9-26053 Form 4 Business Associate Agreement.pdf

Form 4 - DHHS26053

*Instructions: In the blank below, please enter your legal business name that matches the business name on your Form W-9. Please also enter the required information on page 6.

UTAH DEPARTMENT OF HEALTH AND HUMAN SERVICES

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“Agreement”) is entered into by and between the Utah Department of Health and Human Services (the “Department”) and ____________________________________ (“Business Associate”). The Parties have entered into one or more underlying agreements (each and together, the "Service Agreement") pursuant to which Business Associate provides services to the Department that require the use and disclosure of PHI. This Agreement only applies when Business Associate is carrying out the covered functions described in the Service Agreement.

This Agreement sets forth the terms and conditions under which PHI that is created, received, maintained, or transmitted by Business Associate, for or on behalf of the Department, will be handled during the term of the Service Agreement and after its termination.

The Parties agree as follows:

1. Definitions A. The following terms used in this Agreement shall have the same meaning as those terms defined in the HIPAA Rules: Breach, Covered Functions, Data Aggregation, Designated Record Set, Disclosure, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, Workforce Member, and Use.

B. “HIPAA Rules” means the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and its implementing regulations at 45 C.F.R. Parts 160 and 164, as amended by the Health Information Technology for Economic and Clinical Care Act (HITECH) enacted under Title XII of the American Recovery and Reinvestment Act of 2009, and its implementing regulations.

2. Permitted Uses and Disclosures of PHI by Business Associate A. Business Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of, the Department as specified in the Service Agreement, so long as such use or disclosure would not violate HIPAA Rules if done by the Department.

B. Business Associate may use or disclose PHI if necessary for its proper management and administration or to carry out its legal responsibilities, provided that: (i) the disclosures are permitted by law, or (ii) (1) Business Associate obtains reasonable assurances from the third party to whom PHI is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the third party;

and (2) the third party notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

C. If Business Associate provides data aggregation services for the Department under the Service Agreement, Business Associate may use and aggregate PHI only for purposes of providing the data aggregation services to the Department. Any use of PHI for other data aggregation or commercial purposes unrelated to the Service Agreement is prohibited. Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514 for purposes required by the Service Agreement. All such uses and disclosures of de-identified data shall be subject to the limits set forth in 45 C.F.R. § 164.514.

3. Obligations and Activities of Business Associate

A. Limitations on Use. Business Associate may use or disclose PHI solely (1) as necessary to perform its obligations under the Service Agreement, (2) as required by law, or (3) as permitted or required under this Agreement. Business Associate shall not use or disclose PHI for any other purpose or in any other manner.

B. Minimum Necessary. Business Associate shall request, use, and/or disclose only the minimum amount of PHI necessary to accomplish the intended purpose of the request, use, or disclosure in accordance with the HIPAA Rules.

C. Duty to Safeguard PHI. Business Associate shall implement and maintain appropriate administrative, technical, and physical safeguards that comply with Subpart C of 45 C.F.R. 164 in order to secure electronic PHI, prevent the use or disclosure of PHI other than as provided for by this Agreement, and protect the integrity and availability of PHI.

As appropriate, information security safeguards include:

(i) Limiting access to PHI to authorized workforce members and persons.

(ii) Securing its facilities, data centers, paper files, servers, back-up systems, and computing equipment with information storage capability.

(iii) Implementing network, device application, database, and platform security.

(iv) Securing information in transit and at rest.

(v) Implementing authentication and access controls within media, applications, operating systems, and equipment.

(vi) Encrypting PHI stored on any mobile media and computing devices that allow remote access.

(vii) Implementing appropriate personnel security and integrity procedures and practices; and

(viii) Providing appropriate privacy and information security training to its workforce members whose services may be used to satisfy Business Associate’s obligations under this Agreement.

D. Subcontractors. In accordance with 45 C.F.R. §§ 164.502(e)(1)(i) and 164.308(b)(2), Business Associate shall require any subcontractors or agents that create, receive, maintain, or transmit PHI for or on behalf of the Business Associate, agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information.

To the extent that subcontractors or agents create, receive, maintain, or transmit electronic PHI on behalf of Business Associate, it shall require its subcontractors or agents to comply with Subpart C of 45 C.F.R. 164.

E. Access to PHI. If the services performed under the Service Agreement require Business Associate to maintain a designated record set, within fifteen (15) days of receipt of the Department’s request, Business Associate agrees to make available PHI to the Department or, as directed by the Department, to an individual in order to meet the requirements under 45 C.F.R. § 164.524, relating to an individual’s right to inspect and obtain a copy of PHI relating to such individual. In the event an individual requests access to PHI directly from Business Associate or its Subcontractors, Business Associate shall forward the request to the Department within three

(3) days of the request.

As a governmental entity, Business Associate understands it must comply with the Government Records and Management Act (GRAMA) in the retention and disclosure of records in its possession. Pursuant to U.C.A. § 63G-2-107, GRAMA does not apply to a record containing PHI as defined in 45 C.F.R., Part 164, Standards for Privacy of Individually Identifiable Health Information, if the record is: (1) controlled or maintained by a governmental entity; and (2) governed by 45 C.F.R., Parts 160 and 164, Standards for Privacy of Individually Identifiable Health Information.

F. Amendment to PHI. If the services performed under the Service Agreement require Business Associate to maintain a designated record set, within thirty (30) days of receipt of the Department’s request, Business Associate agrees to make any amendments to PHI, if applicable, as the Department directs or agrees to pursuant to 45 C.F.R. § 164.526. In the event an individual requests an amendment to PHI directly from Business Associate or its Subcontractors, Business Associate shall forward the request to the Department within three (3) days of the request.

G. Accounting of Disclosures of PHI. Business Associate shall, as applicable, maintain and make available the information required to provide an accounting of the disclosures as necessary to satisfy the Department’s obligations under 45 C.F.R. § 164.528. In the event that an individual requests an accounting of disclosures to PHI directly from Business Associate or its Subcontractors, Business Associate shall forward the request to the Department within three (3) days of the request.

H. Performance of Obligations. To the extent Business Associate is to carry out one or more of the Department’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate shall comply with the requirements of Subpart E that apply to the Department in the performance of such obligations under this Agreement.

I. Availability of Records for Review. Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining the Department’s compliance with the HIPAA Rules. Upon reasonable prior request of the Department, Business Associate agrees to allow the Department to perform a review of its facilities, systems, books, records, agreements, and policies and procedures relating to the use or disclosure of PHI in order to determine Business Associate’s compliance with the terms of this Agreement.

J. Prohibition of Offshoring. Business Associate shall not perform any work outside the territory of the U.S. that involves access to, use, or disclosure of PHI in any form via any medium. Nothing in this Agreement shall permit Business Associate to assign, delegate, or subcontract any of its rights or obligations under this Agreement to its subcontractors or agents residing beyond the boundaries and jurisdiction of the U.S. without express written consent of the Department.

4. Incident and Breach Reporting and Mitigation

A. Reporting Duties. Business Associate shall report to the Department any security incident or use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including breaches of unsecured PHI as required at 45 C.F.R. § 164.410, within two (2) days of Business Associate’s discovery of such incident. The report must include the following information, to the extent known:

(1) Description of the incident;

(2) Date of the incident and the date the incident was discovered;

(3) Description of the type of PHI involved;

(4) Identification of who received PHI;

(5) Identification of the individuals whose PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed during the incident;

(6) Steps Business Associate or its subcontractor or agents are taking to investigate the incident and prevent continuing or further incidents; and

(7) Any other information requested by the Department.

Any of the above information which is not known within two (2) days must be reported to Department no later than thirty (30) days.

B. Breach Determination. The Department will make the final determination of whether a breach of unsecured PHI has occurred and will notify Business Associate of the determination. If the Department determines a breach of unsecured PHI has occurred, Business Associate must take prompt corrective action to cure any such deficiencies and mitigate any significant harm that may have occurred to individuals whose information was disclosed inappropriately. The Department, in its sole discretion, will determine whether the Department or Business Associate is responsible for providing notifications to the individuals whose PHI has been disclosed, the Secretary, and/or the media.

C. Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effects resulting from a security incident or any use and or disclosure of PHI in violation of the requirements of this Agreement, the HIPAA Rules, or other applicable law.

D. Financial Obligations. Notwithstanding any other provision in this Agreement, Business Associate shall be responsible for any and all costs and expenses arising from or related to a security incident or breach by Business Associate or its subcontractors and agents, including, but not limited to, any required notifications and credit monitoring services to affected individuals, notifications to the Secretary and the media, corrective action plans, and remedial and mitigation costs associated with the Department’s and Business Associate’s compliance with Subpart D of 45 C.F.R. 164.

5. Obligations of the Department

A. Notice of Privacy Practices. The Department shall notify Business Associate of any limitation in the Department’s Notice of Privacy Practices in accordance with 45 C.F.R. § 164.520 to the extent such limitations affect the Business Associate’s use or disclosure of PHI.

B. Revocation of Authorization of Individual. The Department shall notify Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose PHI, if and to the extent that such changes affect Business Associate’s use or disclosure of PHI.

C. Restrictions on Use and Disclosure. The Department shall notify Business Associate of any restriction on the use or disclosure of PHI that the Department has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent such restriction may affect Business Associate’s use or disclosure of PHI.

D. Requested Uses or Disclosures. The Department shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by the Department, except that Business Associate may use or disclose PHI for purposes set forth in Section 2(B).

6. Term and Termination

A. Term. This Agreement shall be effective as of the effective date of the Service Agreement and shall terminate upon termination or expiration of the Service Agreement or on the date the Department terminates this Agreement for cause as authorized in paragraph (B) of this Section, whichever is sooner.

B. Termination. If the Department determines that Business Associate has violated a material term of this Agreement, the Department may: (1) provide Business Associate an opportunity to cure the breach within the timeframe specified in writing by the Department, or (2) immediately terminate this Agreement if a cure is not possible and termination is possible under state law. In the absence of a cure reasonably satisfactory to the Department, the Department may terminate this Agreement unless prohibited by state law.

C. Effect of Termination. Upon termination of this Agreement, for any reason, Business Associate shall return or destroy all PHI received from the Department or created, maintained, or received by Business Associate on behalf of the Department that Business Associate still maintains in any form, unless the Business Associate is otherwise authorized by law to retain PHI for its official purposes. These termination provisions shall also apply to PHI in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of PHI. Upon the Department’s request, Business Associate shall certify to the Department that all PHI in its possession or control, and all PHI created, received or maintained by its subcontractors or agents, has been returned or destroyed. If return or destruction of PHI is not feasible, Business Associate will provide written notification of the conditions that make return or destruction infeasible. Upon a mutual agreement by the Parties that return or destruction of PHI is infeasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make return or destruction infeasible, for so long as Business Associate maintains such PHI. This Section 6 shall survive termination of this Agreement for any reason.

7. Indemnification Business Associate shall be fully liable for the actions of its agents, employees, officers, partners, and subcontractors. Business Associate shall fully indemnify, defend, and hold harmless the Department and the State of Utah from all claims, losses, suits, actions, damages, and costs of every name and description arising out of Business Associate’s performance of this Agreement caused by any intentional act or negligence of Business Associate, its agents, employments, officers, partners, or subcontractors, without limitation; provided, however, that Business Associate shall not indemnify for that portion of any claim, loss, or damage arising hereunder due to the sole fault of the Department.

8. Miscellaneous

A. Other Confidentiality Obligations. The parties acknowledge that this Agreement is intended to supplement any and all other confidentiality obligations that either party may have under other agreements or applicable federal and state laws.

B. Independent Contractor Status. Business Associate is an independent contractor of the Department and shall not be considered an agent of the Department.

C. Notice. Any notice or other communications required or permitted to be given under this Agreement shall be sent to:

If to the Department:

Natasha Naylor UDHHS Chief Privacy Officer 288 North 1460 West P.O. Box 14109 Salt Lake City, Utah 84114 801-989-8684 nknaylor@utah.gov

If to Business Associate:

Name: _____________________________

Title: _____________________________

Address: _____________________________

Phone: _____________________________

Email: _____________________________

D. Amendments. This Agreement may be amended or modified only in a writing, signed by the Parties. The Parties agree to take such action as is necessary to amend this Agreement from time to time for compliance with the requirements of the HIPAA Rules and any other applicable law.

E. Waiver. Any failure of a party to exercise or enforce any of its rights under this Agreement will not act as a waiver of such rights.

F. Interpretation. Any ambiguity in this Agreement shall be interpreted to permit the Department to comply with the HIPAA Rules. In the event the Service Agreement contains provisions relating to the use or disclosure of PHI that are more restrictive than the provisions of this Agreement, the provisions of the more restrictive documentation will control. Except as specified herein, all other terms of the Service Agreement will continue in full force and effect.

G. Entire Agreement. This Agreement shall supersede any and all other earlier-dated Business Associate Agreements that may have been entered into by Business Associate executing this Agreement and the Department.

H. Regulatory References. A reference in this Agreement to HIPAA Rules means the sections as in effect or as amended.