Attachment A BAA.docx

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“BAA”) is entered into by and between the Arkansas Department of Insurance, Public Employee Claims Division (hereinafter “Division”) and _________________________________ __________________ (hereinafter “Business Associate”).

W I T N E S S E T H:

WHEREAS, the parties to this Business Associate Agreement have entered into an arrangement under which the Business Associate provides certain services to the Division as more fully described in the Agreement between the parties; and WHEREAS, the Division will disclose certain information to the Business Associate during the course of the latter’s provision of such services, some of which may constitute “Confidential Personal Information”.

WHEREAS, both the Business Associate and the Division intend to comply with applicable Arkansas law and protect the privacy of injured employees and to provide for the security of “Confidential Personal Information” disclosed to the Business Associate; and WHEREAS, both the Business Associate and the Division wish to set forth the terms and the conditions pursuant to which Confidential Personal Information received by the Business Associate in the performance of services for the Division will be handled between themselves and with third parties;

NOW, THEREFORE, in consideration of the mutual promises, covenants, terms, and conditions contained herein, and intending to be legally bound, the Business Associate and the Division agree as follows:

1. Definitions.

The following terms shall be defined as set forth below.

(a) For purposes of this Agreement, “Business Associate” shall mean the named Business Associate hereinabove. For purposes of this Agreement, “Division” shall include the named Public Employee Claims Division hereinabove, as well as any other entity specifically identified in any joint notice of privacy practices.

(b) “Confidential Personal Information” shall include social security numbers, dates of birth, home telephone numbers, and “Health Information” and “Electronic Health Information” of an “Individual.”

(c) “Electronic Health Information” or “eHI” shall include health information transmitted by electronic media or maintained in electronic media received by the Business Associate from or on behalf of the Division.

(d) “Individual” means the person who is the subject of the Confidential Personal Information” and shall include a person who qualifies as a personal representative of the individual.

(e) “Health Information” or “HI” means individually identifiable health information, limited to the information received or created by the Business Associate from or on behalf of the Division. Unless otherwise stated in this Agreement, any provision, restriction, or obligation in this Agreement related to the use or disclosure of HI shall apply equally to eHI.

(f) “Security Breach” shall mean the acquisition, access, use, or disclosure of Confidential Personal Information in a manner which compromises the security or privacy of the information.

(g) “Security Incident” shall mean the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system, except that “Security Incident” shall not include unsuccessful spam emails, viruses, phishing scams, firewall attacks, DOS or DDOS attacks, or any other unsuccessful attempted unauthorized activity or interference if such activity or interference is sufficiently common or routine to be successfully neutralized in the ordinary course of providing data security.

(h) “Unsecured HI” shall mean HI or eHI that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals.

2. Background of the Agreement The Business Associate and the Division have entered into an Agreement for services. In the performance of these services, the Division may disclose Confidential Personal Information to the Business Associate and the Business Associate may disclose Confidential Personal Information to the Division. Both parties are committed to protecting Confidential Personal Information and accordingly, have entered into this Agreement to set forth the terms and conditions of how such Confidential Personal Information shall be handled between the Business Associate, the Division, and third parties. The parties have entered into this BAA in order to set forth the terms and conditions for access to and use of Confidential Personal Information.

3. Permitted Uses and Disclosures by the Business Associate

(a) Except as otherwise limited in this Agreement, the Business Associate may use or disclose Confidential Personal Information on behalf of the Division for purposes of providing the services described hereinabove and described in any written agreement between the parties. Except as otherwise limited in this Agreement, the Business Associate may use Confidential Personal Information for the proper management and administration of the Business Associate, or to carry out the legal responsibilities of the Business Associate.

(b) Except as otherwise limited in this BAA, the Business Associate may disclose Confidential Personal Information to a third person for the proper management and administration of the Business Associate, provided that such disclosures are Required By Law, or the Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and may only be used or further disclosed as Required By Law, or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it becomes aware in which the confidentiality of the information has been the subject of a Security Breach.

(c) The Business Associate may use Confidential Personal Information to report violations of law to appropriate federal and state authorities.

(d) The Business Associate may disclose Confidential Personal Information to the Arkansas Workers’ Compensation Commission if required to comply with state law or Workers’ Compensation Rules and Regulations.

(e) The Business Association may disclose Confidential Personal Information to the Division, medical providers, the software vendor with whom the Division has a contract, and vocational rehabilitation personnel for purposes of processing bills, importing and exporting of data, performing data conversions and reports, obtaining any needed clarification of bills or medical records, obtaining peer reviews, independent medical evaluations, impairment ratings, disability status of individuals, determining the reasonableness and/or necessity of medical services and procedures.

(f) The Business Associate may de-identify any and all HI that it obtains from the Division or medical providers, but only if such de-identification is accomplished in accordance with the requirements set out in the HIPAA regulations contained at 45 CFR § 514 (a) and (b).

4. Obligations of the Business Associate

(a) The Business Associate agrees not to use or disclose Personal Confidential Information other than as permitted or required by this Agreement or as Required by Law.

(b) The Business Associate agrees to use appropriate safeguards to prevent disclosure of Confidential Personal Information other than as provided for by this Agreement, and to implement administrative, physical, and technical safeguards in order to protect the confidentiality, integrity, and availability of Confidential Personal Information that the Business Associate receives, maintains, or transmits.

(c) The Business Associate agrees to report to the Division within four (4) hours of becoming aware of any use or disclosure of Confidential Personal Information not provided for by this Agreement. In addition, the Business Associate shall notify the Division of any Security Incident or Security Breach. This notice shall include the identification of each Individual whose Unsecured Confidential Personal Information has been, or is reasonably believed by the Business Associate to have been accessed, acquired or disclosed during the Security Breach, analysis of the storage mechanisms for the Confidential Personal Information, the data elements that have been compromised, and all details regarding the circumstances by which the Confidential Personal Information came to be compromised. The Business Associate agrees to cooperate with the Division in mitigating, to the extent practicable, any harmful effect that is known to exist as a result of such unauthorized use or disclosure of Confidential Personal Information, such Security Incident, or Security Breach. The Business Associate further agrees to cooperate with the Division in complying with all state and federal public notification requirements arising therefrom.

(d) If the Security Breach is the result of negligence on the part of the Business Associate, the Business Associate will indemnify the Division for actual costs for the following:

1. Notification to affected individuals; and

2. Purchasing of one year of credit monitoring for individuals affected if social security numbers or dates of birth information are involved in the security breach.

(e) The Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Confidential Personal Information received from or received by the Business Associate on behalf of the Division, agrees to the same restrictions and conditions that apply in the Agreement to the Business Associate with respect to such information, including but not limited to, the requirement that such agent or subcontractor implement reasonable and appropriate safeguards to protect such information.

(f) The Business Associate agrees to make its internal practices, books, and records relating to the use and disclosure of Confidential Personal Information received from or received by the Business Associate on behalf of the Division, available to the Division.

(g) The Business Associate shall only request, use, or disclose Confidential Personal Information necessary to accomplish the intended purpose of the request, use, or disclosure.

5. Term.

The term of this Agreement shall remain in force and effect until terminated pursuant to Section herein below.

6. Termination.

(a) If the Division determines that the Business Associate has breached a material term of this BAA, the Division shall provide written notice of the material breach to the Business Associate, after which the Business Associate shall have thirty (30) days to take reasonable steps to cure the breach. If the Business Associate does not cure the breach within this specified time, the Division may terminate this BAA and any related agreements covering the services provided by the Business Associate to or on behalf of the Division.

7. Survival.

The respective rights and obligations of the Business Associate Agreement shall survive the termination of services.

8. No Third-Party Beneficiaries.

Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person, other than the parties and their respective successors and assigns, any rights, remedies, obligations, or liabilities whatsoever.

9. Disputes.

If any dispute or claim arises between the parties with respect to this Agreement, the parties will make a good faith effort to resolve such matters informally, it being the intention of the parties that they reasonably cooperate with each other in the performance of the mutual obligations under this Agreement.

10. Amendment.

The parties agree to take such action as is necessary to amend this Agreement from time to time in order for the Division and Business Associate to comply with the requirements of state or federal law or regulation, as statutes and implementing regulations may be implemented or changed. No amendment to this Agreement shall be effective until reduced to writing and duly signed by the authorized representatives of the parties.

11. Non-Waiver.

A waiver with respect to one event shall not be construed as continuing, or as a bar to or waiver of any other right or remedy as to any subsequent events.

12. Assignment.

Neither party may assign any of its rights or obligations under this Agreement without the prior written consent of the other party.

13. Nature of Agreement.

Nothing in this Agreement shall be construed to create a partnership, joint venture, or other joint business relationship between the parties or any of their affiliates, or a relationship of employer and employee between the parties. Rather, it is the intention of the parties that their relationship shall be that of independent contractors.

14. Entire Agreement.

This Agreement constitutes the entire agreement between the Business Associate and the Division relating to the matters specified in this Agreement, and supersedes all prior representations or agreements, whether oral or written, with respect to such matters.

15. Severability.

Any provision of this Agreement that is determined to be invalid or unenforceable will be ineffective to the extent of such determination without invalidating the remaining provisions of this Agreement or affecting the validity of enforceability of such remaining provisions.

16. Notices.

All notices, requests, demands, and other communications required or permitted to be given under this Agreement shall be in writing, and shall be effective upon receipt. Such notice may be made by personal delivery, by overnight delivery service with proof of delivery, or by certified or registered United States mail, return receipt requested. All such communications shall be sent to the addresses of the other party as set out in the signature blocks below. Neither party shall refuse delivery of any notice hereunder.

17. Interpretation.

Any ambiguity in this Agreement shall be resolved to permit the parties to comply with any statute or regulation. The provisions of this Agreement shall prevail over any provision of any other agreement between the Business Associate and the Division that may conflict or be inconsistent with any provisions in this Agreement.

18. Governing Law, Jurisdiction and Venue.

This Agreement and the rights and obligations of the parties hereunder shall be construed, interpreted, and enforced with, and shall be governed by, the laws of Arkansas.

19. Counterparts.

This Agreement may be executed in one or more counterparts, each of which shall be deemed and original, but all of which together shall constitute one and the same document.

The parties have executed this Agreement as of the date signed below.

For Business Associate: For Division: