Attachment 12 - Business Associate Agreement.docx

DOCX document 28 KB Posted Sep 25, 2026

Attached to: Foster Care Case Management
Solicitation number: 300000283718677
Issued by: Missouri

About this file

Written by GovTribe AI · Sep 29, 2026

This is a Business Associate Agreement (BAA) attachment for a Foster Care Case Management contract issued by the Missouri Department of Social Services. The agreement establishes the legal framework governing the contractor's obligations as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH). The BAA defines the permitted uses and disclosures of Protected Health Information (PHI) and Electronic Protected Health Information (ePHI) that the contractor may access or create while performing services on behalf of the Department. The contractor is required to implement appropriate administrative, physical, and technical safeguards to protect PHI, including workforce training, encryption of portable devices and electronic transmissions, and policies preventing inappropriate use or disclosure by employees, agents, and subcontractors.

The contractor must comply with all applicable HIPAA Rules, including the Privacy, Security, Breach Notification, and Enforcement Rules. Key obligations include reporting security incidents, unauthorized uses or disclosures, and breaches to the Department's Security and Privacy Officers within five to ten calendar days of discovery; providing access to PHI and accountings of disclosures within five calendar days of request; maintaining records for a minimum of six years; and indemnifying the Department for any liability, costs, and attorney's fees resulting from HIPAA violations or breaches caused by the contractor's conduct or omission. Upon contract expiration, termination, or cancellation, the contractor must return or destroy all PHI at the Department's discretion. The Department is obligated to notify the contractor of privacy practices, authorization changes, and restrictions on PHI use or disclosure. The agreement expressly prohibits the contractor from receiving remuneration for PHI without valid authorization, and any material breach of the BAA's provisions may result in contract cancellation and reporting to the Secretary of the Department of Health and Human Services.

View the file

Other files

File	Type	Posted
State 0000000597SL FCCM.docx	DOCX document	Sep 28, 2026
Attachment 1 - Current Case Information by County per Region.pdf	PDF	Sep 25, 2026
Attachment 2 - Case Distribution by County for New Contract Awards.pdf	PDF	Sep 25, 2026
Attachment 3 - Percentage of Children Placed in Relative and Foster Home Placements.pdf	PDF	Sep 25, 2026
Attachment 4 - Number of LS1 Cases by County per Region.pdf	PDF	Sep 25, 2026
Attachment 5 - Joint Settlement Agreement Training Compliance Protocol.docx	DOCX document	Sep 25, 2026
Attachment 6 - Referral Letter.docx	DOCX document	Sep 25, 2026
Attachment 7 - Record Transfer Protocol.docx	DOCX document	Sep 25, 2026
Attachment 8 - Replacement Case Protocol.docx	DOCX document	Sep 25, 2026
Attachment 9 - Service Transition Protocol.docx	DOCX document	Sep 25, 2026
Attachment 10 - Transitional Living Program Requirements.docx	DOCX document	Sep 25, 2026
Attachment 11 - Contracted Case Management External Inquiry Form.docx	DOCX document	Sep 25, 2026
Attachment 13 - Federal Funds Requirements.docx	DOCX document	Sep 25, 2026

Show all 13

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

STATE 0000000597SL

Attachment 12 – Business Associate Agreement (rev 12-29-2025) (Health Insurance Portability and Accountability Act of 1996, as amended)

1.	Health Insurance Portability and Accountability Act of 1996, as amended - The Department and the contractor are both subject to and must comply with provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH) (PL-111-5) (collectively, and hereinafter, HIPAA) and all regulations promulgated pursuant to authority granted therein. The contractor constitutes a “Business Associate” of the Department. Therefore, the term, “contractor” as used in this section shall mean “Business Associate” and “Department” as used in this section shall mean “covered entity.”
2.	The contractor agrees that for purposes of the Business Associate Agreement contained herein, terms used but not otherwise defined shall have the same meaning as those terms defined in 45 CFR Parts 160 and 164 and 42 U.S.C. §§ 17921 et. seq. including, but not limited to the following:
a.	“Access”, “administrative safeguards”, “confidentiality”, “covered entity”, “data aggregation”, “designated record set”, “disclosure”, “hybrid entity”, “information system”, “physical safeguards”, “required by law”, “technical safeguards”, “use” and “workforce” shall have the same meanings as defined in 45 CFR 160.103, 164.103, 164.304, and 164.501 and HIPAA.
b.	“Breach” shall mean the unauthorized acquisition, access, use, or disclosure of Protected Health Information which compromises the security or privacy of such information, except as provided in 42 U.S.C. § 17921. This definition shall not apply to the term “breach of contract” as used within the contract.
c.	“Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean the contractor.
d.	“Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean the Department.
e.	“Electronic Protected Health Information” shall mean information that comes within paragraphs (1)(i) or (1)(ii) of the definition of Protected Health Information as specified below.
f.	“Enforcement Rule” shall mean the HIPAA Administrative Simplification: Enforcement; Final Rule at 45 CFR Parts 160 and 164.
g.	“Health Care” as defined in 45 CFR §160.103, shall mean care, services, or supplies related to the health of an individual. Health care includes but is not limited to, the following:
	1)	Preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure or function of the body; and
	2)	Sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription.
h.	“HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.
i.	“Individual” shall have the same meaning as the term “individual” in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502 (g).
j.	“Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E.
k.	“Protected Health Information” as defined in 45 CFR 160.103, shall mean individually identifiable health information:
1)	Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; or (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium.
2)	Protected Health Information excludes individually identifiable health information in (i) Education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; (ii) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv); and (iii) Employment records held by a covered entity (Department) in its role as employer
l.	“Security Incident” shall be defined as set forth in the “Obligations of the Contractor” section of the Business Associate Agreement.
m.	“Security Rule” shall mean the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Part 164, Subpart C.
n.	“Unsecured Protected Health Information” shall mean Protected Health Information that is not secured through the use of a technology or methodology determined in accordance with 42 U.S.C. § 17932 or as otherwise specified by the secretary of Health and Human Services.
3.	The contractor agrees and understands that wherever in this document the term "Protected Health Information" is used, it shall also be deemed to include Electronic Protected Health Information.
4.	The contractor must appropriately safeguard Protected Health Information which the contractor receives from or creates or receives on behalf of the Department. To provide reasonable assurance of appropriate safeguards, the contractor shall comply with the business associate provisions stated herein, as well as the provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH) (PL-111-5) and all regulations promulgated pursuant to authority granted therein.
5.	The Department and the contractor agree to amend the contract as is necessary for the parties to comply with the requirements of HIPAA and the Privacy Rule, Security Rule, Enforcement Rule, and other rules as later promulgated (hereinafter referenced as the regulations promulgated thereunder). Any ambiguity in the contract shall be interpreted to permit compliance with the HIPAA Rules.
6.	Permitted Uses and Disclosures of Protected Health Information by the Contractor
6.1	The contractor may not use or disclose Protected Health Information in any manner that would violate Subpart E of 45 CFR Part 164 if done by the Department, except for the specific uses and disclosures in the contract.
6.2	The contractor may use or disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, the Department as specified in the contract, provided that such use or disclosure would not violate HIPAA and the regulations promulgated thereunder.
6.3	The contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j)(1) and shall notify the Department by no later than ten (10) calendar days after the contractor becomes aware of the disclosure of the Protected Health Information.
6.4	If required to properly perform the contract and subject to the terms of the contract, the contractor may use or disclose Protected Health Information if necessary for the proper management and administration of the contractor’s business.
6.5	If the disclosure is required by law, the contractor may disclose Protected Health Information to carry out the legal responsibilities of the contractor.
6.6	If applicable, the contractor may use Protected Health Information to provide Data Aggregation services to the Department as permitted by 45 CFR 164.504(e)(2)(i)(B).
6.7	The contractor may not use Protected Health Information to de-identify or re-identify the information in accordance with 45 CFR 164.514(a)-(c) without specific written permission from the Department to do so.
6.8	The contractor agrees to make uses and disclosures and requests for Protected Health Information consistent with the Department’s minimum necessary policies and procedures.
7.	Obligations and Activities of the Contractor
7.1	The contractor shall not use or disclose Protected Health Information other than as permitted or required by the contract or as otherwise required by law, and shall comply with the minimum necessary disclosure requirements set forth in 45 CFR § 164.502(b).
7.2	The contractor shall use appropriate administrative, physical and technical safeguards and comply with Subpart C of 45 CFR Part 164 to prevent use or disclosure of the Protected Health Information other than as provided for by the contract. Such safeguards shall include, but not be limited to:
a.	Workforce training on the appropriate uses and disclosures of Protected Health Information pursuant to the terms of the contract;
b.	Policies and procedures implemented by the contractor to prevent inappropriate uses and disclosures of Protected Health Information by its workforce and subcontractors, if applicable;
c.	Encryption of any portable device used to access or maintain Protected Health Information or use of equivalent safeguard;
d.	Encryption of any transmission of electronic communication containing Protected Health Information or use of equivalent safeguard; and
e.	Any other safeguards necessary to prevent the inappropriate use or disclosure of Protected Health Information.
7.3	With respect to Electronic Protected Health Information, the contractor shall use appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the Electronic Protected Health Information that contractor creates, receives, maintains or transmits on behalf of the Department and comply with Subpart C of 45 CFR Part 164, to prevent use or disclosure of Protected Health Information other than as provided for by the contract.
7.4	In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), the contractor shall require that any agent or subcontractor that creates, receives, maintains, or transmits Protected Health Information on behalf of the contractor agrees to the same restrictions, conditions, and requirements that apply to the contractor with respect to such information.
7.5	By no later than ten (10) calendar days after receipt of a written request from the Department, or as otherwise required by state or federal law or regulation, or by another time as may be agreed upon in writing by the Department, the contractor shall make the contractor’s internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, created by, or received by the contractor on behalf of the Department available to the Department and/or to the Secretary of the Department of Health and Human Services or designee for purposes of determining compliance with the HIPAA Rules and the contract.
7.6	The contractor shall document any disclosures and information related to such disclosures of Protected Health Information as would be required for the Department to respond to a request by an individual for an accounting of disclosures of Protected Health Information in accordance with 42 USCA §17932 and 45 CFR 164.528. By no later than five (5) calendar days of receipt of a written request from the Department, or as otherwise required by state or federal law or regulation, or by another time as may be agreed upon in writing by the Department, the contractor shall provide an accounting of disclosures of Protected Health Information regarding an individual to the Department. If requested by the Department or the individual, the contractor shall provide an accounting of disclosures directly to the individual. The contractor shall maintain a record of any accounting made directly to an individual at the individual’s request and shall provide such record to the Department upon request.
7.7	In order to meet the requirements under 45 CFR 164.524, regarding an individual’s right of access, the contractor shall, within five (5) calendar days following a Department request, or as otherwise required by state or federal law or regulation, or by another time as may be agreed upon in writing by the Department, provide the Department access to the Protected Health Information in an individual’s designated record set. However, if requested by the Department, the contractor shall provide access to the Protected Health Information in a designated record set directly to the individual for whom such information relates.
7.8	At the direction of the Department, the contractor shall promptly make any amendment(s) to Protected Health Information in a Designated Record Set pursuant to 45 CFR 164.526.
7.9	The contractor shall report to the Department’s Security Officer any security incident immediately upon becoming aware of such incident and shall take immediate action to stop the continuation of any such incident. For purposes of this paragraph, security incident shall mean the attempted or successful unauthorized access, use, modification or destruction of information or interference with systems operations in an information system. This does not include trivial incidents that occur on a daily basis, such as scans, “pings,” or unsuccessful attempts that do not penetrate computer networks or servers or result in interference with system operations. By no later than five (5) calendar days after the contractor becomes aware of such incident, the contractor shall provide the Department’s Security Officer with a description of any remedial action taken to mitigate any harmful effect of such incident and a proposed written plan of action for approval that describes plans for preventing any such future security incidents.
7.10	The contractor shall report to the Department’s Privacy Officer any unauthorized use or disclosure of Protected Health Information not permitted or required as stated herein immediately upon becoming aware of such use or disclosure and shall take immediate action to stop the unauthorized use or disclosure. By no later than five (5) calendar days after the contractor becomes aware of any such use or disclosure, the contractor shall provide the Department’s Privacy Officer with a written description of any remedial action taken to mitigate any harmful effect of such disclosure and a proposed written plan of action for approval that describes plans for preventing any such future unauthorized uses or disclosures.
7.11	The contractor shall report to the Department’s Security Officer any breach immediately upon becoming aware of such incident and shall take immediate action to stop the continuation of any such incident. By no later than five (5) calendar days after the contractor becomes aware of such incident, the contractor shall provide the Department’s Security Officer with a description of the breach, the information compromised by the breach, and any remedial action taken to mitigate any harmful effect of such incident and a proposed written plan for approval that describes plans for preventing any such future incidents.
7.12	The contractor’s reports required in the preceding paragraphs shall include the following information regarding the security incident, improper disclosure/use, or breach, (hereinafter “incident”):
a.	The name, address, and telephone number of each individual whose information was involved if such information is maintained by the contractor;
b.	The electronic address of any individual who has specified a preference of contact by electronic mail;
c.	A brief description of what happened, including the date(s) of the incident and the date(s) of the discovery of the incident;
d.	A description of the types of Protected Health Information involved in the incident (such as full name, Social Security Number, date of birth, home address, account number, or disability code) and whether the incident involved Unsecured Protected Health Information; and
e.	The recommended steps individuals should take to protect themselves from potential harm resulting from the incident.
7.13	Notwithstanding any provisions of the Terms and Conditions attached hereto, in order to meet the requirements under HIPAA and the regulations promulgated thereunder, the contractor shall keep and retain adequate, accurate, and complete records of the documentation required under this agreement for a minimum of six (6) years as specified in 45 CFR Part 164.
7.14	The contractor shall not directly or indirectly receive remuneration in exchange for any Protected Health Information without a valid authorization.
7.15	If the contractor becomes aware of a pattern of activity or practice of the Department that constitutes a material breach of contract regarding the Department's obligations under the Business Associate Agreement of the contract, the contractor shall notify the Department’s Security Officer of the activity or practice and work with the Department to correct the breach of contract.
7.16	The contractor shall indemnify the Department from any liability resulting from any violation of the Privacy Rule or Security Rule or Breach arising from the conduct or omission of the contractor or its employee(s), agent(s) or subcontractor(s). The contractor shall reimburse the Department for any and all actual and direct costs and/or losses, including those incurred under the civil penalties implemented by legal requirements, including but not limited to HIPAA as amended by the Health Information Technology for Economic and Clinical Health Act, and including reasonable attorney’s fees, which may be imposed upon the Department under legal requirements, including but not limited to HIPAA’s Administrative Simplification Rules, arising from or in connection with the contractor’s negligent or wrongful actions or inactions or violations of this agreement.
8.	Obligations of the Department
8.1	The Department shall notify the contractor of limitation(s) that may affect the contractor’s use or disclosure of Protected Health Information, by providing the contractor with the Department’s notice of privacy practices in accordance with 45 CFR 164.520.
8.2	The Department shall notify the contractor of any changes in, or revocation of, authorization by an Individual to use or disclose Protected Health Information.
8.3	The Department shall notify the contractor of any restriction to the use or disclosure of Protected Health Information that the Department has agreed to in accordance with 45 CFR 164.522.
8.4	The Department shall not request the contractor to use or disclose Protected Health Information in any manner that would not be permissible under HIPAA and the regulations promulgated thereunder.
9.	Expiration/Termination/Cancellation: Except as provided in the subparagraph below, upon the expiration, termination, or cancellation of the contract for any reason, the contractor shall, at the discretion of the Department, either return to the Department or destroy all Protected Health Information received by the contractor from the Department, or created or received by the contractor on behalf of the Department, and shall not retain any copies of such Protected Health Information. This provision shall also apply to Protected Health Information that is in the possession of subcontractor or agents of the contractor.
a.	In the event the Department determines that returning or destroying the Protected Health Information is not feasible, the contractor shall extend the protections of the contract to the Protected Health Information for as long as the contractor maintains the Protected Health Information and shall limit the use and disclosure of the Protected Health Information to those purposes that made return or destruction of the information infeasible. If at any time it becomes feasible to return or destroy any such Protected Health Information maintained pursuant to this paragraph, the contractor must notify the Department and obtain instructions from the Department for either the return or destruction of the Protected Health Information.
10.	Breach of Contract: In the event the contractor is in breach of contract with regard to the business associate provisions included herein, the contractor agrees that in addition to the requirements of the contract related to cancellation of contract, if the Department determines that cancellation of the contract is not feasible, the State of Missouri may elect not to cancel the contract, but the Department shall report the breach of contract to the Secretary of the Department of Health and Human Services.

File details come from the government source that posted it. Updated Sep 29, 2026.