Appendix G - Sample Business Associate Agreement (BAA).docx

APPENDIX G, RFP 0045-N

ATTACHMENT A

SAMPLE BUSINESS ASSOCIATE AGREEMENT BETWEEN

STATE OF WYOMING, DEPARTMENT OF HEALTH, DIVISION OF HEALTHCARE FINANCING AND [Insert full legal name of Business Associate in all caps]

1. Parties. The parties to this Business Associate Agreement are the State of Wyoming, Department of Health, Division of Healthcare Financing, whose address is: 122 West 25th Street, 4 West, Cheyenne, WY 82002 (Covered Entity), and [Insert Full Legal Name of Business Associate], whose address is [Insert Business Associate’s address] (Business Associate). In this Agreement, Covered Entity and Business Associate are each a “party” and, collectively, are the “parties.”

2. Purpose of Agreement. This Agreement seeks to ensure the privacy and security of protected health information as required by 45 C.F.R. Parts 160 and 164, as well as more stringent applicable Wyoming state law.

3. Definitions.

A. Catch-all definitions. The following terms used in this Agreement shall have the same meaning as those terms in the Health Insurance Portability and Accountability Act (HIPAA) Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

B. Specific definitions.

4. Term of Agreement. This Agreement is effective when all parties have executed it (Effective Date). Once this Agreement becomes effective, it shall remain effective until it is terminated under the terms of this Agreement or on the date the Covered Entity terminates as authorized in Subsection D of Section 8, whichever is sooner.

5. Obligations and Activities of Business Associate. Business Associate agrees to:

A. Not use or disclose protected health information other than as permitted or required by this Agreement or as required by law.

B. Use appropriate safeguards, and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by this Agreement.

C. Report to Covered Entity any use or disclosure of protected health information not provided for by this Agreement of which it becomes aware, including breaches of unsecured protected health information as required at 45 C.F.R. § 164.410, and any security incident of which it becomes aware. The report of such use, disclosure, potential breach, or security incident to Covered Entity must be made within forty-eight (48) hours of discovery in writing by emailing the incident details to [Insert Covered Entity’s email address] and wdh-hipaa@wyo.gov. Upon report, Business Associate shall comply with Covered Entity’s requests for additional information, including completion of forms provided by Covered Entity. At Covered Entity’s discretion, Business Associate shall handle the required breach notifications to individuals, the HHS Office for Civil Rights (OCR), and potentially the media, on behalf of Covered Entity, including covering the costs of such notifications.

D. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information.

E. Make available protected health information in a designated record set to the individual or the individual’s designee as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.524. Business Associate shall require the individual or the individual’s designee to submit access requests in writing. Business Associate shall respond to a written access request as soon as reasonably practicable, and in no circumstance later than thirty (30) calendar days.

F. Make any amendment(s) to protected health information in a designated record set as directed or agreed to by Covered Entity pursuant to 45 C.F.R. § 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.526. If Business Associate receives a request to amend protected health information directly, Business Associate shall notify Covered Entity within three (3) business days.

G. Maintain and make available the information required to provide an accounting of disclosures to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.528. Business Associate shall comply with Covered Entity’s request for such information within seven (7) business days following Covered Entity’s request. If Business Associate receives a request for an accounting of disclosures directly, Business Associate will notify Covered Entity within three (3) business days.

H. Comply with the requirements of Subpart E of 45 C.F.R. Part 164 that apply to Covered Entity to the extent Business Associate is to carry out one or more of Covered Entity's obligations under Subpart E in the performance of such obligations.

I. Make its internal practices, books, and records available to the Secretary and Covered Entity for purposes of determining Business Associate and Covered Entity’s compliance with the HIPAA Rules. Business Associate shall inform Covered Entity if Business Associate provides such information to the Secretary.

J. Conduct electronic transactions covered by 45 C.F.R. Part 162 as a standard transaction, and ensure that any agents, including subcontractors, also process electronic transactions as required therein.

K. Provide notice within seven (7) business days of any event that triggers Business Associate’s obligation to notify Covered Entity unless otherwise provided.

6. Permitted Uses and Disclosures by Business Associate.

A. Business Associate may only use or disclose protected health information as necessary to perform the services set forth in the Contract between the parties into which this Agreement is incorporated.

B. Business Associate may use or disclose protected health information as required by law.

C. Business Associate agrees to make uses and disclosures and requests for protected health information consistent with Covered Entity’s minimum necessary policies and procedures.

D. Business Associate may not use or disclose protected health information in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except for the specific uses and disclosures set forth in Subsections E, F, or G of Section 6.

E. Business Associate may use protected health information for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate.

F. Business Associate may disclose protected health information for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided the disclosures are required by law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

G. Business Associate may provide data aggregation services relating to the health care operations of Covered Entity.

H. Business Associate is authorized to de-identify protected health information in accordance with 45 C.F.R. §§ 164.514(a)-(c) in order to [Insert a description of the specific service to which this clause applies or delete the subsection]. Specifically, Business Associate agrees that all de-identification of data shall be in accordance with 45 C.F.R. § 164.514(b)(2). Business Associate agrees to comply with Covered Entity’s request to audit Business Associate’s de-identification procedures. Such audits may include providing Covered Entity with copies of de-identified data, procedures for de-identification, and any additional justification, analysis, or assurances that may be related to the process of de-identification of data.

7. Responsibilities of Covered Entity. Covered Entity agrees to:

A. Notify Business Associate of any limitation in the notice of privacy practices of Covered Entity under 45 C.F.R. § 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of protected health information.

B. Notify Business Associate of any changes in, or revocation of, permission by an individual to use or disclose protected health information, to the extent that such changes affect Business Associate’s use or disclosure of protected health information.

C. Notify Business Associate of any restriction on the use or disclosure of protected health information that Covered Entity has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of protected health information.

D. Not request Business Associate to use or disclose protected health information in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity, except for data aggregation or management and administrative activities of Business Associate.

8. General Provisions.

A. Amendments. The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.

B. Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA Rules.

C. Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

D. Termination. This Agreement may be terminated by Covered Entity without cause, in accordance with the terms and procedures outlined in the Contract, or by Covered Entity immediately for cause if Covered Entity determines Business Associate has violated a material term of this Agreement.

THE REMAINDER OF THIS PAGE WAS INTENTIONALLY LEFT BLANK

Attachment A Business Associate Agreement between State of Wyoming, Department of Health, Division of Healthcare Financing (Covered Entity) and [Insert Business Associate’s Name] (Business Associate) Template Version January 2024

Business Associate Agreement between State of Wyoming, Department of Health, Division of Healthcare Financing (Covered Entity) and [Insert Business Associate’s Name] (Business Associate)