9046_Keefe_Canteen_BAA.docx.pdf

DEPARTMENT OF CORRECTIONS State of Wisconsin

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“Agreement”) is made between the Wisconsin

Department of Corrections (DOC) (“Covered Entity”) and Keefe Commissary

Network, LLC (Keefe) (“Business Associate”), collectively, the “Parties.”

This Agreement is specific to those services, activities, or functions performed by the

Business Associate on behalf of the Covered Entity when such services, activities, or functions are covered by the Health Insurance Portability and Accountability Act of

1996 (HIPAA), including all pertinent regulations (45 CFR Parts 160 and 164) issued by the U.S. Department of Health and Human Services. Services, activities, or functions covered by this Agreement include, but are not limited to:

The services, activities, and functions provided by Keefe to DOC in relation to the parties’ agreement identified as Contracted

Canteen Services (“Underlying Contract.”)

This Agreement is effective between the Covered Entity and Business Associate beginning on the date when all parties affixed their respective signatures to

Underlying Contract and terminates any prior existing Business Associate

Agreements between the two parties.

The Covered Entity and Business Associate agree to modify the Underlying Contract to incorporate the terms of this Agreement and to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996, as amended by the

Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009 ("HITECH"), and all applicable implementing regulations, including, without limitation, the

Standards for Privacy of Individually Identifiable Health Information (the "Privacy

Rule"), Notification in the Case of Breach Of Unsecured Protected Health Information

("Breach Notification Rule"), and the Security Standards for the Protection of

Electronic Protected Health Information (the "Security Rule") found at Title 45, Parts

160 and 164 of the Code of Federal Regulations, dealing with the security, confidentiality, integrity and availability of protected health or health-related information, as well as breach notifications (all such laws and regulations shall be collectively referred to herein as "HIPAA"), addressing confidentiality, security and the transmission of individually identifiable health information created, used or maintained by the Business Associate during the performance of the Underlying

Contract and after Contract termination. The parties agree that any conflict between provisions of the Underlying Contract and the Agreement will be governed by the terms of the Agreement.

Docusign Envelope ID: D6D4CEC2-188A-4687-A4D1-66D10CB1E900

1. DEFINITIONS

a. Catch-all definition:

The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health

Information (“PHI”), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

b. Specific definitions:

(i) Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR

160.103, and in reference to the party to this agreement, shall mean Keefe.

(ii) Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean the

Wisconsin Department of Corrections.

(iii) HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

(iv) Related Data. Data Derived from PHI.

2. RESPONSIBILITIES OF THE BUSINESS ASSOCIATE

a. At all times, the Covered Entity owns the PHI. Business Associate shall not use or disclose PHI other than as permitted or required by the

Agreement or as required by law, or as otherwise authorized in writing by the Covered Entity, if done by the Covered Entity.

b. Unless otherwise limited herein, Business Associate may use or disclose

PHI to the extent necessary for Business Associate’s proper management and administrative services, to carry out legal responsibilities of Business Associate, and to provide data aggregation services relating to health care operations of the Covered Entity if required under the Agreement.

c. Minimum Necessary. Business Associate shall not request, use or disclose more than the minimum amount of PHI necessary to accomplish the purpose of the Use, Disclosure, or request.

d. Subcontractors and Agents. Business Associate shall in accordance with

45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information by requiring each subcontractor to agree in writing to the same restrictions and conditions as are imposed on Business Associate by this Agreement and applicable law.

e. Access to PHI: The Business Associate shall make PHI held under this

Agreement and Underlying Contract by Business Associate accessible to

Covered Entity at all times. All costs related to this shall be assumed by the Business Associate. In addition to that, at the direction of the

Covered Entity, the Business Associate agrees to provide access, in accordance with 45 CFR 164.524, to any PHI held by the Business

Associate, which Covered Entity has determined to be part of Covered

Entity’s Designated Record Set, in the reasonable time and manner designated by the Covered Entity. This access will be provided to

Covered Entity. All costs related to this shall be assumed by the

Business Associate.

f. Amendment or Correction to PHI: At the direction of the Covered Entity, the Business Associate agrees to amend or correct PHI held by the

Business Associate, which the Covered Entity has determined is part of the Covered Entity’s Designated Record Set, in the time and manner designated by the Covered Entity in accordance with 45 CFR 164.526.

All costs related to this shall be assumed by the Business Associate.

g. Audit: The Business Associate agrees to make internal practices, books, and records available to the Covered Entity, or to the federal Secretary of Health and Human Services (HHS) in a time and manner determined by the Covered Entity or the HHS Secretary, or designee, for purposes of determining compliance with the HIPAA Rules. The Business

Associate agrees to promptly notify the Covered Entity of communications with HHS regarding PHI and will provide the Covered

Entity with copies of any PHI or other information the Business

Associate has made available to HHS under this provision at the

Covered Entity’s request.

h Destruction: The Business Associate shall not destroy PHI and Related

Data absent express written consent from Covered Entity.

3. SAFEGUARDING PROTECTED HEALTH INFORMATION

a. Business Associate shall use appropriate safeguards and comply with

Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of PHI other than as provided for by the Agreement.

b. Business Associate shall, at its own cost, review and modify its privacy and security safeguarding measures as needed to continue providing reasonable and appropriate protection of PHI and maintain documentation of privacy and security safeguarding measures as required by HIPAA.

c. Business Associate shall cooperate in good faith in response to any reasonable requests from the Covered Entity to discuss, review, inspect, and/or audit Business Associate’s safeguards.

4. IMPROPER USES OR DISCLOSURES, INCLUDING SECURITY

INCIDENTS AND BREACHES

a. Business Associate shall report by telephone and in writing to Covered

Entity any improper use or disclosure of PHI not provided for by the

Agreement of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident within one (1) business day following the discovery of the improper use or disclosure, including breach or incident.

(i) The notification shall be provided to:

DOC HIPAA Compliance Officer

Phone: 608-240-5000, Caller should request to speak with

HIPAA Privacy Officer

Email: DOCHIPAABreachReport@wisconsin.gov

(ii) The improper use or disclosure of PHI, including a security incident and breach, shall be “discovered” as of the first day on which the violation is known to the Business Associate or, by exercising reasonable diligence, would have been known to the

Business Associate.

(iv) Notification reports, both oral and written, shall include the following:

(1) The date of the improper use or disclosure;

(2) The date of the discovery of the use or disclosure;

(3) Each Individual whose PHI has been or is reasonably to have been accessed, acquired, or disclosed;

(4) A complete description of the circumstances of the improper use or disclosure, including a brief description of probable causes of the improper use or disclosure;

(5) The name of persons assigned to review and investigate the use;

(6) A description of all PHI used or disclosed (such as a full name, social security number, date of birth, home address, account number);

(7) The names of persons and organizations involved in the improper use, including a description of unauthorized persons known or reasonably believed to have improperly used or disclosed PHI or confidential data;

(8) A description of where the PHI or confidential data is believed to have been improperly transmitted, sent, or utilized;

(9) The actions the Business Associate has undertaken or will undertake to mitigate any harmful effect of the improper use or disclosure;

(10) A corrective action plan that includes steps the

Business Associate has taken or will take to prevent future similar incidents from occurring;

(11) Any other details necessary to complete an assessment of the risk of harm to the Individual;

and

(12) Any other information requested by the Covered

Entity related to the improper use or disclosure;

b. Business Associate shall be responsible to immediately investigate the improper use or disclosure, cooperate with Covered Entity in the investigation, and supplement the notice with additional information as it becomes available.

c. Business Associate shall report any attempted, unsuccessful Security

Incident(s) of which the Business Associate becomes aware of in writing at the reasonable written request of the Covered Entity.

d. The Business Associate shall take immediate steps to mitigate any harmful effects of any improper or unauthorized use, disclosure, loss, improper use, of ePHi and/or PHI and Related Data. The Business

Associate shall reasonably cooperate with the Covered Entity’s efforts to seek appropriate injunctive relief or otherwise prevent or curtail such threatened or actual breach, or to recover its Protected Health

Information, including complying with a reasonable Corrective Action

Plan and taking such steps as requested by the Covered Entity.

e. Notification of Breach by Business Associate. Upon request by the

Covered Entity, Business Associate agrees to participate in, and to the extent requested by Covered Entity, provide the notification of

Individuals, the media, and the Secretary of any Breach of Unsecured

PHI. Business Associate agrees to pay actual costs for notification and of any associated mitigation costs incurred by the Covered Entity, such as credit monitoring, if the Covered Entity determines that the breach is significant enough to warrant such measures.

In that event, the Business Associate must obtain the Covered Entity’s approval of the time, manner and content of any such notifications, provide the Covered Entity with copies of the notifications, and provide the notifications within thirty (30) days after discovery of the breach.

The Business Associate shall have the burden of demonstrating to the

Covered Entity that all notifications were made as required, including any evidence demonstrating the necessity of any delay beyond the 30 day calendar notification requirement to affected individuals after the discovery of the breach by the Covered Entity or Business Associate.

5. DISCLOSURES OF PROTECTED HEALTH INFORMATION BY

BUSINESS ASSOCIATE

Requests for access to PHI that Business Associate receives directly from

Individuals, health providers, attorneys, agencies, and others should be redirected to covered entity for response within two (2) business days of receipt.

The notification shall be sent by mail to:

Mail: DOC HIPAA Compliance Officer

Bureau of Records Management

Wisconsin Department of Corrections

3099 East Washington Avenue, Madison WI 53704

And notice shall be provided by phone to this number:

Phone: 608-240-5000, Caller should request to speak with HIPAA

Privacy Officer

6. TERM AND TERMINATION OF AGREEMENT

a. The Business Associate and the Covered Entity agree that this

Agreement becomes effective on the date all parties have affixed their respective signatures to the Underlying Contract.

b. The Business Associate agrees that if in good faith the Covered Entity determines that the Business Associate has materially breached any of its obligations under this Agreement, the Covered Entity at its sole discretion, may:

(i) Exercise any of its rights to reports, access and inspection under this Agreement,

(ii) Require the Business Associate to conduct monitoring and reporting, as the Covered Entity determines reasonably necessary to maintain compliance with this Agreement;

(iii) Provide the Business Associate with a defined time period to cure the breach; and/or

(iv) Terminate this Agreement immediately.

c. Before exercising any of these options, the Covered Entity will provide written notice of preliminary determination to the Business Associate describing the violation and the action the Covered Entity intends to take.

7. RETURN OR DESTRUCTION OF PROTECTED HEALTH

INFORMATION

Upon termination, cancellation, expiration, or other conclusion of this

Agreement as determined by the Covered Entity, the Business Associate shall, and shall ensure its Subcontractors that possess PHI or data derived from PHI, fulfill one of the following options with respect to PHI as directed by the

Covered Entity:

a. Return PHI, and any Related Data, to the Covered Entity in customary industry form or medium as directed within the sole discretion of the

Covered Entity at the Business Associate’s expense. During this time, the PHI, and Related Data, shall be continuously and without interruption accessible to Covered Entity. No copies of such PHI and

Related Data shall be retained. PHI and Related Data shall be returned as promptly as possible, but not after the effective date of conclusion of this Agreement or the Underlying Contract. Within five (5) days after the effective date of the conclusion of this Agreement or the Underlying

Contract, Business Associate shall certify on oath in writing to Covered

Entity that such return has been completed.

b. Destroy the PHI, and any Related Data, using technology or a methodology that renders the PHI, or Related Data, unusable, unreadable, or undecipherable to unauthorized individuals as specified by HHS in its guidance at:

http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotification rule/brguidance.html. Acceptable methods for destroying PHI or

Related Data include: (A) paper, film, or other hard copy media shredded or destroyed in order that PHI or Related Data cannot be read or reconstructed; and (B) electronic media cleared, purged or destroyed consistent with the standards of the National Institute of

Standards and Technology (NIST). Redaction as a method of destruction of PHI or Related Data is specifically excluded.

c. If Business Associate believes that the return or destruction of PHI or

Related Data is not feasible, Business Associate shall provide written notification of the conditions that make return or destruction infeasible.

If the Covered Entity agrees that return or destruction is not feasible, Business Associate shall extend the protections of this Agreement to

PHI and Related Data received from or created on behalf of Covered

Entity, and limit further uses and disclosures of such PHI and Related

Data, for so long as Business Associate maintains the PHI. If the

Covered Entity does not agree that destruction is infeasible, the

Business Associate must return the PHI in the format and within time frame as determined by the Covered Entity at Business Associate’s expense.

8. MISCELLANEOUS PROVISIONS

a. State and Federal Law Compliance: The Business Associate acknowledges that PHI from the Covered Entity may be subject to state confidentiality laws and other federal confidentiality regulations. The

Business Associate agrees to comply with all applicable federal and state laws. Business Associate shall comply with the more restrictive protection requirements between state and federal law for the protection of PHI.

b. Automatic Amendment: The parties acknowledge that state and federal laws relating to electronic data security and privacy are rapidly evolving and that amendment of this Agreement may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement the standards and requirements of HIPAA, the HIPAA Regulations, the

HITECH Act, other applicable state laws, and federal laws relating to this BAA and relating to the security or confidentiality of Health

Information. This Agreement shall automatically incorporate any change or modification to HIPAA, the HITECH Act, any other applicable state law, or federal laws as of the effective date of the change or modification. The Business Associate agrees to maintain compliance with all changes or modifications to HIPAA, the HITECH Act, and any other applicable state laws, and federal laws, as required.

c. Interpretation of Terms or Conditions of Agreement: Any ambiguity in this Agreement shall be construed and resolved in favor of a meaning that permits the Covered Entity and Business Associate to comply with

HIPAA and the HITECH ACT.

d. Submission of Compliance Plan: The Business Associate agrees that the

Covered Entity may request a HIPAA compliance plan. If requested by the Covered Entity, the Business Associate agrees to provide periodic reports of the progress of the compliance plan. Further, the Business

Associate agrees that the plan and progress reports will comply with the requirements of the Covered Entity.

e. Prohibition of Offshore Disclosure. Nothing in this Agreement shall permit the Business Associate to share, use or disclose PHI in any form via any medium with any third party beyond the boundaries and jurisdiction of the United States without express written authorization from the Covered Entity.

f. Indemnification. Business Associate shall indemnify the Covered Entity for costs associated with any Incident, improper or unauthorized use, disclosure, loss, of ePHi and/or PHI and Related Data in a manner not permitted by this Agreement or permitted under applicable laws.

g. Survival. The obligations of Business Associate under this Section shall survive the termination of this Agreement.

h. Headings. Paragraph Headings used in this Agreement are for the convenience of the Parties and shall have no legal meaning in the interpretation of the Agreement.

i. Capitalized terms used in this Agreement, but not otherwise defined, shall have the same meaning as those terms in the Privacy Rule or the

Security Rule.

IN WITNESS WHEREOF, the undersigned have caused this Agreement to be duly executed by their respective representatives.

Name: Jared Hoy Name: John Puricelli

Title: Secretary Title: Executive Vice President

Department of Corrections Keefe Commissary Network

Dated: Dated: