40DHHS-S3339 - BAA Global DHHS August 2024.docx

BUSINESS ASSOCIATE ADDENDUM

BETWEEN

State of Nevada Department of Health and Human Services Division of Health Care Financing and Policy Hereinafter referred to as the “Covered Entity” and

[ENTER VENDOR’S NAME]

Hereinafter referred to as the “Business Associate”

This Business Associate Agreement (“BAA”) is incorporated as an attachment by reference to a State of Nevada Contract (in consideration of mutual obligations contained therein and below and the exchange of information pursuant to this BAA and the State of Nevada Contract) by and between the named Nevada Department of Health and Human Services (“Covered Entity”), a government entity, and the named Independent Contractor (“Business Associate”), licensed to do business in the State of Nevada in accordance with the meanings ascribed to the terms “Covered Entity” and “Business Associate” under 45 CFR § 160.103 et seq. (see also 45 CFR § 164.501). The Covered Entity and Business Associate are collectively referred to herein as the “Parties.”

I. RECITALS

a. Covered Entity is either a “covered entity” in its own right or a “business associate” of a covered entity as each are defined under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the Health Information Technology for Economic and Clinical Health Act, Public Law 111-5 (collectively, “HIPAA” as may be amended or in effect at the time) and, as such, is required to comply with HIPAA’s provisions regarding the confidentiality and privacy of Protected Health Information (as defined below);

b. The Parties have entered into or will enter into an agreement or agreements under which Business Associate provides or will provide certain specified services to Covered Entity (collectively, the “Agreement”);

c. In providing services pursuant to the Agreement, Business Associate will have access to Protected Health Information (“PHI”), including, where applicable, through provision of services on behalf of Covered Entity which result in direct receipt of PHI from sources other than Covered Entity;

d. By providing the services pursuant to the Agreement, Business Associate will become a “business associate” of Covered Entity as such term is defined under HIPAA;

e. Both Parties are committed to complying with all federal and state laws governing the confidentiality and privacy of health information, including but not limited to, the Standards for Privacy of Individually Identifiable Health Information (45 CFR Part 160 and Part 164, Subparts A and E, collectively the “Privacy Rule”); and

f. Both Parties intend to protect the privacy and provide for the security of PHI disclosed to the Business Associate pursuant to the terms of this Agreement, the Contract for Services to which this Agreement is incorporated, HIPAA, and other applicable state and federal laws and regulations.

II. DEFINITIONS

a. For the purposes of this BAA, the Parties give the following meaning to each of the terms as set forth below and in the information above. Any capitalized term used in this BAA, but not otherwise defined, has the meaning given to that term in the Privacy Rule or pertinent law.

i. “Affiliate” means a subsidiary or affiliate of Covered Entity that is, or has been, considered a covered entity as defined by HIPAA.

ii. “Breach” means the acquisition, access, use, or disclosure of PHI in a manner not permitted under the Privacy Rule which compromises the security or privacy of the PHI as defined in 45 CFR § 164.402 and 42 USC § 17921.

iii. “Breach Notification Rule” means the portion of HIPAA set forth in subpart D of 45 CFR Part 164.

iv. “CFR” means the Code of Federal Regulations.

v. “Data Aggregation” means, with respect to PHI created or received by Business Associate in its capacity as the “business associate” under HIPAA of Covered Entity, the combining of such PHI by Business Associate with the PHI received by Business Associate in its capacity as a business associate of one or more other “covered entity” under HIPAA, to permit data analyses that relate to Health Care Operations (defined below) of the respective covered entities. The meaning of “data aggregation” in this BAA shall be consistent with the meaning given to that term in the Privacy Rule.

vi. “Designated Record Set” has the meaning given to such term under the Privacy Rule, including 45 CFR § 164.501.

vii. “De-Identify” means to alter the PHI such that the resulting information meets the requirements described in 45 CFR §§ 164.514(a) and (b).

viii. “Disclosure” means the release, transfer, provision of, access to, licensure of, use of, or divulging in any other manner of information outside the entity holding the information as defined in 45 CFR § 160.103.

ix. “Electronic PHI” means any PHI maintained in or transmitted by electronic media as defined in 45 CFR § 160.103.

x. “Health Care Operations” has the meaning given to that term in 45 CFR § 164.501.

xi. “Individual” has the same meaning given to that term in 45 CFR §§ 164.501 and 160.103 as and includes a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).

xii. “Individually Identifiable Health Information” means health information, in any form or medium, including demographic information or inquiries collected from an individual, that is created or received by a covered entity or a business associate of the covered entity and relates to the past, present, or future care of the individual. Individually identifiable health information is information serving to identify the individual directly, or for which there is a reasonable basis to believe it can serve to identify the individual as provided in 45 CFR § 160.103.

xiii. “Protected Health Information” or “PHI” has the meaning given to the term “protected health information” in 45 CFR §160.103, limited to the information created or received by Business Associate from or behalf of Covered Entity, in whichever medium it is maintained, transmitted, or stored.

xiv. “Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

xv. “Security Rule” means the Security Standards for the Protection of Electronic Health Information provided in 45 CFR Part 160 and Part 164, Subparts A and C.

xvi. “Unsecured Protected health Information” or “Unsecured PHI” means any “protected health information” as defined in 45 CFR §160.103 that is not rendered unusable, unreadable or indecipherable to unauthorized individuals or entities through the use of a technology or methodology specified by the Secretary of the federal Department of Health and Human Services in the guidance issued pursuant to the HITECH Act and codified in 42 USC § 17932(h).

xvii. “USC” means the United States Code.

III. DATA OWNERSHIP

Business Associate’s data stewardship does not confer data ownership rights on Business Associate with respect to any data shared with it under the Agreement, including any and all forms thereof.

IV. USE AND DISCLOSURE OF PHI BY BUSINESS ASSOCIATE

a. Except as otherwise provided in this BAA and the laws and regulations related to PHI, Business Associate may use or disclose PHI as reasonably necessary to provide the services described in the Agreement to Covered Entity, and to undertake other activities of Business Associate permitted or required of Business Associate by this BAA or as required by law.

b. Except as otherwise limited by this BAA or federal or Nevada law, Covered Entity authorizes Business Associate to use the PHI in its possession for the proper management and administration of Business Associate’s business and to carry out its legal responsibilities under Contract. Business Associate may disclose PHI for its proper management and administration, provided that (i) the disclosures are required by law; or (ii) Business Associate obtains, in writing, prior to making any disclosure to a third party (a) reasonable assurances from this third party that the PHI will be held confidential as provided under this BAA and used or further disclosed only as required by law or for the purpose for which it was disclosed to this third party and (b) an agreement from this third party to notify Business Associate immediately of any breaches of the confidentiality of the PHI, to the extent it has knowledge of the breach.

c. Business Associate will not use or disclose PHI in a manner other than as provided in this BAA, as permitted under the Privacy Rule, or as required by law. Business Associate will use or disclose PHI, to the extent practicable, as a limited data set or limited to the minimum necessary amount of PHI to carry out the intended purpose of the use or disclosure, in accordance with Section 13405(b) of the HITECH Act (codified at 42 USC § 17935(b)) and any of the act’s implementing regulations adopted by the federal United States Department of Health and Human Services, for each use or disclosure of PHI.

d. Upon request at any time, and at no additional cost, Business Associate will make available to Covered Entity any of Covered Entity’s PHI that Business Associate or any of its agents or subcontractors have in their possession.

e. Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR §164.502(j)(1).

f. Except as otherwise limited in this BAA, Business Associate shall not disclose PHI to a health plan for payment or health care operations purposes if an Individual has required this special restriction and has paid out of pocket in full for the health care item or service to which the protected health information relates in accordance with 42 USC § 17935.

g. Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI, as specified by 42 USC § 17935, unless the Covered Entity obtained a valid authorization, in accordance with 45 CFR § 164.508 that includes a specification that protected health information can be exchanged for remuneration.

V. RESPONSIBILITIES OF BUSINESS ASSOCIATE

a. Safeguards Against Misuse of PHI. Business Associate will use appropriate safeguards to prevent the use or disclosure of PHI other than as provided by the Agreement or this BAA and Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity in accordance with 45 CFR 164.308, 164.310, 164.312, 164.316, and 164.504(e)(2)(ii)(B). Sections 164.308, 164.310 and 164.312 of the CFR apply to the Business Associate of the Covered Entity in the same manner that such sections apply to the Covered Entity. Technical safeguards must meet the information security standards and guidelines set forth by the National Institute of Standards and Technology (NIST). Business Associate agrees to take reasonable steps, including providing adequate training to its employees to ensure compliance with this BAA and to ensure that the actions or omissions of its employees or agents do not cause Business Associate to breach the terms of this BAA.

b. Contents of Notifications to Covered Entity by Business Associate and Direction of Corrective Action. In the event of a breach or suspected breach of PHI, the report to the Covered Entity by Business Associate in accordance with the timelines set forth below must be in writing and include the following: a brief description of the incident; the date of the incident; the date the incident was discovered by the Business Associate; a thorough description of the unsecured PHI that was involved in the incident; the number of individuals whose protected health information was involved in the incident; the steps the Business Associate is taking to investigate the incident and to protect against further incidents; and proof of timely or contemporaneous notification by Business Associate to any of the Business Associate’s insurers. Business Associate must take prompt corrective action at its sole expense to cure any such deficiencies and mitigate any significant harm that may have occurred to individual(s) whose information was disclosed inappropriately based on the determinations of Covered Entity.

c. Reporting Disclosures of PHI and Security Incidents. Business Associate will immediately report to Covered Entity in writing any use, access, or disclosure of PHI not provided for by this BAA or on the first day Business Associate, its agents, or subcontractors become aware of the same or would have been aware by exercising reasonable diligence in accordance with 45 CFR § 164.410, 164.504(e)(2)(ii)(C) and 164.308(b) and 42 USC § 17921 and Business Associate agrees to report to Covered Entity any Security Incident affecting Electronic PHI of Covered Entity of which it becomes aware. Business Associate agrees to report any such event within five business days of becoming aware of the event.

d. Reporting Breaches of Unsecured PHI. Business Associate will notify Covered Entity in writing promptly upon the discovery of any suspected or actual Breach of Unsecured PHI in accordance with the requirements set forth in 45 CFR § 164.410, but in no case later than 5 calendar days after discovery of a Breach. Business Associate will be responsible for notifying Individuals whose unsecured PHI was breached in accordance with 42 USC § 17932 and 45 CFR 164.404 through 164.406 and must provide evidence to Covered Entity that appropriate and timely notification to Individuals or others when necessary as specified in 45 CFR § 164.404 and 45 CFR 164.406 has timely occurred. Business Associate is further responsible for all costs of notification set forth herein as well as all costs associated with mitigating future breaches. Business Associate must further notify the Secretary of the federal United Stated Department of Health and Human Services of all breaches in accordance with 45 CFR § 164.408 and must provide Covered Entity of a contemporaneous copy of all notifications made as required.

e. Mitigation of Disclosures of PHI. Business Associate will take reasonable measures to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of any use or disclosure of PHI by Business Associate or its agents or subcontractors in violation of the requirements of this BAA.

f. Agreements with Agents or Subcontractors. Business Associate will ensure that any of its agents or subcontractors (such agents or Subcontractors must be duly disclosed and authorized per the State of Nevada Contract to which this BAA is incorporated) that have access to, or to which Business Associate provides, PHI agree in writing to the restrictions and conditions concerning uses and disclosures of PHI contained in this BAA and agree to implement reasonable and appropriate safeguards to protect any Electronic PHI that it creates, receives, maintains or transmits on behalf of Business Associate or, through the Business Associate, Covered Entity. Business Associate shall ensure that all subcontracts and agreements provide the same level of privacy and security as this BAA and that the Business Associate implements and maintains sanctions against agents and/or subcontractors who violate such restrictions and conditions and ensure appropriate mitigation of the effects of violation(s) outlined under 45 CFR § 164.530(f) and 164.530(e)(1).

g. Audit Report. Upon request and at no additional cost or charge, Business Associate will provide Covered Entity, or upstream Business Associate, with a copy of its most recent independent HIPAA compliance report (which meets the AT-C Section 315 attestation standard issued by the American Institute of Certified Public Accountants), HITRUST certification or other mutually agreed upon independent standards based third party audit report. Business Associate and individuals associated with Business Associate are solely responsible for all civil and criminal penalties assessed as a result of an audit, breach, or violation of HIPAA or HITECH laws or regulations.

h. Access to PHI by Individuals.

i. Upon request, Business Associate agrees, at no additional cost or charge, to furnish Covered Entity with copies of the PHI maintained by Business Associate in a Designated Record Set in the time and manner designated by Covered Entity to enable Covered Entity to respond to an Individual’s request for access to PHI under 45 CFR §164.524.

ii. In the event any Individual requests access to the Individual’s PHI directly from Business Associate, Business Associate within five business days, will forward that request to Covered Entity. Any disclosure of, or decision not to disclose, the PHI requested by an Individual and compliance with the requirements applicable to an Individual’s right to obtain access to PHI shall be the sole responsibility of Covered Entity, but at no additional cost or charge to Individual or Covered Entity by Business Associate.

i. Amendment of PHI.

i. Upon request and instruction from Covered Entity, Business Associate will amend PHI or a record about an Individual in a Designated Record Set that is maintained by, or otherwise within the possession of, Business Associate as directed by Covered Entity in accordance with procedures established by 45 CFR §164.526. Any request by Covered Entity to amend such information will be completed by Business Associate within 15 business days of Covered Entity’s request.

ii. In the event that any Individual requests that Business Associate amend such Individual’s PHI or record in a Designated Record Set, Business Associate within ten business days will forward this request to Covered Entity. Any amendment of, or decision not to amend, the PHI or record as requested by an Individual and compliance with the requirements applicable to an Individual’s right to request an amendment of PHI will be the sole responsibility of Covered Entity, but at no additional cost or charge to Individual or Covered Entity by Business Associate.

j. Accounting of Disclosures.

i. Business Associate will document any disclosures of PHI made by it to account for such disclosures as required by 45 CFR § 164.528(a). Business Associate also will make available information related to such disclosures as would be required for Covered Entity to respond to a request for an accounting of disclosures in accordance with 45 CFR § 164.528. At a minimum, Business Associate will furnish Covered Entity the following with respect to any covered disclosures by Business Associate: (i) the date of disclosure of PHI; (ii) the name of the entity or person who received PHI, and, if known, the address of such entity or person; (iii) a brief description of the PHI disclosed; and (iv) a brief statement of the purpose of the disclosure which includes the basis for such disclosure.

ii. Business Associate will furnish to Covered Entity information collected in accordance with this Section, within ten business days after written request by Covered Entity, to permit Covered Entity to make an accounting of disclosures as required by 45 CFR §164.528, or in the event that Covered Entity elects to provide an Individual with a list of its business associates, Business Associate will provide an accounting of its disclosures of PHI upon request of the Individual, if and to the extent that such accounting is required under the HITECH Act or under federal United States Department of Health and Human Services regulations adopted in connection with the HITECH Act.

iii. In the event an Individual delivers the initial request for an accounting directly to Business Associate, Business Associate will within ten business days forward such request to Covered Entity.

k. Availability of Books and Records. Business Associate will make available its internal practices, books, agreements, records, and policies and procedures relating to the use and disclosure of PHI, upon request, to the Secretary of the federal United States Department of Health and Human Services for purposes of determining Covered Entity’s and Business Associate’s compliance with HIPAA, and this BAA.

l. Training. Business Associate must train employees (and ensure verification of the same by Business Associate’s agents and subcontractors as applicable) on the policies and procedures associated with safeguarding PHI. This includes, at a minimum, training that covers the technical, physical and administrative safeguards needed to prevent inappropriate uses or disclosures of protected health information; training to prevent any intentional or unintentional use or disclosure that is a violation of HIPAA; and training that emphasizes the criminal and civil penalties related to HIPAA breaches or inappropriate uses or disclosures of protected health information. Training must be completed within 30 days of the date of hire by Business Associate and all employees must be re-trained at least annually thereafter. The Business Associate must maintain written records for a period of six years. These records must document each employee that received training and the date the training was provided or received.

m. Litigation or Administrative Proceedings. Business Associate shall make itself, any subcontractors, employees, or agents assisting the Business Associate in the performance of its obligations, available to Covered Entity, at no cost to the Covered Entity, to testify as witnesses, or otherwise, in the event litigation or administrative proceedings are commenced against Covered Entity, its administrators or workforce members upon a claimed violation of HIPAA, the Privacy and Security Rule, the HITECH Act, or other laws relating to security and privacy. Nothing herein limits or abrogates Business Associate’s obligation under the State of Nevada Contract to which this BAA is incorporated to defend and indemnify Covered Entity.

n. Policies and Procedures. Business Associate must adopt written privacy and security policies and procedures and documentation standards to meet the requirements of HIPAA.

o. Privacy and Security Officer(s). Business Associate must appoint Privacy and Security Officer(s) whose responsibilities shall include: monitoring the Privacy and Security compliance of Business Associate; development and implementation of Business Associate’s HIPAA Privacy and Security policies and procedures; establishment of Privacy and Security training programs; and development and implementation of an incident risk assessment and response plan in the event Business Associate sustains a breach or suspected breach of protected health information.

VI. RESPONSIBILITIES OF COVERED ENTITY

a. With regard to the use and/or disclosure of PHI by Business Associate, Covered Entity agrees to:

i. Notify Business Associate of any limitation(s) in its notice of privacy practices in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

ii. Notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such changes may affect Business Associate’s use or disclosure of PHI.

iii. Notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

iv. Except for Data Aggregation or management and administrative activities of Business Associate, Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity.

VII. TERM AND TERMINATION

a. This BAA as an incorporated attachment to a State of Nevada Contract is effective upon the effective date of that referenced Contract and continues in effect extending beyond any termination of said Contract until all PHI related thereto in the custody or control of Business Associate is returned to Covered Entity and destroyed thereafter by Business Associate, or, if no feasibly destroyed, protections are extended by Business Associate to such information.

b. Covered Entity may terminate immediately this BAA, the Agreement, and any other related agreements if Covered Entity makes a determination that Business Associate has breached a material term of this BAA and Business Associate has failed to cure that material breach, to Covered Entity’s reasonable satisfaction, in accordance with the notice provisions set forth in the State of Nevada Contract to which this BAA is incorporated. Covered Entity may report the breach to the Secretary of the federal United States Department of Health and Human Services.

c. If Business Associate determines that Covered Entity has breached a material term of this BAA, then Business Associate will comply with the notice provisions set forth in the State of Nevada Contract to which this BAA is incorporated and related cure opportunity deadline and procedures. Business Associate may immediately report the problem to the Secretary of the federal United States Department of Health and Human Services.

d. Upon termination of the Agreement or this BAA for any reason, all PHI maintained by Business Associate will be returned to Covered Entity or destroyed by Business Associate. Business Associate will not retain any copies of such information. This provision will apply to PHI in the possession of Business Associate’s agents and subcontractors. If return or destruction of the PHI is not feasible, in Business Associate’s reasonable judgment, Business Associate will furnish Covered Entity with notification, in writing, of the conditions that make return or destruction infeasible. Upon mutual written agreement of the Parties that return or destruction of the PHI is infeasible, Business Associate will extend the protections of this BAA to such information for as long as Business Associate retains such information and will limit further uses and disclosures to those purposes that make the return or destruction of the information not feasible. The Parties understand that this Section will survive any termination of this BAA or the State of Nevada Contract to which it is incorporated.

VIII. HITECH ACT COMPLIANCE

a. The Parties acknowledge that the HITECH Act includes significant changes to the Privacy Rule and the Security Rule. The privacy subtitle of the HITECH Act sets forth provisions that significantly change the requirements for business associates and the agreements between business associates and covered entities under HIPAA and these changes may be further clarified in forthcoming regulations and guidance. Each Party agrees to comply with the applicable provisions of the HITECH Act and any HHS regulations issued with respect to the HITECH Act. The Parties also agree to negotiate in good faith to modify this BAA via a duly authorized State of Nevada Contract Amendment as reasonably necessary to comply with the HITECH Act and its regulations as they become effective but, in the event that the Parties are unable to reach agreement on such a modification, the Parties shall utilize applicable and available contract termination provisions set forth in the State of Nevada Contract to which this BAA is incorporated to the extent jointly or severally authorized, utilizing the notice deadlines and provisions related to the same.

Nothing herein creates any rights in favor of any third party except as expressly stated herein or as provided by law. The Business Associate and Covered Entity have agreed to the terms of the above written BAA by incorporation of the same as an attachment or exhibit to the State of Nevada Contract between the Parties and in accordance with the order of precedence set forth in the State of Nevada Contract except where federal law may preempt Nevada law.

IN WITNESS WHEREOF, the Parties hereto have caused this Agreement to be signed and intend to be legally bound thereby.

BUSINESS ASSOCIATE

Independent Contractor’s Signature Date Independent Contractor Title

STATE OF NEVADA

Administrator, DHCFP

Title

Revised: August 2024 Page 1 of 2