Attachment 11_Business Associates Addendum (HIPAA).docx

Request for Proposal

Solicitation No. BPM007086

Statewide Mobile Diagnostic Imaging Services Arizona Department of Administration State Procurement Office

Business Associates Addendum (HIPAA)

This Addendum is made part of this Contract between the State of Arizona System ("STATE") and The Contractor / Vendor referred to as “Business Associate” in this Addendum, if the Contractor is awarded a Contract by the Procurement Officer. If the Business Associate does not receive a Contract award, this Business Associates Addendum (“BAA”) will constitute a standalone agreement between the State and the Business Associate with respect to any and all State data given to Business Associate for use in the Solicitation process.

For good and valuable consideration, the State and Business Associate agree to be bound to the terms and conditions of this BAA.

STATE and Business Associate agree that the underlying Contract shall comply with the Administrative Simplification requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as set forth in Title 45, Parts 160 and 164 of the Code of Federal Regulations (the "CFR"), as amended. In the event of conflicting terms or conditions, this Addendum shall supersede the underlying Contract.

The State will only consider this BAA to be fully executed if it is signed without any modifications.

1. DEFINITIONS

The following terms used in this Addendum shall have the same meaning as those terms in the HIPAA rules set forth in Title 45, Parts 160 and 164 of the CFR: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE

Business Associate agrees to:

2.1. Not use or disclose protected health information (“PHI”) other than as permitted or required by this Addendum or as required by law;

2.2. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of protected health information other than as provided for by this Addendum;

2.3. Report to STATE any use or disclosure of PHI not provided for by this Addendum of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR §164.410, and any security incident of which it becomes aware in the following manner;

2.3.1. Reporting. Business Associate shall report to STATE any use or disclosure of PHI that is not authorized by the Contract, by law, or in writing by STATE. Business Associate shall make an initial report to the STATE not more than twenty-four (24) hours after Business Associate learns of such unauthorized use or disclosure. The initial report shall include all of the following information to the extent known to the Business Associate at the time of the initial report:

A. A description of the nature of the unauthorized use or disclosure, including the number of individuals affected by the unauthorized use or disclosure;

B. A description of the PHI used or disclosed;

C. The date(s) on which the unauthorized use or disclosure occurred;

D. The date(s) on which the unauthorized use or disclosure was discovered;

E. Identify the person(s) who used or disclosed the PHI in an unauthorized manner;

F. Identify the person(s) who received PHI disclosed in an unauthorized manner;

G. A description of actions, efforts, or plans undertaken by the Business associate to mitigate the harm of the unauthorized disclosure;

H. A description of corrective actions undertaken or planned to prevent future similar unauthorized use or disclosure;

I. An assessment of whether a breach, as defined in 45 CFR 164.402, has occurred, including, if necessary, an assessment of the probability of harm, and J. Such other information, as may be reasonably requested by the STATE Privacy Official.

Business Associate shall provide STATE with supplemental reports promptly as new information becomes available, as assessments and action plans are developed, and as action plans are implemented. In any event, Business Associate shall provide a comprehensive written report including all of the information listed above no later than thirty (30) days after discovery of the unauthorized use or disclosure.

2.3.2. Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of the Contract.

2.3.3. Sanctions. Business Associate shall have and apply appropriate sanctions against any employee, subcontractor or agent who uses or discloses STATE PHI in violation of this Addendum or applicable law.

2.4. In accordance with 45 CFR §164.502(e)(1)(ii) and §164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions and requirements that apply to the Business Associate with respect to such information;

2.5. Make available PHI in a designated record set to STATE as necessary to satisfy STATE’ obligations under 45 CFR §164.524;

2.6. Make any amendment(s) to PHI in a designated record set as directed or agreed to by STATE pursuant to 45 CFR §164.526, or take other measures as necessary to satisfy STATE’ obligations under 45 CFR §164.526;

2.7. Maintain and make available the information required to provide an Accounting of Disclosures to STATE as necessary to satisfy STATE’ obligations under 45 CFR §164.528;

2.8. To the extent Business Associate is to carry out one or more of STATE’ obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to STATE in the performance of such obligation(s); and

2.9. Make its internal practices, books and records available to STATE and the Secretary for purposes of determining compliance with the HIPAA rules within ten (10) business days of a written request by STATE.

3. PERMITTED USES AND DISLOSURES BY BUSINESS ASSOCIATE

3.1. Business Associate may only use or disclose PHI as necessary to perform the services and obligations set forth in the underlying Contract;

3.2. Business Associate may use or disclose protected health information as required by law;

3.3. Business Associate agrees to make uses and disclosures and requests for protected health information consistent with minimum necessary requirements ;

3.4. Business Associate may not use or disclose protected health information in a manner that would violate Subpart E of 45 CFR Part 164 if done by STATE, except for the specific uses and disclosures set forth below in (3.5 and 3.6);

3.5. Business Associate may use protected health information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate; and

3.6. Business Associate may provide data aggregation services relating to the health care operations of STATE.

4. PROVISIONS FOR STATE TO INFORM BUSINESS ASSOCIATE OF PRIVACY PRACTICES AND RESTRICTIONS

4.1. STATE shall notify Business Associate of any limitation(s) in the STATE Notice of Privacy Practices under 45 CFR §164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI;

4.2. STATE shall notify Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose his or her PHI, to the extent that such changes may affect Business Associate’s use or disclosure of PHI; and

4.3. STATE shall notify Business Associate of any restriction on the use or disclosure of PHI that STATE has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

5. TERM AND TERMINATION

5.1. Term: This Addendum is effective upon the effective date of the underlying Contract and shall terminate on the date STATE terminates the contract for cause as authorized in Section 5.2, or for any other reason permitted under the contract, whichever is sooner.

5.2. Termination for Cause: Business Associate authorizes termination of the Contract by STATE if STATE determines that Business Associate has breached a material term of this Addendum and Business Associate has not cured the breach or ended the violation within the time specified by STATE.

5.3. Obligations of Business Associate Upon Termination: Upon termination, cancellation, expiration or other conclusion of the Contract, Business Associate, with respect to PHI received from STATE, or created, maintained, or received by Business Associate on behalf of STATE, shall:

5.3.1. Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

5.3.2. Destroy or return to STATE all remaining PHI that the Business Associate still maintains in any form;

5.3.3. Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI to prevent use or disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate retains the PHI;

5.3.4. Not use or disclose the PHI retained by Business Associate other than for the purposes for which such protected health information was retained and subject to the same conditions set out in this Addendum that applied prior to termination; and

5.3.5. Destroy or return to STATE the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal and contractual responsibilities.

5.4. Survival: The obligations of Business Associate under this Section shall survive the termination of the Contract.

6. INDEMNIFICATION AND MISCELLANEOUS

6.1. Indemnification: Business Associate shall indemnify, hold harmless and defend STATE from and against any and all claims, losses, liabilities, costs, civil and criminal penalties, and other expenses resulting from, or relating to, the acts or omissions of Business Associate, its employees, agents, and sub-contractors in connection with the representations, duties and obligations of Business Associate under this Addendum. The parties’ respective rights and obligations under this Section shall survive termination of the Contract.

6.2. Complete Agreement: If the Business Associate is not awarded a Contract at the end of the Solicitation process, this BAA shall constitute the entire agreement of the State and Business Associate with respect to the State data given to Business Associate during the Solicitation process. The State and Business Associate have not made any representations, warranties, inducements, or oral agreements except as expressly set forth herein. Business Associate and the State may not change, modify, or rescind this BAA except in writing, signed by Contractor and the Procurement Officer.

6.3. Exclusive Remedy: This BAA shall be the exclusive source of remedy for any claim arising out of the subject matter of this BAA.

6.4. Successors: This BAA shall be binding upon, and inure to the benefit of, any successors and assigns of the State and Business Associate.

6.5. Regulatory References: A reference in this Addendum to a section in the HIPAA rules means the section as in effect or as amended.

6.6. Amendment: The parties agree to take such action as is necessary to amend this Addendum from time to time as is necessary for compliance with the requirements of the HIPAA rules or any other applicable law.

6.7. Interpretation: Any ambiguity in this Addendum shall be interpreted to permit compliance with the HIPAA rules.

6.8. Governing Law: This Addendum and any action related thereto shall be governed by and interpreted under the laws of the State of Arizona. The parties expressly consent to the jurisdiction and venue of the state and federal courts of Phoenix, Arizona for any action arising from or related to this Addendum.

Business Associate hereby acknowledges receipt and acceptance of this HIPAA Business Associate Agreement and that a signed copy must be filed with the Procurement Office.

Signature Date

Printed Name

Title

Name of Contractor / Vendor

The above referenced HIPAA Business Associate Agreement is hereby executed this __________ day of _______________ 2023 by the Department of Administration, on behalf of the State of Arizona Benefit Options Health Care Plans subject to HIPAA Privacy and Security.

Statewide Procurement Manager

Printed Name

Solicitation Offer Forms Page 2 of 6 image1.jpg