Attachment_13.pdf

Rev. 7/2022 Attachment H - Page 1

ATTACHMENT H

FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT

BUSINESS ASSOCIATE AGREEMENT

For a CONTRACTOR that creates, receives, maintains, or transmits individually identifiable health information on behalf of a New York State Department of Health HIPAA-Covered Program.

I. Definitions. For purposes of this Attachment H of this Contract (the “Business Associate Agreement” or “BAA”)::

A. “Business Associate” shall mean CONTRACTOR.

B. “Covered Program” shall mean the STATE.

C. Other terms used, but not otherwise defined, in this BAA shall have the same meaning as those terms in the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and implementing regulations, including those at 45 CFR Parts 160 and 164.

II. Obligations and Activities of Business Associate:

A. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or required by this Contract or as required by law.

B. Business Associate agrees (1) to use the appropriate administrative, physical and technical safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Contract and (2) to comply with the security standards for the protection of electronic protected health information in 45 CFR Part 164, Subpart C. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Contract.

C. Business Associate agrees to report to Covered Program as soon as reasonably practicable any use or disclosure of the Protected Health Information not provided for by this Contract of which it becomes aware. Business Associate also agrees to report to Covered Program any Breach of Unsecured Protected Health Information of which it becomes aware. Such report shall include, to the extent possible:

1. A brief description of what happened, including the date of the Breach and the date of the discovery of the Breach, if known;

2. A description of the types of Unsecured Protected Health Information that were involved in the Breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);

Rev. 7/2022 Attachment H - Page 2

3. The identification of each individual, to the extent possible, whose Unsecured Protected Health Information has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, used, or disclosed during the Breach.

4. Any steps individuals should take to protect themselves from potential harm resulting from the Breach;

5. A description of what Business Associate is doing to investigate the Breach, to mitigate harm to individuals, and to protect against any further Breaches; and

6. Contact procedures for Covered Program to ask questions or learn additional information.

D. Business Associate agrees, in accordance with 45 CFR § 164.502(e)(1)(ii), to ensure that any Subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of the Business Associate agree to the same restrictions and conditions that apply to Business Associate with respect to such information.

E. Business Associate agrees to provide access, at the request of Covered Program, and in the time and manner designated by Covered Program, to Protected Health Information in a Designated Record Set, to Covered Program in order for Covered Program to comply with 45 CFR § 164.524.

F. Business Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that Covered Program directs in order for Covered Program to comply with 45 CFR § 164.526.

G. Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Program to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR § 164.528; and Business Associate agrees to provide to Covered Program, in time and manner designated by Covered Program, information collected in accordance with this Contract, to permit Covered Program to comply with 45 CFR § 164.528.

H. Business Associate agrees, to the extent the Business Associate is to carry out Covered Program’s obligation under 45 CFR Part 164, Subpart E, to comply with the requirements of 45 CFR Part 164, Subpart E that apply to Covered Program in the performance of such obligation.

I. Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of, Covered Program available to Covered Program, or to the Secretary of the federal Department of Health and Human Services, in a time and manner designated by Covered Program or the Secretary, for purposes of the Secretary determining Covered Program’s compliance with HIPAA, HITECH and 45 CFR Parts 160 and 164.

Rev. 7/2022 Attachment H - Page 3

III. Permitted Uses and Disclosures by Business Associate A. Except as otherwise limited in this Contract, Business Associate may only use or disclose Protected Health Information as necessary to perform functions, activities, or services for, or on behalf of, Covered Program as specified in this Contract.

B. Business Associate may use Protected Health Information for the proper management and administration of Business Associate.

C. Business Associate may disclose Protected Health Information as required by law.

IV. Term and Termination

A. Term. This Business Associate Agreement shall be effective for the term specified on the cover page of this Contract, after which time all of the Protected Health Information provided by Covered Program to Business Associate, or created or received by Business Associate on behalf of Covered Program, shall be destroyed or returned to Covered Program; provided that, if it is infeasible to return or destroy Protected Health Information, protections are extended to such Information, in accordance with the termination provisions in this BAA.

B. Termination for Cause. The Covered Program may immediately terminate this Contract, and any other related agreement, if it determines, in its sole discretion, that the Business Associate has violated a material term of this BAA. The Covered Program may, but is not required to, provide Business Associate with written notice of that determination and allow Business Associate up to 30 days to cure, to the Covered Program’s reasonable satisfaction, any such violation.

C. Effect of Termination.

1. Except as provided in paragraph (c)(2) below, upon termination of this

Contract, for any reason, Business Associate shall return or destroy all Protected Health Information received from Covered Program, or created or received by Business Associate on behalf of Covered Program. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information.

2. In the event that returning or destroying the Protected Health Information is infeasible, Business Associate shall provide to Covered Program notification of the conditions that make return or destruction infeasible.

Upon mutual agreement of Business Associate and Covered Program that return or destruction of Protected Health Information is infeasible, Business Associate shall extend the protections of this Contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information and discontinue all further uses and disclosures of such Protected Health Information, for so long as Business Associate maintains such Protected Health Information.

Rev. 7/2022 Attachment H - Page 4

V. Violations A. Any violation of this BAA may cause irreparable harm to the STATE. Therefore, the STATE may seek any legal remedy, including an injunction or specific performance for such harm, without bond, security or necessity of demonstrating actual damages.

B. Business Associate shall indemnify and hold the STATE harmless against all claims, suits, actions, damages, and costs, resulting from, relating to, or arising out of the acts/omissions of Business Associate, its agents, employees, partners and/or subcontractors in connection with Business Associate’s obligations under this BAA. Business Associate shall be fully liable for the actions of its agents, employees, partners or subcontractors and shall fully indemnify and save harmless the STATE from suits, actions, damages, obligations, and costs, relating to, or arising out of, any breach notification required by 45 CFR Part 164 Subpart D, State Technology Law § 208, and/or any other notifications required by law, caused by any intentional act or omission or negligent act or omission of Business Associate, its agents, employees, partners or subcontractors, without limitation;

provided, however, that Business Associate shall not indemnify for that portion of any claim, loss or damage arising hereunder due to the negligent act of the

STATE.

VI. Miscellaneous A. Regulatory References. A reference in this BAA to a section in the Code of

Federal Regulations means the section as in effect or as amended, and for which compliance is required.

B. Amendment. Business Associate and Covered Program agree to take such action as is necessary to amend this Contract from time to time as is necessary for Covered Program to comply with the requirements of HIPAA, HITECH and 45 CFR Parts 160 and 164.

C. Survival. The respective rights and obligations of Business Associate under Section IV.C and Section V.B. of this BAA shall survive the termination of this Contract.

D. Interpretation. Any ambiguity in this BAA shall be resolved in favor of a meaning that permits Covered Program to comply with HIPAA, HITECH and 45 CFR Parts 160 and 164.

E. HIV/AIDS. If HIV/AIDS information is to be disclosed under this Contract, Business Associate acknowledges that it has been informed of the confidentiality requirements of Public Health Law Article 27-F.