Attachment_15_Business_Associate_Agreement__HIPPA_.docx

Request for Proposal Solicitation No. BPM005633 Foreign Language Interpretation and Translation Services Arizona Department of Administration State Procurement Office 100 N 15th Avenue Phoenix, AZ 85007

Attachment 15 Business Associates Addendum (HIPAA)

This Business Associates Agreement is in effect for those State entities that are HIPAA Covered Components. The “State” HIPAA Covered Component entities are:

1. Arizona Health Care Cost Containment System (AHCCCS)

2. Arizona Department of Economic Security (ADES)

3. Arizona Department of Child Safety (ADCS)

4. Arizona Department of Health Services (ADHS)

5. Arizona Department of Administration Benefits section

6. Arizona Veterans Home

For good and valuable consideration, the State and Business Associate agree to be bound to the terms and conditions of this BAA.

STATE and Business Associate agree that the underlying Contract shall comply with the Administrative Simplification requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as set forth in Title 45, Parts 160 and 164 of the Code of Federal Regulations (the "CFR"), as amended. In the event of conflicting terms or conditions, this Addendum shall supersede the underlying Contract.

The State will only consider this BAA to be fully executed if it is signed without any modifications.

1. DEFINITIONS

The following terms used in this Addendum shall have the same meaning as those terms in the HIPAA rules set forth in Title 45, Parts 160 and 164 of the CFR: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

0. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE

Business Associate agrees to:

2.1 Not use or disclose protected health information (“PHI”) other than as permitted or required by this Addendum or as required by law;

2.2 Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of protected health information other than as provided for by this Addendum;

2.3 Report to STATE any use or disclosure of PHI not provided for by this Addendum of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR §164.410, and any security incident of which it becomes aware in the following manner;

2.3.1 Reporting. Business Associate shall report to STATE any use or disclosure of PHI that is not authorized by the Contract, by law, or in writing by STATE. Business Associate shall make an initial report to the STATE not more than twenty-four (24) hours after Business Associate learns of such unauthorized use or disclosure. The initial report shall include all of the following information to the extent known to the Business Associate at the time of the initial report:

a. A description of the nature of the unauthorized use or disclosure, including the number of individuals affected by the unauthorized use or disclosure;

b. A description of the PHI used or disclosed;

c. The date(s) on which the unauthorized use or disclosure occurred;

d. The date(s) on which the unauthorized use or disclosure was discovered;

e. Identify the person(s) who used or disclosed the PHI in an unauthorized manner;

f. Identify the person(s) who received PHI disclosed in an unauthorized manner;

g. A description of actions, efforts, or plans undertaken by the Business associate to mitigate the harm of the unauthorized disclosure;

h. A description of corrective actions undertaken or planned to prevent future similar unauthorized use or disclosure;

i. An assessment of whether a breach, as defined in 45 CFR 164.402, has occurred, including, if necessary, an assessment of the probability of harm, and

j. Such other information, as may be reasonably requested by the STATE Privacy Official.

2.3.2 Business Associate shall provide STATE with supplemental reports promptly as new information becomes available, as assessments and action plans are developed, and as action plans are implemented. In any event, Business Associate shall provide a comprehensive written report including all of the information listed above no later than thirty (30) days after discovery of the unauthorized use or disclosure.

5.4 Survival: The obligations of Business Associate under this Section shall survive the termination of the Contract.

6. INDEMNIFICATION AND MISCELLANEOUS

6.1 Indemnification: Business Associate shall indemnify, hold harmless and defend STATE from and against any and all claims, losses, liabilities, costs, civil and criminal penalties, and other expenses resulting from, or relating to, the acts or omissions of Business Associate, its employees, agents, and sub-contractors in connection with the representations, duties and obligations of Business Associate under this Addendum. The parties’ respective rights and obligations under this Section shall survive termination of the Contract.

6.2 Complete Agreement: If the Business Associate is not awarded a Contract at the end of the Solicitation process (BPM001416), this BAA shall constitute the entire agreement of the State and Business Associate with respect to the State data given to Business Associate during the Solicitation process. The State and Business Associate have not made any representations, warranties, inducements, or oral agreements except as expressly set forth herein. Business Associate and the State may not change, modify, or rescind this BAA except in writing, signed by Contractor and the Procurement Officer.

6.3 Exclusive Remedy: This BAA shall be the exclusive source of remedy for any claim arising out of the subject matter of this BAA.

6.4 Successors: This BAA shall be binding upon, and inure to the benefit of, any successors and assigns of the State and Business Associate.

6.5 Regulatory References: A reference in this Addendum to a section in the HIPAA rules means the section as in effect or as amended.

6.6 Amendment: The parties agree to take such action as is necessary to amend this Addendum from time to time as is necessary for compliance with the requirements of the HIPAA rules or any other applicable law.

6.7 Interpretation: Any ambiguity in this Addendum shall be interpreted to permit compliance with the HIPAA rules.

6.8 Governing Law: This Addendum and any action related thereto shall be governed by and interpreted under the laws of the State of Arizona. The parties expressly consent to the jurisdiction and venue of the state and federal courts of Phoenix, Arizona for any action arising from or related to this Addendum.

Business Associate hereby acknowledges receipt and acceptance of this HIPAA Business Associate Agreement and that a signed copy must be filed with the Procurement Office.

9-29-23

Signature Date

Liz Topete-Stonefield Printed Name

________President & C.E.O.________________ Title

Topete/Stonefield, Inc.

Name of Contractor / Vendor

The above referenced HIPAA Business Associate Agreement is hereby executed this __________ day of _______________ 2022 by the Department of Administration, on behalf of the State of Arizona Benefit Options Health Care Plans subject to HIPAA Privacy and Security.

Statewide Procurement Manager

Printed Name image1.jpeg image2.jpg