Profile Application Aug 2024 FINAL for Contracting.pdf

August 2024

Business Associate Profile Application IMPORTANT NOTE: The Profile Application asks questions concerning the relationship between your company and the Veterans Health Administration (VHA), and the privacy and security of VHA data required by your company. We request that the appropriate company officials with knowledge of privacy and security controls assist with completing, signing and dating this profile.

Company Demographic Information:

1. Please provide your company’s official name, d/b/a, address, website, and UEI #.

Company Name:

d/b/a:

Address:

Website:

Unique Entity Identifier (UEI) #:

2. Please provide the addresses of all other/alternate locations where VHA Data is used, processed, accessed, created, stored, transmitted (other than telework locations). Note: This question is asking about locations where operations using VHA PII/PHI take place within your company.

Address 1:

Address 2:

Address 3:

3. Please provide names and contact information (phone, cell phone, email) for the following positions in your company:

Privacy Officer:

Information Security Officer:

Compliance Officer:

Records Manager:

Other:

Other:

Services Provided to VHA:

4. Please describe ALL the functions or services your company provides on VHA’s behalf based upon any and all underlying agreements such as contracts, purchase orders, task orders, MOUs, MOAs, BPAs, MOU/ISAs and other underlying agreements in place with the VA NAC, SAC, or TAC and/or VHA. Please provide enough detail in your response so that the services your company provides are clearly enumerated.

5-7. Questions 5-7 ask about your company’s status as a healthcare provider, whether or not your company provides treatment, and whether your staff are considered VHA workforce members based upon your company’s underlying agreements with the VA/VHA.

5. Under the terms of your contract with VHA, does your company act as a health care provider as defined by the HIPAA Regulations at 45 CFR §160.103?

☐ Yes ☐ No

6. Under the terms of your contract with VHA, do your employees act as members of the VHA workforce as defined by the HIPAA Regulations at 45 CFR §160.103?

7. Under the terms of your contract with the VHA, does your company’s function or services provided on behalf of the VHA meet the definition of treatment under the HIPAA Privacy Rule at 45 CFR § 164.501?

If you answered “Yes” to Question 5-7, please disregard the remaining questions, sign the document in the space provided on page 14, and submit the form to VHABAAIssues@va.gov.

If you answered “No” to Question 5, 6, or 7, continue to Question 8.

Engagement with VA/VHA Data, PII, and PHI:

The following questions relate to your company’s engagement with VA/VHA data, PII, and PHI/ePHI. Specific questions will be asked regarding your company’s access, receipt, transmission, use, disclosure, storage, maintenance, de-identification, and destruction of VHA PII/PHI. You will also be asked to provide a thorough description of all services or functions you provide on VHA’s behalf based upon any underlying agreements such as a contract, purchase order, task order, BPA, MOU, MOA, MOU/ISA and any other underlying agreement you have in place with the VA/VHA.

Protected Health Information (PHI) – PHI contains patient identifiers such as name, social security number and address or any other of the 18 data elements outlined in the HIPAA Privacy Rule. In the VHA, PII = PHI.

Business Associate - A VHA Business Associate accesses, creates, receives, maintains, stores, destroys, uses, discloses, or transmits Protected Health Information (PHI) to perform a function or activity on VHA’s behalf.

8. Please provide information regarding how your company engages with VA/VHA data, PII, and PHI/ePHI based upon the terms of all your underlying agreements with the VA/VHA to include but not limited to contracts, purchase orders, task orders, BPAs, MOUs, MOAs, MOU/ISAs or other underlying agreements with the VA (NAC, SAC, TAC) and/or VHA.

Under the terms of your company’s agreements with VA/VHA, does your company use or disclose VHA’s PHI/PII or does it access, store, create, receive, maintain, transmit or destroy, or de-identify VHA PHI/PII?

Please mark all that apply.

If you answered “No” to all of Question 8, please disregard the remaining questions, sign, the document in the space provided on page 14, and submit the form to VHABAAIssues@va.gov.

If you answered “Yes” to any part of Question 8, complete the remaining questions before signing and submitting the form to VHABAAIssues@va.gov.

Access ☐Yes ☐ No Create ☐Yes ☐ No Disclose ☐Yes ☐ No Destroy ☐Yes ☐ No De-Identify ☐Yes ☐ No Receive ☐Yes ☐ No Store/Maintain ☐Yes ☐ No Transmit ☐Yes ☐ No Use ☐Yes ☐ No https://www.law.cornell.edu/cfr/text/45/160.103 https://www.law.cornell.edu/cfr/text/45/160.103 https://www.law.cornell.edu/cfr/text/45/164.501 mailto:VHABAAIssues@va.gov mailto:VHABAAIssues@va.gov mailto:VHABAAIssues@va.gov

9. Please provide the names of all VHA Program Offices, VA Medical Centers, or VISNs that receive the services identified in Question 4 above. If your company provides services to all VAMCs/VISNs, please check the box next to All VAMCs/VISNs.

All VAMCs/VISNs ☐

Provide the list of the VAMCs, VISNs, VHA Program Offices for whom your company provides services:

10-10h. In questions 10-10h, please address your company’s access to VHA data, PII, and PHI/ePHI based upon the terms of any underlying agreements you have with the VA/VHA.

Access to VHA Data, PII, PHI/ePHI

10. How many of your company’s employees have or will have access to VHA data? Please provide an overall headcount.

☐ 1-10 ☐ 11-25 ☐ 26-50 ☐ 51-100 ☐ 100-500 ☐ Over 500

10a. Does your company access VA/VHA PII/PHI outside of a VA/VHA boundary (this includes PII or PHI that has been disclosed to your company by VHA)? (If you answered “No” please skip to question 10d.)

10b. How many employees will access or will have access to VHA data from outside the VA/VHA boundary?

☐ 0

☐ 11-25 ☐ 26-50 ☐ 51-100 ☐ Over 100

10c. From how many locations will your company’s employees access VA/VHA data outside the VA/VHA boundary? (Including PHI that has been disclosed to your company by VHA)

☐ 1 ☐ 2-5 ☐ Over 5 ☐ Over 10

10d. Do you have employees working remotely from home? (If you responded “No”, please move to question 10f.)

10e. Of your employees working remotely from home, how many will access VA/VHA data from their homes?

☐ 11-25 ☐ 26-50 ☐ 51-100 ☐ Over 100

10f. How will your employees access VA/VHA data, PII, and PHI in electronic format? (If you selected “Other”, please provide details in the additional comments space provided in 10h below.)

☐ VPN

☐ CAG/Azure Virtual Desktop ☐ Interconnection ☐ Direct Access ☐ Other

10g. If your employees will access VA/VHA data, PII, and PHI in hardcopy, please select one of the following:

☐ N/A ☐ Files ☐ Paper Documents ☐ Other Media (Films, Tissues, Photographs)

10h. Additional Comments Regarding Access to VA/VHA data, PII, and PHI:

11-11c. Questions 11-11c address your company’s creation of VHA data, PII, and PHI/ePHI on VHA’s behalf based upon the terms of any underlying agreements you have with the VA/VHA.

Creation of VHA Data, PII, PHI/ePHI

11. Does your company create data for VHA or on VHA’s behalf?

(If you answered “No”, please proceed to question 12.)

11a. If your company creates data on VHA's behalf, is the data considered PHI/ePHI or IIHI (Individually Identifiable Health Information)?

☐ Yes ☐ No ☐ N/A

11b. What PHI/ePHI is created by your company for VHA on VHA’s behalf?

(Select all that apply.)

☐ Electronic ☐ Hard Copy ☐ N/A

11c. Additional Comments Regarding Creation of VHA Data, PII, and PHI/ePHI:

12-12c. Questions 12-12c ask about your company’s transmission of VHA data, PII, and PHI/ePHI on VHA’s behalf based upon the terms of any underlying agreements you have with the VA/VHA.

Transmission of VHA Data, PII, PHI/ePHI

12. Does your company transmit VHA data, PII, and/or PHI/ePHI on VHA’s behalf? (If you answered “No”, please move on to question 13.)

12a. If you answered “Yes” to question 12, what type of data or PHI/ePHI is transmitted on VHA’s behalf?

Please describe:

12b. How does your company protect VHA data, PII or PHI/ePHI during transmission? Please describe:

12c. Additional Comments Regarding Transmission of VHA data, PII, and/or PHI/ePHI:

13-13f. Questions 13-13f ask about your company’s maintenance/storage of VHA data, PII, and PHI/ePHI on VHA’s behalf based upon the terms of any underlying agreements you have with the VA/VHA.

Maintenance/Storage of VHA Data, PII, and PHI/ePHI

13. Does your company store or maintain VHA data on VHA’s behalf? (If you answer “No”, please move on to question 14.)

13a. What type of data or PHI/ePHI does your company store or maintain on behalf of VHA? (If you select “Other”, please provide additional information in 13f below.)

☐ Electronic ☐ Hardcopy ☐ Other

13b. If your company maintains/stores data, PII, PHI, or ePHI on VHA’s behalf, please describe where that information is maintained/stored (e.g., physical location, local server, cloud server, file room, other).

13c. If your company maintains/stores VHA data, is that data maintained separately from other data (i.e., not co-mingled with other data)?

13d. If VHA data, PHI, ePHI is maintained on a server, who maintains the server? (If you select “Other”, please provide information in 13f below.)

☐ Business Associate

☐ VA/VHA

☐ Subcontractor

13e. If your company maintains/stores VHA data, please describe how that information is protected and safeguarded in accordance with the HIPAA Privacy and Security Rules.

13f. Additional Comments Regarding Maintenance/Storage of VHA data, PII, PHI/ePHI:

14-14d. Questions 14-14d ask about your company’s destruction of VHA data, PII, PHI, ePHI on VHA’s behalf based upon the terms of any underlying agreements you have with the VA/VHA.

Destruction of VHA data, PII, PHI, ePHI

14. Does your company destroy VHA data or PHI on VHA’s behalf (this includes any PHI disclosed to you by VHA)?

14a. How is the hardcopy data or PHI destroyed? (If you select “Other”, please provide information in 14d below.)

☐ N/A ☐ Shred ☐ Macerate ☐ Pulp

14b. How is ePHI destroyed? (Please describe)

14c. If your company destroys data on VHA’s behalf, is that destruction done in accordance with VHA Records Control Schedule (RCS) as outlined in RCS 10-1?

14d. If your company returns VHA data, PII, PHI, ePHI, retains for regulatory purposes or you answered “Other” in 14a above, please elaborate:

15-15l. Questions 15-15l ask about your company’s use, disclosure, incidents, policies and other Business Associate responsibilities with respect to VHA data, PII, PHI, ePHI on VHA’s behalf based upon the terms of any underlying agreements you have with the VA/VHA.

Use, Disclosure, Incidents, Policies and Other Required Business Associate Responsibilities

15. How many records on individuals (PHI/ePHI per Individual) does your company create, access, receive, store, transmit, maintain/store, destroy, and de-identify on VHA’s behalf?

☐ 1-100 ☐ 100-1000 ☐ 1000-10,000 ☐ Over 10,000

15a. Does your company use VHA data, PII, PHI/ePHI for purposes other than those specified in your underlying agreements for which you are a Business Associate with VHA? (e.g., state reporting required of your company, litigation defense, etc.)

15b. If you answered “Yes” to 15a, please list the purposes for which VHA’s data, PII, PHI, ePHI is being used or disclosed outside the purposes of the of the BAA?

15c. Does your company make disclosure of PHI/ePHI to other individuals or entities in the provisions of contracted services or activities on VHA’s behalf, including disclosures to subcontractors for them to provide a portion of the services?

15d. Does your company have direct contact with VHA patients?

15e. Does your company receive requests from third parties for VHA to be disclosed by you or created by you for purposes other than defined in the BAA?

15f. Has your company ever been involved in an incident (as defined in the BAA) involving VHA PHI/ePHI? (If “No”, please skip to question 15i.)

15g. If you answered “Yes” in 15f, how many breaches has your company had since completing the last profile application form?

☐ None ☐ 1-5 ☐ 6-10 ☐ 11-20 ☐ Over 20 ☐ Over 50

15h. How many Veterans were affected by the incident/breach?

☐ Less than 500

15i. Has your company developed, documented, and implemented company policies, processes, and procedures that explain safeguards to protect PHI/ePHI and prevent the use or disclosure of PHI/ePHI not authorized by the VHA BAA, specifically policies and procedures related to Privacy, Security and Records Management?

15j. Does your company have any other classification, other than Business Associate or health care provider, as defined under the HIPAA Privacy and Security Rules? (e.g., Covered Entity, Hybrid Entity, etc.)?

15k. If you answered “Yes” in 15j, please provide the type of classification.

15l. Other Comments Regarding Use, Disclosure, Policies, Incidents and other Business Associate Requirements:

Underlying Agreements with the VA/VHA and Subcontractor Relationships

16-16l. Questions 16-16l asks you to provide or reference all current underlying agreements with the VA/VHA that require access to VHA data, PII, PHI/ePHI. Those agreements may be contracts, purchase orders, task orders, MOUs, MOAs, MOU/ISAs, BPAs, IDIQs and/or other underlying agreements in place with the VA NAC, SAC, or TAC and/or VHA. In addition, you will need to provide a list of the subcontractors your company employs to provide services to the VHA on your behalf.

Underlying Agreements & Subcontractor Relationships

16. Please provide a response to the following:

VHA Contracts:

Purchase Orders/Task Orders:

MOU, MOA, or MOU/ISA:

NAC Contracts:

SAC Contracts:

TAC Contracts:

16a. Please provide information on all underlying agreements your company has in place with the VA/VHA as described above. This information should include contract numbers, purchase order numbers, task order numbers, BPAs, IDIQs, MOUs, MOAs, MOU/ISAs with all VAMCs, VISNs, and/or VA and VHA Program Offices.

16b. Are any of your company’s underlying agreements which give rise to the Business Associate relationship, expiring in the next year?

16c. If you answered “Yes” to question 16a, which underlying agreements will be expiring in the next year?

16d. Have any of your contracts or other underlying agreements related to the BAA been modified in the last 2 years?

16e. If you answered “Yes” in question 16c, please provide details.

16f. Has your company entered into any Business Associate Agreements with any VA Medical Centers, VISNs, or VHA Program Office or the Contracting Officer for those agreements?

16g. If you answered “Yes” in question 16e, please provide details.

16h. Does your company use subcontractors in services provided to VHA under your BAA? (If you answer “No”, please skip to question 17.)

16i. If you answered “Yes” in question 16g, please provide a list of the subcontractors your company employs and to whom you disclose VHA data, PHI/ePHI to provide services to VHA on your behalf.

16j. Does your company have HIPAA mandated subcontractor agreements in place with your company’s subcontractors who provide a portion of your services to the VHA?

Note: If your company doesn’t have appropriate subcontractor BAAs in place, this requirement must be satisfied to adhere to HIPAA and VA requirements.

16k. Does your company have a specific, documented chain-of-custody agreement that requires the subcontractor to meet the requirements set forth in your BAA with VHA?

16l. Do you have subcontractors who provide services to VHA that are outside the jurisdiction of the laws of US?

17. Questions 17-17e ask you to provide additional information about your company.

Additional Information

17. Has your company changed names or undergone a novation since you last completed the Profile Application and signed the current BAA?

17a. If you answered “Yes” in to question 17, please provide your company’s old name.

17b. Is your company as listed in question 1 of this profile application a wholly owned subsidiary of another company?

17c. If you answered “Yes” in question 17b, please provide the name of the parent company.

17d. Has your company been purchased or merged with another company since you completed the last Profile Application and signed the current BAA?

17e. If you answered “Yes” to question 17d, please tell us what company purchased or merged with your company.

18. Please provide any additional information you may not have had space to provide in the tables above or other information you would like to share in the space provided below.

Please obtain signatures for the appropriate company officials below:

Company Representative Date

Privacy/Compliance Officer Date

Information Security Officer Date