Attachment 7 - Business Associate Agreement.docx

NOTE TO BIDDERS:

This is a template Business Associate Agreement. By submitting a bid, you agree to sign this Agreement without revisions or a version substantially similar thereto at the GIC’s discretion. Additionally, and if applicable, by submitting a bid, you agree to sign a pre-contract version of this Agreement which is substantially similar but written to govern the period of time before the contract is in effect. You agree to sign these Agreements if the GIC deems it necessary.

GROUP INSURANCE COMMISSION

BUSINESS ASSOCIATE AGREEMENT

PRIVACY AND SECURITY

WHEREAS, the Group Insurance Commission (“Covered Entity” or “GIC”) ran a procurement for services titled “[PROCUREMENT NAME]” and having a CommBuys bid number of [BID NUMBER]; and WHEREAS [VENDOR NAME] (“Business Associate” or “VENDOR SHORT NAME”) is the apparent successful bidder from that procurement; and WHEREAS the Covered Entity and Business Associate are entering into a contract resulting from said procurement to provide products or services as set forth in the RFR and the contract will have an effective date of July 1, [YEAR] and to which this Agreement is incorporated into; and WHEREAS Covered Entity will make available and/or transfer to Business Associate certain protected information, in conjunction with products or services that will be provided by Business Associate to Covered Entity, which information is confidential and must be afforded special treatment and protection pursuant to Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”); and WHEREAS, Business Associate will have access to and/or receive from Covered Entity certain Protected Health Information (“PHI”) that can be used or disclosed only in accordance with this Business Associate Agreement (“Agreement”), the Privacy Rule, and other applicable state or federal laws;

NOW, THEREFORE, Covered Entity and Business Associate enter into this Agreement as follows:

I. DEFINITIONS

All terms used but not otherwise defined in this Agreement shall be construed in a manner consistent with the Privacy Rule and other applicable state or federal privacy or confidentiality laws. Any changes to the Privacy Rule or other applicable state or federal privacy or confidentiality laws that would require amendment of this Definitions section shall be binding upon both parties to this Agreement without need for written amendment.

A. “Breach” means the acquisition, access, use, or disclosure of PHI in a manner not permitted under the Privacy Rule which compromises the security or privacy of the PHI, as defined by 45 C.F.R. §164.402.

B. “Breach Notification Rule” means the portion of HIPAA set forth in Subpart D of 45 C.F.R. Part 164.

C. “Business Associate” means [VENDOR NAME]

D. “Covered Entity” means the Group Insurance Commission.

E. “Contract” means the Contract to be entered into between Covered Entity and Business Associate that will have an effective date of July 1, [YEAR] and as extended or amended thereafter.

F. “Commonwealth” means the Commonwealth of Massachusetts.

G. “Commonwealth’s Terms and Conditions” means the terms and conditions contained in the RFR.

H. “Data Aggregation” means, with respect to PHI created or received by Business Associate in its capacity as a business associate of the Covered Entity, the combining of PHI by Business Associate with the PHI received in its capacity as a business associate of one or more other Covered Entities under HIPAA, to permit data analyses that relate to the Health Care Operations of the respective covered entities. The meaning of “data aggregation” in this BAA shall be consistent with the meaning given to it in the Privacy Rule.

I. “Data and Network Map” means a full description of where GIC PHI and other data is stored, specifically detailing which types of PHI and other data is stored in each location.

J. “Designated Record Set” has the meaning given to it under the Privacy Rule including 45 C.F.R. §164.501.B.

K. “Deidentify” means to alter the PHI such that the resulting information meets the requirements described in 45 C.F.R.§§164.514(a) and (b).

L. “Individual” means the person who is the subject of PHI, as set forth in 45 C.F.R. 160.103, and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. 164.502 (g).

M. “Electronic Transactions Rule” means the Transaction and Code Set requirements set forth at 45 C.F.R. 162.

N. “Electronic PHI” means individually identifiable health information that is transmitted by electronic media or maintained in electronic media, as defined in the Security Rule at 45 C.F.R.160.103. Any modifications to the definition of “Electronic PHI” in the Security Rule shall be binding upon the parties to this Agreement.

O. “Enrollee” means an individual enrolled in the Group Insurance Commission’s dental and/or vision insurance programs.

P. “Part 2” means Confidentiality of Substance Use Disorder Patient Records, 42 C.F.R. Part 2.

Q. “Privacy Rule” means that portion HIPAA set forth in 45 C.F.R. Parts 160 and 164 subparts A & E.

R. Protected Health Information” (“PHI”) means any information in any form or medium: i) relating to the past, present or future, physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual, and ii) identifying the individual or with respect to which there is a reasonable basis to believe can be used to identify the individual, as described in 45 C.F.R. 160.103.

S. “Required By Law” shall have the same meaning as used in 45 C.F.R. 164.103.

T. “RFR” means the Request for Response (RFR) issued by the GIC issued in CommBuys on [RFR ISSUE DATE] and having the bid number of [BID NUMBER].

U. “Security Incident” means the attempt or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

V. “Secretary” shall mean the Secretary of the US Department of Health and Human Services or the Secretary’s designee.

W. “Security Rule” shall mean the Security Standards for the Protection of Electronic Health Information at 45 C.F.R. Part 160 and Part 164 Subparts A and C.

X. “Unsuccessful Security Incidents” shall include, but not be limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of Electronic PHI.

Y. “Unsecured Protected Health Information” or “Unsecured PHI” means any “protected health information” as defined by 45 CRF §§164.501 and 160.103 that is not rendered unusable, unreadable or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in the guidance issued pursuant to the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”) and codified at 42 U.S.C. § 17932(h).

II. BUSINESS ASSOCIATE’S OBLIGATIONS

Business Associate acknowledges that it is Covered Entity’s business associate, as that term is used in the Privacy Rule, for the purposes specified herein and as such, agrees as follows:

A. In no event is the Business Associate entitled to use or disclose PHI in a manner that would constitute a breach if that use or disclosure was made by the Covered Entity.

B. Business Associate shall not use or disclose PHI other than as permitted or required by the RFR or the Contract or this Business Associate Agreement, as requested by Covered Entity, or as Required By Law, consistent with the restrictions of 42 C.F.R. 431.306 (f) and Part 2.

C. In general, Business Associate may not unilaterally decide to subcontract its responsibilities or obligations of work. GIC Legal Department, the Executive Director, or the Chief Financial Officer must provide written approval prior to Business Associate subcontracting any work or responsibilities. In the event that Covered Entity permits Business Associate to engage a subcontractor, the Business Associate shall ensure that any agent or subcontractor to whom it provides PHI that is received from or created or received by it on behalf of Covered Entity agrees in writing to the restrictions and conditions no less stringent than the restrictions and conditions that apply to Business Associate under this Agreement with respect to such information. All provisions of this Agreement apply to all such information, whether in the possession of Business Associate or any of its agents or subcontractors. Business Associate is responsible for ensuring its agents’ and subcontractors’ compliance with all provisions of this Agreement, in accordance with 45 C.F.R. 164.502(e)(1)(ii) and 45 C.F.R. 164.308(b)(2).

D. Business Associate shall use appropriate safeguards and comply with sub part C of 45 C.F.R. 164 to prevent use or disclosure of PHI other than as provided for by this Business Associate Agreement and as Required by Law.

E. Business Associate shall take appropriate and legal action necessary to mitigate any harmful effect that is known to Business Associate of its use or disclosure of PHI in violation of the requirements of this Agreement or in violation of any applicable law. Any actions undertaken by Business Associate on its own initiative or pursuant to Covered Entity’s request under this provision to mitigate harmful effects of privacy violations shall not relieve Business Associate of its obligations to report privacy violations as set forth in other provisions of this Agreement or as Required by Law.

F. Upon written request, Business Associate shall provide to Covered Entity’s Enrollees access to or copies, including electronic copies, of their PHI that Business Associate maintains on behalf of Covered Entity, whether or not it is in a Designated Record Set and for which the Business Associate is the source, as shall be necessary for Covered Entity to meet its PHI access obligations under 45 C.F.R. 164.524. Such access or copies shall be provided to the requesting Enrollee as soon as practicably possible, but no later than 30 days, in a time and manner in accordance with such requirements as set forth in 45 C.F.R. 164.524. Business Associate shall promptly notify Covered Entity of any such requests of access and the disposition of any records. In the case where Covered Entity is the original source of PHI and has supplied it to Business Associate, Business Associate will promptly notify Covered Entity, in writing, of the request not later than 10 days of receiving the request in order for Covered Entity to decide whether to provide access to the PHI. Business Associate shall, at the direction of Covered Entity, assist in any way necessary to allow Covered Entity to fulfill its obligations under 45 C.F.R. 164.524.

G. Upon written request by an Enrollee to Business Associate and where Business Associate is the source of the PHI, Business Associate shall make any amendment(s) to PHI maintained on behalf of Covered Entity, whether or not it is in a Designated Record Set, in order for Covered Entity to meet its obligations under 45 C.F.R. § 164.526. Such amendments shall be made within 15 business days of Enrollee’s request, in accordance with such requirements as set forth in 45 C.F.R. 164.526. Business Associate shall notify Covered Entity in writing of any such requests and the resulting disposition of the request. If Business Associate receives a request to make amendments to PHI for which Covered Entity is the original source, Business Associate will promptly notify Covered Entity in writing and will do what is necessary, at the direction of Covered Entity, in order for Covered Entity to meet its obligations under 45 C.F.R. 164.526.

H. Business Associate shall document PHI disclosures made by Business Associate which are not excepted from disclosure accounting requirements under Privacy Rule and related information, as is necessary, to respond to requests for an accounting of disclosures of PHI and related information in accordance with 45 C.F.R. 164.528. Upon written request, Business Associate agrees to produce an accounting of PHI, for which Business Associate is the source, to Covered Entity within the time period as set forth in 45 C.F.R. 164.528.

I. If Enrollee makes an accounting of disclosures request to Business Associate, Business Associate will furnish Enrollee the requested information, in accordance with 45 C.F.R. 164.528, on behalf of Covered Entity, within 60 business days. Business Associate will provide an accounting of its disclosures of PHI upon request of the Individual, if and to the extent that such accounting is required under the HITECH Act or under the US Department of Health and Human Services (“HHS”) regulations adopted in connection with the HITECH Act. Business Associate will promptly notify Covered Entity of any such request and the disposition of the request.

J. Business Associate shall make available to Covered Entity upon request, or to the Secretary, its internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity. Covered Entity or the Secretary shall determine the time and manner for making such material available for purposes of the Secretary determining Covered Entity’s compliance with the Privacy Rule. This provision shall survive the termination of this BAA and the Contract.

K. Business Associate agrees to promptly report to Covered Entity, in writing, any use or disclosure of the PHI not provided for by this Agreement, including breaches of unsecured PHI as required by 45 C.F.R. 164.410 and any successful Security Incident, of which it becomes aware, provided, however, the parties acknowledge and agree that this section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents for which no additional notice to Covered Entity shall be required. Business Associate further agrees to cooperate with Covered Entity in any breach notifications to individuals, the Secretary, the HHS Office of Civil Rights, and, potentially, the media. Business Associate will reimburse Covered Entity for any costs incurred by it in complying with the requirements of Subpart D of 45 C.F.R. §164 that are imposed on Covered Entity as a result of a Breach committed by Business Associate.

L. Business Associate shall adhere to all applicable requirements of the Electronic Transactions Rule with respect to each Transaction, as defined by the Electronic Transaction Rule and U.S. Centers for Medicare and Medicaid Services (in its guidance issued on July 24, 2003), it performs or assists in performing, on behalf of Covered Entity, including, without limitation, the requirement to conduct Transactions using the standards and code sets adopted by the HHS under 45 C.F.R. Part 162; and shall conduct Transactions in accordance with all applicable requirements under any Trading Partner Agreement entered into between Covered Entity and the other party(ies) with respect to those Transactions.

M. Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity as required by the Security Rule. Business Associate agrees to take reasonable steps, including providing adequate training to its employees and persons hired in a non-employee capacity to ensure compliance with this BAA and to ensure that the actions or omissions of its employees and persons hired in a non-employee capacity or agents do not cause Business Associate to breach the terms of this BAA.

N. Business Associate must provide to Covered Entity at the time of signature of this Agreement a Data and Network Map. If Business Associate is using approved subcontractors to transmit or store PHI and other GIC data, Business Associate is expected to provide a Data and Network Map for each approved subcontractor.

Business Associate is obligated to provide any updates or changes of their or their approved subcontractor(s)’ Data and Network Map(s) or their general data environment or operations that could impact Covered Entity and its PHI and other data.

O. With respect to information subject to 42 C.F.R. Part 2 and Part 2a (“Part 2”), Business Associate agrees to resist any efforts in judicial proceedings to obtain access to the protected information except as expressly provided for in Part 2.

P. Upon request, Business Associate will provide Covered Entity with a copy of its most recent independent HIPAA compliance report (AT-C 315) HITRUST certification or other mutually agreed upon independent standards based third party audit report.

Q. Business Associate represents and warrants that it will comply with all applicable reporting requirements under this Agreement.

III. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE

Except as otherwise limited in the RFR or the Contract, Business Associate may use or disclose PHI on behalf of, or to provide services to, Covered Entity in order to perform services as agreed to by Business Associate and Covered Entity per the terms of the RFR or as written in the Contract, provided such use or disclosure would neither violate the Privacy Rule if done by Covered Entity, nor the Minimum Necessary Standard set forth in 45 C.F.R. 164.502(b). Business Associate will only use or disclose PHI, to the extent practicable, as a limited data set or limited to the minimum necessary amount of PHI to carry out the intended purpose, in accordance with Section §13405(b) of the HITECH Act (codified at 42 U.S.C. § 17935(b)) and any of the act’s implementing regulations adopted by HHS, for each use and disclosure of PHI.

A. Specified Use and Disclosure for Management and Administration

1. Except as otherwise limited in this Agreement, Business Associate may use the PHI for the proper management and administration of Business Associate and to carry out the legal responsibilities of the Business Associate.

2. Except as otherwise limited in this Agreement, Business Associate may disclose PHI for its proper management and administration, provided that disclosures are Required By Law, or Business Associate obtains reasonable assurances from the recipient of the information disclosed that it will remain PHI protected by the recipient under an agreement no less stringent this Agreement and used or further disclosed only as Required By Law, consistent with the restrictions of 42 C.F.R. § 431.306 (f) or for the purpose for which it was disclosed to the recipient, and the recipient notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

3. Business Associate may not use PHI for Data Aggregation services as set out in 42 C.F.R. § 164.504 (e) (2)(i)(B).

4. Business Associate may use PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. § 164.502(j)(1).

5. Business Associate may disclose PHI to Covered Entity for administration purposes.

6. At Covered Entity’s direction, Business Associate may disclose PHI in its possession to Covered Entity’s other Business Associates, as defined in 45 C.F.R. § 160.103.

7. Business Associate may release Summary Health Information as defined in 45 C.F.R. § 164.504(a), for the purposes of obtaining premium bids to provide health insurance coverage or modifying, amending, or terminating the group health plan.

8. Upon Covered Entity’s written agreement, Business Associate may de-identify PHI provided that it conforms to the requirements of 45 C.F.R. § 164.514(b).

9. Business Associate may create a limited data set for the purpose of providing the services in accordance with the RFR or the Contract, provided that Business Associate complies with its obligations under this Business Associate Agreement.

IV. COVERED ENTITY’S OBLIGATIONS

A. Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices issued in accordance with 45 C.F.R. § 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI. If Business Associate promptly notifies Covered Entity that it cannot comply with the proposed limitation, both parties agree to make good faith efforts to reach a mutually agreeable resolution.

B. Covered Entity shall notify Business Associate of any known changes in, or revocation of, permission by Enrollees or their personal representatives to use or disclose PHI, to the extent that such changes may affect Business Associate’s use or disclosure of PHI.

C. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Enrollees’ PHI that it has agreed to in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI. If Business Associate promptly notifies Covered Entity that it cannot comply with the proposed restriction, both parties agree to make good faith efforts to reach a mutually agreeable resolution.

D. Covered Entity shall immediately notify Business Associate of any changes to its Business Associates to whom Business Associate has been directed to release PHI pursuant to the Contract or as directed in writing by the Covered Entity. Covered Entity will enter into agreements in accordance with 45 C.F.R. § 164.504(e) with such business associates to whom Business Associate is directed to release PHI.

E. Covered Entity and its business associates whom Covered Entity directs to release PHI to Business Associate, shall provide to Business Associate or otherwise confirm receipt of Enrollees’ valid authorization as Required By Law, in order to receive PHI from business associates.

F. Covered Entity shall not request Business Associate use or disclose PHI in a manner that is not permissible under the Privacy Rule if done by Covered Entity, except for uses and disclosures of PHI for data aggregation or management and administrative activities of Business Associate.

V. TERMINATION

A. Termination for Cause

1. Upon either party’s knowledge of a material breach of this Agreement both parties are obligated to notify each other as soon as practicably possible.

2. If either party discovers a material breach by the other party, the breaching party will have the opportunity to cure the breach or end the violation. If such an opportunity is provided to Business Associate but cure is not feasible or the Business Associate fails to cure the breach or end the violation within a time period specified by the Covered Entity, Covered Entity may terminate the Contract in accordance with the Commonwealth’s Terms and Conditions provisions.

3. In the event that there is a material breach of any obligation regarding PHI, regardless of cure, Covered Entity may report such breach or violation to the Secretary, to the Individual, to the HHS Office for Civil Rights, and/or to the media as Required by Law and pursuant to Section 13402 of HITECH Act, and to any other entities or individuals as required by any state or federal law or regulations, currently in place or hereafter implemented.

B. Effect of Termination

1. Upon either the failure of the Parties to form a Contract or the termination of this BAA for any reason, Business Associate shall either:

a) return or, if agreed to by Covered Entity, destroy all copies of PHI obtained or created in any form under this Agreement, including all PHI in the possession of Business Associate’s subcontractors or agents, and Business Associate shall ensure that all such data in the possession of its subcontractors or agents has been returned or, if agreed to by Covered Entity, destroyed and that no subcontractor or agent retains any copies of such data in any form; or

b) if agreed to by Covered Entity, extend all protections set forth in this Agreement to all such PHI or data and shall limit further uses and disclosures of the data to those purposes that make the return or destruction of such data infeasible, for as long as Business Associate and/or its subcontractors and agents maintain the data.

2. Notwithstanding any other provision concerning the term of the Contract, all protections pertaining to any PHI covered by this Agreement shall continue to apply until such time as all such data is returned to the Covered Entity or destroyed, or if return or destruction is not feasible, protections are applied to such data in accordance with subsection B.1.(b) immediately above.

3. Business Associate will notify Covered Entity of PHI that is not practicable to return or destroy any and all documentation required to be maintained by applicable law or regulation and/or Business Associate’s internal policies and procedures and agrees to apply protections to such data in accordance with subsection (b) above.

VI. MISCELLANEOUS PROVISIONS

A. Regulatory References. Any reference in the RFR or the Contract or this Agreement to a section in the Privacy Rule or other regulation or law refers to that section as in effect or as amended.

B. Amendment. The parties agrees to take such action as is necessary to amend this Agreement in order for both the Covered Entity and Business Associate to comply with any requirements of the Privacy Rule, HIPAA; the HITECH Act; the Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the HITECH Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules; Final Rule 78 Federal Register 17 (25 January 2013) (“Final Rule”); Part 2; and any other applicable federal or state law pertaining to the privacy, confidentiality, or security of PHI. Upon the Covered Entity’s request, Business Associate agrees to enter promptly into negotiations for any amendment as the Covered Entity deems necessary for the Covered Entity’s compliance with any such laws. Business Associate agrees that, notwithstanding any other provision in the RFR or this BAA, the Covered Entity may terminate this BAA upon written notice, in the event the Business Associate fails to enter into negotiations for, and to execute, any such amendment.

C. Survival. The Business Associate’s obligations under the terms of this Agreement shall survive the termination of this BAA even if the Parties enter into a second BAA unless the second BAA specifically states that the obligations of this BAA are terminated.

D. Remedies. Nothing in the RFR or Contract or other course of dealing shall be construed to waive or limit any of the Covered Entity’s legal rights or remedies which may arise from Business Associate’s unauthorized use or disclosure of any data received by it under this Agreement. The Covered Entity’s exercise or non-exercise of any authority under this Agreement including, for example, any rights of inspection or approval of privacy or security practices or approval of sub-contractors, shall neither relieve Business Associate of any obligations set forth herein, nor be construed as a waiver of any of Business Associate’s obligations nor as an acceptance of any unsatisfactory practices or privacy or security failures or breaches by Business Associate.

E. Interpretation. Any ambiguity in this Agreement shall be resolved to permit the Covered Entity and Business Associate to comply with the Privacy Rule, HIPAA, HITECH Act, the Final Rule, Part 2, and any other applicable federal or state law pertaining to the privacy, confidentiality, or security of PHI.

F. Conflict. In the event that any terms of this Agreement are inconsistent with the terms of the RFR or the Contract, then the terms of this Agreement shall control with respect to the subject matter hereof. Any ambiguity shall be resolved in favor of a meaning that permits Covered Entity to comply with the HIPAA Rules.

G. Independent Contractor. Business Associate and Covered Entity are independent contractors and this Agreement will not establish any relationship of partnership, joint venture, employment, franchise or agency between Business Associate and Covered Entity. Neither Business Associate nor Covered Entity will have the power to bind the other or incur obligations on the other party’s behalf without the other party’s prior written consent, except as otherwise expressly provided in this Agreement.

H. Entire Agreement. This Agreement shall constitute the entire agreement of the parties hereto with respect to the subject matter hereof except to the extent that the RFR or Contract imposes more stringent requirements related to the use and protection of PHI upon Business Associate. This Agreement supersedes all prior business associate agreements, oral or written, and all other communications between the parties regarding the subject matter of this Agreement.

VII. NOTICES

All notices, requests, and demands or other communications to be given under this Agreement to a Party will be made via email, along with one or more of the following, if necessary: first class mail, registered or certified or express courier to the address given below:

A. If to Covered Entity:

Email: Rachelle.Mercier@mass.gov; Andrew.Stern@mass.gov Mail: Attn: Legal Department, McCormick Building, 1 Ashburn Place, Suite 1413, Boston, MA 02108

B. If to Business Associate:

GROUP INSURANCE COMMISSION

(Covered Entity)

By________________________________ Name:

Title: Executive Director

Date:

[VENDOR NAME]

(Business Associate)

By________________________________Name:

Title:

_________________________________Date:

GIC-[VENDOR NAME] BAA – [YEAR] 5