J.8 Standard Language TrOOP BAA 07192010.doc

Attachment J.8

ATTACHMENT J.8 HIPAA BUSINESS ASSOCIATE PROVISIONS FOR USE BY PART D PLANS WORKING WITH THE TRUE OUT OF POCKET (TROOP) CONTRACTOR This Business Associate Agreement (“Agreement”) by and between Business Associate and Covered Entity, as defined in Section 1 (each a “party” and together “the parties”).

RECITALS

A. Business Associate and Covered Entity have a business relationship by virtue of the services relating to the identification and reporting of supplemental payer costs provided by Business Associate to Covered Entity.

B. Business Associate must use and/or disclose Protected Health Information (PHI) created or received from Covered Entity in its performance of Services related to correct calculation of true out-of-pocket amounts for Medicare enrollees of Covered Entity.

C. Covered Entity is required by the Privacy Rule and the Security Rule issued pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to obtain satisfactory assurance that Business Associate will appropriately safeguard the PHI created or received from Covered Entity.

The parties agree as follows.

1. Definitions:

All terms used herein and not otherwise defined shall have the same meaning as in the Privacy and Security Rules (45 CFR Part 160 and Part 164, Subparts A, C and E).

"Business Associate'' (BA) shall mean (Insert Name of TrOOP Facilitation Contractor) when it creates, discloses or receives protected health information (PHI) from a Covered Entity’s Part D plan for one of the purposes listed in the definition of “business associate” at 45 C.F.R. § 160.103.

"Covered Entity" (CE) shall mean the [Insert Name of Part D Plan Sponsor].

“Designated Record Set” (DRS) shall mean a group of records maintained by or for a health plan or health care provider; the medical records and billing records about individuals maintained by or for a covered health care provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or used, in whole or in part, by or for the health plan or health care provider to make decisions about individuals.

“Electronic Protected Health Information” (ePHI) shall have the same meaning as the term “electronic protected health information” in 45 C.F.R. § 160.103, limited to the information created or received by BA from CE.

“Individual” shall have the same meaning as the term “individual” in 45 C.F.R. § 160.103, except that this term includes such person(s) who qualify as a personal representative in accordance with 45 C.F.R. § 164.502(g).

“Privacy Rule” shall mean the Standards for Privacy and of Individually Identifiable Health Information at 45 C.F.R. Parts 160 and 164, Subparts A and E.

“Protected Health Information” (PHI) shall have the same meaning as the term “protected health information” in 45 C.F.R. § 160.103, limited to the information created or received by BA from CE.

“Required by Law” shall have the same meaning as the term “required by law” in 45 CFR § 164.103.

"Secretary" shall mean the Secretary of the Department of Health and Human Services or the Secretary’s designee.

“Security Rule” shall mean the Standards for Security of Electronic Protected Health Information at 45 C.F.R. Parts 160 and 164, Subparts A and C.

“Security Incident” shall have the same meaning as the term “security incident” in 45 CFR § 164.304.

“Services” shall mean the identification and reporting of costs reimbursed by payers supplemental to Medicare.

“Standard Transactions” shall mean the standardized electronic exchanges of health-related administrative information under HIPAA.

2. Obligations and Activities of BA:

(a) BA agrees to not use or disclose PHI other than as permitted or required by this Agreement or as required by law.

(b) BA agrees to use appropriate safeguards to prevent use or disclosure of PHI unless the use or disclosure is otherwise provided for by this Agreement. Furthermore, BA agrees to use appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the ePHI it creates or receives, from the CE to prevent unauthorized use or disclosure of such ePHI.

(c) BA agrees to mitigate, to the extent practicable, any harmful effect that is known to BA of a use or disclosure of PHI by BA in violation of the requirements of this Agreement.

(d) BA agrees to report to CE within 24 hours of the discovery of the event any use or disclosure involving PHI that is not provided for by this Agreement of which it becomes aware. Furthermore, BA agrees to report to CE any Security Incident involving ePHI of which it becomes aware.

(e) BA agrees to require that any agent, including a subcontractor, to whom it provides PHI agrees to the same restrictions and conditions that apply through this Agreement to BA with respect to such information, including but not limited to implementation of reasonable and appropriate safeguards to protect ePHI. BA represents and warrants that in the event of a disclosure of PHI to any third party, BA will make reasonable efforts to limit the information disclosed to the minimum necessary to accomplish the intended purpose of the disclosure.

(f) BA agrees to provide access, upon request of the CE or an Individual identified by CE, to PHI in the Designated Record Set (DRS) within 10 business days in order to enable CE to meet the requirements under 45 CFR § 164.524 or other applicable law. In the event any Individual requests access to PHI for BA, whether or not BA is in possession of PHI, BA may not approve or deny access to the PHI requested. Rather, BA shall forward such request to the CE within 10 business days.

(g) BA agrees, upon request of CE, to make any amendment(s) to PHI in a DRS that CE directs or agrees to pursuant to 45 CFR § 164.526 or other applicable law, within 10 business days. In the event that the request for amendment of PHI is made directly to the BA, whether or not BA is in possession of PHI, BA may not approve or deny the requested amendment. Rather, BA shall forward such request to the CE within 10 business days.

(h) BA agrees to make internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI, available to the Secretary for purposes of the Secretary determining CE's compliance with the various rules implementing the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (HIPAA).

(i) BA agrees to document such disclosures of PHI and information related to such disclosures as would be required for CE to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

(j) BA agrees to provide to CE, or an Individual identified by the CE, within 10 business days, information collected under this Agreement, to permit CE to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528 or other applicable law. BA acknowledges that it shall request from the CE and so disclose to its affiliates, subsidiaries, agents and subcontractors or other third parties only the minimum PHI necessary to perform or fulfill a specific function required or permitted hereunder.

In the event the request for an accounting is delivered directly to BA, BA shall, within 10 business days, forward such request to CE and any such information as is in BA’s possession and is required for CE to respond to a request for an accounting made in accordance with 45 CFR § 164.528 or other applicable law. It shall be CE’s responsibility to prepare and deliver any such accounting requested.

3. Permitted Uses and Disclosures by BA

(a) Except as otherwise limited in this Agreement, BA may create, disclose or receive PHI from, or to provide services to, CE for purposes specified in Section C (“Description specifications work statement”) of CMS TrOOP Statement of Work (TrOOP “Services”), provided that such use or disclosure of PHI would not violate the HIPAA Privacy or Security Rules if done by CE. These uses and disclosures include, but are not limited to, uses and disclosures needed:

(1) To enable the CE to maintain calculations of CEs beneficiaries’ TrOOP expenditures.

(2) To enable the CE to engage in “payment” activities as that term is defined in 45 CFR § 164.501, upon CE’s beneficiaries’ enrollment in another Part D plan in the event CE’s Part D coverage ceases mid-year, and disclose TrOOP expenditure information to that new Part D plan for the year in which coverage under CE’s plan ceased.

(b) Except as otherwise limited in this Agreement, BA may use PHI for the proper management and administration of the BA or to carry out the legal responsibilities of the BA, and may disclose PHI to a third party for the same purposes, provided that the disclosures are required by law or BA has received from the third party legally binding written assurances that (i) the information will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the third party; and (ii) the third party will notify BA of any instances of which it becomes aware in which the confidentiality of the information has been breached.

(c) BA may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 C.F.R. § 164.502(j)(1).

(d) BA may use PHI to create information that is de-identified pursuant to 45 CFR § 164.514(b)(2) and use and disclose that de-identified information for purposes consistent with this Agreement, in accordance with the Privacy Rule, as well as any other applicable laws.

4. Obligations of CE

(a) CE shall notify BA of any limitation(s) in its notice of privacy practices developed pursuant to 45 C.F.R. § 164.520, to the extent that such limitation may affect BA's use or disclosure of PHI.

(b) CE shall notify BA of any changes in, or revocation of, permission by Individual to use or disclose PHI, to the extent that such changes may affect BA's use or disclosure of PHI.

(c) CE shall notify BA of any restriction to the use or disclosure of PHI that CE has agreed to in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect BA's use or disclosure of PHI.

5. Permissible Requests by CE

CE shall not request BA to use or disclose PHI in any manner that would not be permissible under the HIPAA Privacy or Security Rules if done by the CE.

6. Term and Termination

Term.

(a) The term of this Agreement shall be effective as of the date the BAA is signed by both parties, and shall continue until terminated by either party.

Termination.

(b) As CE is contractually required to utilize BA to calculate TrOOP, CE cannot immediately terminate this Agreement upon knowledge of a material breach by BA without violating its Part D contract with CMS. Therefore, upon material breach of this Agreement by BA, CE shall provide BA written notice of that breach and provide a reasonable time period for BA to cure that breach. If the breach is not cured by BA within the time period provided by the CE or is uncurable, CE shall report material violations of this Agreement to the Secretary as provided in 45 CFR §§ 164.314(a)(1)(i)(B) and 164.504(e)(1)(ii)(B).

Effect of Termination of this Agreement.

(c) Upon termination of this Agreement for any reason,BA, if feasible, shall return or destroy all PHI received from CE, or created or received by BA from CE. BA shall retain no copies of the PHI. This provision shall apply to PHI that is in the possession of subcontractors or agents of BA. Except as required by the Secretary, in the event that BA determines that returning or destroying the PHI is infeasible and the CE agrees that returning or destroying the PHI is infeasible, for example, where CE’s Part D plan ceases operations mid-year and the TrOOP information is needed for payment purposes by the Part D plan enrolling one or more of Part D eligible individuals previously enrolled in CE’s Part D plan, BA shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as BA maintains such PHI.

7. Miscellaneous

(a) A reference in this Agreement to a section in the Privacy and Security Rules issued under HIPAA means the section as in effect or as amended.

(b) The Parties agree to take such action in good faith as is reasonably necessary to amend this Agreement from time to time as is necessary for CE to comply with the requirements of the Rules issued under HIPAA.

(c) The respective rights and obligations of BA under Section 6(c)(2) and this Section 7(c) shall survive the termination for any reason of this Agreement.

(d) Any ambiguity in this Agreement shall be resolved to permit CE to comply with the Rules implemented under HIPAA.

(e) Nothing in this Agreement shall confer upon any person, other than the parties and their respective successors and assigns, any rights, remedies, obligations or liabilities whatsoever.

Choice of Law. This Agreement shall be construed, and the parties’ rights shall be determined, in accordance with the laws of the State of (Insert State of TrOOP Facilitation Contractor) (without giving effect to principles of conflicts of law) and applicable Federal law.

Limitation of Liability. The business associate or its affiliates, or any of their directors, officers, employees or other agents, shall not be liable to the covered entity for any damages arising out of or in connection with this agreement unless the business associate or its affiliates, or any of their directors, officers, employees or other agents, acted with reckless disregard of its obligations under this agreement or with intent to commit fraud.

IN WITNESS WHEREOF, each of the undersigned has caused this Agreement to be duly executed in its name and on its behalf.