Addendum E Business Associate Agreement.docx

BUSINESS ASSOCIATE AGREEMENT

ADDENDUM E

Except as otherwise provided in this Business Associate Agreement Addendum, Insert Vendor Name (hereinafter referred to as the "Business Associate") may use, access or disclose Protected Health Information (PHI), to perform functions, activities or services for or on behalf of The State of Rhode Island, Executive Office of Health and Human Services (hereinafter referred to as the "Covered Entity"), as specified herein and the attached Agreement between the Business Associate and the Covered Entity (hereinafter referred to as "the Agreement"), which this Addendum supplements and is made part of, provided such use, access, or disclosure does not violate the Health Insurance Portability and Accountability Act (HIPAA), 42 USC 1320d et seq., and its implementing regulations including, but not limited to, 45 CFR, parrs 160, 162, and 164, hereinafter referred to as the Privacy and Security Rules and patient confidentiality regulations, and requirements of the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009 (ARRA), Public Law 111-5 (HITECH Act) and any regulations adopted or to be adopted pursuant to the HITECH Act that relate to the obligations of Business Associates, Rhode Island Mental Health Law, RI General Laws Chapter 40.1-5-26, Confidentiality of Health Care Communications and Information Act, RI General Laws Chapter 5-37.3-1 et seq., Confidentiality of Substance Use Disorder (SUD) Patient Records (“2022 Part 2 NPRM”), Support Reproductive Health Care Privacy (“2023 Privacy Rule NPRM”) Rhode Island Reproductive Privacy Act, RI General Law Chapter § 23-4.13-2 et seq. and Business Associate recognizes and agrees it is obligated by law to meet the applicable provisions of the HITECH Act.

1. Definitions:

Generally:

In this Agreement, terms used but not otherwise defined shall have the same meaning as those terms in 45 CFR§§ 160.103, 164.103, and 164.304, 164.501, and 164.502.

The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA, the Privacy and Security Rules, and the HITECH Act: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, and Protected Health Information as required by Law, Secretary of Health and Human Services, Security Incident, Subcontractor, Unsecured Protected Health Information and Use

Specific:

A. "Addendum" means this Business Associate Agreement Addendum.

B. "Agreement" means the contractual Agreement by and between the State of Rhode Island, Department of Behavioral Health, Developmental Disabilities, and Hospitals and Business Associate, awarded pursuant to the State of Rhode Island's Purchasing Law (Chapter 37-2 of the Rhode Island General Laws) and Rhode Island Department of Administration, Division of Purchases, Purchasing Rules, Regulations and General Conditions of Purchasing.

C. "Business Associate" generally has the same meaning as the term "business associate" at 45CFR 160.103 and, in reference to the party to this Agreement, shall mean Insert Vendor Name D. "Client/Patient" means Covered Entity funded person who is a recipient and the client or patient of the Business Associate.

E. "Covered Entity" generally has the same meaning as "covered entity" at 45CFR 160.103. In reference to the party to this Agreement shall mean, The State of Rhode Island, Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals.

F. "Electronic Health Record" means an electronic record of health-related information on an individual created, gathered, managed, or consulted by authorized health care clinicians and staff.

G. "Electronic Protected Health Information" or "Electronic PHI" means PHI transmitted by or maintained in electronic media as defined in the HIPAA Security Regulations.

H. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191.

I. "HIPAA Privacy Rule" means the regulations promulgated under HIPAA by The United States Department of Health and Human Services to protect the privacy of Protected Health Information, including the Privacy, Security, Breach Notification, and Enforcement Rules 45CFR Part 160 and Part 164.

J. "HITECH Act" means the Privacy, Security, and Security Breach Notification provisions applicable to Business Associate under Subtitle D of the Health Information Technology for Economic and Clinical Health Act, which is Title XII of the American Recovery and Reinvestment Act of 2009, Public Law 111-5, and any regulations promulgated thereunder and as amended from time to time.

K. “Reproductive health care” means health care, as defined in this section, that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes. This definition shall not be construed to set forth a standard of care for or regulate what constitutes clinically appropriate reproductive health care.

L. “Secretary” means Secretary of the U.S. Department of Health and Human Services (DHS) M. "Secured PHI" means PHI that was rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of technologies or methodologies specified under, or pursuant to, Section 13402 (h)(2) of the HITECH Act under ARRA.

N. "Security Incident" means any known successful or unsuccessful attempt by an authorized or unauthorized individual to inappropriately use, disclose, modify, access, or destroy any information.

O. "Security Rule" means the Standards for the security of Electronic Protected Health Information found at 45CFR Parts 160 and 162 and Part 164, Subparts A and C. The application of Security Provisions, Sections 164.308, 164.310, 164.312, and 164.316 of Title 45, Code of Federal Regulations, shall apply to the Business Associate of Covered Entity in the same manner that such sections apply to the Covered Entity.

P. "Suspected Breach" is a suspected acquisition, access, use, or disclosure of Protected Health Information (PHI), in violation of HIPAA Privacy Rules, as referenced above, that compromises the security or privacy of PHI.

Q. "Unsecured PHI" means PHI that is not secured, as defined in this Section, through the use of a technology or methodology specified by The Secretary of the U.S. Department of Health and Human Services.

2. Obligations and Activities of Business Associate

A. The Business Associate agrees not to use or further disclose PHI other than as permitted or required by this Agreement or as required by law, provided such use or disclosure would also be permissible by law by the Covered Entity.

B. The Business Associate shall not disclose or respond to any request or demand for PHI that is actually or potentially related to reproductive health care where the request or demand is for the purpose of health oversight activities, law enforcement activities, judicial or administrative proceedings, or disclosures to coroners and medical examiners. Business Associate agrees that it will not use, disclose, transmit, or otherwise provide PHI for the purpose(s) of a) identifying an individual, conducting a criminal, civil or administrative investigation about an individual, or imposing criminal, civil or administrative liability upon an individual, for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care services.

C. The Business Associate will require that any request or demand for PHI under section B above be accompanied by a signed and valid attestation ensuring that the PHI sought is not for a prohibited purpose. Any request or demand for such PHI must be forwarded to the Department for review, together with the signed attestation from the requesting party on the attestation form provided by the Department or substantially similar to it and acceptable to the Department .

D. The Business Associate agrees to use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for by this Agreement. The Business Associate agrees to implement Administrative Safeguards, Physical Safeguards, and Technical Safeguards ("Safeguards") that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI as required by the "Security Rule."

E. The Business Associate agrees to mitigate, to the extent practicable, any harmful effect known to the Business Associate of a use or disclosure of PHI by the Business Associate in violation of the requirements of the Agreement.

F. The Business Associate agrees to report to the Covered Entity any use or disclosure of the PHI not provided for by this Agreement, including breaches of unsecured PHI as required by 45 CFR § 164.410 and any Security Incident of which it becomes aware, within twenty-four (24) hours of the Incident.

G. The Business Associate agrees to ensure that any agent, including a subcontractor or vendor, to whom it provides PHI received from, created, or received by the Business Associate on behalf of the Covered Entity, agrees to the same restrictions and conditions that apply through this Agreement to Business Associate concerning such information through a contractual arrangement that complies with 45 CFR § 164.314.

H. The Business Associate agrees to provide paper or electronic access, at the request of the Covered Entity and in the time and manner designated by the Covered Entity, to PHI in a Designated Record Set to the Covered Entity or, as directed by the Covered Entity, to an individual to meet the requirements under 45CFR § 164.524. If the individual requests an electronic copy of the information, the Business Associate must provide the Covered Entity with the information requested in the electronic form and format requested by the individual or the Covered Entity if it is readily producible in such form and structure; or, if not, in a readable electronic form and format as requested by the Covered Entity.

I. The Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that the Covered Entity directs or accepts, according to 45 CFR § 164.526 at the Covered Entity's request or an Individual, and in the manner designated by the Covered Entity. If the Business Associate receives a request for an amendment to PHI directly from an Individual, the Business Associate shall notify the Covered Entity upon receipt of such request.

J. Business Associate agrees to make its internal practices, books, and records relating to the use and disclosure of PHI received from, created, or received by the Business Associate on behalf of the Covered Entity available to the Covered Entity, or at the request of the Covered Entity to the Secretary of Health and Human Services, in a time and manner designated by the Covered Entity or the Secretary, for the intent of the Secretary to determine compliance with the Privacy Rule and Security Rule.

K. The Business Associate agrees to document such disclosures of PHI and records related to such disclosures as required for the Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI per 45 CFR§ 164.528.

L. Business Associate agrees to provide to the Covered Entity or an Individual, in a time and manner designated by the Covered Entity, information collected under this Agreement to permit the Covered Entity to respond to a request by an Individual for an accounting of disclosures for PHI per 45 CFR § 164.528.

M. If the Business Associate accesses, maintains, retains, modifies, records, stores, destroys, holds, uses, or discloses unsecured Protected Health Information (as defined in 45 CFR § 164.402) for the Covered Entity, following the discovery of a breach of such information, the Business Associate shall notify the Covered Entity of such breach within twenty-four (24) hours after the discovery of a breach. Such notice shall include: a) the identification of each individual whose Unsecured Protected Health Information has been or is reasonably believed by Business Associate to have been accessed, acquired, or disclosed during such breach; b) a brief description of what happened, including the date of the breach and discovery of the breach; c) a description of the type of Unsecured PHI that was involved in the breach; d) a description of the investigation into the breach, mitigation of harm to the individual and protection against further breaches; e) the results of any investigation performed by Business Associate related to the breach, and f) contact information of the most knowledgeable individual for Covered Entity to contact relating to the breach and its investigation into the breach.

N. To the extent the Business Associate is carrying out an obligation of the Covered Entity's under the Privacy Rule, the Business Associate must comply with the Privacy Rule requirements that apply to the Covered Entity in the performance of such obligation.

O. Business Associate agrees that it will not receive remuneration directly or indirectly in exchange for PHI without authorization unless an exception under 45 CFR § 164.502(a)(5)(ii)(B)(2) applies.

P. Business Associate agrees that it will not receive remuneration for certain communications that fall within the exceptions to the definition of Marketing under 45 CFR § 164.501 unless permitted by 45 CFR § 164.508(a)(3)(A)-(B).

Q. The Business Associate agrees that it will not use or disclose genetic information for underwriting purposes, as defined in 45 CFR § 164.502.

R. Business Associate hereby agrees to comply with state laws and rules and regulations applicable to PHI and personal information of individuals it receives from Covered Entity during the term of the Agreement.

i. Business Associate agrees to (a) implement and maintain appropriate physical, technical, and administrative security measures for the protection of personal information as required by any state law and rules and regulations; including, but not limited to: (i) encrypting all transmitted records and files containing personal information that will travel across public networks, and encryption of all data containing personal information to be transmitted wirelessly; (ii) prohibiting the transfer of personal information to any portable device unless such transfer is approved in advance; and (iii) encrypting any personal information being transferred to a portable device and (b) implement and maintain a Written Information Security Program as required by any state law as applicable.

ii. The safeguards outlined in the Agreement shall apply equally to PHI, confidential, and "personal information." Personal information means an individual's first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver's license number or state-issued identification card number; or (c) financial account number, or credit or debit card number or password, that would permit access to a resident's financial account; provided, however, that "personal information" shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public.

3. Permitted Uses and Disclosures by Business Associate

A. Except as otherwise limited to this Agreement, the Business Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of, the Covered Entity. As specified in the Service Arrangement, such use or disclosure would not violate the Privacy Rule if done by the Covered Entity or the minimum necessary policies and procedures required by 45 CFR § 164.514(d).

B. Except as otherwise limited in this Agreement, the Business Associate may use PHI for the proper management and administration of the Business Associate or carry out the legal responsibilities of the Business Associate.

C. Except as otherwise limited to this Agreement, the Business Associate may disclose PHI for the proper management and administration of the Business Associate, under the provision that the law requires disclosures. The Business Associate requires reasonable assurances from the recipient of disclosed information that the information remains confidential and will only be used or further disclosed if required by law. The recipient will notify the Business Associate of any instances of which it is aware that the confidentiality of the information has been breached.

D. Except as otherwise limited in this Agreement, the Business Associate may use PHI to provide Data Aggregation Services to the Covered Entity as permitted by CFR § 164.504 (e)(2)(i)(B).

E. The Business Associate may use PHI to report law violations to appropriate Federal and State authorities, consistent with 45 CFR § 164.502(j)(1).

4. Obligations of Covered Entity

A. The Covered Entity shall notify the Business Associate of any limitation(s) in the Covered Entity's privacy practices per 45CFR § 164.520, to the extent that such restriction may affect the Business Associate's use or disclosure of PHI.

B. The Covered Entity shall notify the Business Associate of any changes in, or revocation of, an Individual's permission to use or disclose PHI to the extent that such changes may affect the Business Associate's use or disclosure of PHI.

C. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to per 45 CFR § 164.522, to the extent that such limitation may affect Business Associate's use or disclosure of PHI.

5. Permissible Requests by Covered Entity

The Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by the Covered Entity, provided that, to the extent permitted by the Service Arrangement, the Business Associate may use or disclose PHI for the Business Associate’s Data Aggregation activities or proper management and administrative activities.

6. Term and Termination

a. The term of this Agreement shall begin as of the effective date of the Service Arrangement, governed by the issuance of any applicable, valid Purchase Order. The termination of this Agreement will take effect when all PHI provided by the Covered Entity or PHI created or received by the Business Associate on behalf of the Covered Entity is destroyed or returned to the Covered Entity. If it is infeasible to return or destroy PHI, protections will extend to such information according to the termination provisions of this Section.

b. Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall either:

i. Provide an opportunity for the Business Associate to correct the breach or violation within a specified time provided by the Covered Entity. If the Business Associate does not rectify the breach or violation within this time, the Covered Entity will terminate this Agreement and the Service Arrangement.

ii. Immediately terminate this Agreement and the Service Agreement if the Business Associate has breached a material term of this Agreement and a resolution is not possible.

a.

b.

c. Except as provided in paragraph (d) of this Section (6), upon any termination or expiration of this Agreement, the Business Associate shall return or destroy all PHI received from the Covered Entity or created or received by the Business Associate on behalf of the Covered Entity. This provision shall apply to PHI that is in the possession of subcontractors or agents of the Business Associate. The Business Associate shall not retain copies of the PHI. The Business Associate shall ensure that its subcontractors or vendors return or destroy any of the Covered Entity’s PHI received from the Business Associate.

d. If the Business Associate determines that returning or destroying PHI is not feasible, the Business Associate shall provide notification of the conditions preventing the return or destruction of PHI to the Covered Entity. Upon written agreement by the Covered Entity that the return or destruction of PHI is not possible, the Business Associate will extend the protections of this Agreement to limit further use or disclosure of such PHI to those purposes that make the return or destruction not possible for as long as the Business Associate maintains such PHI.

7. Miscellaneous

1. A reference to a section of the Privacy Rule or Security Rule in this Agreement means this Section is in effect or as amended.

2. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is required for the Covered Entity to comply with HIPAA requirements, The Privacy and Security Rules, and HITECH.

3. The respective rights and obligations of the Business Associate under Section 6 (c) and (d) of this Agreement shall survive the termination of this Agreement.

4. Any ambiguity in this Agreement shall be resolved to permit the Covered Entity to comply with HIPAA and HITECH.

5. The Business Associate is solely responsible for all decisions made by the Business Associate regarding the safeguarding of PHI.

6. Nothing expressed or implied in this Agreement intends to confer, nor shall anything herein confer upon anyone other than the Covered Entity, the Business Associate, and their respective successors and assigns any rights, remedies, obligations, or liabilities whatsoever.

7. Modifying the terms of this Agreement shall not be valid or binding upon the parties unless and until such modification is committed in writing and executed by the parties hereto.

8. This Agreement shall be binding upon the parties hereto and their respective legal representatives, trustees, receivers, successors, and permitted assigns.

9. Should any provision of this Agreement be found unenforceable, it shall be deemed severable. The balance of the Agreement shall continue in full force and effect as if the unenforceable provision had never been made a part hereof.

10. This Agreement and the rights and obligations of the parties hereunder shall be governed by, and construed under, the State of Rhode Island laws, including all matters of construction, validity, and performance.

11. All notices and communications required or permitted to be given hereunder shall be sent by certified or regular mail. Communications to the party shall be sent to its respective address as stated in PAR.15 (Notices) of Addendum F of this Agreement or at another address as such party shall, from time to time, designate in writing to the other party and shall be effective from the date of mailing.

12. This Agreement, including such portions incorporated by reference herein, constitutes the entire Agreement by, between, and among the parties. Such parties acknowledge by their signature hereto that they do not rely upon any representations or undertakings by any person or party, past or future, not expressly set forth in writing herein.

13. The Business Associate shall maintain or cause sufficient insurance coverage as shall be necessary to the Business Associate and its employees, agents, representatives, or subcontractors against any claims or damages arising under this Business Associate Agreement. According to this Business Associate Agreement, such insurance coverage shall apply to all services provided by the Business Associate or its agents or subcontractors. The Business Associate shall indemnify, hold harmless and defend the Covered Entity from and against any claims, losses, liabilities, costs, and other expenses (including, but not limited to, reasonable attorneys' fees and expenses, administrative penalties and fines, costs expended to notify individuals and to prevent or remedy possible identity theft, financial harm, reputational harm, or any other claims or liability related to a breach) incurred as a result of, or arising out of, or in connection with, any negligent or intentional acts or omissions of the Business Associate, its employees, agents, representatives, or subcontractors, under this Business Associate Agreement. This provision shall survive termination of this Agreement.

8. Acknowledgement

The undersigned affirms that they are a duly noted authorized representative of the Business Associate for which they are signing and have the authority to execute this Addendum on behalf of the Business Associate.

Acknowledged and agreed to by:

State of Rhode Island, Executive Office of Health and Human Services

Vendor Name

Director

Title of Authorized Agent

Title of Authorized Agent

Printed Name of Authorized Agent

Printed Name of Authorized Agent

Signature of Authorized Agent

Signature of Authorized Agent

Date

Date

Revised-1/30/2025