Attach 8 - Business Association Agreement.pdf

Phoenix Area Office, Phoenix, AZ August 19, 2024

Business Associate Agreement

CHC Business Associate Agreement © 2021 July 30, 2021

I. Authority:

Pursuant to 45 C.F.R. § 164.502(e), the Phoenix Area Office (PAO), as a covered entity, is required to enter into an agreement with a “business associate,” as defined by 45 C.F.R. § 160.103, under which the business associate must agree to appropriately safeguard Protected Health Information (PHI) that it will Use and Disclose when providing products, software and/or services (“Services”) pursuant to the General Services Administration Contract Number GS-35F-0176X and applicable Periods of Performance and Purchase Orders (“Contract” or “Contracts”). By signing, Change Healthcare Operations, LLC agrees that it is a Business Associate and will comply with the terms below, in addition to other applicable Contract terms and conditions, and applicable law, relating to the safekeeping, Use, and Disclosure of PHI. This Appendix comprises the Business Associate Agreement (“BAA”).

II. Definitions:

The following terms shall have the same meaning as those terms in 45 C.F.R. Part 160 and Part 164, which are the federal regulations implementing the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended: Breach, Designated Record Set, Disclose/Disclosure, Discovery, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, PHI, Privacy Rule, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured PHI, and Use.

A. Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 C.F.R. § 160.103, and in reference to the party to this BAA shall mean ______________________________

B. Covered Entity. “Covered Entity” shall generally have the same meaning as the term

“covered entity” at 45 C.F.R. § 160.103, and in reference to the party to this BAA, shall mean the ____________________________.

C. HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach

Notification, and Enforcement Rules at 45 C.F.R. Part 160 and Part 164.

III. Obligations and Activities of Business Associate:

A. Compliance: Business Associate agrees not use or disclose PHI other than as authorized by the Contract, or as Required by Law. Business Associate acknowledges that it is directly liable for certain violations under the HIPAA Rules and subject to civil and, in some cases, criminal penalties. Business Associate agrees that it will require all of its employees and subcontractors, to whom Business Associate provides PHI, or who create or receive PHI on behalf of Business Associate for Covered Entity for the Services under this BAA, to comply with the HIPAA Rules and to enter into written agreements with Business Associate that provide substantially the same restrictions, terms, and conditions as set forth in this BAA.

B. Subcontractors: In accordance with 45 C.F.R. §§ 164.502(e) (1) (ii) and

164.308(b)(2), which govern relations with subcontractors, Business Associate agrees

CHC Business Associate Agreement © 2021 July 30, 2021 to ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate for the services provided to Covered Entity agree to the same restrictions, terms, and conditions that apply to Business Associate with respect to such PHI.

C. Safeguarding PHI: Business Associate shall implement and maintain administrative, physical and technical safeguards to prevent the Use or Disclosure of PHI in a manner not permitted by the Contract, this BAA or as Required by Law.

Business Associate will make reasonable efforts to limit any Use, Disclosure, or request for Use or Disclosure of PHI to the minimum amount necessary to accomplish the intended purpose of the Use, Disclosure, or request.

D. Safeguarding Electronic PHI: Business Associate agrees to use appropriate safeguards, as set forth in Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI, to prevent Use or Disclosure of electronic PHI other than as authorized by the Contract, this BAA, or as Required by Law.

E. Reporting Use or Disclosures Not Authorized By this BAA or Required by Law:

Business Associate agrees to report to Covered Entity any use or disclosure of PHI not authorized by this BAA or required by law or any Security Incident within thirty (30) business days of Discovery; provided, however, that the parties acknowledge and agree that this Section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents.

“Unsuccessful Security Incidents” will include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access to, Use or Disclosure of PHI. In addition, Business Associate shall cooperate with Covered Entity’s efforts to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of the use, disclosure, of PHI that is not permitted by this Contract.

F. Notification of Breach of Unsecured PHI: In addition to the above, Business

Associate shall notify Covered Entity of a Breach, as set forth in 45 C.F.R. § 164.410, of Unsecured PHI that Business Associate received from, or created or received on behalf of, Covered Entity within thirty (30) business days after the discovery of the Breach by Business Associate, its employees or subcontractors unless notification is specifically excepted by 45 C.F.R. § 164.412.

1. Requirements of Notice. Such notice shall include, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach; a brief description of the circumstances of the Breach, including the date of the Breach and the date of Business Associate’s discovery of the Breach; and the type of unsecured PHI involved in the Breach. Business Associate agrees to make reasonable efforts to provide any other available information that Covered Entity is required to include in notification to the individual under 45 §164.404(c).

G. Individual Access to PHI: To the extent Business Associate agrees in the Contract to maintain any PHI in a Designated Record Set that is not duplicative of a

CHC Business Associate Agreement © 2021 July 30, 2021

Designated Record Set maintained by Covered Entity, Business Associate shall make such PHI available to Covered Entity within 15 business days of Business Associate’ receipt of a written request by Covered Entity to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.524. Covered Entity shall solely be responsible for: (a) making all determinations regarding the grant or denial of an Individual’s request for PHI contained in a Designated Record Set, and Business Associate will make no such determinations; and (b) releasing PHI contained in such a Designated Record Set to such Individual pursuant to such a request; and (c) all costs and liabilities associated therewith.

H. Accounting of Disclosures: Business Associate shall maintain records of PHI received from, or created or received on behalf of, Covered Entity and shall document subsequent Uses and Disclosures of such information by Business Associate. Business Associate shall, within thirty (30) calendar days after receiving a written request from Covered Entity, provide to Covered Entity such information as required of Covered Entity to fulfill its obligations to account for disclosures of PHI pursuant to 45 C.F.R.

§ 164.528.

I. Amendment of PHI: To the extent Business Associate agrees in the Contract to maintain any PHI in a Designated Record Set that is not duplicative of a Designated Record Set maintained by Covered Entity, Business Associate shall make such PHI available to Covered Entity within twenty (20) business days of Business Associate’ receipt of a written request by Covered Entity to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.526 to amend PHI. Business Associate shall forward to Covered Entity all requests to amend PHI in a Designated Record Set that it receives directly from individuals within twenty (20) calendar days of its receipt of a request.

J. Carrying out Covered Entity’s Obligations: Except as expressly provided in the

Contract or this BAA, Business Associate will not assume any obligations of Covered Entity under the Privacy Rule. To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 C.F.R. Part 164, Business Associate agrees to comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).

K. Disclosures for Verifying Compliance: Upon request, Business Associate shall permit access by the Secretary to its internal practices, books, and records relating to the Use and Disclosure of PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, for purposes of the Secretary determining both Business Associate’s and Covered Entity’s compliance with the Privacy Rule, the Security Rule, or the Breach Notification Rule.

L. Data Aggregation: Business Associate may Use PHI to provide data aggregation services for the health care operations of the Covered Entity as permitted by 45 C.F.R.

§ 164.504(e)(2)(i)(B).

IV. Permitted Uses and Disclosures by Business Associate:

A. De-Identification of PHI: Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514(b) and may Use and Disclose such de-identified data unless prohibited by applicable law.

B. Business Associate agrees that it may Use or Disclose PHI on behalf of Covered

Entity:

1. For the purposes of treatment, payment or health care operations unless Covered Entity has agreed to a restriction pursuant to 45 C.F.R. § 164.520(b)(iv)(A) or 45 C.F.R. § 164.522; or

2. Without an authorization or consent, if in accordance with 45 C.F.R. § 164.510, 45 C.F.R. § 164.512, 45 C.F.R. § 164.514(e), 45 C.F.R. § 164.514(f), or 45 C.F.R. § 164.514(g).

C. Business Associate shall Use and Disclose PHI in compliance with each applicable requirement of 45 C.F.R. § 164.504(e), which section is fully incorporated herein.

D. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except that Business Associate may use or disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate.

Business Associate may Disclose PHI to a third party for such purposes, provided the disclosures are Required by Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as Required by Law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

V. Obligations of Covered Entity:

A. Covered Entity shall provide Business Associate within fifteen (15) days, if practicable, with its Notice of Privacy Practices and any changes to the Notice.

B. Covered Entity shall notify Business Associate within fifteen (15) days, if practicable, of any limitation(s) in Covered Entity’s Notice of Privacy Practices under 45 C.F.R. § 164.520, to the extent that such limitation may affect Business Associate’s Use or Disclosure of PHI.

C. Covered Entity shall notify Business Associate within fifteen (15) days, if practicable, of any change in, or revocation of, the permission by an individual to Use or Disclose his or her PHI to the extent that such changes may affect Business Associate’s Use or Disclosure of PHI.

D. Covered Entity shall notify Business Associate within fifteen (15) days, if practicable, of any restriction on the Use or Disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate’s Use or Disclosure of PHI.

E . Covered Entity will notify Business Associate 15 business days, if practicable, prior to the effective date of: (a) any limitations in its notice of privacy practices in

CHC Business Associate Agreement © 2021 July 30, 2021 accordance with 45 C.F.R. § 164.520; (b) any changes in, or revocation of, permission by an Individual to Use or Disclose PHI; or (c) any restriction to the Use or Disclosure of PHI that Covered Entity has agreed to in accordance with 45 C.F.R.

§ 164.522. Covered Entity will make a notification to the extent that the limitation, restriction, or change may affect Business Associate’s Use or Disclosure of PHI in connection with the Services, and, with respect to those changes described in (b) and (c), Covered Entity will take all necessary measures to ensure that Business Associate will not receive any PHI following the date of any changes in or revocation of permission described in (b) or any restriction described in (c) and will assume any associated liabilities.

F. Covered Entity shall not request Business Associate to Use or Disclose PHI in any manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if done by Covered Entity, except as provided in Part IV, Subpart F, Section 1 or, to the extent permitted by the Contract or this BAA, Business Associate may Use or Disclose PHI for Business Associate’s data aggregation activities or proper management and administrative activities.

G. Except as expressly provided in the Contract or this BAA, Business Associate will not assume any obligations of Covered Entity under the Privacy Rule. To the extent Business Associate is to carry out Covered Entity’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to Covered Entity’s compliance with such obligations

VI. Termination:

A. Term: The Term of this BAA shall be effective as of the date Business Associate signs the underlying Contract and shall terminate when the Contract ends or on the date Covered Entity or Business Associate terminates for cause as authorized in paragraph (B) of this Section, whichever is sooner.

B. Termination for Cause: Each party authorizes termination of this BAA by the other party, if the terminating party determines that the other party has violated a material term of the BAA and the other party has not ended the violation within twenty (20) business days.

C. Obligations of Business Associate Upon Termination: Upon termination of this

BAA for any reason, Business Associate, with respect to PHI received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, shall:

1. Except as provided in Part VI. Subpart C. Section 2, upon termination of this BAA for any reason, Business Associate will return or destroy all PHI that Business Associate or its Subcontractor maintain in any form or format, at Covered Entity’s expense.

2. If Business Associate believes that returning or destroying PHI upon termination of this BAA for any reason is infeasible, Business Associate will: (a) extend the protections of this BAA to the PHI; and (b) limit further

CHC Business Associate Agreement © 2021 July 30, 2021

Uses and Disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains the PHI.

3. Not Use or Disclose PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions.

D. Survival: The obligations of Business Associate under this Part shall survive the termination of this BAA.

VII. Cost Reimbursement: In the event of a Breach caused solely by Business Associate or its employees or subcontractors and notice to Individuals is required pursuant to the Breach Notification Rule, Business Associate agrees to reimburse Covered Entity for the reasonable and substantiated costs related to the following: providing notifications to affected individuals, the media, or the Secretary, providing credit monitoring services to the affected individuals, if appropriate, for up to one (1) year, any fines and penalties assessed against Covered Entity directly attributable to a Breach by Business Associate or its employees or subcontractors, investigation costs, and mitigation efforts required under the Privacy Rule or Security Rule.

BUSINESS ASSOCIATE’S TOTAL CUMALATIVE LIABILTY UNDER THIS BAA FOR

BREACH OF CONTRACT, WARRANTY, TORT, PRODUCT LIABILITY, OR OTHERWISE,

IS LIMITED TO THE TOTAL FEES PAID (LESS ANY REFUNDS, CREDITS, AND PASS-

THROUGH FEES) BY COVERED ENTITY TO BUSINESS ASSOCIATE UNDER THE

APPLICABLE PURCHASE ORDER FOR THE PRODUCT OR SERVICE GIVING RISE TO

THE CLAIM DURING THE TWELVE (12) MONTHS PRERIOD PRECEDING THE DATE OF

THE CLAIM. NEITHER PARTY IS LIABLE TO THE OTHER PARTY UNDER THIS BAA

FOR ANY SPECIAL, INCIDENTAL, INDIRECT, OR CONSEQUENTIAL DAMANGES, OR

LOST PROFITS, LOST REVENUE, OR LOSS OF REPUTATION OR GOODWILL, WHETHER

BASED ON BREACH OF CONTRACT, WARRANTY, TORT, PRODUCT LIABILITY, OR

OTHERWISE, EVEN IF BUSINESS ASSOCIATE HAS BEEN ADVISED OF THE

POSSIBILITY OF THE DAMAGE

VIII. Cooperation in Investigations: The parties acknowledge that certain breaches or violations of this BAA may result in litigation or investigations pursued by federal or state governmental authorities of the United States resulting in civil liability or criminal penalties. Each party will cooperate in good faith in all respects with the other party in connection with any request by a federal or state governmental authority for additional information and documents or any governmental investigation, complaint, action or other inquiry.

IX. Miscellaneous:

A. Incorporation: This BAA modifies and supplements the terms and conditions of the

Contract, will be considered an attachment to the Contract, and is incorporated as though fully set forth within the Contract. This BAA will govern in the event of conflict or inconsistency with any provision of the Contract.

B. Notices: All notices relating to the parties’ legal rights and remedies under this

BAA: (a) will be provided in writing to a party; (b) will be sent to its address set forth in the Contract, or to such other address as may be designated by that party by notice to the sending party; and (c) will reference this Agreement.

C. Regulatory References: A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended.

D. Amendment: The Parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for compliance with the requirements of the HIPAA Rules and any other applicable law.

E. Interpretation: The terms of this BAA will be construed in light of any applicable interpretation or guidance on the Privacy Rule, the Security Rule, or the Breach Notification Rule issued by HHS.

F. Successors and Assigns: This BAA shall be binding upon, inure to the benefit of and be enforceable by and against the Parties and their successors and assigns.

G. Severability: If a court of competent jurisdiction deems any provision of this BAA unenforceable, such provision shall be severed from this BAA and every other provision of the BAA shall remain in full force and effect.

Contractor:

Phoenix Area Office-Indian Health Service. Issued Blank Purchase Agreement Calls on an individual basis. Designee is Designated Contracting Officer’s Representative (COR) with coordination with Contracting Officer (CO).

By: _______________________________ By: _____._________________

Name: _______________________________ Name: _____________________________

Title: _______________________________ Title: ____________ _________________

Date: ________________________________ Date: __________________________