Attachment A - HIPAA Business Associate Agreement_FINAL~1.docx

STATE OF ILLINOIS

ATTACHMENT A – HIPAA BUSINESS ASSOCIATE AGREEMENT

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (the “BA Agreement”) is effective as Click here to insert date (the “Effective Date”) by and between the Illinois Department of Public Health, 535 W. Jefferson Street, Springfield, Illinois 62761 (“Department”) and Click here to enter Offeror Name are each a “Party” and collectively the “Parties”).

The Parties have entered into a Contract (“Contract”) under which Click here to enter Offeror Name, uses and/or discloses Protected Health Information (“PHI”) as these terms are defined in the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) that is created, received, maintained or transmitted by Click here to enter Offeror Name from or on behalf of the Department, in the notifying test recipients of the results of COVID 19 tests administered at mobile sites operated by the Illinois Emergency Management Agency in concert with the Illinois Department of Public Health (the “Services”).

The Parties shall comply with the Standards for Privacy of Individually Identifiable Health Information (the “Privacy Rule”) and the Standards for Security of Electronic Protected Health Information (the “Security Rule”) under the HIPAA. This BA agreement, in accordance with HIPAA, sets forth the terms and conditions pursuant to which PHI will be handled between the Parties and supersedes any business associate agreement previously in place between the Parties. The Parties agree as follows:

DEFINITIONS

A. “Business Associate” shall have the same meaning as the term “business associate” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean Click here to enter Offeror Name.

B. “Breach” shall have the same meaning as the term “breach” set out in 45 CFR 164.402.

C. “CFR” means the Code of Federal Regulations. A reference to a CFR section means that section as amended from time to time; provided that if future amendments change the designation of a section referred to herein, or transfer a substantive regulatory provision referred to herein to a different section, the section references herein shall be deemed to be amended accordingly.

D. “Compliance Date(s)” shall mean the date(s) established by the Secretary or the United States Congress as the effective date(s) of applicability and enforceability of the Privacy Rule, Security Rule and HITECH Standards.

E. “Contract” shall mean the agreement between the Illinois Department of Public Health and Click here to enter Offeror Name.

F. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean the Department.

G. “Electronic Protected Health Information” (ePHI) shall have the same meaning as the term “electronic protected health information” in 45 CFR §160.103, limited to the information received from or created on behalf of Covered Entity by Business Associate.

H.

I. “HITECH Standards” shall mean the privacy, security and security breach notification provisions applicable to a Business Associate under Subtitle D of the Health Information Technology for Education and Clinical Health Act, which is Title XIII of the American Recovery and Reinvestment Act of 2009, and any regulations promulgated thereunder.

J. “Individual” shall have the same meaning as the term “individual” in 45 CFR §160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR §164.502(g).

K. “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR parts 160 and 164, subparts A and E.

L. “Protected Health Information” (PHI) shall have the same meaning as the term “protected health information” in 45 CFR §160.103, limited to the information received from or created on behalf of Covered Entity by Business Associate.

M. “Required by Law” shall have the same meaning as the term “required by law” in 45 CFR §164.103.

N. “Security Incident” shall have the same meanings as the term “security incident” in 45 CFR §164.304.

O. “Security Rule” shall mean the Standards for the Protection of Electronic Protected Health Information at 45 CFR parts 160 and 164, subparts A and C.

Terms used, but not otherwise defined, shall have the same meaning as those terms in the Privacy Rule, Security Rule and HITECH Standards.

PERMITTED USES AND DISCLOSURES OF PHI.

Services. Except as limited in this BA agreement, Click here to enter Offeror Name may use PHI as necessary to perform its obligations under the Contract. Click here to enter Offeror Name may disclose PHI as permitted under this BA agreement:

i. to its employees, subcontractors and agents, in accordance with this BA agreement; or

ii. as otherwise permitted by or as required by the Privacy or Security Rule. Except as permitted by this BA agreement, Click here to enter Offeror Name may not use or disclose PHI in a manner that would violate the requirements of the Privacy or Security Rule, or any other applicable law, if done by Covered Entity.

Business Activities of Click here to enter Offeror Name. Unless otherwise limited herein or by the Contract, Click here to enter Offeror Name may:

i. Use the PHI in its possession for its proper management and administration and to fulfill any present or future legal responsibilities of Click here to enter Offeror Name provided that such uses are permitted under state and federal confidentiality laws.

ii. Disclose the PHI in its possession to third parties for the purpose of its proper management and administration or to fulfill any present or future legal responsibilities of Click here to enter Offeror Name, provided that the third party notifies Click here to enter Offeror Name of any instances of which it is aware in which the confidentiality of the PHI has been breached within 24 hours of discovering of such breach, via certified mail to Click here to enter Offeror Name .

iii. If needed for the provision of Services, following the approval of the Department, provide data aggregation services, as that term is defined in HIPAA.

RESPONSIBILITIES OF THE PARTIES WITH RESPECT TO PHI.

Responsibilities of Click here to enter Offeror Name . With regard to use and/or disclosure of PHI, Click here to enter Offeror Name shall:

i. Not use or disclose PHI other than as permitted or required by this BA agreement, the Contract, or as required by Law.

ii. Use appropriate safeguards and comply with the Privacy Rule and the Security Rule with respect to electronic PHI.

iii. Report to the Department, within 2 business days of discovering any use or disclosure of PHI not provided for by this BA agreement, or the Contract, of which it becomes aware and any security incident of which it becomes aware, including breaches of unsecured PHI as required at 45 C.F.R. § 164.410, and cooperate with the Department in any mitigation or breach reporting efforts; provided, however, that this Section constitutes reporting by Business Associate of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below) for which no additional report to the Department shall be required. “Unsuccessful Security Incidents” means security incidents which do not result in access to PHI, such as pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the above, so long as such incident does not:

(a) result in unauthorized access, use, or disclosure of PHI, or

(b) impact the confidentiality, integrity, or availability of PHI or the Department's information systems.

iv. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any subcontractors, as allowed by the Contract, of Click here to enter Offeror Name, agree to the restrictions, conditions, and requirements that apply to Click here to enter Offeror Name with respect to PHI.

v. Maintain and make available the information required to provide an accounting of disclosures as necessary to satisfy the Department’s obligations under 45 C.F.R. § 164.528.

vi. To the extent Click here to enter Offeror Name is to carry out one or more of the Department’s obligations under Subpart E of 45 C.F.R. Part 164, comply with the requirements of Subpart E that apply to the Department in the performance of such obligations.

vii. Upon request from the Secretary of the US Department of Health and Human Services, make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of the US Department of Health and Human Services for purposes of determining compliance with HIPAA.

viii. Comply with the minimum necessary requirements under HIPAA.

Responsibilities of the Department. With regard to the use and/or disclosure of PHI by Click here to enter Offeror Name, the Department shall:

i. Provide Click here to enter Offeror Name the Notice of Privacy Practices that the Department provides to individuals pursuant to 45 C.F.R. § 164.520 that may affect the Department’s use or disclosure of PHI.

ii. Inform Click here to enter Offeror Name of changes in, or revocation of, an individual’s permission to use or disclose PHI, if such limitation may affect the Department’s use or disclosure of PHI.

iii. Notify Click here to enter Offeror Name in writing of any restriction on the use or disclosure of PHI that the Department has agreed to or is required to abide by under 45 C.F.R. § 164.522, if such restriction impacts the use and/or disclosure of PHI by Click here to enter Offeror Name.

iv. Not request Click here to enter Offeror Name to use or disclose PHI in any manner that would not be permissible under the Privacy and Security Rules if done by the Department.

v. Comply with the minimum necessary requirements under HIPAA.

No Sale of PHI. Click here to enter Offeror Name shall not directly or indirectly receive remuneration from a third party in exchange for PHI unless Click here to enter Offeror Name has:

has obtained explicit authorization from the Department in writing; and the Department or Click here to enter Offeror Name has received a valid authorization from the Individual that specifies that Click here to enter Offeror Name can further exchange PHI about the Individual for remuneration by the entity receiving the PHI, in compliance with the requirements of 45 C.F.R. § 164.508. The foregoing provision shall not apply to the Department’s payment to Click here to enter Offeror Name for Services.

TERM AND TERMINATION.

Term. The term of this BA agreement shall commence on the Effective Date and continue until the earlier of termination of the Contract or the date the Department terminates this BA agreement for cause as authorized in Section IV(B) of this BA agreement.

Termination for Cause. The parties shall abide by the “Term and Termination” Section of the Contract.

Obligations of the Department upon Termination. Department further agrees to extend any and all protections, limitations and restrictions contained in this BA agreement to Click here to enter Offeror Name to use and/or disclosure of any PHI retained after the termination of this BA agreement, and to limit any further uses and/or disclosures to the purposes that make the return or destruction of the PHI infeasible.

MISCELLANEOUS.

Amendments; Waiver. This BA agreement may not be modified except in a writing signed by the Parties. A waiver with respect to one event shall not be construed as a bar to or waiver of any subsequent events. The Parties will take such action as is necessary to amend this BA agreement from time to time as necessary for compliance with the requirements of HIPAA and any other applicable law.

Third-Party Beneficiaries. Nothing express or implied in this BA agreement is intended to confer any rights, remedies, obligations, or liabilities to any third party to this BA agreement.

Notices. Any notices required under this BA agreement shall be in writing and made by personal delivery, registered or certified mail, postage prepaid, sent by nationally recognized express courier, or via electronic mail to the address given below:

If to THE DEPARTMENT, to: Donna L. Otis, HIPAA/Privacy Officer, Illinois Department of Public Health, 122 S. Michigan Avenue, 7th Floor, Chicago, IL 60603.

If to Click here to enter Offeror Name, to: Click here to enter text.

Counterparts. This BA agreement may be executed in any number of counterparts, each of which shall be deemed an original.

Disputes. If any dispute arises between the Parties with respect to this BA agreement, the Parties shall make good faith efforts to resolve such matters informally.

Changes in Law. The Parties acknowledge this BA agreement is subject to applicable state, local, and federal laws, which may be amended or subject to new legislation. Any laws that invalidate or are inconsistent with the material terms and conditions of this BA agreement or that would cause one or both of the Parties to be in violation of law, shall be deemed to have superseded the terms of this BA agreement; in such event, the Parties will use their best efforts to modify the BA agreement to be consistent with such laws.

Construction of Terms and Interpretation. The terms of this BA agreement shall be construed in light of any applicable interpretation or guidance on HIPAA and/or the Privacy Rule issued by the Department of Health and Human Services or the Office for Civil Rights from time to time. Ambiguity in this BA agreement shall be interpreted to permit compliance with HIPAA.

Contradictory Terms. Any provision of the Contract that is directly contradictory to one or more terms of this BA agreement (“Contradictory Term”) shall be superseded by the terms of this Contract for the purpose of the Parties’ compliance with HIPAA and to the extent that it is reasonably impossible to comply with both the Contradictory Term and the terms of this BA agreement.

Governing Law. This BA agreement shall be governed by the governing law designated in the Contract.

Indemnification And Liability: Business Associate shall indemnify and hold harmless the State of Illinois, its agencies, officers, employees, agents and volunteers from any and all costs, demands, expenses, losses, claims, damages, liabilities, settlements and judgments, including in-house and contracted attorneys’ fees and expenses, arising out of:

any breach or violation by Click here to enter Offeror Name of any of its certifications, representations, warranties, covenants or agreements;

any actual or alleged death or injury to any person, damage to any real or personal property, or any other damage or loss claimed to result in whole or in part from Click here to enter Offeror Name negligent performance;

any act, activity or omission of Click here to enter Offeror Name or any of its employees, representatives, subcontractors or agents; or any actual or alleged claim that the services or goods provided under this contract infringe, misappropriate, or otherwise violate any intellectual property (patent, copyright, trade secret, or trademark) rights of a third party. In accordance with Article VIII, Section 1(a), (b) of the Constitution of the State of Illinois and 1973 Illinois Attorney General Opinion 78, the State may not indemnify private parties absent express statutory authority permitting the indemnification. Neither Party shall be liable for incidental, special, consequential, or punitive damages.

SIGNATURE PAGE

By: __________________________________

Name: XXX

Title: XXX - Illinois Department of Public Health

Date: _________________________________

By: __________________________________

Name:

Title: _________________________________

Date: ___________________________________