Att 17 - HIPPA Business Associate Agreement.docx

BUSINESS ASSOCIATE AGREEMENT

THIS BUSINESS ASSOCIATE AGREEMENT (the "Business Associate Agreement") is by and between ASSOCIATE NAME, having an office at ADDRESS (hereinafter referred to as the "Business Associate") and State of Alaska, Department of Administration, Division of Retirement and Benefits having an office at 333 Willoughby Ave., 6th Floor, Juneau, AK 99801, as Plan Administrator of the Health Plans (hereinafter referred to as the "Covered Entity"). The Business Associate Agreement is effective as of _______________, 20___.

RECITALS

WHEREAS, the Business Associate and the Covered Entity have entered into a service agreement (the "Service Agreement") under which the Business Associate performs or assists the Covered Entity with functions or activities involving the use or disclosure of Individually Identifiable Health Information ("Services"); and

WHEREAS, the Covered Entity and the Business Associate desire to comply with the requirements of regulations promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), which Privacy Rule, Security Rule, Breach Notification Rule, and Enforcement Rule are codified at 45 CFR parts 160, 162, and 164 as such regulations may be amended from time to time (collectively referred to herein as the "HIPAA Standards"); and

WHEREAS, the Covered Entity and the Business Associate acknowledge and agree that capitalized terms used herein, but not otherwise defined, are as defined in the HIPAA Standards; and

WHEREAS, the HIPAA Standards require that the Covered Entity obtain satisfactory assurances that the Business Associate will appropriately safeguard the Individually Identifiable Health Information used or disclosed by the Business Associate in the course of performing Services pursuant to this Business Associate Agreement and the Service Agreement.

NOW, THEREFORE, in consideration of the foregoing and the mutual promises and covenants herein contained, the Parties agree as follows:

1. Definitions

The following terms shall have the meaning ascribed to them in this Section:

a. Breach shall have the same meaning as the term "breach" at 45 CFR § 164.402, and generally means the unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of such information.

b. Business Associate shall have the same meaning as the term "business associate" at 45 CFR § 160.103, and in reference to the Party in this Business Associate Agreement, shall mean ASSOCIATE NAME.

c. Covered Entity shall have the same meaning as the term "covered entity" at 45 CFR § 160.103, and in reference to the Party in this Business Associate Agreement, shall mean the Health Plans.

d. Designated Record Set shall mean a group of records maintained by or for Covered Entity that is: (a) the medical records and billing records about Individuals maintained by or for a covered health care provider; (b) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (c) used in whole or in part, by or for Covered Entity to make decisions about Individuals. For these purposes, the term record means any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for Covered Entity.

e. Effective Date means, with respect to the term of this Business Associate Agreement, EFFECTIVE DATE.

f. Electronic Health Information means Protected Health Information that is transmitted or maintained by or in electronic media, as defined by 45 CFR § 160.103.

g. Health Plans shall mean the health plans that may be sponsored, from time to time, by the State of Alaska for its eligible employees, retirees, and their eligible dependents to which Business Associate provides Services or to which Business Associate will provide Services during the term of this Business Associate Agreement, and which are covered entities as defined by 45 CFR §160.103.

h. HHS shall mean the United States Department of Health and Human Services.

i. HIPAA shall mean the Health Insurance Portability and Accountability Act of 1996, as amended or modified by applicable laws or regulations.

j. HIPAA Standards shall mean the Privacy Rule, Security Rule, Breach Notification Rule, and Enforcement Rule at 45 CFR Parts 160, 162 and 164.

k. Individual shall mean the person who is the subject of the PHI, and shall have the same meaning as the term "individual" at 45 CFR § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).

l. Limited Data Set shall have the same meaning as the term "limited data set" at 45 CFR § 164.514(e)(2).

m. Parties shall mean the Business Associate and the Covered Entity.

n. Protected Health Information("PHI") shall have the same meaning as the term "protected health information" at 45 CFR § 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity.

o. Required By Law shall have the same meaning as the term "required by law" at 45 CFR § 164.103.

p. Secretary shall mean the Secretary of HHS or his or her designee.

q. Security Incident shall have the same meaning as the term "security incident" at 45 CFR § 164.304, which generally means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

r. Subcontractor shall have the same meaning at the term "subcontractor" at 45 CFR § 160.103, which generally means a person to whom a Business Associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such Business Associate.

s. Transaction Standards shall mean the standards adopted by the Secretary under 45 CFR Part 162.

t. Unsecured Protected Health Information ("Unsecured PHI") shall have the meaning set forth at 45 CFR § 164.402, as amended, and generally means PHI that is not secured through the use of technologies and methodologies that render such PHI unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in guidance.

2. Obligations and Activities of Business Associate

a. Business Associate shall not use or further disclose Protected Health Information other than as permitted or required by this Business Associate Agreement or as Required By Law. Further, Business Associate shall use and disclose Protected Health Information in accordance with Covered Entity's Notice of Privacy Practices as provided by Covered Entity to Business Associate pursuant to Section 4(a).

b. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to Electronic Protected Health Information, to prevent use or disclosure of the Protected Health Information other than as provided for by this Business Associate Agreement.

c. Business Associate shall immediately report to Covered Entity any use or disclosure of Protected Health Information or an Individual's information not provided for by this Business Associate Agreement, including, without limitation, any Breach of Protected Health Information, Unsecured Protected Health Information or an Individual's information, and any Security Incident involving the Protected Health Information or an Individual's information of which the Business Associate becomes aware. Such report shall be in writing and shall be reported to Covered Entity as soon as practicable after Business Associate becomes aware of such use or disclosure or Security Incident, but in no event more than five (5) days following such date. Business Associate shall take prompt corrective action to cure any such deficiencies and any action pertaining to such unauthorized disclosure required by applicable Federal and State laws and regulations. Further, Business Associate shall take any action necessary or reasonably requested by the Covered Entity to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Security Incident or use or disclosure of Protected Health Information, Unsecured Protected Health Information, or an Individual's information by Business Associate, or any agent or Subcontractor of Business Associate, in violation of the requirements of this Business Associate Agreement. In the event of a Breach of Protected Health Information or Unsecured Protected Health Information, Business Associate's notice to Covered Entity of such Breach shall include, to the extent possible:

· The identification of each Individual whose Protected Health Information has been, or is reasonably believed by the Business Associate, to have been, accessed, acquired, or disclosed during such Breach;

· A description of the Breach, including the date of the Breach and the date of the discovery of the Breach, if known;

· A description of the types of Unsecured Protected Health Information that were involved in the Breach (such as whether full name, social security number, date of birth, home address, account number, credit card numbers, diagnosis, disability code or other types of Protected Health Information were involved);

· Any steps that Individuals should take to protect themselves from potential harm resulting from the Breach;

· A description of what Business Associate is doing to investigate the Breach, to mitigate the harm to Individuals and to protect against further Breaches; and

· Contact procedures for Individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, Web site or postal address.

Business Associate shall also provide Covered Entity any other available information that the Covered Entity is required to include in the notification to the Individual, even if such information becomes available after notification to the Individual. Business Associate shall also take any action necessary as reasonably requested by the Covered Entity to assist Covered Entity in complying with any applicable Breach notification obligations to Individuals, the media, and/or the Secretary, as applicable, under 45 CFR §§ 164.404, 164.406, and 164.408. If a notification, notice, or posting required by the Breach Notification Rule would impede a criminal investigation or cause damage to national security, such notification shall be delayed as required by law enforcement pursuant to 45 CFR § 164.412.

In the event that some of the above listed information is not known by Business Associate at the time of notification of Covered Entity of the Breach, Business Associate shall provide such information to Covered Entity as soon as it becomes available to Business Associate, but in no event later than thirty (30) days after Business Associate discovers such Breach.

d. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate shall ensure that any Subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of the Business Associate agree in writing to the same restrictions, conditions, and requirements that apply through this Business Associate Agreement to the Business Associate with respect to such information. Such written agreement shall also require the agent or Subcontractor to implement reasonable and appropriate administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic Protected Health Information that it creates, receives, maintains or transmits on behalf of Covered Entity. Business Associate, and not Covered Entity, is solely responsible for its agents' and Subcontractors' compliance under the HIPAA Standards.

e. Business Associate shall make available Protected Health Information in a Designated Record Set. The Business Associate shall provide access, at the request of the Covered Entity, and in the time and manner designated by Covered Entity, to Protected Health Information in a Designated Record Set, to Covered Entity, or as directed by Covered Entity, to an Individual in order to meet the requirements under 45 C.F.R. §164.524; and

(1) Make PHI maintained by Business Associate available to Covered Entity, at the request of the Covered Entity and in the time and manner designated by Covered Entity or as directed by Covered Entity, to a person or entity other than an Individual, for use and disclosure pursuant to a valid written authorization and maintain appropriate documentation for the period, including, but not limited to, copies of any written authorization by an Individual or his or her legal representative, to enable Covered Entity to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 CFR § 164.508; and

(2) Notify Covered Entity, if any Individual requests access to, or the release pursuant to an authorization or otherwise of, PHI directly from Business Associate or its agents or Subcontractors, in writing within five (5) business days of the request. Covered Entity shall have sole authority and responsibility to approve or deny such a request, and shall notify Business Associate, in writing, of its decision to approve or deny any such request.

f. Business Associate shall make any amendment(s) to Protected Health Information contained in a Designated Record Set that the Covered Entity directs or agrees to make pursuant to 45 C.F.R. §164.526 at the request of Covered Entity, and in the time and manner designated by Covered Entity, or to otherwise allow Covered Entity to comply with its obligations under 45 CFR § 164.526. If any Individual requests an amendment of Protected Health Information contained in a Designated Record Set directly from Business Associate or its agents or Subcontractors, Business Associate shall notify Covered Entity in writing within ten (10) days of the request. Covered Entity shall have sole authority and responsibility to approve or deny such a request, and shall notify Business Associate, in writing, of its decision to approve or deny any such request.

g. Business Associate shall make internal practices, books and records relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity available to the Covered Entity or the Secretary, in a time and manner designated by the Covered Entity or the Secretary, for purposes of the Secretary determining Covered Entity's or Business Associate's compliance with HIPAA Standards. Business Associate shall notify Covered Entity, in writing, of any request by the Secretary under this Section, and shall provide Covered Entity with a copy of any practices, books, and records that Business Associate provides to the Secretary concurrently with providing such materials to the Secretary.

h. Business Associate shall document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity or Business Associate to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. §164.528.

i. Business Associate shall document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR §

164.528. Such documentation shall be kept with regard to all disclosures of Protected Health Information except the disclosures described in 45 CFR § 164.528(a)(1). For each such disclosure, Business Associate shall document the following information: (i) the date of the disclosure; (ii) the name of the entity or person who received the Protected Health Information and, if known, the address of such entity or person; (iii) a brief description of the Protected Health Information disclosed; and (iv) a brief statement of the purpose of the disclosure that reasonably states the basis for the disclosure.

ii. Business Associate shall provide to Covered Entity, in a time and manner designated by Covered Entity, information pertaining to disclosures of Protected Health Information by Business Associate to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. §164.528. In the event that Business Associate, or its agent or Subcontractor, receives a direct request from an Individual, or a party other than Covered Entity, for an accounting of disclosures of Protected Health Information made by Business Associate, Business Associate shall within five (5) business days of such request forward it to Covered Entity in writing. Business Associate shall, unless otherwise directed by Covered Entity or as Required By Law, supply an accounting of disclosures of Protected Health Information only to Covered Entity.

i. Business Associate shall implement and maintain appropriate safeguards designed to ensure that all Protected Health Information is used or disclosed only as authorized under the HIPAA Standards and this Business Associate Agreement.

Business Associate agrees to assess potential risks and vulnerabilities to Protected Health Information in its possession and develop, implement and maintain the administrative, physical and technical safeguards required by the HIPAA Standards that protect the confidentiality, availability and integrity of the Electronic Protected Health Information that Business Associate creates, receives, maintains or transmits on behalf of the Covered Entity as required by the Security Rule. These measures must be documented in comprehensive written privacy and security policies and procedures and kept current, and must include, at a minimum, those measures that fulfill the requirements outlined in the HIPAA Standards and the necessary administrative, technical and physical safeguards appropriate to the size and complexity of Business Associate's operations and the nature and scope of its activities. Business Associate also agrees to implement policies and procedures that address Business Associate's compliance with applicable HIPAA Standards and its efforts to detect, prevent, and mitigate the risks of identity theft resulting from the improper use and/or disclosure of an Individual's information.

j. Business Associate shall, in the performance of its duties under this Business Associate Agreement and the Agreement, comply with the HIPAA Standards and all applicable federal laws, regulations and rules relating to the administrative simplification provisions of the HIPAA Standards.

k. Business Associate may use and disclose PHI that Business Associate obtains or creates only if such use or disclosure is in compliance with each applicable requirement of 45 CFR § 164.504(e), relating to business associate agreements. The HIPAA Standards that relate to privacy and that are made applicable with respect to Covered Entity and Business Associate are hereby incorporated into this Business Associate Agreement.

l. Business Associate acknowledges that if it violates any of the requirements provided under this Business Associate Agreement, Business Associate will be subject to the same civil and criminal penalties that a Covered Entity would be subject to if such Covered Entity violated the same requirements.

m. Business Associate shall provide appropriate training to its workforce in security, privacy, and confidentiality issues and regulations relating to Protected Health Information.

n. Business Associate shall promptly notify Covered Entity if it receives a subpoena or other legal process seeking the disclosure of Protected Health Information. Such notification shall be provided in a timeframe that allows Covered Entity a reasonable amount of time to respond to the subpoena, object to the subpoena, or to otherwise intervene in the action to which the subpoena pertains.

o. Business Associate shall promptly notify Covered Entity upon notification or receipt of any civil or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions arising out of or related to this Business Associate Agreement or the Protected Health Information, regardless of whether Covered Entity and/or Business Associate are named as parties in such claims, demands, causes of action, lawsuits, or enforcement actions.

p. Business Associate shall make itself and any Subcontractors, employees or agents assisting Business Associate in the performance of its obligations under this Business Associate Agreement, available to Covered Entity to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against Covered Entity, its directors, officers, or employees based upon Business Associate’s (or its Subcontractors') claimed violation of HIPAA, the HIPAA Standards, or other laws relating to security and privacy, except where Business Associate or its Subcontractor, employee, or agent is named as an adverse party.

q. Business Associate shall retain any documentation it creates or receives relating to its duties under this Business Associate Agreement for the duration of this Business Associate Agreement. Covered Entity shall have the right to reasonably access and copy such documentation during the term of the Business Associate Agreement. At the termination of this Business Associate Agreement, Business Associate shall, at Covered Entity's election, return or destroy all such documentation.

r. If Business Associate performs any transactions for Covered Entity for which a standard has been adopted by the Secretary under 45 CFR Part 162, the following shall apply:

i. Business Associate, its agents and Subcontractors, shall conduct all transmissions of data required under the Business Associate Agreement that are subject to the Transaction Standards in compliance with the Transaction Standards, as they may be amended from time to time. With respect to any such Transactions, neither Party shall: (i) change the definition, data condition, or use of a data element or segment in a Transaction Standard; (ii) add any data elements or segments to the maximum defined data set; (iii) use any code or data elements that are either marked "not used" in the Transaction Standard's implementation specification or are not in the Transaction Standard's implementation specification(s); or (iv) change the meaning or intent of the Transaction Standard's implementation specification(s).

ii. Each Party, at its own expense, shall provide and maintain the hardware, software, services and testing necessary to effectively and reliably conduct the applicable Transaction Standards.

3. Permitted Uses and Disclosures by Business Associate

a. Except as otherwise limited in this Business Associate Agreement, Business Associate may use or disclose Protected Health Information to perform the functions, activities or services for, or on behalf of, Covered Entity as specified in the Agreement, provided that such use or disclosure would not violate the HIPAA Standards if done by Covered Entity, except for the specific uses and disclosures set forth below in Sections 3(b), 3(c), and 3(d). Any such use or disclosure shall be limited to those reasons and those individuals as necessary to meet Business Associate's obligations.

b. Business Associate may use or disclose Protected Health Information as Required By Law.

c. Except as otherwise limited in this Business Associate Agreement, Business Associate may use Protected Health Information: (i) for the proper management and administration of the Business Associate, (ii) to carry out the legal responsibilities of the Business Associate, or (iii) to report violations of law to appropriate Federal and State authorities, consistent with 42 CFR § 164.502(j)(1).

d. Except as otherwise limited in this Business Associate Agreement, Business Associate may disclose Protected Health Information to carry out the functions described in Section 3(a), for the management and administration of the Business Associate, or to carry out the legal responsibilities of Business Associate, provided that disclosures are Required by Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

e. Except as otherwise permitted by the HIPAA Standards, when using or disclosing Protected Health Information or responding to a request for Protected Health Information, Business Associate must limit such Protected Health Information, to the extent practicable, to a Limited Data Set, or if more information than a Limited Data Set is required, to the minimum necessary to accomplish the intended purpose of such use, disclosure or request.

f. Except as otherwise permitted by the HIPAA Standards, to the extent this Business Associate Agreement or the related Agreement would otherwise permit Business Associate to receive remuneration for PHI, Business Associate agrees that it will not directly or indirectly receive remuneration in exchange for any Protected Health Information, as prohibited by 42 U.S.C. § 17936(a).

g. Except as otherwise permitted by the HIPAA Standards, Business Associate agrees that it will not use or disclose Protected Health Information in connection with any fundraising and/or marketing communication for or on behalf of Covered Entity unless Covered Entity has obtained a valid authorization from each Individual who will be a recipient of any such communication. In any event, Business Associate shall not make or cause to be made any written fundraising communication that is prohibited by 42 U.S.C. § 17936(b) and 45 CFR § 164.514(f).

h. If an Individual requests that Business Associate restrict the disclosure of the Individual's Protected Health Information to carry out treatment, payment or health care operations, Business Associate agrees that it will comply with the requested restriction if, except as otherwise Required By Law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment), and the Protected Health Information pertains solely to a health care item or service for which the health care provider involved has been paid out of pocket in full.

i. Disclosures to Workforce. Business Associate shall not disclose PHI to any member of its workforce unless necessary to fulfill a purpose described in Section 3 and unless Business Associate has advised such person of Business Associate's obligations under this Business Associate Agreement and of the consequences for such person and for Business Associate of violating this Business Associate Agreement. Business Associate shall take appropriate disciplinary action against any member of its workforce who uses or discloses PHI in contravention of this Business Associate Agreement or the Privacy Rule.

4. Obligations of Covered Entity

a. Covered Entity shall provide Business Associate with the Notice of Privacy Practices that Covered Entity produces in accordance with 45 C.F.R. §164.520, as well as any changes to such Notice and the Business Associate shall comply with such Notice of Privacy Practices.

b. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect Business Associate's permitted or required uses and disclosures. Business Associate shall comply with any such changes or revocations.

c. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 C.F.R. §164.522. Business Associate shall comply with any such restrictions.

d. Except as necessary for the management and administrative activities of Business Associate as allowed in Sections 3(b), 3(c), and 3(d), Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Standards if done by Covered Entity.

5. Term and Termination

a. Term. The Term of this Business Associate Agreement shall be effective as of the Effective Date and shall terminate when all of the Protected Health Information provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this Section.

b. Termination for Cause. Upon either Party's knowledge of a material breach of this Business Associate Agreement by the breaching Party, the non-breaching Party shall provide an opportunity for the breaching Party to cure the breach or end the violation, and the non-breaching Party shall terminate the Business Associate Agreement and the Service Agreement if the breaching Party does not cure the breach or end the violation within thirty (30) days from the date of written notification from the non-breaching party describing the breach or violation, or immediately terminate the Business Associate Agreement if the breaching Party has breached a material term of this Business Associate Agreement and cure is not possible, as determined by the non-breaching Party in its reasonable discretion.

If termination of this Business Associate Agreement is not feasible, the non-breaching Party shall report the breach to the Secretary.

c. Covered Entity may terminate this Business Associate Agreement and any other agreement or relationship between the Parties related to the Services by written notice to the Business Associate, effective immediately, if: (a) the Business Associate is named as a defendant in a criminal proceeding for a violation of HIPAA, the HIPAA Standards, or other security or privacy laws; or (b) a finding or stipulation that the Business Associate has violated any standard or requirement of HIPAA, the HIPAA Standards, or any other security or privacy laws is made in any administrative or civil proceeding in which the Business Associate has been joined.

d. In the event of passage of a law or promulgation of a regulation or an action or investigation by any regulatory body which would prohibit the relationship between the Parties, or the operations of either Party with regard to the subject of this Business Associate Agreement, the Parties shall attempt in good faith to renegotiate the Business Associate Agreement to delete the unlawful provision(s) so that the Business Associate Agreement can continue. If the Parties are unable to renegotiate the Business Associate Agreement within thirty (30) days, the Business Associate Agreement shall terminate immediately, upon written notice of either Party.

e. Effect of Termination.

i. Except as provided in subparagraph (ii) of this subsection (e), upon termination of the Agreement or this Business Associate Agreement, for any reason, Business Associate shall return or destroy all Protected Health Information received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. This provision shall apply to Protected Health Information that is in the possession of Subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information. If Business Associate is directed to destroy the Protected Health Information, Business Associate shall certify in writing to Covered Entity that such Protected Health Information has been destroyed.

ii. In the event that Business Associate determines that it is necessary to retain some or all of the Protected Health Information to continue its proper management and administration or to carry out its legal responsibilities, Business Associate shall provide to Covered Entity written notification of such need. Upon Covered Entity's approval, which shall not be unreasonably withheld, Business Associate may retain only the Protected Health Information that is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities, but Business Associate shall return or destroy (at Covered Entity's election and in a time frame to be determined by Covered Entity) all other Protected Health Information pursuant to subparagraph (i). With regard to any retained Protected Health Information, Business Associate shall not use or disclose such Protected Health Information other than for the purposes for which the Protected Health Information was retained and subject to the same conditions set forth in this Business Associate Agreement that applied prior to this Business Associate Agreement's termination. Business Associate shall return or destroy (at Covered Entity's election and in a time frame to be determined by Covered Entity) the retained Protected Health Information pursuant to subparagraph (i) when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

iii. The parties hereto understand and agree that the terms of this Business Associate Agreement are reasonable and necessary to protect the interests of the Covered Entity and the Business Associate. The parties further agree that the Covered Entity would suffer irreparable harm if the Business Associate breached this Business Associate Agreement and there exists no adequate remedy of law. Thus, in addition to any other rights or remedies, all of which shall be deemed cumulative, the Covered Entity shall be entitled to obtain injunctive relief to enforce the terms of this Business Associate Agreement. The exercise by Covered Entity of its rights under this subparagraph (iii) shall not act as a waiver of any remedies, whether at law or in equity, that Covered Entity may seek against Business Associate for any breach by Business Associate of its privacy, security, and confidentiality obligations under this Business Associate Agreement.

6. Miscellaneous

a. Survival. The respective rights and obligations of Business Associate under Section 5(e) and the obligations of Business Associate under Section 6(i) of this Business Associate Agreement shall survive the termination of this Business Associate Agreement.

b. Interpretation. Any ambiguity in this Business Associate Agreement shall be resolved in favor of a meaning that permits the parties to comply with the HIPAA Standards where provisions of this Business Associate Agreement are different from those mandated by the HIPAA Standards, but are nonetheless permitted by the HIPAA Standards, the provisions of the Business Associate Agreement shall control.

c. No Private Cause of Action. This Business Associate Agreement is not intended to and does not create a private cause of action by any individual, other than the parties to this Business Associate Agreement, as a result of any claim arising out of the breach of this Business Associate Agreement, the HIPAA Standards or other state or federal law or regulation relating to privacy or confidentiality.

d. Amendment. In the event that any law or regulation is enacted or promulgated regarding the protection of health information that is in any way inconsistent with the terms of this Business Associate Agreement or that interferes with either Party's obligations with respect to the protection of health information so as to warrant a modification to this Business Associate Agreement or in the event any HIPAA Standard is amended or modified, either Party shall have the right to amend this Business Associate Agreement so as to bring it into compliance with any such change by providing written notice thereof to the other Party but without having to obtain the other Party's consent thereto. Except as set forth above in this Section 6(d), this Business Associate Agreement shall only be amended or modified upon written consent of the parties.

e. Application of State Law. Where any applicable provision of State law relates to the privacy of health information and is not preempted by HIPAA, as determined by application of the HIPAA Standards, the parties shall comply with the applicable provisions of State law.

f. Severability. If any provision of this Business Associate Agreement shall be declared invalid or illegal for any reason whatsoever, then notwithstanding such invalidity or illegality, the remaining terms and provisions of this Business Associate Agreement shall remain in full force and effect in the same manner as if the invalid or illegal provision had not been contained herein, and such invalid, unenforceable or illegal provision shall be valid, enforceable and legal to the maximum extent permitted by law.

g. Governing Law. To the extent not preempted by federal law, this Business Associate Agreement shall be interpreted, construed and governed according to the laws of the State of Alaska. The parties agree that venue shall lie in Federal and State courts in Alaska, without regard to its conflicts of law principles, regarding any and all disputes arising from this Business Associate Agreement.

h. Notices. Any notice or other communication given to either Party pursuant to this Business Associate Agreement must be in writing and (i) delivered personally, (ii) delivered by overnight express, or (iii) sent by registered or certified mail, postage prepaid, to the address set forth above and shall be considered given upon delivery.

i. Indemnification. Without limitation to any indemnification obligation that Business Associate may have under the Service Agreement, Business Associate shall indemnify, hold harmless and defend Covered Entity from and against, and reimburse Covered Entity for, any and all claims, losses, liabilities, demands, causes of action, lawsuits, governmental enforcement actions, costs and other expenses brought by a third party resulting from, or relating to, the actual or alleged acts or omissions of Business Associate, its employees, agents and Subcontractors, in breach of their obligations under this Business Associate Agreement or Business Associate’s, or its employees’ or Subcontractors’, use or disclosure of Protected Health Information, Unsecured Protected Health Information or an Individual's information not provided for by this Business Associate Agreement, including without limitation any Breach of Protected Health Information, Unsecured Protected Health Information or an Individual's information or any expenses incurred by Covered Entity in providing required breach notifications. Such indemnification shall include, but not be limited to, the payment of Covered Entity’s reasonable attorney fees associated with any claims, losses, liabilities, demands, causes of action, lawsuits, governmental enforcement actions arising out of or related to such acts or omissions. In addition to the foregoing, in the event of a Breach of Unsecured Protected Health Information or similar breach or wrongful disclosure as defined by an applicable law or regulation requiring notification or other remedial action due to the breach or wrongful disclosure of Protected Health Information or other personal or financial information ("Other Breach Law") that arose out of or related to Business Associate's actual or alleged acts and omissions (or those of its agents or Subcontractors), Business Associate shall indemnify Covered Entity against all costs and expenses incurred by Covered Entity that are associated with complying with the notification requirements under the Breach Notification Rule or Other Breach Law. Such indemnification shall include all costs related to notifying Covered Entity, Individuals, HHS, or any other entity required to be notified by an Other Breach Law, any remediation necessitated by the Breach, any fines or penalties arising out of the Breach, and any other actions required to be taken pursuant to the Breach Notification Rule or Other Breach Law.

j. Insurance. Business Associate shall obtain and maintain at its sole expense, and in amounts consistent with industry standards, insurance to support its indemnification obligation under Section 6(i). A certificate of insurance coverage shall be provided to Covered Entity upon request.

k. Assignment. This Business Associate Agreement shall be binding upon and inure to the benefit of the respective legal successors of the parties. Neither this Business Associate Agreement nor any rights or obligations hereunder may be assigned, in whole or in part, without the prior written consent of the other Party.

l. Disclaimer. Covered Entity makes no warranty or representation that compliance by Business Associate with this Business Associate Agreement, HIPAA, or the HIPAA Standards will be adequate or satisfactory for Business Associate's own purposes. Business Associate is solely responsible for all decisions made by Business Associate regarding the safeguarding of Protected Health Information.

m. Property Rights. All Protected Health Information shall be and remain the exclusive property of Covered Entity. Business Associate agrees that it acquires no title or rights to the Protected Health Information, including any de-identified information, as a result of this Business Associate Agreement.

n. Preemption of Other Business Associate Agreements and Liability Limitations/Exclusions. Any limitations on liabilities or exclusions from liability previously agreed upon by the parties, whether written or oral, shall not be applicable to breaches of this Business Associate Agreement, HIPAA, the HIPAA Standards, and other confidentiality and privacy requirements regarding Protected Health Information under this Business Associate Agreement. To the extent that any provision of this Business Associate Agreement conflicts with the Agreement or any other agreement between the parties, whether written or oral, the provisions of this Business Associate Agreement shall govern. Furthermore, and by way of example and not limitation, the termination provisions of this Business Associate Agreement shall supersede the termination provisions of any other agreement, including, but not limited to, any limitations on terminating the Service Agreement or any other agreement (such as notice periods) or any provisions requiring a period to cure.

o. Right to Cure. Business Associate agrees that Covered Entity has the right, but not the obligation, to cure any and all breaches of Business Associate's privacy, security and confidentiality obligations under this Business Associate Agreement. Any expenses or costs associated with Covered Entity's cure of Business Associate's breach(es) shall be borne solely by Business Associate. The exercise by Covered Entity of its rights under this Section shall not act as a waiver of any remedies, whether at law or in equity, that Covered Entity may seek against Business Associate for any breach by Business Associate of its privacy, security, and confidentiality obligations under this Business Associate Agreement.

p. Regulatory References. A reference in this Business Associate Agreement to a section in the HIPAA Standards means the section as in effect or as amended, and for which compliance is required.

q. Entire Business Associate Agreement. This document, together with any written schedules, amendments and addenda, constitute the entire agreement of the parties and supersedes all prior oral and written agreements or understandings between them with respect to the matters provided for herein.

r. Waiver of Breach. No failure or delay by either Party in exercising its rights under this Business Associate Agreement shall operate as a waiver of such rights, and no waiver of any breach shall constitute a waiver of any prior, concurrent, or subsequent breach.

s. Titles. Titles or headings are used in this Business Associate Agreement for reference only and shall not have any effect on the construction or legal effect of this Business Associate Agreement.

t. Independent Contractors. For purposes of this Business Associate Agreement, Covered Entity and Business Associate are and will act at all times as independent contractors. None of the provisions of this Business Associate Agreement are intended to create, nor shall be deemed or construed to create, any relationship other than that of independent entities contracting with each other for the purpose of effecting this Business Associate Agreement. None of the provisions of this Business Associate Agreement shall establish or be deemed or construed to establish any partnership, agency, employment agreement or joint venture between the parties.

u. No Third Party Beneficiaries. It is the intent of the parties that this Business Associate Agreement is to be effective only in regards to their rights and obligations with respect to each other. It is expressly not the intent of the parties to create any independent rights in any third party or to make any third-party beneficiary of this Business Associate Agreement and no privity of contract shall exist between third parties and each Party.

Each Party to this Business Associate Agreement warrants that it has full power and authority to enter into this Business Associate Agreement, and the person signing this Business Associate Agreement on behalf of either Party warrants that he/she has been duly authorized and empowered to enter into this Business Associate Agreement.

IN WITNESS WHEREOF, the parties hereto have executed this Business Associate Agreement as of the Effective Date.

BUSINESS ASSOCIATE

By:

Printed Name:

Title:

COVERED ENTITY

By:

Printed Name:

Title:

cc: Covered Entity HIPAA Compliance Officer