Attachment B - BAA.PDF

ATTACHMENT B Arkansas State Police

BUSINESS ASSOCIATE AGREEMENT

This BUSINESS ASSOCIATE AGREEMENT (this “Agreement”) is entered into by and between and Arkansas State Police Health Plan (the

“Health Plan”) (together, the “Parties”), effective as provided below.

RECITALS

WHEREAS, the Health Plan is a “covered entity” within the meaning of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations concerning privacy of individually identifiable health information as set forth in 45 CFR Parts 160-164, as amended from time to time (the “Privacy Rule”); and

WHEREAS, has heretofore entered into an agreement with the Arkansas State

Police (“Plan Sponsor”) to provide certain administrative services in connection with the Health Plan (the

“Service Agreement”); and

WHEREAS, the Privacy Rule requires covered entities such as the Health Plan to obtain and document satisfactory assurances from “business associates” (as defined therein) regarding appropriate safeguarding of certain “protected health information” (as defined therein) received or created by the business associate

(a “BA Agreement”); and

WHEREAS, , in the performance of its services in connection with the Health Plan, may be deemed a “business associate” within the meaning of the Privacy Rule; and

WHEREAS, the Parties desire to enter into an agreement intended to satisfy the BA Agreement requirement and related requirements under the Part D Program (as defined in the Service Agreement) as and to the extent such requirement may be applicable.

NOW, THEREFORE, in consideration of the premises and the respective covenants and agreements herein contained, the Parties agree as follows:

AGREEMENT

1. Definitions

Capitalized terms not expressly defined in this Agreement shall have the meanings as defined in the

Privacy Rule and the Security Standards (as defined below). For purposes of this Agreement:

(a) “Designated Record Set” shall have the same meaning as the term “designated record set” in 45 CFR 164.501 in respect of the Health Plan.

(b) “Effective Date” shall have the meaning as set forth in Section 7(a) of this Agreement.

(c) “ERISA” shall mean Employee Retirement Income Security Act of 1974, as amended, and the regulations hereunder.

(d) “Individual” shall have the same meaning as the term “individual” in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with

45 CFR 164.502(g).

(e) “Health Plan Administrator” or “Plan Administrator” shall have the same meaning as set forth in the Health Plan’s Plan Document.

(f) “Privacy Rule” shall have the meaning as set forth in the RECITALS portion of this

Agreement.

(g) “Protected Health Information” shall have the same meaning as the term “protected health information” in 45 CFR 160.103, but limited to the information created, received, transmitted or maintained by from or on behalf of the Health Plan.

“Protected Health Information” includes electronic protected health information (as defined in 45 CFR 160.103) (“ePHI”) that ________________creates, receives, maintains or transmits on behalf of the Health Plan.

(h) “Required by Law” shall have the same meaning as the term “required by law” in 45

CFR 164.103 (and as further described in 70 Federal Register 4405 with regard to compliance with the Center for Medicare and Medicaid Services’ requirement of disclosure of Protected Health Information pursuant to 42 CFR 423.884(b)).

(i) “Secretary” shall mean the Secretary of the Department of Health and Human Services or his designee.

(j) “Security Incident” shall have the same meaning as set forth in 45 CFR 164.304, and which includes the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an

Information System (as defined at 45 CFR 164.304).

(k) “Security Standards” shall mean the Security Standards for the Protection of Electronic

Protected Health Information at 45 CFR Parts 160, 162, and 164, as amended from time to time.

(l) “Service Agreement” shall have the meaning as set forth in the RECITALS portion of this Agreement.

(m) “Significant Breach” shall mean a pattern of activity or practice that constitutes a material breach or violation of this Agreement in the written opinion of legal counsel for the Health Plan. For purposes hereof, a “pattern of activity or practice” shall consist of at least three (3) discrete acts and/or omissions within a period of not more than 180 consecutive days.

2. Obligations of ________________ agrees to:

(a) Not use or disclose Protected Health Information other than as permitted or required by this Agreement, the Privacy Rule, the Security Standards, or as Required By Law;

(b) Use appropriate safeguards to prevent use or disclosure of the Protected Health

Information other than as provided for by this Agreement and mitigate to the extent practicable, any harmful effect known to of use or disclosure of

Protected Health Information in violation of this Agreement;

(c) Report to the Health Plan Administrator, for the benefit of the Health Plan, any use or disclosure of the Protected Health Information not provided for by this Agreement of which it becomes aware, including any potential “breach” of Protected Health

Information that may require notification to Individuals, the media, and/or the Secretary pursuant to 45 CFR 164.400 et. seq., and any Security Incident of which it becomes aware.

____________________agrees to assist Health Plan, or Health Plan Administrator on behalf of the Health Plan, as it determines, in its sole discretion, whether any impermissible use or disclosure of Protected Health Information constitutes a breach of

Protected Health Information for purposes of Subtitle D of the Health Information

Technology for Economic and Clinical Health Act of 2009 (42 U.S.C. 17921-53) and its implementing regulations (“HITECH”) and the Privacy Rule, and whether such breach requires notification by the Health Plan to Individuals, the media, and/or the Secretary.

In furtherance of the foregoing, in the event discovers a breach of Protected

Health Information, agrees:

(i) To provide the Health Plan with relevant information, including without limitation, a brief description of the incident, the date of the incident, the

Individuals potentially affected, the date of discovery, the type of Protected

Health Information involved, any recommendations that should be made to

Individuals for their protection, a description of how is and proposes to mitigate any harm to Individuals, a description of how is and will prevent future incidents, and any other information reasonably requested by the Health Plan so that it may comply with its obligations under

HITECH and its implementing regulations, and the Privacy Rule.

(ii) To assist the Health Plan to further investigate any breach incident, to assist in making notifications to Individuals as necessary, to mitigate any harm resulting or that may reasonably result from a breach incident, and to assist in taking any other actions that the Health Plan deems reasonably necessary to comply with

HITECH and its implementing regulations, and the Privacy Rule.

(d) Ensure that any agent, including a subcontractor, to whom it provides Protected Health

Information received from the Health Plan, or that creates, receives, maintains, or transmits Protected Health Information on behalf of , enters into an agreement that contains the same restrictions and conditions that apply through this

Agreement to with respect to such information, including without limitation, ensuring that any such agent or subcontractor agrees to implement administrative, physical and technical safeguards as required by the Security Standards that reasonably and appropriately protect the security, confidentiality, integrity, and availability of any ePHI that creates, receives, maintains, or transmits on behalf of the Health Plan; provided that the Health Plan shall not have any right to disapprove any subcontractors of or to review any agreements with such subcontractors, except to the extent specifically provided herein;

(e) Provide, in a commercially reasonable time and manner, access to Protected Health

Information to the Health Plan Administrator, for the benefit of the Health Plan, to the extent necessary to meet the requirements under 45 CFR 164.524, provided that such access shall be provided only to the extent such Protected Health Information is in the possession of ______________________ and is a part of the Designated Record Set.

(f) Make, in a commercially reasonable time and manner, any amendment(s) to Protected

Health Information that the Health Plan Administrator, for the benefit of the Health Plan, directs or agrees to pursuant to 45 CFR 164.526, provided that such amendment(s) shall be made only to the extent such Protected Health Information is in the possession of and is a part of the Designated Record Set;

(g) Make available to the Health Plan, in a commercially reasonable time and manner, information in the possession of as and to the extent required for the Health Plan to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528;

(h) To the extent has agreed to carry out any of the Health Plan’s obligations under the Privacy Rule, shall comply with the requirements of the Privacy Rule that apply to the Health Plan in the performance of its obligations; and

(i) Make internal practices, books, and records relating to the use and disclosure of Protected

Health Information received from the Health Plan, or created or received by on behalf of the Health Plan, available to the Secretary for purposes of the Secretary determining the Health Plan's and _______________’s compliance with the Privacy Rule and Security Standards.

3. Permitted Uses and Disclosures by _________________________

(a) General Use and Disclosure Provisions. Except as otherwise limited in this Agreement, may use or disclose Protected Health Information to perform its duties, functions, activities, or services for, or on behalf of, the Health Plan or its Plan Sponsor, provided that such use or disclosure would not violate the Privacy Rule if done by the Health Plan.

To the extent practicable, shall use a Limited Data Set (as defined in the Privacy Rule) with respect to Protected Health Information of the Health Plan. If not practicable, ____________________________shall use the least amount of Protected Health Information necessary to achieve the intended purpose, and shall document why such amount of Protected Health Information is necessary.

shall use and/or disclose the minimally necessary Protected Health Information to perform its obligations under the Service Agreement, and shall comply with any guidance issued by the Secretary regarding the minimal necessary use and disclosure of Protected

Health Information.

(b) Specific Use and Disclosure Provisions.

(i) may use Protected Health Information for the proper management and administration of or to carry out the legal responsibilities of .

(ii) Except as otherwise limited in this Agreement, may disclose

Protected Health Information for the proper management and administration of

___________________or to carry out the legal responsibilities of

, provided that:

(A) Disclosures are Required By Law, or

(B) obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies of any instances of which it is aware in which the confidentiality of the information has been breached.

(iii) Except as otherwise limited in this Agreement, may use

Protected Health Information to provide Data Aggregation services as permitted by 45 CFR 164.504(e)(2)(i)(B).

(iv) may use or disclose Protected Health Information to report violations of law to appropriate Federal and/or State authorities to the extent consistent with 45 CFR 164.502(j).

(v) Except as otherwise limited in this Agreement, may disclose

Protected Health Information to other “business associates” (within the meaning of the Privacy Rule) of the Health Plan to perform its duties under the Service

Agreement. Notwithstanding any provision hereof or any other prior agreement by the Parties, it shall be the Health Plan’s sole responsibility (and not

_________________’s responsibility) to ensure that the Health Plan has entered into appropriate business associate agreements with its business associates.

(vi) Except as otherwise limited in this Agreement, may disclose

Protected Health Information to the persons to whom the Health Plan

Administrator, on behalf of the Health Plan, directs __________________ to provide Protected Health Information. Notwithstanding any provision hereof or any other prior agreement by the Parties, it shall be the Health Plan’s sole responsibility (and not ’s responsibility) to ensure that the

Health Plan has, in its official plan document, appropriate provisions regarding disclosures of Protected Health Information.

4. Obligations of the Health Plan and Health Plan Administrator

(a) General. Except as otherwise specifically provided under this Agreement, the Health Plan shall not request or permit to (and shall not cause the Health Plan

Administrator to request or permit to) use or disclose Protected

Health Information in any manner that may not be permissible under the Privacy Rule if done by the Health Plan.

(b) Notification of Privacy Practices and Restrictions. The Health Plan shall cause the Health

Plan Administrator to promptly notify of:

(i) Any limitation(s) in the Health Plan’s notice of privacy practices in accordance with 45 CFR 164.520, to the extent that such limitation may affect

's use or disclosure of Protected Health Information;

(ii) Any changes in, or revocation of, permission by Individual to use or disclosure of Protected Health Information, to the extent that such changes may affect 's use or disclosure of Protected Health Information; and

(iii) Any restriction to the use or disclosure of Protected Health Information that the Health Plan has agreed to in accordance with 45 CFR 164.522, to the extent that such restriction may affect 's use or disclosure of

Protected Health Information.

5. Disclosure to CMS for Part D Program

Pursuant to 42 CFR 423.884(b) and notwithstanding any provision herein to the contrary, the

Health Plan agrees that the Health Plan, the Health Plan Administrator or (on behalf of the Health Plan) may disclose Protected Health Information to the Center for Medicare and Medicaid Services (CMS) to the extent necessary to comply with Subpart R of 42 CFR Part

423 (relating to Notices of Creditable and Non-Creditable Coverage and applications for drug subsidy payment to the Plan Sponsor in connection with the prescription drug benefit under the

Health Plan).

6. Security of Electronic Protected Health Information

(a) has implemented administrative, physical, and technical safeguards that reasonably and appropriately protect the security, confidentiality, integrity and availability of ePHI that it creates, receives, maintains or transmits on behalf of the

Health Plan as required under the Security Standards.

(b) agrees that it will ensure that agents or subcontractors to whom it provides ePHI agree to implement the administrative, physical, and technical safeguards that reasonably and appropriately protect its confidentiality, integrity and availability.

(c) agrees to report to the Health Plan, as soon as reasonably practicable, any Security Incident (as defined in 45 C.F.R. Part 164.304) of which it becomes aware.

(d) The Health Plan agrees and understands that the Health Plan is independently responsible for the security of ePHI in its possession, whether it was created by the Health Plan or received from outside sources (including _______________).

7. Term and Termination

(a) Term. The term of this Agreement shall be for a period commencing as of the effective date of the Service Agreement and ending when all of the Protected Health Information provided by the Health Plan to , or created or received by on behalf of the Health Plan, is destroyed, returned to the Health Plan or further protected in accordance with the termination provisions in this Section 7.

(b) Termination for Cause. Upon the Health Plan Administrator’s knowledge of a

Significant Breach of ________________’s obligation under this Agreement and subject to Section 7(c) hereof, the Health Plan Administrator may commence termination of this

Agreement by providing a notice of termination to____________________.

Notwithstanding the foregoing, this Agreement shall be considered to have been terminated pursuant to this Section 7(b) only if, prior to such notice of termination:

(i) The Health Plan Administrator shall have given to written notice describing with specificity the Significant Breach;

(ii) A period of 60 days from and after the giving of such notice shall have elapsed without having substantially cured or remedied such reason for termination during such 60-day period, unless such reason for termination cannot be substantially cured or remedied within 60 days, in which case the period for remedy or cure shall be extended for a reasonable time (not to exceed 60 days), provided that has made and continues to make a diligent effort to effect such remedy or cure; and

(iii) A final determination shall have been made by the Health Plan Administrator that

Significant Breach persists, following a meeting at which shall be entitled to appear and contest the determination.

In the event learns of a pattern of activity or practice by the Health Plan, or the

Health Plan Administrator, of material breach or violations of the terms and conditions set forth herein, if the Health Plan or Health Plan Administrator fails to cure or end such breach or violations, shall have the right to terminate this Agreement, or if termination is not feasible, report the material breach or violations to the Secretary.

(c) Condition Precedent. Upon receipt of a notice of termination pursuant to Section 7(b) hereof, or for termination of this Agreement for any other reason, shall return or destroy all Protected Health Information received from the Health Plan, or created or received by _______________on behalf of the Health Plan, that still maintains in any form, and shall retain no copies of such information. If determines that such return or destruction is not feasible, shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible.

(d) Report to Secretary of HHS. If, in the reasonable determination of the Health Plan

Administrator, termination of the Agreement pursuant to Section 7(b) hereof is not feasible, the Health Plan Administrator shall report the Significant Breach to the

Secretary, if required under HIPAA.

8. Other Provisions

(a) Separate from Service Agreement. Except to the extent specifically provided herein, this

Agreement shall not be construed, and is not intended, to be a part of the Service

Agreement or to otherwise impose on any duties, responsibilities, obligation whatsoever in respect of the administration of the Health Plan, including any duties, responsibilities or obligation of the Health Plan pursuant to the Privacy Rule.

(b) No Liability. To the fullest extent permitted by law, shall be under no liability for any use or disclosure of Protected Health Information made in accordance with the directions of the Health Plan.

(c) No Duty to Question. Notwithstanding anything herein to the contrary, __________________________shall not be under any duty to question any directions received from the Health Plan Administrator, nor to review in any respect the manner in which any fiduciary of the Health Plan exercises its authority and discharges its duties with respect to the Health Plan.

(d) Amendment. The Parties agree to take such action to amend this Agreement from time to time as is necessary for the Health Plan to comply with applicable law, including the requirements of HIPAA, HITECH, the Privacy Rule, and the Security Standards.

(e) Ambiguities. Any ambiguity in this Agreement shall be resolved in a manner that is consistent with the applicable requirements under the Privacy Rule.

(f) Notice. Any notice required to be given hereunder shall be in writing and delivered by hand or sent by facsimile, registered or certified mail, return receipt requested, or by air courier, to the address (or fax number) cited in the signature block of this Agreement or to such other address (or fax number) as shall be specified by like to notice by either

Party, and shall be deemed given only when received.

(g) Headings. The title, headings, and subheadings of this Agreement are solely for the convenience of the Parties and do not effect the meaning or interpretation of any provision of this Agreement.

(h) Governing Law. Except to the extent preempted by ERISA, this Agreement shall be governed by and enforceable in accordance with the laws of the State of Arkansas without giving effect to the principles of conflict of laws thereof.

(i) Entire Agreement. This Agreement and the Service Agreement contain the entire understanding between the Health Plan and with respect to the subject matter hereof and, except as specifically provided herein, cancels and supersedes any and all other agreements between the Health Plan and with respect to the subject matter hereof. Any amendment or modification of this Agreement shall not be binding unless in writing and signed by both the Health Plan and .

(j) Severability. In the event that any provision of this Agreement is determined to be invalid or unenforceable, the remaining terms and conditions of this Agreement shall be unaffected and shall remain in full force and effect, and any such determination of invalidity or unenforceability shall not affect the validity or enforceability of any other provision of this Agreement.

(k) No Benefit to Others. The representations, covenants and agreements contained in this

Agreement are for the sole benefit of the Parties, and they shall not be construed as conferring, and are not intended to confer, any rights on any other persons.

(l) Counterparts. This Agreement may be signed in counterparts, each of which shall be an original, with the same effect as if the signatures thereto and hereto were upon the same instrument.

IN WITNESS WHEREOF, the Parties have entered into this Business Associate Agreement, effective as of the Effective Date.

ARKANSAS STATE POLICE

Signed By:_____________________ Signed By:_____________________

Name:_________________________ Name:_________________________

Title: _________________________ Title: _________________________

Address:_______________________ Address:_______________________

Date:__________________________ Date:__________________________