5-Attachment D Business Associate Agreement.pdf

Attachment D Page 1 of 7 Contract No. XXXXXX

Attachment D

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“BAA”) is entered into this _____ day of _______________, 2025 (“Effective Date”), between the City of Scottsdale, an Arizona municipal corporation (“City”), and CONTRACTOR (“Contractor”). For purposes of this BAA, City and Contractor may be referred to individually as a “Party” and collectively as the “Parties”.

RECITALS

A. The City and Contractor are parties to a contract (“Contract”), Contract No. _______, dated _____________________, 2025, pursuant to which Contractor provides certain services to the City.

B. In the performance of the Contract, the City has and will come into possession of certain protected health information that will be necessary and appropriate to disclose to Contractor in order to perform the services described in the Contract.

C. For purposes of this BAA and the Contract, the City is a covered entity (“Covered Entity”) and Contractor is a business associate (“Business Associate”), as those terms are defined in 45 CFR §160.103.

D. The Parties desire to enter into this BAA for Business Associate to provide satisfactory assurances concerning the appropriate safeguarding of the above-described protected health information, as required by 45 CFR §§164.502 and 164.504.

FOR AND IN CONSIDERATION of the mutual promises and covenants contained herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

1. Recitals. The Recitals set forth above are incorporated into and made a part of this BAA.

2. Definitions. When used in this BAA the following terms shall have the meanings ascribed to them below, unless the context requires otherwise.

a. “Business Associate” shall mean Contractor.

b. “Breach” shall mean the access, acquisition, use or disclosure of PHI (as defined below) in a manner not permitted under the Privacy Rule (as defined below) that compromises the security or privacy of PHI in accordance with 45 CFR §164.402.

c. “Covered Entity” shall mean the City.

d. “Data Aggregation” shall have the same meaning as given to such term in 45 CFR §164.501.

e. “Designated Record Set” shall have the same meaning as given to such term in

45 CFR §164.501.

SAMPLE

Page 2 of 7 Contract No. XXXXXX

f. “HHS” shall mean the U.S. Department of Health and Human Services.

g. “HIPAA” shall mean the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as amended by the HITECH Act (as defined below), and including the related regulations promulgated by HHS.

h. “HITECH Act” shall mean the Health Information Technology for Economic and Clinical Health Act, enacted as part of the American Recovery and Reinvestment Act of 2009, Public Law 111-005.

i. “Individual” shall have the same meaning as given to such term in 45 CFR §160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR §164.502(g).

j. “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information set forth in 45 CFR Part 160, and Part 164, Subparts A and E.

k. “Protected Health Information” (“PHI”) shall have the same meaning as given to such term in 45 CFR §§164.501 and 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity.

l. “Required By Law” shall have the same meaning given to such term in 45 CFR §164.103.

m. “Secretary” shall mean the Secretary of HHS or his or her designee.

n. “Security Rule” shall mean the Security Standards for the Protection of Electronic Health Information set forth in 45 CFR Part 160, and Part 164, Subparts A and C.

o. “Unsecured PHI” means any “protected health information” (as that term defined in 45 CFR §§164.501 and 160.103) that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in the guidance issued pursuant to the HITECH Act and codified at 42 USC §17932(h).

3. Obligations and Activities of Business Associate

a. Business Associate shall not use or further disclose PHI other than as permitted or required by this BAA, or as Required By Law.

b. Business Associate agrees and acknowledges that the HITECH Act, and the regulations thereunder (including 45 CFR §§164.308, 164.310, 164.312, and 164.316), apply to Business Associate in the same manner that such sections apply to Covered Entity.

c. Business Associate shall not use or disclose PHI, except as permitted by law.

d. Business Associate shall not use or disclose PHI in a manner that, had Covered Entity done so, would violate HIPAA.

Page 3 of 7 Contract No. XXXXXX

e. Business Associate shall use appropriate safeguards to prevent any use or disclosure of PHI, other than as provided for by this BAA.

f. Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate from any use or disclosure of PHI by Business Associate in violation of the requirements of this BAA.

g. Business Associate shall report promptly to Covered Entity any use or disclosure of PHI not provided for by this BAA.

h. Following the discovery of a breach of Unsecured PHI, Business Associate shall notify Covered Entity of such breach. A breach shall be treated as discovered by Business Associate as of the first day on which such breach is known to Business Associate or, by exercising reasonable diligence, would have been known to Business Associate. Business Associate shall be deemed to have knowledge of a breach if the breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is an employee, officer, or other agent of Business Associate. In the event of such a breach, Business Associate shall follow all notification requirements in 45 CFR §164.410.

i. Business Associate shall ensure that any agent, including a subcontractor, to whom it provides PHI received from, or created or received by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply through this BAA to Business Associate with respect to any such PHI.

j. Business Associate shall provide access, at the request of Covered Entity and in the time and manner designated by Covered Entity, to PHI in a Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements under 45 CFR §164.524.

k. Business Associate shall make any amendment(s) to PHI in a Designated Record Set that Covered Entity directs or agrees to, pursuant to 45 CFR §164.526, at the request of Covered Entity or an Individual and in the time and manner designated by Covered Entity.

l. Business Associate shall make internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to Covered Entity or, at the request of Covered Entity, to the Secretary in a time and manner designated by Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity’s compliance with the Privacy Rule.

m. Business Associate shall document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR §164.528.

Page 4 of 7 Contract No. XXXXXX

n. Business Associate shall provide to Covered Entity or an Individual, if requested by Covered Entity, information collected in accordance with this section of this BAA, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR §164.528.

o. Business Associate shall comply with the Privacy Rule, the Security Rule, any other applicable provisions of HIPAA and the HITECH Act, and all applicable provisions of the American Recovery and Reinvestment Act of 2009 and all implementing regulations thereof (collectively, “ARRA”).

4. General Use and Disclosure Provisions

a. Except as otherwise limited in this BAA, Business Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity, as specified in the Contract, provided that such use or disclosure would not violate any applicable provisions of HIPAA if done by Covered Entity.

5. Specific Use and Disclosure Provisions

a. Except as otherwise limited in this BAA, Business Associate may use PHI for the proper management and administration of Business Associate’s business, or to carry out Business Associate’s legal responsibilities, as permitted by 42 CFR §164.504(e)(2)(i)(A). Business Associate may only use PHI as described in this paragraph if:

i. Such use is Required By Law; or

ii. Business Associate obtains reasonable assurances from the entity to whom the PHI is disclosed that such PHI will be held confidentially and used or further disclosed only as Required By Law or for the purposes for which it was disclosed to such entity, and the entity notifies Business Associate of any instances of which the entity is aware in which the confidentiality of the PHI has been breached.

b. Except as otherwise limited in this BAA, Business Associate may use PHI to provide Data Aggregation services to Covered Entity, as permitted by 42 CFR §164.504(e)(2)(i)(B).

6. Obligations of Covered Entity

a. With regard to the use and/or disclosure of PHI by Business Associate, Covered Entity agrees to:

i. Notify Business Associate of any limitation(s) in its notice of privacy practices in accordance with 45 CFR §164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

ii. Notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such changes may affect Business Associate’s use or disclosure of PHI.

Page 5 of 7 Contract No. XXXXXX

iii. Notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR §164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

iv. Except for data aggregation or management and administrative activities of Business Associate, Covered Entity shall not request Business Associate use or disclose PHI in any manner that would not be permissible under HIPAA if done by Covered Entity.

7. Term and Termination

a. Term. This BAA will be effective as of the Effective Date and will terminate when the Contract is terminated or as otherwise set forth herein, with the exception that Business Associate remains under the obligation to comply with this BAA until all PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy any such PHI, protections are extended to such PHI, in accordance with the termination provisions in this Section 7.

b. Termination for Cause. Upon knowledge of a material breach of this BAA by either Party, the non-breaching Party will provide written notice of breach or violation to the other Party specifying the nature of the breach or violation. The non-breaching Party will provide an opportunity for the breaching Party to cure the breach or end the violation within a reasonable time frame. If the breaching Party does not cure the breach or end the violation within a time frame specified by the non-breaching Party, the non-breaching Party may immediately terminate the agreement.

c. Effect of Termination. Upon termination of this BAA for any reason, all PHI maintained by Business Associate will be returned to Covered Entity or destroyed by Business Associate. Business Associate will not retain any copies of any such PHI. This provision will apply to PHI in the possession of Business Associate’s agents and subcontractors. If return or destruction of the PHI is not feasible, in Business Associate’s reasonable judgment, Business Associate will furnish Covered Entity with notification, in writing, of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of the PHI is infeasible, Business Associate will extend the protections of this BAA to such information for as long as Business Associate retains such information and will limit further uses and disclosures to those purposes that make the return or destruction of the information not feasible. The Parties understand and agree that this Section 7(c) will survive any termination of this BAA.

8. Security Requirements

a. Business Associate agrees to comply, where applicable, with 45 CFR Part 164, Subpart C and to implement safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of all PHI that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity. Business

Page 6 of 7 Contract No. XXXXXX

Associate agrees to maintain records of such safeguards in accordance with 45

CFR §164.316.

b. Business Associate will ensure that any agent, including a subcontractor, that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees to comply with same safeguards listed in Section 8(a) above and enters into a contract or other arrangement with agent or subcontractor that is substantially similar to the contract or other arrangement between Covered Entity and Business Associate.

c. Business Associate agrees to report to Covered Entity any security incident of which it becomes aware including any breaches of Unsecured PHI.

9. Miscellaneous

a. Regulatory References. A reference in this BAA to any provision of HIPAA means the provision as in effect or as amended at the time.

b. Amendment. This BAA may not be modified, nor will any provision be waived or amended, except in writing duly signed by authorized representatives of the Parties. A waiver with respect to one event shall not be construed as a continuing waiver or as a bar to, or waiver of, any right or remedy as to subsequent events.

c. HITECH Act Compliance. The Parties acknowledge that the HITECH Act includes significant changes to the Privacy Rule and the Security Rule. The privacy subtitle of the HITECH Act sets forth provisions that significantly change the requirements for business associates and the agreements between business associates and covered entities under HIPAA and these changes may be further clarified in forthcoming regulations and guidance. Each Party agrees to comply with the applicable provisions of the HITECH Act and any HHS regulations issued with respect to the HITECH Act. The Parties also agree to negotiate in good faith to modify this BAA as reasonably necessary to comply with the HITECH Act and its regulations as they become effective.

d. Survival. The respective rights and obligations of Business Associate under this BAA shall survive the termination of this BAA as specified in Section 7(c) above.

e. Interpretation. Any ambiguity in this BAA shall be resolved in favor of a meaning that permits Covered Entity to comply with the Privacy Rule, Security Rule, and HITECH Act.

f. No Third-Party Beneficiaries. The parties agree that the terms of this BAA shall apply only to themselves and are not for the benefit of any third-party beneficiaries.

g. De-Identified Data. Notwithstanding the provisions of this BAA, Business Associate and its subcontractors may disclose non-personally identifiable information provided that the disclosed information does not include a key or other mechanism that would enable the information to be identified.

[REMAINDER OF PAGE INTENTIONALLY LEFT BLANK]

Page 7 of 7 Contract No. XXXXXX

IN WITNESS WHEREOF, the Parties have executed this BAA as of the date first set forth above.

CONTRACTOR CITY OF SCOTTSDALE

CONTRACTOR NAME

CONTRACTOR ADDRESS By: ______________________________

CONTRACTOR ADDRESS NAME, TITLE

Contract Administrator

By: ______________________________ APPROVED AS TO FORM:

(Authorized Representative Signature)

(Name) Luis E. Santaella, Interim City Attorney By: Lindsay Hampshire, Asst. City Attorney (Title)