Attachment 6- 36H79725R0003 VHA Business Associate Application BAA 2025.pdf

Profile Application, January 2025 1

Business Associate Profile Application

INSTRUCTIONS: The Profile Application asks questions concerning the relationship between your company and the Veterans Health Administration (VHA), and the privacy and security of VHA data required by your company to provide all contracted services. Please provide thorough and complete responses and ensure that appropriate company officials with knowledge of privacy and security controls assist with completing, signing, and dating this profile and return to VHABAAIssues@va.gov. If you have questions about the Profile Application, please email the BAA Issues team at the same email.

Company Demographic Information

Questions 1-10a ask important demographic information about your company.

1. Please provide your company’s official name, d/b/a, address, website, and UEI #. Note: Your company’s UEI # can be found within your contract or on www.SAM.gov.

Company Name:

d/b/a:

Address:

Website:

Unique Entity Identifier (UEI) #:

2. Please provide the addresses of all other/alternate locations where VHA Data is used, processed, accessed, created, stored, transmitted (other than telework locations). Note: This question is asking about all the locations where operations using VHA PII/PHI take place within your company.

Address 1:

Address 2:

Address 3:

3. Please provide names and contact information (phone, cell, email) for the following positions in your company:

Privacy Officer:

Information Security Officer:

Compliance Officer:

Records Manager:

Other:

mailto:VHABAAIssues@va.gov http://www.sam.gov/

Profile Application, January 2025 2

Other:

Questions 5-7 ask about your company’s status as a healthcare provider, whether or not your company provides treatment, and whether your staff are considered VHA workforce members based upon your company’s underlying agreements with the VA/VHA.

5. Under the terms of your contract with VHA, does your company act as a health care provider as defined by the HIPAA Regulations at 45 CFR §160.103?

☐ Yes ☐ No

6. Under the terms of your contract with VHA, do your employees act as members of the VHA workforce as defined by the HIPAA Regulations at 45 CFR §160.103?

7. Under the terms of your contract with the VHA, does your company’s function or services provided on behalf of the VHA meet the definition of treatment under the HIPAA Privacy Rule at 45 CFR § 164.501?

Questions 8-10 ask for additional information regarding your company.

8. Has your company changed names or undergone a novation since the last 2-year review of your BAA? If “Yes”, please provide your company’s previous name below.

9. Is your company as listed in question 1 of this profile application a wholly owned subsidiary of another company? If “Yes”, please provide the name of the parent company below.

10. Has your company been purchased or merged with another company since the last 2-year review of your BAA? If “Yes”, please tell us what company purchased or merged with your company in the space below.

Proceed to the next page.

https://www.law.cornell.edu/cfr/text/45/160.103 https://www.law.cornell.edu/cfr/text/45/160.103 https://www.law.cornell.edu/cfr/text/45/164.501

Profile Application, January 2025 3

Services Your Company Provides to the VA/VHA

Questions 11-11a ask questions about the services your company provides to the VA/VHA. Please note that we are asking for you to provide information on all services your company provides to the VHA on VHA’s behalf.

11. Please describe ALL the functions or services your company provides to VHA on VHA’s behalf in the space below. Services you list in response to this question should include the services from any and all underlying agreements (e.g. (e.g. contracts, purchase orders, task orders, MOUs, MOAs, BPAs, MOU/ISAs and other underlying agreements in place with the VA NAC, SAC, or TAC and/or VHA).

Please provide enough detail in your response so that the services your company provides are clearly enumerated.

11a. Describe the specific steps in your business processes related to how your company uses or processes VHA data in order to provide contracted services listed above to VHA (e.g., a data flow diagram, etc.) in the space below.

Profile Application, January 2025 4

Please proceed to the next page.

Profile Application, January 2025 5

Engagement with VA/VHA Data, PII, and PHI

Questions 12-13b asks you provide high level overview of your company’s engagement with and use of VA/VHA data, PII, and PHI/ePHI. Specific more detailed questions will then be asked regarding your company’s access, receipt, transmission, use, disclosure, storage/maintenance, de-identification, and destruction/disposition of VHA PII/PHI. We have provided the following definitions for your understanding.

Protected Health Information (PHI) – PHI contains patient identifiers such as name, social security number and address or any other of the 18 data elements outlined in the HIPAA Privacy Rule. In the VHA, PII = PHI.

Business Associate - A VHA Business Associate accesses, creates, receives, maintains, stores, destroys, uses, discloses, or transmits Protected Health Information (PHI) to perform a function or activity on VHA’s behalf.

12. Please provide information regarding how your company engages with VA/VHA data, PII, and PHI/ePHI based upon the terms of all your underlying agreements with the VA/VHA as listed above in questions 4 and 4a.

Please mark all that apply. Under the terms of your company’s agreements with VA/VHA, does your company:

Use or is exposed to VHA PII/PHI to provide contracted services?

Use: ☐Yes ☐ No

Access VHA PII/PHI in any way (either from inside the VA boundary or outside the VA boundary)?

Access: ☐Yes ☐ No

Create PII/PHI for the VHA as a part of your contracted services?

Create: ☐Yes ☐ No

Disclose VHA PII/PHI data to 3rd parties outside the VHA as a part of your contracted services?

Disclose: ☐Yes ☐ No

Destroy VHA data or documents as a part of your contracted services?

Destroy: ☐Yes ☐ No

De-identify VHA PII/PHI provided by the VA/VHA for de-identification?

De-Identify: ☐Yes ☐ No

Receive VHA PII/PHI from VA/VHA to perform contracted services?

Receive: ☐Yes ☐ No

Maintain/Store VHA data on your servers or physically at your location outside the VA boundary?

Store/Maintain: ☐Yes ☐ No

Transmit VHA data in any way, either from outside the VA boundary to inside the VA boundary, or from inside the VA boundary to a recipient outside the VA boundary?

Transmit: ☐Yes ☐ No

13. Please provide the names of all VHA Program Offices, VA Medical Centers, or VISNs with whom you have contracts for the services identified in Questions 11, 11a, & 12 above. Note: You should provide your response in either 13a or 13b.

13a. All VAMCs/VISNS/VHA Program Offices ☐

13b. Provide the list of all VAMCs, VISNs, VHA Program Offices for whom your company provides services in the space below: (Note: If you need more space, you may send the list in a separate attachment, or provide additional information in question 22 below.)

Profile Application, January 2025 6

List each VAMC with whom your company has a contract or provides services on behalf:

List each VISN with whom you have contracts and to whom you provide services:

List each VHA Program Office with whom your company has a contract or to whom you provide services:

The next series of questions are in tabular format and ask you to provide more detailed information regarding how your company provides agreed upon services to the VA/VHA. Please provide thorough and complete information in response to these questions. Please note, most of the sections lead with a

Yes or No question. If you respond “No” to the initial question, you can skip the remainder of that section and move to the next (e.g., if your company does not create data/PII/PHI on VHA’s behalf, you will answer

“No” to the first question, and then move to the next section).

Access To, Receipt of, De-Identification of VHA Data, PII, PHI/ePHI

14-14n. In questions 14-14n, please address your company’s access to, receipt of, and/or de-identification of VHA data, PII, and PHI/ePHI based upon the terms of any underlying agreements you have with the VA/VHA.

14. How many of your company’s employees have, or will have, access to or will receive VHA data/PII/PHI to provide the contracted services? Please provide an overall headcount of your company’s staff who will access or receive the data.

☐ 1-10

☐ 11-25

☐ 26-50

☐ 51-100

☐ 100-500

Profile Application, January 2025 7

☐ Over 500

14a. Will your employees access or receive VA/VHA data, PII, and PHI in electronic format and, if so, how? (If you selected “Other”, please provide details in the additional comments space provided in 14l. below.)

☐ VPN

☐ CAG/Azure Virtual Desktop

☐ Interconnection

☐ Direct Access

☐ Other (e.g. screen share, onsite troubleshooting, fax, web portal, secure FTE file, vendor owned website/portal.)

14b. If your employees will access or receive VA/VHA data, PII, and PHI in hardcopy format, please select all that apply:

☐ N/A

☐ Files

☐ Paper Documents

☐ Other Media (Films, Tissues, Photographs)

14c. Does your company access VA/VHA PII/PHI from outside the VA/VHA boundary (this includes PII or PHI that has been disclosed to your company by VHA)? (If you answered “No” please skip to question 14g.)

14d. How many employees will access or will have access to VHA data from outside the VA/VHA boundary?

☐ 0

☐ 1-10

☐ 11-25

☐ 26-50

☐ 51-100

☐ Over 100

14e. From how many outside locations will your company’s employees access VA/VHA data? We are specifically asking you to provide the total # of locations outside the VA/VHA boundary from where you staff will access VA/VHA data. (This does include PHI that has been disclosed to your company by VHA.)

☐ 0

☐ 1

☐ 2-5

☐ Over 5

☐ Over 10

14f. Are any of the outside locations in other countries? Please specify:

14g. Do you have employees working remotely from home? (If you responded “No”, please move to question 14i.)

14h. Of your employees working remotely from home, how many will access VA/VHA data from their homes?

☐ 0 None; No VHA Access

☐ 1-10

☐ 11-25

☐ 26-50

☐ 51-100

☐ Over 100

Countries:

Profile Application, January 2025 8

14i. If your company receives VHA data/PII/PHI from the VHA to provide contracted services, explain how VHA sends the data to your company and how you ensure the data is kept secure while in your company’s control?

Please provide details:

14j If your company receives VA/VHA data/PII/PHI, is your company doing so for the purposes of de-identifying the data? (If “No”, move to question 15.)

14k. If your company de-identifies VA/VHA data on VHA’s behalf, does that de-identification meet all the required standards of VHA Directive 1605.01, Appendix A?

14l. Additional Comments or Information Regarding Access to and Receipt of VA/VHA data, PII, and PHI:

Creation of VHA Data, PII, PHI/ePHI

15-15c. Questions 15-15c. address your company’s creation of VHA data, PII, and PHI/ePHI on VHA’s behalf based upon the terms of any underlying agreements you company has with the VA/VHA.

15. Does your company create data/PII/PHI for VHA or on VHA’s behalf as a part of your contracted services? (If you answered “No”, please proceed to question 16.)

15a. If your company creates data on VHA's behalf, is the data considered PHI/ePHI or IIHI (Individually Identifiable Health Information)?

☐ Yes ☐ No ☐ N/A

15b. What PHI/ePHI is created by your company for VHA on VHA’s behalf? (Select all that apply.)

☐ Electronic

☐ Hard Copy

☐ N/A

15c. Where is the data that your company creates maintained/stored? (Ex: Stored on Business Associate’s servers outside VA boundary; stored on VA servers within VA boundary, etc.). Please describe.

Profile Application, January 2025 9

Transmission of VHA Data, PII, PHI/ePHI

16-16d. Questions 16-16d ask about your company’s transmission of VHA data, PII, and PHI/ePHI on VHA’s behalf based upon the terms of any underlying agreements you have with the VA/VHA.

16. Does your company transmit VHA data, PII, and/or PHI/ePHI on VHA’s behalf? Please note that we are asking if your company transmits VHA data in any way, either from outside the VA boundary to inside the VA boundary, or from inside the VA boundary to a recipient outside the VA boundary as a part of your contracted services. (If you answered “No”, please move on to question 17.)

16a. If you answered “Yes” to question 16, what type of data or PHI/ePHI is transmitted on VHA’s behalf?

Please specifically describe the data:

16b. Please describe in detail the data transmission flow of any VHA PII/PHI. Please highlight whether there is any data egress from the VA network and the process by which you plan to export VA/VHA data.

16c. How does your company protect VHA data, PII or PHI/ePHI during transmission? Please specifically describe:

Profile Application, January 2025 10

16d. Additional Comments or Information Regarding Transmission of VHA data, PII, and/or PHI/ePHI:

Maintenance/Storage of VHA Data, PII, and PHI/ePHI

17-17f. Questions 17-17f ask for details about your company’s maintenance/storage of VHA data, PII, and PHI/ePHI on VHA’s behalf based upon the terms of any underlying agreements you have with the VA/VHA. PLEASE NOTE: This series of questions is asking if your company or your subcontractor store or maintain VHA data/PII/PHI on company or subcontractor owned and controlled servers, cloud storage, physical locations, etc. that are outside the VA boundary.

17. Does your company or your subcontractor store or maintain VHA data on VHA’s behalf? (If you answer “No”, please move on to question 18.)

17a. What type of data or PHI/PII does your company or your subcontractor store or maintain on VHA’s behalf?

(If you select “Other”, please provide additional information in 17f below.)

☐ Electronic

☐ Hardcopy

☐ Other

17b. Please describe where your company or your subcontractor maintains/stores VHA data/PII/PHI (e.g., physical location to include other countries, local server, cloud server, file room, other).

17c. Is VHA data maintained separately from other data (i.e., not co-mingled with other data)?

17d. If VHA data, PHI, ePHI is maintained on a server, who owns/maintains the server? (If you select “Other”, please provide information in 17f below.)

☐ Business Associate

☐ Subcontractor

☐ VA/VHA

Profile Application, January 2025 11

17e. If your company or subcontractor maintains/stores VHA data on servers or locations outside the VA boundary, please specifically describe how that information is protected and safeguarded at rest in accordance with the HIPAA Privacy and Security Rules.

17f. Additional Comments or Information Regarding Maintenance/Storage of VHA data, PII, PHI/ePHI:

Destruction/Appropriate Disposition of VHA data, PII, PHI, ePHI

18-18f. Questions 18-18f ask about your company’s destruction/disposition of VHA data, PII, PHI, ePHI on VHA’s behalf based upon the terms of any underlying agreements you have with the VA/VHA.

18. Does your company or your subcontractor destroy or dispose of VHA data or PHI/ePHI on VHA’s behalf (this includes any PHI disclosed to you by VHA)?

18a. How is the hardcopy data or PHI destroyed? If you select “Other”, please provide details in the space below:

☐ N/A

☐ Shred

☐ Macerate

☐ Pulp

18b. How is ePHI destroyed? Please specifically describe:

18c. If your company or subcontractor destroys data on VHA’s behalf, is that destruction done in accordance with VHA Records Control Schedule (RCS) as outlined in RCS 10-1?

18d. Is your company or subcontractor required to return VHA data/PII/PHI/ePHI at the conclusion of your contract(s) with the VHA? If “Yes”, please provide details in the space below (e.g., return via FedEx, IT will take hard drive, other):

Profile Application, January 2025 12

18e. Is your company or your subcontractor required to retain VHA data/PII/PHI/ePHI for regulatory purposes at the conclusion of your contract(s)? If “Yes”, please elaborate:

Use, Disclosure, Incidents, Policies and Other Required Business Associate Responsibilities

19-19l. Questions 19-19l ask about your company’s use, disclosure, incidents, policies and other

Business Associate responsibilities with respect to VHA data, PII, PHI, ePHI on VHA’s behalf based upon the terms of any underlying agreements you have with the VA/VHA.

19. How many records on individuals (PHI/ePHI per Individual) does your company create, access, receive, store, transmit, maintain/store, destroy, and de-identify on VHA’s behalf? Please note we are asking for an overall #.

☐ 1-100

☐ 100-1000

☐ 1000-10,000

☐ Over 10,000

19a. Does your company use VHA data, PII, PHI/ePHI for purposes other than those specified in your underlying agreements for which you are a Business Associate with VHA? (e.g., state reporting required of your company, litigation defense, etc.)

19b. If you answered “Yes” to 19a, please list the purposes for which VHA’s data, PII, PHI, ePHI is being used or disclosed outside the purposes of the BAA?

19c. Does your company make disclosure of PHI/ePHI to other individuals or entities in the provisions of contracted services or activities on VHA’s behalf, including disclosures to subcontractors for them to provide a portion of the services?

19d. Does your company have direct contact with VHA patients for the purposes of performing the contracted services?

19e.Does your company have direct contact with VHA patients for purposes other than the contracted services?

Profile Application, January 2025 13

19f. Does your company receive requests from third parties for VHA data/PII/PHI to be disclosed by you or created by you for purposes other than defined in the BAA?

19g. If Yes, who are the 3rd parties you are receiving requests from?

If you answered “Other”, please elaborate:

☐ Law Enforcement*

☐ Courts/Admin Proceedings*

☐ Coroner/Medical Examiners*

☐ Accrediting Bodies

☐ Health Care Providers

☐ Health Plans

☐ Employers

19h. Has your company ever been involved in an incident/breach?

(If “No” move to question 19k.)

19i. If “Yes”, how many breaches/incidents has your company had since completing the last application form?

☐ None

☐ 1-5

☐ 6-10

☐ 11-20

☐ Over 20

☐ Over 50

19j. How many Veterans were affected by the incident/breach?

☐ Less than 500

19k. Has your company developed, documented, and implemented company policies, processes, and procedures that explain safeguards to protect PHI/ePHI and prevent the use or disclosure of PHI/ePHI not authorized by the VHA BAA, specifically policies and procedures related to Privacy, Security and Records Management?

19l. Does your company have any other classification, other than

Business Associate or health care provider, as defined under the

HIPAA Privacy and Security Rules? (e.g., Covered Entity, Hybrid

Entity, etc.)? If “Yes”, please provide the type of classification:

19n. Other Comments Regarding Use, Disclosure, Policies, Incidents and other Business Associate Requirements:

Profile Application, January 2025 14

Underlying Agreements & Subcontractor Relationships

20-20l. Questions 20-20l asks you to provide or reference all current underlying agreements with the VA/VHA that require access to VHA data, PII, PHI/ePHI. Those agreements may be contracts, purchase orders, task orders, MOUs, MOAs, MOU/ISAs, BPAs, IDIQs and/or other underlying agreements in place with the VA NAC, SAC, or TAC and/or VHA. In addition, you will need to provide a list of the subcontractors your company employs to provide services to the VHA on your behalf.

20. Please indicate the types of underlying agreements that are in place between your company and the VA/VHA. Please provide either a “Yes” or “No” response to each agreement type.

VHA Contracts: ☐ Yes ☐ No

Purchase Orders/Task Orders:

MOU, MOA, or MOU/ISA:

NAC Contracts: ☐ Yes ☐ No

SAC Contracts: ☐ Yes ☐ No TAC Contracts:

20a. Please provide information on all underlying agreements your company has in place with the VA/VHA as described above. This information should include contract numbers, purchase order numbers, task order numbers, BPAs, IDIQs, MOUs, MOAs, MOU/ISAs with all VAMCs, VISNs, and/or VA and VHA Program Offices.

20b. Are any of your company’s underlying agreements which give rise to the Business Associate relationship, expiring in the next year?

20c. If you answered “Yes” to question 20b, which underlying agreements will be expiring in the next year?

Please provide contract # and date of expiration:

Profile Application, January 2025 15

20d. Have any of your contracts or other underlying agreements related to the BAA been modified in the last 2 years?

20e. If you answered “Yes” in question 20d, please provide details.

20f. Has your company entered into any Business Associate Agreements with any VA Medical Centers, VISNs, or VHA Program Office or the Contracting Officer for those agreements?

20g. If you answered “Yes” in question 20f, please provide details.

20h. Does your company use subcontractors in services provided to VHA under your BAA? (If you answer “No”, please skip to question 21.)

20i. If you answered “Yes” in question 20g, please provide a list of the subcontractors your company employs and to whom you disclose VHA data, PHI/ePHI to provide services to VHA on your behalf.

20j. Does your company have HIPAA mandated subcontractor agreements in place with your company’s subcontractors who provide a portion of your services to the VHA? Note: If your company doesn’t have appropriate subcontractor BAAs in place, this requirement must be satisfied to adhere to HIPAA and VA requirements.

20k. Does your company have a specific, documented chain-of-custody agreement that requires the subcontractor to meet the requirements set forth in your BAA with VHA?

20l. Do you have subcontractors who provide services to VHA that are outside the jurisdiction of the laws of US?

Please proceed to the next page.

Profile Application, January 2025 16

Artificial Intelligence (AI)

21. Question 21-21c. asks about your company’s use of Artificial Intelligence (AI) in relation to the VHA data.

21. Does your company use AI in its operations as it applies to services or functions provided to the VHA/VA? (If you answered “No”, proceed to 22.)

21a. If you responded “Yes” in question 17, please describe how AI is applied to your contract(s) with VHA (chatbot, robotics, healthcare, care identification, etc.).

21b. Is your company using VHA production data to train your AI models?

21c. How does your company ensure the privacy and security of VHA data when using AI? Please describe:

Additional Information

22. Please provide any additional information you may not have had space to provide in the tables above or other information you would like to share in the space provided below.

Profile Application, January 2025 17

Please obtain signatures for the appropriate company officials below:

Company Representative Date

Privacy/Compliance Officer Date

Information Security Officer Date