A8 - 2024-1600-0249-1624-020 Appendix F HIPAA and HITECH Information Security Agreement (ISA v241014).pdf

Appendix F State of Alaska, Department of Health

HIPAA AND HITECH Informa on Security Agreement (ISA)

This agreement, effec ve upon the date of full contract execu on, is entered into by and between the Department of Health (herea er known as Covered En ty) and the _________________________________ (herea er known as Business Associate). This agreement is in accordance with Covered En ty’s obliga ons under:

• The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the applicable requirements of HIPAA's implemen ng regula ons issued by the U.S. Department of Health and Human Services (HHS), Title 45 of the Code of Federal Regula ons ("C.F.R.") Parts 160-164 ("HIPAA Regula ons");

• The Health Informa on Technology for Economic and Clinical Health Act (the "HITECH Act"), as incorporated in the American Recovery and Reinvestment Act of 2009, Public Law 111-005;

• The Gene c Informa on Nondiscrimina on Act (“GINA”);

• The HIPAA Final Rule (the “Final Rule”).

Covered En ty and Business Associate acknowledge and agree to the terms and condi ons of this agreement to ensure the confiden ality, integrity, and availability of Protected Health Informa on by lawfully complying with the abovemen oned provisions and regula ons, all as amended from me to me.

A. Defini ons

1. "Breach" shall mean the impermissible acquisi on, access, use, or disclosure of Protected Health Informa on (PHI) which compromises the security, confiden ality, privacy, or integrity of such informa on pursuant to the HITECH Act § 13400, any regula ons issued there under, or as amended by law. An impermissible use or disclosure of protected health informa on is presumed to be a breach unless the Covered En ty or Business Associate, as applicable, demonstrates that there is a low probability that the protected health informa on has been compromised. This does not include:

a. Uninten onal acquisi on, access, or use of PHI by a workforce member or person ac ng under the authority of a Covered En ty or Business Associate, if access was in good faith and within the scope of authority; or

b. Inadvertent disclosure by a person authorized to access the PHI to another person authorized to access the PHI.

2. "Business Associate" shall mean an individual or en ty who or which performs a func on or ac vity on behalf of, or provides a service, to Covered En ty that involves the crea on, use, or disclosure of PHI. Shall have the meaning given to such term under the HIPAA Privacy Rule, the HIPAA Security Rule, and the HITECH Act, but not limited to, Sec on 13400 and Sec on 13401 of the HITECH Act, 42 U.S.C. Sec on 17938 and 45 C.F.R. Sec on 160.103.

3. "Covered En ty" shall mean a health plan, health care clearinghouse, or a health care provider who transmits any health informa on in electronic form in connec on with a transac on covered under the HIPAA Regula ons. Covered En ty shall have the meaning given to such term under the HIPAA Privacy Rule and the HIPAA Security Rule, including but not limited to, 45 C.F.R. Sec on 160.103.

4. “Data Aggrega on” shall have the meaning given to such term under the HIPAA Rules, including, but not limited to, 45 CFR Sec on 164.501.

5. “Data Breach No fica on Rule” shall mean the standards for Breach No fica on of Unsecured Protected Health Informa on at 45 CFR part 164, subpart D, as amended.

6. “Designated Record Set” shall have the meaning given to such term under the HIPAA Rules, including, but not limited to, 45 CFR Sec on 164.501.

7. "Electronic Protected Health Informa on"(ePHI) shall mean PHI maintained or transmi ed in electronic form.

8. “Health Care Opera ons” shall have the meaning as defined under the HIPAA Rules, including, but not limited to, 45 CFR Sec on 164.501.

9. “Individual” shall have the meaning as defined in 45 CFR 160.103 and shall include a person who qualifies as a personal representa ve in accordance with 45 CFR 164.502(g).

10. "Limited Data Set" shall mean PHI that excludes direct iden fiers of the individual or of rela ves, employers, or household members of the individual. (See 45 C.F.R. § 164.514(e)(2)).

11. “Minimum Necessary”. Business Associate shall only request, use, and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use, or disclosure.

12. “Personally Iden fiable Informa on” (PII), as defined in OMB Memorandum M-07-16 refers to "informa on that can be used to dis nguish or trace an individual's iden ty, either alone or when combined with other personal or iden fying informa on that is linked or associated with a specific individual." The defini on of PII is not anchored to any single category of informa on or technology.

Rather, it requires a case-by-case assessment of the specific risk that an individual can be iden fied.

13. "Privacy Official" shall mean the Covered En ty’s designated individual, and such individual's designees, who are responsible for the development and implementa on of Covered En ty’s policies and procedures regarding privacy and confiden ality of PHI.

14. "Protected Health Informa on" (PHI) shall mean either medical informa on or personally iden fiable informa on in electronic, physical, or oral form. Medical informa on is any informa on in possession of, or derived from, a physician or other provider of health care, or a health care service plan regarding an individual's medical history, mental or physical condi on, or treatment. PHI shall have the meaning given to such term under the HIPAA Privacy Rule and the GINA, including, but not limited to 45 C.F.R. Sec ons 160.103.

15. "Required by law" shall have the meaning given to such term as stated within 45 C.F.R. §164.103.

16. "Security Incident" shall mean the a empted or successful unauthorized access, use, disclosure, modifica on, or destruc on of informa on or interference with system opera ons in an informa on system that is created, received, maintained, or transmi ed by or on behalf of Covered En ty. (See 45 C.F.R. §164.304).

17. "Unsecured PHI" shall mean PHI that is not secured in accordance with guidance issued by the United States Department of Health and Human Services (HHS) under the HITECH Act including, but not limited to, 42 U.S.C. Sec on 17932(h), and applicable regula ons issued thereunder.

B. Privacy and Security of PHI

1. Permi ed Uses and Disclosures. Business Associate is permi ed or required to use or disclose PHI it creates, receives, maintains, or transmits in service to Covered En ty only as follows:

a. Func ons and Ac vi es on Covered En ty’s Behalf. Business Associate is permi ed to use and disclose the minimum necessary PHI it creates, receives, maintains, or transmits to/from Covered En ty, to perform those services set forth in the underlying contract, provided that no such use or disclosure would violate HIPAA Regula ons, or the HITECH Act and applicable regula ons issued thereunder, if Covered En ty itself made the use or disclosure.

b. Marke ng and Fundraising. Unless expressly authorized by the underlying contract between the par es, Business Associate shall not Use or Disclose PHI for any marke ng or fundraising purpose.

c. Audit. For purposes of determining Business Associate’s compliance with HIPAA, upon request of Covered En ty or the Secretary of HHS, Business Associate shall:

i. Make its HIPAA policies and procedures, related documenta on, records maintained, and any other relevant internal prac ces, books, and records rela ng to the use and disclosure of PHI, available to the Secretary of HHS or to Covered En ty.

ii. Provide reasonable access to Business Associate’s facili es, equipment, hardware, and so ware used for the maintenance or processing of Covered En ty’s PHI.

d. Record Keeping. Business Associate agrees to implement appropriate record keeping procedures to enable it to comply, and to adequately evidence such compliance, including; the documenta on required regarding subcontractors and agents, records of Business Associate’s workforce HIPAA educa on and training, documenta on related to any breach, Business Associate Agreements issued to third par es with whom Business Associate discloses PHI for Business Associate’s proper management and administra on, or as required by law.

e. Business Associate’s Opera ons. Business Associate may use and disclose the PHI it creates, receives, maintains, or transmits in service to Covered En ty, as necessary, to perform the Business Associate’s obliga ons under the contract, to enable that Business Associate’s proper management and administra on of Covered En ty's PHI, or to carry out Business Associate’s legal responsibili es. All PHI disclosures must maintain compliance with the HIPAA minimum necessary standard.

2. Prohibi on on Unauthorized Use or Disclosure. Business Associate shall neither use nor disclose PHI it creates, receives, maintains, or transmits in service to Covered En ty, except as permi ed or required by the contract, as required by law, or as otherwise permi ed in wri ng by Covered En ty. Business Associate acknowledges that Business Associate will be liable for viola ng any of the requirements of this agreement rela ng to the use or disclosure of PHI, or any privacy-related requirements of the HITECH Act and regula ons issued thereunder.

3. Offshoring Prohibi on. Business Associate may not transmit or make PHI accessible to any recipient outside the United States of America without Covered En ty’s prior wri en consent.

4. Compliance with Laws; Regulatory Amendments. Business Associate shall comply with all applicable state and federal privacy and security laws pursuant to HIPAA, HIPAA Regula ons, the HITECH Act, and any regula ons promulgated thereunder. Any regula ons or amendments to applicable privacy and security laws shall be automa cally included in this a, such that this agreement remains in compliance with such regula ons or amendments. Any future state privacy and security laws shall be automa cally included in this agreement, such that this agreement remains in compliance with such regula ons or amendments.

5. Effect. The terms and provisions of this agreement shall supersede any other conflic ng or inconsistent terms and provisions in any other contract between the par es, including any exhibits, a achments, addenda, or amendments thereto, and any other documents incorporated by reference therein, which pertain or relate to the use or disclosure of PHI by either party, or the crea on or receipt of PHI by Business Associate on behalf of Covered En ty.

6. Change in Law Amendments. The par es agree to amend this agreement to the extent necessary to allow either arty to comply with any amendments to any provision of HIPAA or its implemen ng regula ons or any judicial, legisla ve, or administra ve interpreta on which alters or conflicts with any provisions contained herein.

7. Defini ons, Construc on of Terms, and Interpreta on. Capitalized terms herein without defini on shall have the same meanings assigned to such terms in 45 CFR Parts 160 and 164. The terms of this agreementshall be construed in light of any applicable interpreta on or guidance on HIPAA and/or the Privacy and Security Standards issued by HHS or the Office for Civil Rights from me to me. This agreement shall be interpreted as broadly as necessary to implement and comply with HIPAA and the Privacy and Security Standards. The par es agree that any ambiguity in this agreement shall be resolved in favor of a meaning that complies and is consistent with HIPAA and the Privacy and Security Standards.

8. No Third-Party Beneficiaries. Nothing in this agreement shall confer upon any person other than the par es and their respec ve successors or assigns, any rights, remedies, obliga ons, or liabili es whatsoever.

9. Independent Contractors. The par es agree that they are independent par es and not employees, partners, or party to a joint venture of any kind. Neither party shall hold itself out as the other’s agent for any purpose and shall have no authority to bind the other to any obliga on.

10. Informa on Safeguards. Business Associate shall develop, implement, maintain, and use appropriate administra ve, technical, and physical safeguards, in compliance with applicable state and federal laws, to preserve the integrity, confiden ality, and availability of PHI, and to prevent unauthorized disclosures of PHI created or received for or from Covered En ty as required by 45 C.F.R. Part 164, Subpart C, the HITECH Act, HHS’ guidance on the Direct Liability of Business Associates, and any applicable regula ons issued thereunder. Business Associate shall document and keep such safeguards current and shall develop and implement policies and procedures to meet the Security Rule documenta on requirements of the HITECH Act and shall, upon Covered En ty’s request, either orally or in wri ng, provide Covered En ty with a copy of its policies and procedures related to such safeguards. Business Associate shall also provide reasonable descrip on of the prac ces and processes that are in place to support the policies, procedures, and requirements.

a. 45 C.F.R. 164.308 (administra ve safeguards), 164.310 (physical safeguards), 164.312 (technical safeguards), and 164.316 (policies, procedures, and documenta on requirements) shall apply to Business Associate in the same manner that such sec ons apply to Covered En ty and shall be implemented in accordance with HIPAA, the HITECH Act, and the Privacy and Security Rule. The addi onal requirements of Title XIII of the HITECH Act contained in Public Law 111-5 that relate to security and that are made applicable to Covered En ty shall also apply to Business Associate and are incorporated into this Informa on Security Agreement.

11. Subcontractors and Agents. Business Associate shall require any of its subcontractors and agents to which Business Associate is permi ed by this agreement or in wri ng by Covered En ty to disclose PHI, to sign a further Business Associate Agreement and to provide reasonable assurance evidenced by wri en contract, that such subcontractor or agent shall comply with the same privacy and security safeguard obliga ons with respect to PHI that are applicable to Business Associate under this agreement, including, but not limited to:

a. Holding such PHI in confidence and using or further disclosing it only for the purpose for which

Business Associate disclosed it to the agent, subcontractor, or other third party, or as required by law.

b. In compliance with 45 CFR §§ 164.400-414 Subcontractor or Agent shall provide no fica on to Business Associate, and the Business Associate shall provide no fica on to the Covered En ty, of any instance of which the agent, subcontractor, or other third party becomes aware in which the confiden ality of such PHI was breached.

12. Minimum Necessary and Limited Data Set. Business Associate’s use, disclosure, or request of PHI shall u lize a limited data set, whenever possible. Otherwise, Business Associate shall, in its performance of the func ons, ac vi es, services, and opera ons specified in Sec on B.1 above, make reasonable efforts to use, to disclose, and to request only the minimum amount of PHI reasonably necessary to accomplish the intended purpose of the use, disclosure, or request, except that Business Associate shall not be obligated to comply with the minimum necessary limita ons with respect to those excep ons specified in 45 C.F.R. § 164.502 (b)(2). Business Associate shall comply with the requirements governing the minimum necessary use and disclosure of PHI set forth in the HITECH Act § 13405(b) and any applicable regula ons or other guidance issued thereunder.

13. Employee Educa on. Business Associate shall inform all of its employees, workforce members, subcontractors, and agents (“Business Associate Personnel”), whose services may be used to sa sfy Business Associate’s obliga ons under the agreement, of the Business Associate’s obliga ons under this agreement. Business Associate represents and warrants that the Business Associate Personnel are under legal obliga on to Business Associate, by contract or otherwise, sufficient to enable Business Associate to fully comply with the provisions of this agreement. Business Associate will maintain a system of sanc ons for any Business Associate Personnel who violates this agreement.

14. Risk Assessment. Upon agreement execu on, and prior to any system entering a produc on state or containing produc on data, Business Associate must complete Covered En ty’s established security assessment process and obtain Authority to Operate (ATO). Any iden fied risks must be remediated to ensure that the system complies with the Covered En ty’s security standards and the Covered En ty’s selected standards for HIPAA compliance. This security assessment process must be updated and reassessed triennially therea er, or upon changes that occur which significantly affect the security posture of the system (whichever comes first), and Authority to Operate must be updated to reflect the current risk profile of the system.

C. PHI Access, Amendment, Restric on, and Repor ng

1. Access. Business Associate shall, upon Covered En ty’s reasonable request, and in compliance with 45 CFR 164.524(b)(2)(i), permit an individual (or the individual's personal representa ve) to obtain and inspect copies of any PHI about the individual which Business Associate created or received for or from Covered En ty and that is in Business Associate’s custody or control. Business Associate shall provide such informa on in an electronic format, if requested by the individual, and as directed by Covered En ty.

2. Amendment. Business Associate shall, upon receipt of no ce from Covered En ty, promptly amend or permit Covered En ty access to amend, any por on of an individual's PHI which Business Associate created or received for or from Covered En ty and that is in Business Associate’s custody or control.

3. Restric on. Business Associate shall, upon Covered En ty’s wri en no ce of any changes in, or restric ons to, the permi ed use or disclosure of PHI, promptly restrict the use or disclosure of PHI consistent with the Covered En ty’s instruc ons. Covered En ty will promptly no fy Business Associate in wri ng of the termina on of any such restric on agreement and, with respect to termina on of any such restric on agreement, instruct Business Associate as to whether any PHI will remain subject to the terms of the restric on agreement.

4. Repor ng.

a. Legal or Authorized Disclosure Repor ng. Except as permi ed by applicable law, Business

Associate shall document each disclosure it makes of an individual's PHI to a third party. Such report shall include the affected individual's name, the person or en ty to whom the PHI was disclosed, what was disclosed, why the informa on was disclosed, the date of such disclosure and any other informa on necessary for Covered En ty to comply with relevant statutes and regula ons. Such report shall be furnished to Covered En ty within ten (10) calendar days of its request. In addi on, where Business Associate is contacted directly by an individual based on informa on provided to the individual by Covered En ty, and where so required by the HITECH Act and/or any accompanying regula ons, Business Associate shall make such report available directly to the individual.

i. Disclosure Accoun ng. Upon request, Business Associate shall forward to Covered En ty a report of disclosures as required by 45 C.F.R. § 164.528, and as applicable, the HITECH Act § 13405(c) and any regula ons issued thereunder.

ii. Disclosure Accoun ng Reten on. Business Associate shall maintain an accoun ng of such disclosures for six (6) years a er the date of occurrence.

b. Security Incident Repor ng. Business Associate shall report to Covered En ty’s Chief Privacy Officer and Chief Informa on Security Officer as s pulated in 45 CFR 164.410 a er Business Associate knows, or should reasonably have known of such Security Incident, any Security Incident of which Business Associate becomes aware. In addi on, Business Associate shall, upon Covered En ty’s request, report any a empted unauthorized access, use, disclosure, modifica on, or destruc on of ePHI. If any such security incident resulted in a disclosure of PHI not permi ed by this agreement, Business Associate shall make a report in accordance with Sec on C.5(c), below.

If Business AssociatThise is aware of a pa ern of ac vity or prac ce by its subcontractor that cons tutes a breach or viola on of the subcontractor’s obliga ons under its Business Associate Agreement or obliga ons with Business Associate, Business Associate must take reasonable steps to cure the breach or end the viola on and take further ac ons consistent with 45 C.F.R. § 164.504.

c. Breach Repor ng. Business Associate shall report to Covered En ty any breaches of PHI as s pulated in 45 CFR 164.410. Business Associate shall make such report to Covered En ty’s Privacy Officer a er Business Associate knows, or should reasonably have known, of such breach.

Business Associate shall cooperate with Covered En ty in inves ga ng such breach, and in mee ng Covered En ty’s obliga ons under the HITECH Act and any other security breach no fica on laws. Business Associate shall report all breaches to Covered En ty in wri ng (and in the format requested by Covered En ty) and such reports shall, at a minimum:

i. Iden fy the nature of the breach, including the date of the breach and the date of discovery of the breach.

ii. Iden fy which elements of the PHI (e.g., full name, social security number, date of birth, etc.) were breached, or were part of the breach.

iii. Iden fy who was responsible for the breach and who received the PHI.

iv. Iden fy what correc ve ac ons Business Associate took or will take to prevent further incidents of a breach.

v. Iden fy what Business Associate did or will do to mi gate any deleterious effect of the breach.

vi. Iden fy Business Associate contact informa on and procedures to enable Covered En ty to obtain addi onal informa on if required.

vii. Provide such other informa on, including a wri en report, as Covered En ty may reasonably request.

d. Obliga ons in the Event of an Improper Pa ern of Ac vity or Prac ce. In the event that either party becomes aware of a pa ern of ac vity or prac ce of the other party that cons tutes a material breach or viola on of this agreement, the party discovering such pa ern of ac vity or prac ce must take reasonable steps to cause the other party to cure the breach or end the viola on. If a cure is not effectuated within a reasonable me period, specified by the party reques ng the cure, such party shall terminate the contract, if feasible, or if not feasible report the problem to the Secretary of HHS or its designee. (See 45 C.F.R. § I 64.504(e)(1)(ii) and HITECH Act § 13404(b)).

5. Inspec on of Books and Records. Business Associate shall make available for inspec on its internal prac ces, books, and records (rela ng to its use and disclosure of the PHI it creates for, or receives from, Covered En ty) to Covered En ty and/or the HHS to determine compliance with the HIPAA Regula ons or the Business Associate’s compliance with this agreement.

6. Designated Record Set. Business Associate agrees that all PHI received by or created for Covered En ty shall be included in an individual's Designated Record Set. Business Associate shall maintain such Designated Record Set with respect to services provided to an individual under this agreement and shall allow such individual to access the Designated Record Set as provided in the HIPAA Regula ons.

7. Restric on Contracts and Confiden al Communica ons. Business Associate shall comply with any agreement that Covered En ty makes that either; (i) restricts use or disclosure of PHI pursuant to 45 C.F.R.

§ 164.522(a); or (ii) requires confiden al communica on about PHI pursuant to 45 C.F.R. § 164.522(b), provided that Covered En ty no fies Business Associate, in wri ng, of the restric on or confiden al communica on obliga ons that Business Associate must follow. Covered En ty will promptly no fy Business Associate in wri ng of the termina on of any such restric on agreement or confiden al communica on requirement, and with respect to termina on of any such restric on agreement, instruct Business Associate whether any PHI will remain subject to the terms of the restric on agreement.

D. Termina on and Con nuing Privacy and Security Obliga ons

1. Termina on of Contract. As required by the HIPAA Regula ons and this agreement, Covered En ty may, in addi on to other available remedies, terminate the contract if Business Associate has materially breached any provision of this agreement and has failed to cure or take ac ons to cure such material breach within five (5) calendar days of such breach. Covered En ty shall exercise this right to terminate the contract by providing Business Associate wri en no ce of termina on, which shall include the reason for the termina on. Any such termina on shall be effec ve immediately or at such other date specified in Covered En ty’s no ce of termina on. Within thirty (30) calendar days of such termina on of the contract, Business Associate shall provide to Covered En ty one final report of any and all breaches made of all individuals' PHI during the term of the contract.

2. Obliga ons upon Termina on. Upon termina on, cancella on, expira on, or other conclusion of the contract, Business Associate shall:

a. As directed by Covered En ty, Business Associate shall immediately return or destroy all PHI, including all copies of and any data or compila ons derived from, and allowing iden fica on of, any individual who is a subject of the PHI, in whatever form or medium (including in any electronic medium under Business Associate’s custody or control), and at whatever loca on the PHI resides including offices local and remote, data centers, remote storage facili es, off-site backup facili es and vendors, and all other loca ons, that Business Associate created or received for or from Covered En ty. Returned PHI must be provided to the Covered En ty in a common, nonproprietary, industry standard data format.

b. Complete all such return or destruc on ac vi es as promptly as possible, but no later than thirty

(30) calendar days a er the effec ve date of the termina on, cancella on, expira on, or other conclusion of the contract.

c. These provisions shall apply to PHI that is in the possession of subcontractors or agents of Business Associate.

3. Con nuing Privacy and Security Obliga on. Business Associate’s obliga on to protect the privacy and security of the PHI, including all copies of and any data or compila ons derived from and allowing iden fica on of any individual who is a subject of the PHI it created for or received from Covered En ty, shall be con nuous and survive termina on, cancella on, expira on, or other conclusion of the contract.

4. Termina on for Cause. Without limi ng the termina on rights of the par es pursuant to the contract and upon Covered En ty’s knowledge of a material breach of this contract by Business Associate, Covered En ty shall either:

a. Provide an opportunity for Business Associate to cure the breach or end the viola on and, if

Business Associate does not cure the breach or end the viola on within the me specified by Covered En ty, terminate the contract, if feasible; or

b. Immediately terminate the contract if cure is not possible, if feasible.

5. Effect of Termina on.

a. Except as provided in paragraph (2) of this Sec on, upon termina on of the contract for any reason, as directed by Covered En ty, Business Associate shall promptly return or destroy all PHI received from or created or received by Business Associate on behalf of, Covered En ty that Business Associate maintains in any form and retain no copies. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate. Returned PHI must be provided to the Covered En ty in a common, nonproprietary, industry standard data format.

b. In the event that Business Associate reasonably believes that returning or destroying the PHI is infeasible, Business Associate shall provide to Covered En ty prompt no fica on of the condi ons that make return or destruc on infeasible. Upon mutual agreement of the par es that return, or destruc on is infeasible, Business Associate shall extend the protec ons of the contract to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruc on infeasible, for so long as Business Associate maintains such PHI.

E. Conflicts

The terms and condi ons of this agreement shall prevail in the event any terms and condi ons herein conflict with any provision of the contract.

F. Privacy and Security Contact Informa on

1. Privacy

a. Covered En ty

i. A n:

ii. Phone:

iii. E-mail: privacyofficial@alaska.gov

b. Business Associate

i. A n:

ii. Phone:

iii. E-mail:

2. Security

a. Covered En ty

i. A n:

ii. Phone:

iii. E-mail: doh.its.dso@alaska.gov

b. Business Associate

i. A n:

ii. Phone:

iii. E-mail:

Except as set forth in this Contract, all other provisions of this Contract shall remain unchanged and in effect.

Covered En ty Business Associate

Signature: Signature:

By: By:

Title: Title:

Date: Date: