Attachment 4 - HIPAA Business Associate Agreement.docx
DOCX document 30 KB Posted
- Attached to
- Actuarial Analysis & Consulting
- Solicitation number
- 26-478HFS-MEDPR-B-52728
- Issued by
- Illinois
About this file
This document is a HIPAA Business Associate Agreement (BAA) executed between the Illinois Department of Healthcare and Family Services (HFS) and Milliman, Inc., serving as an attachment to a contract for Actuarial Analysis and Consulting Services (BidBuy #26-478HFS-MEDPR-B-52728, Agency Reference Number 2026-36-001). The agreement establishes the legal framework governing how Milliman, Inc., as a Business Associate, must handle Protected Health Information (PHI) in performing actuarial services, including assistance in reviewing, advising on, and developing actuarially sound rates for Managed Care Organizations participating in Illinois Medicaid and related medical programs. The BAA becomes effective upon execution of the underlying contract and remains in effect for the contract's duration, with obligations surviving any termination.
The agreement imposes comprehensive obligations on Milliman, Inc. regarding PHI protection, including restrictions on use and disclosure to only what is necessary for performing contracted services, implementation of appropriate safeguards and encryption of PHI at rest and in transmission, and mandatory reporting of any breaches or security incidents to HFS within 24 hours of discovery using the provided Notification form. Upon contract termination, Milliman, Inc. must destroy all PHI in accordance with NIST Special Publication 800-88 standards and certify such destruction in writing, or if destruction is infeasible, extend protections indefinitely. Milliman, Inc. bears financial responsibility for breach-related costs, including individual notifications, credit monitoring services for affected individuals for at least 12 months, and any resulting litigation costs, fines, or penalties, and must indemnify HFS for unauthorized acquisition, access, use, or disclosure of Unsecured PHI. The agreement further requires that any subcontractors or agents receiving PHI execute written agreements with restrictions at least as stringent as those imposed on the Business Associate.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| BEP Utilization Plan v.26.1~7.pdf | ||
| Commitment to Diversity - Vendor Guidance.pdf | ||
| Attachment 5 - State Security Requirements.docx | DOCX document | |
| Commitment to Diversity - Vendor Answer Sheet.pdf | ||
| 2026-36-001 Actuarial Analysis and Consulting Services RFP REVISED.docx | DOCX document | |
| Attachment 3 - State Supplemental Terms and Conditions.docx | DOCX document | |
| Attachment 7 - Work Order Amendment Form.docx | DOCX document | |
| Attachment 2 - Agency Definitions and Acronyms.docx | DOCX document | |
| Vendor Disclosure form - formerly Forms A~1.docx | DOCX document | |
| Offer~6.pdf | ||
| IPG Active Registered Disclosure Form - formerly Forms B~1.docx | DOCX document | |
| BEP Waiver Request and Review form.pdf | ||
| Attachment 6 - Work Order.docx | DOCX document | |
| Attachment 1 - Required Deliverables and Reporting.docx | DOCX document | |
| 2026-36-001 Actuarial Analysis and Consulting Services Questions and Answers.docx | DOCX document |
Show all 15
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
HIPAA BUSINESS ASSOCIATE AGREEMENT (REV. 4/2019)
Actuarial Analysis and Consulting Services Attachment 4 HIPAA Business Associate Agreement Department of Healthcare and Family Services BidBuy #26-478HFS-MEDPR-B-52728: |Agency Reference Number: 2026-36-001
| A. | Definitions. Capitalized terms used in this HIPAA Business Associate Agreement shall have the following meanings: |
| 1. | “Designated Record Set” shall have the same meaning as set forth in 45 CFR Section 164.501. |
| 2. | “Individual” shall have the same meaning as set forth in in 45 CFR Section 160.103, and shall include a person who qualifies as a personal representative in accordance with 45 CFR Section 164.502(g). |
| 3. | “Protected Health Information” or “PHI” shall have the same meaning as set forth in 45 CFR Section 160.103, and is limited to the information created or received by Business Associate from or on behalf of Covered Entity in connection with Business Associate’s performance of the Services. |
| 4. | “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information set forth in 45 CFR Part 160 Subpart A and 45 CFR Part 164 subparts A and E. |
| 5. | “Required by law” shall have the same meaning as set forth in 45 CFR Section 164.103. |
| 6. | “Services” shall mean the duties or obligations described in the Agreement to be performed by Business Associate for Covered Entity. |
| 7. | “Business Associate” shall generally have the same meaning as set forth in 45 CFR 160.103 and, in reference to the party to the Agreement and this HIPAA Business Associate Agreement, shall mean Milliman, Inc. |
| 8. | “Covered Entity” shall generally have the same meaning as set forth in 45 CFR 160.103 and, in reference to the party to the Agreement and this HIPAA Business Associate Agreement, shall mean the Illinois Department of Healthcare and Family Services (HFS). |
| 9. | “Breach” shall have the same meaning as set forth in 45 CFR 164.402. |
| 10. | “Unsecured PHI” shall have the same meaning as set forth in 45 CFR 164.402. |
| 11. | “HIPAA Rules” shall mean the “HIPAA Administrative Simplification,” 45 CFR Parts 160, 162, and 164, and shall include any amendments thereto. |
| 12. | “Agreement” shall mean the Contract between HFS and Milliman, Inc. 2026-36-003. |
| 13. | All other terms used herein shall have the meaning ascribed to them in the HIPAA Rules. |
| B. | Business Associate's Obligations and Activities. Business Associate shall: |
| 1. | Not use or disclose PHI other than as permitted or required by the Agreement, or this HIPAA Business Associate Agreement, in compliance with all applicable requirements of 45 C.F.R. § 164.504(e), or as required by law; and |
| 2. | Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement or this HIPAA Business Associate Agreement; and |
| 3. | Report to Covered Entity, as required at 45 CFR 164.410, any use or disclosure of PHI of which Business Associate becomes aware that is not provided for by the Agreement or this HIPAA Business Associate Agreement, including breaches of unsecured PHI and security incidents. A report of a breach to Covered Entity does not alter Business Associate’s responsibility under the law to notify the affected Individuals; and |
| 4. | In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any agents, including subcontractors, to whom Business Associate provides PHI received from Covered Entity or created, received or maintained by Business Associate on behalf of Covered Entity in connection with its performance of the Services, agree to enter into a written agreement that has restrictions and conditions at least as stringent as those that apply to Business Associate under this HIPAA Business Associate Agreement with respect to such information; and |
| 5. | To the extent Business Associate maintains PHI in a Designated Record Set, provide access to such PHI to Covered Entity or, at the request of Covered Entity, to another person or entity in the time and manner reasonably specified by Covered Entity; and |
| 6. | To the extent Business Associate maintains PHI in a Designated Record Set, make such PHI available to Covered Entity for amendment, and incorporate any amendments to such PHI that Covered Entity directs; and |
| 7. | Provide to Covered Entity or to an Individual, in a time and manner specified by the Covered Entity, information collected in accordance with the terms of the Agreement to permit Covered Entity to respond to a request by the Individual for an accounting of disclosures of PHI in accordance with 45 CFR Section 164.528. In the event that Business Associate in connection with the Services uses or maintains an Electronic Health Record of PHI of or about an Individual, Business Associate will make an accounting of disclosures of such PHI in accordance with Section 13405(c) of the HITECH Act; and |
| 8. | To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s); and |
| 9. | For purposes of allowing determination of Covered Entity’s compliance with the Privacy Rule, make available to Covered Entity and to the Secretary of the United States Department of Health and Human Services, Business Associate's internal practices, books, and records, including policies and procedures and PHI, that relate to the use and disclosure of PHI received from Covered Entity or created or received by Business Associate on behalf of Covered Entity; and |
| 10. | Mitigate, to the extent practicable, any harmful effect that is known to the Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of the Agreement or this HIPAA Business Associate Agreement; and |
| 11. | To the extent possible, limit the use, disclosure or request of PHI to the minimum necessary to perform or fulfill a specific function required, contemplated or permitted under the Agreement; and |
| 12. | Refrain from exchanging PHI with any entity which the Business Associate knows has a pattern of activity or practice that constitutes a material breach or violation of HIPAA; and |
| 13. | Encrypt PHI at rest and during transmission; and |
| 14. | Adopt internal procedures for reporting breaches and for mitigating potential damages associated with uses and disclosures of PHI in violation of this HIPAA Business Associate Agreement. |
| C. | Business Associate's Permitted Uses and Disclosures. |
| 1. | Business Associate may use or disclose PHI only to perform Services for, or on behalf of, Covered Entity, and only provided that such use or disclosure would not violate the Privacy Rule. |
| 2. | Business Associate may disclose PHI for the proper management and administration of Business Associate, provided that the disclosures are required by law or Business Associate obtains reasonable assurances from the person or entity to whom the PHI is disclosed that the PHI will remain confidential and will be used or further disclosed only as required by law or for the purpose for which it was disclosed to the person or entity. Business Associate shall require the person or entity to which the PHI was disclosed to notify Business Associate of any breach of the confidentiality of the PHI of which the person is or becomes aware. |
| 3. | Business Associate shall make uses and disclosures and requests for PHI consistent with the “minimum necessary” standard set forth in 45 CFR Section 164.502(b). |
| 4. | Business Associate may not use or disclose PHI in a manner that, if done by Covered Entity, would violate Subpart E of 45 CFR Part 164. |
| 5. | Business Associate may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 CFR Section 164.502(j)(1). |
| D. | Provisions for Covered Entity to Inform Business Associate of Privacy Practices and Restrictions. |
| 1. | Pursuant to 45 CFR 164.520, Covered Entity shall notify Business Associate of any limitation contained in the Covered Entity’s notice of privacy practices to the extent that such limitation may affect Business Associate’s use or disclosure of PHI. |
| 2. | Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI. |
| E. | Term and Termination. |
| 1. | Effective Date. This HIPAA Business Associate Agreement shall be effective as of the execution of the Agreement. |
| 2. | Termination for Cause. The Agreement may be terminated by Covered Entity if Covered Entity determines Business Associate has violated a material term of the Agreement or this HIPAA Business Associate Agreement and Business Associate has not cured the breach or ended the violation within the time specified by Covered Entity. |
| 3. | Obligations of Business Associate Upon Termination. Upon termination of the Agreement for any reason, Business Associate shall, with respect to PHI received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity: |
| a. | Destroy all PHI maintained in any form. Business Associate must perform this destruction in a manner no less restrictive than that set forth in the requirements for “Purge” contained in NIST Special Publication 800-88, Appendix A: Minimum Sanitization Recommendation for Media Containing Data. Business Associate must certify in writing the method used to destroy the PHI, including the date and time of data destruction. HFS reserves the right to verify that the PHI has been properly destroyed pursuant to this Business Associate Agreement; and |
| b. | If destruction of the PHI is not feasible, Business Associate shall extend the protections of the Agreement and this HIPAA Business Associate Agreement to the PHI and limit further uses and disclosures to those purposes that make the return or destruction of the PHI unfeasible. This provision shall apply equally to PHI that is in the possession of any subcontractor or agent of Business Associate. |
| 4. | Survival. The obligations of Business Associate under this HIPAA Business Associate Agreement shall survive the termination of the Agreement or this HIPAA Business Associate Agreement. |
| F. | Covered Entity’s Obligations. Covered Entity shall: |
| 1. | Provide Business Associate with access to Covered Entity’s Notice of Privacy Practices ((https://www.illinois.gov/hfs/SiteCollectionDocuments/hfs3806.pdf) ; and |
| 2. | Notify Business Associate of any change in or revocation of permission by an Individual to use or disclose PHI, to the extent that such change or revocation may affect Business Associate's permitted or required uses and disclosures of PHI; and |
| 3. | Notify Business Associate of any restriction to the use or disclosure of PHI to which Covered Entity has agreed in accordance with 45 CFR Section 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI; and |
| 4. | Not require Business Associate to use or disclose PHI in any manner that would be impermissible for Covered Entity to use or disclose PHI under the Privacy Rule, HIPAA, the HITECH Act, or any applicable federal or state law or regulation for Covered Entity to use or disclose. |
| G. | Breach. |
| 1. | Policies and Procedures. Business Associate shall have in place internal policies and procedures for identifying and reporting breaches, and for mitigating potential damages associated with a Breach of Unsecured PHI. |
| 2. | Breach Notification. If Business Associate discovers a Breach of Unsecured PHI as defined in 45 CFR 164.402, within 24 hours after the Business Associate first becomes aware of the incident Business Associate shall notify Covered Entity, except where a law enforcement official determines that a notification would impede a criminal investigation or cause damage to national security. |
| a. | Business Associate shall notify Covered Entity within the above time frame even if Business Associate has not conclusively determined that the incident constitutes a Breach of Unsecured PHI. |
| b. | Business Associate shall be deemed to have become aware of the Breach of Unsecured PHI as of the first day on which such Breach of Unsecured PHI is known or reasonably should have been known to any person, other than the person or entity committing the Breach of Unsecured PHI, that is an employee, officer or other agent of Business Associate. |
| c. | Business Associate shall notify Covered Entity by completing and submitting the Notification of Unauthorized Access, Use, or Disclosure (Exhibit A). |
| 3. | Investigation. Business Associate and Covered Entity will cooperate in investigating whether a Breach has occurred and deciding how to provide breach notifications to individuals and other entities, as required. If Covered Entity and Business Associate do not agree on whether a Breach as defined by HIPAA has occurred, HFS shall have final authority to make that decision. |
| 4. | Breach Reporting. Business Associate shall provide notification to the Individuals whose PHI was breached, unless Covered Entity agrees to assume the notification and any associated costs. Business Associate shall coordinate with Covered Entity to draft a notice to inform Individuals about the breach. |
| 5. | Costs. Unless Covered Entity agrees to assume the costs, Business Associate shall pay directly or reimburse Covered Entity for all reasonable and direct out-of-pocket costs, including, but not limited to, the cost of providing Breach notifications to affected Individuals who are required by law to receive such notifications, credit monitoring services for not less than 12 months provided to Individuals, and any litigation costs, fines, penalties or judgments resulting from the Breach. |
| 6. | Indemnification for Breach. Business Associate shall indemnify Covered Entity for costs associated with any incident involving the acquisition, access, use or disclosure of Unsecured PHI in a manner not permitted under this Agreement or 45 CFR 164 Subparts D and E. |
H. Third Party Beneficiary. Nothing contained in this HIPAA Business Associate Agreement is intended to confer upon any person other than the Parties hereto any rights, benefits, or remedies of any kind or character whatsoever, whether in contract, statute, tort (such as negligence), or otherwise, and no person shall be deemed a third-party beneficiary under or by reason of this HIPAA Business Associate Agreement.
| I. | Miscellaneous. |
| 1. | Amendment. The Parties may amend this HIPAA Business Associate Agreement from time to time as necessary for compliance with the requirements of the HIPAA Rules and any other applicable law. |
| 2. | Interpretation. Any ambiguity in this HIPAA Business Associate Agreement shall be interpreted to permit compliance with the HIPAA Rules. |
| 3. | No Agency. The Parties do not intend, nor does this Agreement create, an agency relationship between HFS and Business Associate. |
Exhibit A - Notification of Unauthorized Access, Use, or Disclosure
Business Associate must complete this form to notify HFS of any unauthorized access, use, or disclosure of Protected Health Information. In accordance with the Agreement, notice must occur within 24 hours after discovery.
Notice shall be provided to: HFS.Privacy.Officer@illinois.gov
Information to be submitted by Business Associate:
Agreement Number:
Agreement Title:
Contact Person for this Incident:
Contact Person's Title:
Contact's Address:
Contact's E-mail:
Contact's Telephone No.:
NOTIFICATION:
Business Associate hereby notifies HFS that there has been an unauthorized access, use, or disclosure of Protected Health Information that Business Associate had access to under the terms of the Agreement, as described in detail below:
Date of Discovery:
Detailed Description:
Types of Unsecured Protected Health Information involved in the Unauthorized Access, Use, or Disclosure (such as full name, SSN, Date of Birth, Address, Account Number, Disability Code, etc. – List All).
What steps are being/have been taken to investigate the unauthorized access, use, or disclosure, mitigate losses, and protect against any further incidents?
Number of Individuals Impacted. If over 500, identify whether individuals live in multiple states.
Is Business Associate notifying affected individuals?
Is Business Associate notifying the U.S. Dept. of Health and Human Services?
List any other notifications Business Associate plans to complete:
Submitted by:
Signature: Date:
Printed Name and Title:
Rev. 4/2023
File details come from the government source that posted it. Updated .