confidential Communications. Notify the Business Associate of any patient

(or patient’s representative) preferences (or changes to) regarding method of or how to communicate with the patient.

E. Requests Conflicting with HIPAA Rules. Not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA regulations if done by CalVet.

5. Audits, Inspection and Enforcement

From time to time, CalVet may inspect the facilities, systems, books and records of Business Associate to monitor compliance with this Agreement. Business Associate shall promptly remedy any violation of any provision of this Agreement and shall certify the same to the CalVet Privacy Officer in writing. The fact that CalVet inspects, or fails to inspect, or has the right to inspect, Business Associate’s facilities, systems and procedures does not relieve Business Associate of its responsibility to comply with this Agreement, nor does CalVet:

A. Failure to detect; or

B. Detection, but failure to notify Business Associate or require Business Associate’s remediation of any unsatisfactory practices constitutes acceptance of such practice or a waiver of CalVet’s enforcement rights under this Agreement.

6. Termination

A. Termination for Cause. Upon CalVet knowledge of a material breach of this Agreement by Business Associate, CalVet shall:

1) Provide an opportunity for Business Associate to cure the breach or end the violation and terminate this Agreement if Business Associate does not cure the breach or end the violation within the time specified by CalVet;

2) Immediately terminate this Agreement if Business Associate has breached a material term of this Agreement and cure is not possible; or

3) If neither cure nor termination is feasible, report the violation to the Secretary of the U.S. Department of Health and Human Services.

B. Judicial or Administrative Proceedings. Business Associate will notify CalVet if it is named as a defendant in a criminal proceeding for a violation of HIPAA. CalVet may terminate this Agreement if Business Associate is found guilty of a criminal violation of HIPAA. CalVet may terminate this Agreement if a finding or stipulation that the Business Associate has violated any standard or requirement of HIPAA, or other security or privacy laws is made in any administrative or civil proceeding in which the Business Associate is a party or has been joined.

C. Effect of Termination. Upon termination or expiration of this Agreement for any reason, Business

Associate shall return or destroy all PHI received from CalVet (or created or received by Business Associate on behalf of CalVet that Business Associate still maintains in any form, and shall retain no copies of such PHI or, if return or destruction is not feasible, shall continue to extend the protections of this Agreement to such information, and shall limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate.

7. Miscellaneous Provisions

A. Disclaimer. CalVet makes no warranty or representation that compliance by Business Associate with this Agreement, HIPAA or the HIPAA regulations will be adequate or satisfactory for Business Associate’s own purposes or that any information in Business Associate’s possession or control, or transmitted or received by Business Associate, is or will be secure from unauthorized use or disclosure. Business Associate is solely responsible for all decisions made by Business Associate regarding the safeguarding of PHI.

B. Amendment. The parties acknowledge that federal and state laws relating to electronic data security and privacy are rapidly evolving and that amendment of this Agreement may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement the standards and requirements of HIPAA, the HIPAA regulations and other applicable laws relating to the security or privacy of PHI. Upon CalVet’s request, Business Associate agrees to promptly enter into negotiations with CalVet concerning an amendment to this Agreement embodying written assurances consistent with the standards and requirements of HIPAA, the HIPAA regulations or other applicable laws. CalVet may terminate this Agreement upon thirty (30) days written notice in the event:

1) Business Associate does not promptly enter into negotiations to amend this Agreement when requested by CalVet pursuant to this Section, or

2) Business Associate does not enter into an amendment providing assurances regarding the safeguarding of PHI that CalVet in its sole discretion deems sufficient to satisfy the standards and requirements of HIPAA and the HIPAA regulations.

C. Assistance in Litigation or Administrative Proceedings. Business Associate shall make itself and any subcontractors, employees or agents assisting Business Associate in the performance of its obligations under this Agreement, available to CalVet at no cost to CalVet to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against CalVet, its directors, officers or employees based upon claimed violation of HIPAA, the HIPAA regulations or other laws relating to security and privacy, which involves inactions or actions by the Business Associate, except where Business Associate or its subcontractor, employee or agent is a named adverse party.

D. No Third-Party Beneficiaries. Nothing expressed or implied in the terms and conditions of this

Agreement is intended to confer, nor shall anything herein confer, upon any person other than CalVet or Business Associate and their respective successors or assignees, any rights, remedies, obligations or liabilities whatsoever.

E. Interpretation. The terms and conditions in this Agreement shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA regulations and applicable state laws. The parties agree that any ambiguity in the terms and conditions of this Agreement shall be resolved in favor of a meaning that complies and is consistent with HIPAA and the HIPAA regulations.

F. Regulatory References. A reference in the terms and conditions of this Agreement to a section in the

HIPAA regulations means the section as in effect or as amended.

G. Survival. The respective rights and obligations of Business Associate under Section 6(C) of this Agreement shall survive the termination or expiration of this Agreement.

H. No Waiver of Obligations. No change, waiver or discharge of any liability or obligation hereunder on any one or more occasions shall be deemed a waiver of performance of any continuing or other obligation, or shall prohibit enforcement of any obligation, on any other occasion.