Appendix 1 - BAA.docx

BUSINESS ASSOCIATE AGREEMENT

INTRODUCTION:

This Agreement is entered into on this _____ day of _____________, 20[XX] by and between the Commonwealth of Kentucky, Personnel Cabinet, Department of Employee Insurance (“DEI”), Kentucky Employees’ Health Plan (“KEHP”) (hereinafter referred to as "Covered Entity") and _____________________________________ (hereinafter referred to as "Business Associate"). Covered Entity and Business Associate may be referred to herein individually as “Party” or collectively as “the Parties.”

This Agreement relates only to the management and administration of KEHP. The purpose of this Agreement is to ensure that KEHP’s member’s Protected Health Information or PHI is created, received, maintained, and transmitted in a secure manner.

RECITALS:

Covered Entity has engaged Business Associate to provide certain functions, activities, and services (collectively "Services") to Covered Entity in relation to the administration of KEHP. In order for Business Associate to perform the Services, Covered Entity will make available and/or transfer to Business Associate certain PHI that is confidential and must be afforded special treatment and protection pursuant to the Health Insurance Portability and Accountability Act of 1996; the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 160 and Subparts A and E of Part 164 (the “Privacy Rule”); the Security Standards for Protection of Electronic Health Information at 45 C.F.R. Part 160 and Subparts A and C of Part 164 (the “Security Rule”); the Enforcement Rule at 45 C.F.R. Part 160, Subparts C, D, and E; the Health Information Technology for Economic and Clinical Health Act (“HITECH”); and the 2013 Omnibus Rule (collectively referred to herein as the “HIPAA Rules”).

Business Associate will have access to and/or receive from Covered Entity certain PHI created or received by Covered Entity that can be used or disclosed only in accordance with HIPAA, this Agreement, and KEHP’s Notice of Privacy Practices. Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI disclosed to or created, received, maintained, or transmitted by Business Associate. Prior to the disclosure of PHI to Business Associate, HIPAA requires Covered Entity to enter into a contract with Business Associate that contains specific requirements as set forth in, but not limited to, Title 45, §§164.308, 164.310, 164.312, 164.314, 164.316, 164.502, and 164.504 of the Code of Federal Regulations ("C.F.R.").

NOW, THEREFORE, Covered Entity and Business Associate agree as follows:

ARTICLE I

Definitions and General Terms

1.2 Other Terms. Other capitalized terms shall have the meaning ascribed to them in the context in which they first appear. Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 C.F.R. Parts 160, 162, and 164. Those terms include, but are not limited to, Breach, Business Associate, Covered Entity, Designated Record Set, Disclosure, Health Information, Health Plan, Individual, Limited Data Set, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Security Incident, Subcontractor, Transaction Standards, Unsecured Protected Health Information, and Use. Any reference to a regulation or section in the Code of Federal Regulations ("C.F.R.") shall include any corresponding regulation subsequently issued regardless of the date of issue.

1.3 Interpretation of Provisions. In the event of an inconsistency between the provisions of this Agreement and the mandatory terms of the HIPAA Rules (as they may be expressly amended from time to time by HHS or as a result of final interpretations by HHS, an applicable court, or another applicable regulatory agency with authority over the Parties), the HIPAA Rules, as applicable, shall prevail.

1.4 Provisions Permitted by the Privacy or Security Rule. Where provisions of this Agreement are different from those mandated by the HIPAA Rules, but are nonetheless permitted by the HIPAA Rules, the provisions of this Agreement shall control.

ARTICLE II

Security and Safeguards

2.1 Safeguards – General Security Standards. In accordance with 45 C.F.R. §164.306, Business Associate shall implement and use reasonable and appropriate administrative, physical, and technical safeguards.

2.2 Security Rule Compliance. Business Associate shall comply with the Security Rule requirements set forth in 45 C.F.R. §§164.308, 164.310, 164.312, 164.314, and 164.316, all of which are hereby incorporated into the Agreement. Business Associate shall also comply with all other provisions of the Security Rule not specifically stated in this Agreement. Business Associate represents and warrants that it has implemented, and during the term of this Agreement shall maintain, comprehensive written privacy and security policies and procedures and the necessary administrative, technical, and physical safeguards appropriate to the size and complexity of Business Associate’s operations and the nature and scope of its activities.

As needed to continue the provision of reasonable and appropriate protection of PHI, Business Associate shall review and modify its security measures implemented pursuant to the Security Rule and any associated policies and procedures. Business Associate shall update documentation of such security measures in accordance with 45 C.F.R. §164.316.

ARTICLE III

Uses and Disclosures by Business Associate

3.1 Notice of Privacy Practices. Business Associate shall not use or disclose PHI except as permitted by Covered Entity's Notice of Privacy Practices. KEHP’s Notice of Privacy Practices may be viewed at kehp.ky.gov or any successor website that KEHP may utilize.

3.2 Limits on Uses and Disclosures. Business Associate shall use or disclose PHI only in accordance with the HIPAA Rules, this Agreement, or as Required by Law.

Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI as necessary to perform for, or on behalf of Covered Entity, services set forth in the service agreement between the Parties including treatment, payment, and health care operations. Any such use or disclosure shall be limited to those reasons and those individuals as necessary to meet Business Associates’ obligations under the service agreement. Business Associate may use or disclose PHI as specified by this section provided that such use or disclosure would not violate the HIPAA Rules if performed by the Covered Entity. Upon request or authorization from Covered Entity and to assist in the administration of KEHP, Business Associate shall provide PHI to other Business Associates of Covered Entity that are authorized to receive such information.

If necessary and in accordance with 45 C.F.R. §164.504(e)(4), Business Associate may use and disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate. Such use and disclosure is permitted for these purposes only if (a) the disclosure is Required by Law or (b) the Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as Required by Law or for the purposes for which it was disclosed to the person and, the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

In accordance with 45 C.F.R. §164.504(e)(2)(i)(B), Business Associate may provide Data Aggregation services relating to the health care operations of the Covered Entity only as requested by the Covered Entity.

Business Associate may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. §164.502(j)(1).

3.3 Disclosures to Workforce. Business Associate shall not disclose PHI to any member of its workforce unless necessary to carry out Business Associate’s obligations under the service agreement between the parties and unless Business Associate has advised such person of Business Associate’s obligations under this Agreement and of the consequences for such person and for the Business Associate of violating this Agreement. Business Associate shall take appropriate disciplinary action against any member of its workforce who uses or discloses PHI in contravention of the HIPAA Rules or this Agreement.

3.4 Disclosure of the Minimum Necessary PHI. Business Associate and its agents and Subcontractors shall request, use, and/or disclose, to the extent practicable, only the Limited Data Set of PHI necessary, or if needed, the minimum amount and content of PHI necessary, to meet the requirements of Business Associate's obligations to Covered Entity.

3.5 Application of Privacy Provisions. Business Associate may use and disclose PHI that Business Associate obtains or creates only if such use or disclosure is in compliance with each applicable requirement of 45 C.F.R. §164.504(e), relating to Business Associate agreements. The Business Associate may not use or disclose PHI in a manner that would violate the requirements of the Privacy Rule, if done by Covered Entity, except for the purposes specified under §164.504(e)(2)(i). The additional requirements of Subtitle D of HITECH (42 U.S.C. § 17921 et. seq.) that relate to privacy and that are made applicable with respect to Covered Entity shall also be applicable to Business Associate and are hereby incorporated into this Agreement.

3.6 De-identified Information. Business Associate shall not use or disclose PHI that has been de-identified in accordance with 45 C.F.R. §164.514, except as authorized in the service agreement (or any subsequent agreement) between Covered Entity and Business Associate or as necessary to carry out Business Associate’s obligations under the service agreement. In the event Business Associate is authorized in the service agreement to use or disclose de-identified information, neither the Covered Entity nor an Individual shall be identifiable.

ARTICLE IV

Subcontractors

4.1 Satisfactory Assurances Requirement. Business Associate may permit a Subcontractor to create, receive, maintain, or transmit PHI on its behalf and on behalf of Covered Entity only if Business Associate obtains satisfactory assurances in writing and in accordance with 45 C.F.R. §164.314, that the Subcontractor will appropriately safeguard the information.

ARTICLE V

Other Obligations and Activities of Business Associate

5.1 Mitigation of Harm. Business Associate shall, at its own expense, take action to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate, or any agent or subcontractor of Business Associate, in violation of the requirements of the HIPAA Rules or this Agreement.

5.2 Access of Individuals to PHI. Business Associate shall provide access, at the request of the Covered Entity and in the time and manner designated by the Covered Entity, to PHI in a Designated Record Set. Access shall be provided to Covered Entity or, as directed by Covered Entity, to an Individual, in order to comply with the requirements, including the time constraints, of 45 C.F.R. §164.524 with regard to providing an Individual with a right to access the Individual’s PHI. Business Associate’s provision of access to PHI shall be at no cost to Covered Entity or to an Individual.

5.3 Amendment of PHI. Business Associate shall, in the time and manner designated by Covered Entity, make PHI contained in a Designated Record Set available for any amendments that Covered Entity directs or agrees to pursuant to 45 C.F.R. §164.526 or to otherwise, in whatever manner necessary, allow Covered Entity to comply with its obligations, including the time constraints, under 45 C.F.R. §164.526.

If any Individual requests an amendment of PHI contained in a Designated Record Set directly from Business Associate or its agents or Subcontractors, Business Associate shall notify Covered Entity in writing within five (5) business days of the request. Covered Entity shall have sole authority and responsibility to approve or deny such a request, and shall notify Business Associate, in writing, of its decision to approve or deny any such request.

Business Associate shall make PHI available for amendment and incorporate any amendments to PHI in accordance with 45 C.F.R. §164.526 and without any cost to Covered Entity.

5.4 Disclosure Pursuant to a Valid Authorization.

1. Business Associate shall not disclose PHI pursuant to a valid authorization except as permitted under Covered Entity’s Notice of Privacy Practices.

1. Business Associate shall, at the request of Covered Entity and in the time and manner designated by Covered Entity, make PHI maintained by Business Associate available to Covered Entity, or as directed by Covered Entity, to a person or entity other than an Individual, for use and disclosure pursuant to a valid written authorization. Business Associate shall maintain appropriate documentation regarding the disclosure, including, but not limited to, copies of any written authorization by an Individual or his or her personal representative, to enable Covered Entity to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 C.F.R. §164.508.

1. If an Individual requests access to or the release of PHI, pursuant to a valid authorization or otherwise, directly from Business Associate or its agents or Subcontractors, Business Associate shall notify Covered Entity in writing within five (5) business days of the request. Covered Entity shall have the sole authority and responsibility to approve or deny such a request, and shall notify Business Associate, in writing, of its decision to approve or deny any such request. If access is approved, Business Associate shall provide access to PHI at no cost to Covered Entity or an Individual.

5.6 Availability of Internal Practices, Books, and Records. Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity, available to Covered Entity, or at the request of Covered Entity, to the Secretary, in a time and manner designated by Covered Entity or the Secretary, for purposes of determining Covered Entity's compliance with the HIPAA Rules. Within three (3) business days of receipt of a request from the Secretary for information, Business Associate shall notify Covered Entity, in writing, of the request. Business Associate shall, concurrently with providing information to the Secretary, provide Covered Entity with a copy of any internal practices, books, and records that Business Associate provides to the Secretary.

5.7 Training. Business Associate shall provide appropriate training to its workforce regarding (a) the confidential nature of the data and PHI that Business Associate creates, receives, maintains, or transmits on behalf of the Covered Entity; (b) HIPAA requirements including administrative, physical, and technical safeguards for the protection of PHI; and (c) Covered Entity’s Notice of Privacy Practices including the required, limited, and permitted uses and disclosures of PHI and the Individual’s rights regarding their PHI.

5.8 Response to Subpoena. Business Associate shall notify Covered Entity within forty-eight (48) hours if it receives a subpoena or other legal process seeking the disclosure of PHI in order to allow Covered Entity a reasonable amount of time to respond to the subpoena, object to the subpoena, or to otherwise intervene in the action to which the subpoena pertains.

5.9 Notification of Claims. Business Associate shall notify Covered Entity within forty-eight (48) hours of notification or receipt of any civil or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions arising out of or related to this Agreement or the PHI, if Business Associate is named as a party in such claim, demand, cause of action, lawsuit, or enforcement action.

5.10 Assistance in Litigation or Administrative Proceedings. Business Associate shall make itself and any Subcontractors, employees, or agents assisting Business Associate in the performance of its obligations under this Agreement, available to Covered Entity to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against Covered Entity, its commissioner, directors, managers, officers, or employees based upon a claimed violation of the HIPAA Rules or other laws relating to security and privacy, except where Business Associate or its Subcontractor, employee, or agent is named as an adverse party.

5.11 Recordkeeping and Document Retention. Business Associate shall retain any documentation it creates or receives relating to its duties under this Agreement for the duration of this Agreement. Covered Entity shall have the right to reasonably access and copy any such documentation during the term of this Agreement. At the termination of this Agreement, Business Associate shall, at Covered Entity's election, return or destroy all such documentation.

5.13 Restrictions on Remuneration, Marketing, and Fundraising. To the extent the Agreement would otherwise allow Business Associate to receive remuneration for PHI, Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI as prohibited by 42 U.S.C. § 17935(d) unless Covered Entity obtains a valid authorization from the Individual in accordance with 45 C.F.R. §164.508. To the extent that Business Associate is otherwise authorized under this Agreement to communicate about a product or service, it shall not make or cause to be made any communication about a product or service that is prohibited by 42 U.S.C. § 17936(a). To the extent that Business Associate is otherwise authorized under this Agreement to make a fundraising communication, it shall not make or cause to be made any written fundraising communication that is prohibited by 42 U.S.C. § 17936(b).

ARTICLE VI

Breach of Unsecured Protected Health Information

6.1 Report of Security Incidents, Breaches, or Improper Use or Disclosure of PHI. Business Associate shall report to Covered Entity any actual or suspected Security Incident, Breach, or improper use or disclosure of PHI (collectively referred to as “Incident”) not provided for by this Agreement of which Business Associate (or any of its agents or Subcontractors) becomes aware. For the purposes of this Agreement, “Incident” shall not include unsuccessful attempts to penetrate computer networks or services maintained by Business Associate or immaterial incidents such as “pinging” to check if another computer on a network is reachable. Business Associate shall conduct a risk assessment in accordance with section 6.2 of this Agreement if the Security Incident resulted or may have resulted in a Breach.

The report required by this section shall be in writing and delivered to Covered Entity within ten (10) business days after Business Associate discovers such Incident. Business Associate shall take prompt corrective action to cure any such deficiencies and mitigate any harm caused by the Incident. Business Associate shall also take any action necessary or required by applicable federal and state laws as a result of the Incident.

The report to Covered Entity in accordance with this section shall include the following information:

1. A description of the Incident, including the date of the Incident and the date of the discovery of the Incident;

In the event that some of the above listed information is not known by Business Associate at the time of notification of Covered Entity of the Incident, Business Associate shall provide such information to Covered Entity as soon as it becomes available to Business Associate, but in no event later than thirty (30) days after Business Associate discovers such Incident. Business Associate shall cooperate with and provide assistance and further information as may reasonably be requested by Covered Entity.

6.2 Risk Assessment to Determine Breach. An acquisition, access, use, or disclosure of PHI in a manner not permitted under HIPAA is presumed to be a Breach unless Business Associate demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment.

Business Associate shall develop and maintain policies and procedures for conducting a risk assessment in accordance with 45 C.F.R. §164.402(2). If Business Associate determines, after a risk assessment, that no Breach has occurred, Business Associate shall maintain documentation regarding the risk assessment in accordance with section 5.11 of this Agreement.

6.3 Notification to Individuals of Breach. In accordance with 45 C.F.R. §164.404, Covered Entity is responsible for notifying an Individual whose Unsecured PHI has been, or is reasonably believed by the Covered Entity to have been accessed, acquired, used, or disclosed as a result of a Breach.

If the Breach affects one hundred (100) or more Individuals, Business Associate shall, unless otherwise agreed by the Parties, be responsible for notifying Individuals of the Breach. Business Associate shall deliver a sample copy of the notification document to Covered Entity for approval prior to delivery to the affected Individuals, together with a list of affected Individuals. Except if delayed by law enforcement in accordance with 45 C.F.R. §164.412, Business Associate shall provide notification to Individuals without unreasonable delay and in no case later than sixty (60) calendar days after discovery of a Breach. Business Associate shall supply written verification to Covered Entity that the appropriate notification to Individuals has been made.

Covered Entity and Business Associate may agree to other forms of notice as authorized by 45 C.F.R. §164.404.

ARTICLE VII

Obligations of Covered Entity

7.1 Notice of Privacy Practices. Covered Entity shall provide Business Associate with the notice of privacy practices that Covered Entity produces in accordance with 45 CFR §164.520, as well as any changes to such notice. Covered Entity’s Notice of Privacy Practices is available at kehp.ky.gov or any successor website KEHP may utilize.

7.2 Change or Revocation of Permission. Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose PHI, to the extent such changes may affect Business Associate's permitted or required uses and disclosures of PHI. Business Associate shall comply with any such changes or revocations.

7.3 Restrictions on Use or Disclosure. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI. Business Associate shall comply with any such restriction.

7.4 No Request to Use or Disclose in Impermissible Manner. Except as necessary for the management and administrative activities of Business Associate as allowed in Article III of this Agreement or for the provision of data aggregation services, Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules, any applicable Federal regulations, or any applicable State law if performed by Covered Entity.

ARTICLE VIII

Term and Termination

8.1 Term. The Term of this Agreement shall be effective as of the date set forth above, and shall terminate when all PHI created, received, or maintained by Business Associate, on behalf of the Covered Entity, is destroyed or returned to Covered Entity.

8.3 Judicial or Administrative Proceedings. Either Party may terminate this Agreement and any other service agreement between the Parties by written notice to the other Party, effective immediately or as authorized by 200 KAR 5:312 with respect to the service agreement between the Parties, if (a) the other Party is named as a defendant in a criminal proceeding for a violation of the HIPAA Rules or other federal or state security or privacy laws; or (b) there is a finding or stipulation in any administrative or civil proceeding in which a Party has been joined that the Party has violated the HIPAA Rules or any other security or privacy laws, either federal or state.

8.4 Changes in Law. In the event of passage of a law or promulgation of a regulation or an action or investigation by any regulatory body which would prohibit the relationship between the Parties, or the operations of either Party with regard to the subject of this Agreement, the Parties shall attempt in good faith to renegotiate the Agreement to delete the unlawful provision(s) so that the Agreement can continue. If the Parties are unable to renegotiate the Agreement within thirty (30) days, the Agreement and any other service agreement between the Parties shall terminate immediately or as authorized by 200 KAR 5:312, upon written notice of either Party.

1. Return or destroy the PHI that still remains in any form in accordance with section 8.5(a) and (b);

1. Continue to use appropriate safeguards to protect the PHI in accordance with Article II of this Agreement;

1. Not use or disclose the retained PHI except as authorized by this Agreement; and

1. Return or destroy the PHI in accordance with section 8.5(a) and (b) when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

ARTICLE IX

Miscellaneous

9.1 Assignment. This Agreement shall be binding upon and inure to the benefit of the respective legal successors of the Parties. Neither this Agreement nor any rights or obligations hereunder may be assigned, in whole or in part, without the prior written consent of the other Party.

9.2 Disclaimer. Covered Entity makes no warranty or representation that compliance by Business Associate with this Agreement, the HIPAA Rules, or any other federal or state law governing the confidentiality or privacy of information will be adequate or satisfactory for Business Associate's own purposes. Business Associate is solely responsible for all decisions made by Business Associate regarding the safeguarding of PHI.

9.3 Property Rights. All PHI shall be and remain the exclusive property of Covered Entity. Business Associate agrees that it acquires no title or rights to the PHI, including any de-identified information or aggregate data, as a result of this Agreement.

9.4 Preemption of Other Agreements and Liability Limitations/Exclusions. Any limitations on liabilities or exclusions from liability previously agreed upon by the Parties, whether written or oral, shall not be applicable to breaches of this Agreement or a Party’s failure to comply with the HIPAA Rules or any other federal or state law governing the confidentiality or privacy of personal information. To the extent that any provision of this Agreement conflicts with any other agreement between the Parties, whether written or oral, the provisions of this Agreement shall govern. Furthermore, and by way of example and not limitation, the termination provisions of this Agreement shall supersede the termination provisions of any other agreement, including, but not limited to, any limitations on terminating any other agreement (such as notice periods) or any provisions requiring a period to cure.

9.5 Right to Cure. Business Associate agrees that Covered Entity has the right, but not the obligation, to cure any and all breaches of Business Associate's privacy, security, and confidentiality obligations under this Agreement. Any expenses or costs associated with Covered Entity's cure of Business Associate's breach(es) shall be borne solely by Business Associate. The exercise by Covered Entity of its rights under this Section shall not act as a waiver of any remedies, whether at law or in equity, that Covered Entity may seek against Business Associate for any breach by Business Associate of its privacy, security, and confidentiality obligations under this Agreement.

9.6 Injunctive Relief. Business Associate agrees that breach of the terms and conditions of this Agreement shall cause irreparable harm and there exists no adequate remedy at law. Covered Entity retains all rights to seek injunctive relief to prevent or stop any breach of the terms of this Agreement, including, but not limited to the unauthorized use or disclosure of PHI by Business Associate or any agent, Subcontractor, or third party that received PHI from Business Associate. The exercise by Covered Entity of its rights under this Section shall not act as a waiver of any remedies, whether at law or in equity, that Covered Entity may seek against Business Associate for any breach by Business Associate of its privacy, security, and confidentiality obligations under this Agreement.

9.7 Survival. The respective rights and obligations of Business Associate under sections 8.5 and 9.5 of this Agreement shall survive the termination of this Agreement.

9.8 Amendment, Compliance, and Conformance. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the HIPAA Rules and any related regulations. The Parties shall conform their actions under this Agreement to meet any and all requirements of laws, regulations, or guidance that may be forthcoming and that govern the security and privacy of personal information, including PHI. The Parties shall promptly amend this Agreement as necessary to reflect any and all requirements of laws, regulations, or guidance that may be adopted or issued after the effective date of this Agreement.

9.9 Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits the Covered Entity to comply with HIPAA.

9.10 Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended, and for which compliance is required.

9.11 Entire Agreement. This document, together with any written schedules, amendments, and addenda, constitute the entire agreement of the Parties and supersedes all prior oral and written agreements or understandings between them with respect to the matters provided for herein.

9.12 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the Commonwealth of Kentucky to the extent that the provisions of HIPAA do not preempt the laws of the Commonwealth of Kentucky.

9.13 Modifications. Any modifications to this Agreement shall be valid only if made in writing and signed by a duly authorized agent of both Parties.

9.14 Notice. Any notice required or permitted to be given by either Party under this Agreement shall be sufficient if in writing and hand delivered (including delivery by courier) or sent by postage prepaid certified mail, return receipt requested, as follows:

If to Business Associate:

Name: ______________________________ Title: _______________________________ BA Name_____________________________ BA Address: __________________________ City/State/Zip__________________________ Email Address:________________________

If to Covered Entity:

Personnel Cabinet Office of Legal Services ATTN: Chris Chamness 501 High Street, 3rd Floor Frankfort, KY 40601 Email: Chris.Chamness@ky.gov

9.15 Severability. The Parties agree that if a court determines, contrary to the intent of the Parties, that any of the provisions or terms of this Agreement are unreasonable or contrary to public policy, or invalid or unenforceable for any reason in fact, law, or equity, such unenforceability or validity shall not affect the enforceability or validity of the remaining provisions and terms of this Agreement. Should any particular provision of this Agreement be held unreasonable or unenforceable for any reason, then such provision shall be given effect and enforced to the fullest extent that would be reasonable and enforceable.

9.16 Waiver of Breach. No failure or delay by either Party in exercising its rights under this Agreement shall operate as a waiver of such rights, and no waiver of any breach shall constitute a waiver of any prior, concurrent, or subsequent breach.

9.17 Titles. Titles or headings are used in this Agreement for reference only and shall not have any effect on the construction or legal effect of this Agreement.

9.18 Independent Contractors. For purposes of this Agreement, Covered Entity and Business Associate are and will act at all times as independent contractors. None of the provisions of this Agreement are intended to create, nor shall be deemed or construed to create, any relationship other than that of independent entities contracting with each other for the purpose of effecting this Agreement. None of the provisions of this Agreement shall establish or be deemed or construed to establish any partnership, agency, employment agreement, or joint venture between the Parties.

9.19 No Third Party Beneficiaries. It is the intent of the Parties that this Agreement is to be effective only in regards to their rights and obligations with respect to each other. It is expressly not the intent of the Parties to create any independent rights in any third party or to make any third-party a beneficiary of this Agreement, and no privity of contract shall exist between third parties and each Party.

9.20 Execution in Counterparts. This Agreement may be executed simultaneously in two or more counterparts, each of which shall be deemed an original, but all of which together constitute the same Agreement.

ARTICLE X

Execution Each Party to this Agreement warrants that it has full power and authority to enter into this Agreement, and the person signing this Agreement on behalf of either Party warrants that he/she has been duly authorized and empowered to enter into this Agreement.

Printed Business Associate Name: