Attachment B Business Associate Agreement.docx

BUSINESS ASSOCIATE AGREEMENT BETWEEN ENTERPRISE TECHNOLOGY SERVICES AND [FULL LEGAL NAME OF BUSINESS ASSOCIATE]

1. Parties. The Parties to this Agreement are Enterprise Technology Services (ETS), whose address is 2001 Capitol Ave, Cheyenne, WY 82001 (ETS), and [Full Legal Name of Business Associate], whose address is __________________ (Business Associate).

2. Definitions. The Parties agree that the definitions in 45 CFR Parts 160, 162, and 164 shall apply to the terms used in this Agreement.

3. Purpose of Agreement. This Agreement seeks to satisfy the requirements for the privacy and security and transmission of protected health information found in 45 CFR Parts 160, 162, and 164 as well as applicable Wyoming state law. Applicable Wyoming state law may include, but is not limited to, Wyo. Stat. Ann. §§ 35-2-605 et seq., 9-2-125 et seq., and applicable rules and regulations. These statutes, rules, and regulations are collectively referred to as the “Privacy and Security Rules.”

4. Consideration. The Parties accept and agree that the opportunity to do business between the State and the Business Associate is consideration for this Agreement.

5. Term of Agreement and Required Approvals. This Agreement is effective when all parties have executed it, and all required approvals have been granted. Once this Agreement becomes effective, it shall remain effective until it is terminated under the terms of this Agreement.

6. Payment. Please fill out Pricing Schedule 3 in the RFP.

7. Responsibilities of Business Associate. Except as otherwise permitted or required by this Agreement, the Business Associate may only create, receive, maintain, or transmit protected health information received from or on behalf of the Agency as necessary to support the provision and management of a modern, enterprise-level Digital Communication Platform for statewide use, centrally managed by the Department of Enterprise Technology Services (ETS). The platform must provide robust multi-channel capabilities, including email and mission-critical, high-volume SMS (text messaging). Core functionality shall include flexible templating, advanced automation, comprehensive reporting, and strong user and content management. The Business Associate’s services must also support seamless and secure integration with existing State systems, and ensure the successful migration and continuity of all existing contact lists and subscriber data without disruption. Additionally, the services must comply with all applicable laws and regulations, including Federal Communications Commission (FCC), Cellular Telecommunications Industry Association (CTIA), and Telephone Consumer Protection Act (TCPA) requirements for SMS, including two-way messaging, carrier registration, and full opt-in/opt-out management. Such use or disclosure shall be limited to what is required by law, or to carry out the proper management and administration or legal responsibilities of the Business Associate. Further, the Business Associate agrees:

A. To not create, receive, maintain, or transmit protected health information in a manner that would violate any provision of the Privacy and Security Rules, or other applicable federal, state, or local law.

B. To establish, use, and maintain administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of all protected health information that the Business Associate creates, receives, maintains, or transmits on behalf of the Agency and to prevent any use or disclosure of protected health information as provided by this Agreement.

C. To comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information. The Business Associate shall provide notice of its designated security officer to the Agency within thirty (30) days following execution of this Agreement.

D. To limit its use, disclosure, or requests for protected health information to the extent practicable to the minimum necessary to accomplish the intended purpose of such use, disclosure, or request.

E. To secure all protected health information in its possession in accordance with the most current standards established by the Secretary of Health and Human Services under 13402(h)(2) of Public Law 111–5 on the Health and Human Services website.

F. To notify the Agency of any use or disclosure of protected health information not provided for by this Agreement, any security incident, or any breach of unsecured protected health information of which the Business Associate becomes aware.

i. Such notice shall include the identification of each individual whose protected health information has been, or is reasonably believed to have been subject to such use, disclosure, incident, or breach, a statement indicating whether the protected health information was secured or unsecured, and a description of any security measures used.

ii. A disclosure, incident, or breach shall be treated as discovered by the Business Associate as of the first day on which such breach is known to the Business Associate, or, by exercising reasonable diligence, would have been known to the Business Associate. The Business Associate shall be deemed to have knowledge of a disclosure, incident, or breach if the same is known, or, by exercising reasonable diligence, would have been known to any person (other than the person committing the disclosure, incident, or breach) who is an employee, officer, or other agent (determined in accordance with the federal common law of agency) of the Business Associate.

iii. All reports of breach involving unsecured protected health information by the Business Associate shall also include the most current contact information available for each individual whose protected health information has been, or is reasonably believed to have been accessed, acquired, or disclosed, and any other information required by 45 CFR § 164.404 for the notification of individuals.

G. In accordance with 45 CFR §§ 164.502(e)(1)(ii) and 164.308(b)(2), to ensure that any subcontractor that the Business Associate uses to create, receive, maintain, or transmit protected health information on its behalf agrees to the same restrictions, conditions, and requirements that apply to the Business Associate under the terms of this Agreement.

H. To conduct electronic transactions covered by 45 CFR Part 162 as a standard transaction as required by 45 CFR Part 162, and ensure that any agents, including subcontractors, also process electronic transactions as required therein.

I. To make all protected health information received from the Agency or otherwise created, maintained, or transmitted on behalf of the Agency available to the Agency as necessary for the Agency to comply with an individual’s request for access to protected health information under 45 CFR § 164.524, a public records request under Wyo. Stat. Ann. §§ 16-4-201 through 16-4-205, or any other request that may be required by law. If the Business Associate receives such request for protected health information directly, it shall notify the Agency within three (3) business days following its receipt of such request. Thereafter, the Parties agree to meet to promptly discuss and jointly resolve the request for protected health information. The Parties’ failure to reach an agreement regarding any such request prior to the timeframes specified in 45 CFR § 164.524 and Wyo. Stat. Ann. §§ 16-4-201 through 16-4-205 shall be cause to terminate this Agreement and all other contracts between the Parties.

J. To make any amendments to protected health information in a designated record set held by the Business Associate or by any subcontractor or agent pursuant to 45 CFR § 164.526. Should the Business Associate receive such request directly, it shall notify the Agency prior to providing any response to the person requesting amendment. Thereafter, the Parties agree to meet to promptly discuss and jointly resolve the request for amendment to the protected health information. The Parties’ failure to reach an agreement regarding any amendment prior to the timeframes specified in 45 CFR § 164.526 shall be cause to terminate this Agreement and all other contracts between the Parties.

K. To make internal practices, books and records relating to the use and disclosure of protected health information received from or created or received by the Business Associate on behalf of the Agency available to the Agency or to the Secretary of Health and Human Services for purposes of determining the Agency’s or Business Associate’s compliance with the Privacy and Security Rules. The Business Associate shall inform the Agency if it provides such information to the Secretary.

L. To document such disclosures of protected health information and information related to such disclosures as would be required for the Agency to respond to a request by an individual for an accounting of disclosures under 45 CFR § 164.528. The Business Associate shall comply with the Agency’s request for such information within seven (7) business days following the Agency’s request. Should the Business Associate receive such request directly, it will notify the Agency. Thereafter, the Parties agree to meet to promptly discuss and jointly resolve the request for an accounting of disclosures. The Parties’ failure to reach an agreement regarding any accounting of disclosures prior to the timeframes specified in 45 CFR § 164.528 shall be cause to terminate this Agreement and all other contracts between the Parties.

M. Unless otherwise provided, to provide notice within seven (7) business days of any event that triggers the Business Associate’s obligation to notify the Agency.

N. That Business Associate may be subject to civil and criminal penalties enumerated at sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d-5, 1320-6) with respect to violations of this Agreement or the Privacy and Security Rules.

8. Responsibilities of Agency. The Agency shall inform the Business Associate of the Agency’s notice of privacy practices and restrictions on protected health information. The first such notice and restrictions shall be given to the Business Associate no later than the date of the last signature to this Agreement. In addition, the Agency agrees to the following:

A. To provide the Business Associate with the notice of privacy practices the Agency produces in accordance with 45 CFR § 164.520, as well as any changes to such notice.

B. To provide the Business Associate with any changes in, or revocation of, permission by an individual to use or disclose protected health information, if such changes affect the Business Associate’s permitted or required uses and disclosures.

C. To notify the Business Associate of any restriction to the use or disclosure of protected health information to which the Agency has agreed and which are applicable to the Business Associate, in accordance with 45 CFR § 164.522 and section 13405(a) of Public Law 111–5.

D. To not request that the Business Associate use or disclose protected health information in any manner that would not be permissible under the Privacy and Security Rules if done by the Agency.

E. To timely notify the Business Associate of any material violation of this Agreement or material Privacy or Security violation by the Business Associate of which the Agency becomes aware. The Agency may provide an opportunity to cure or end such violation, as applicable, within a reasonable timeframe specified by the Agency.

9. General Provisions A. Amendments. Any changes, modifications, revisions or amendments to this Agreement that are mutually agreed upon by the Parties to this Agreement shall be incorporated by written instrument, executed and signed by all parties to this Agreement.

B. Applicable Law/Venue. The construction, interpretation and enforcement of this Agreement shall be governed by the laws of the State of Wyoming. The Courts of the State of Wyoming shall have jurisdiction over this Agreement and the Parties, and the venue shall be the First Judicial District, Laramie County, Wyoming.

C. Assignment/Agreement Not Used as Collateral. Neither party shall assign or otherwise transfer any of the rights or delegate any of the duties set forth in this

Agreement without the prior written consent of the other party. The Business Associate shall not use this Agreement, or any portion thereof, for collateral for any financial obligation.

D. Entirety of Agreement. This Agreement, consisting of eight (8) pages, represents the entire and integrated Business Associate Agreement between the Parties and supersedes all prior and contemporaneous negotiations, representations and Agreements, whether written or oral, regarding the Privacy and Security Rules, HIPAA.

E. Indemnification. The Business Associate shall release, indemnify, and hold harmless the State, the Agency and their officers, agents, employees, successors and assignees from any and all claims, lawsuits, losses, liability arising out of the Business Associate’s failure to perform any of Business Associate’s duties and obligations hereunder or in connection with the negligent performance of the Business Associate’s duties or obligations, including, but not limited to any claims, lawsuits, losses or liability arising out of the Business Associate’s malpractice.

F. Independent Contractor. The Business Associate shall function as an independent contractor for the purposes of this Contract and shall not be considered an employee of the State of Wyoming for any purpose. Consistent with the express terms of this Contract, the Business Associated shall be free from control or direction over the details of the performance of services under this Contract. The Business Associate shall assume sole responsibility for any debts or liabilities that may be incurred by the Business Associate in fulfilling the terms of this Contract and shall be solely responsible for the payment of all federal, state, and local taxes which may accrue because of this Contract. Nothing in this Contract shall be interpreted as authorizing the Business Associate or its agents and/or employees to act as an agent or representative for or on behalf of the State of Wyoming or the Agency or to incur any obligation of any kind on the behalf of the State of Wyoming or the Agency. The Business Associate agrees that no health/hospitalization benefits, workers’ compensation, unemployment insurance and/or similar benefits available to State of Wyoming employees will inure to the benefit of the Business Associate or the Business Associate’s agents and/or employees as a result of this Contract.

G. Insurance. The Business Associate agrees it will carry comprehensive general liability insurance which includes coverage applicable to this Agreement.

H. Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits the Parties to comply with the Privacy and Security Rules.

I. Notices. All notices arising out of or from the provisions of this Agreement shall be in writing and shall be deemed provided to each respective party if by personal delivery or by, at least, first class United States mail, postage prepaid. Written notices to the Agency shall be provided to the attention of the WDH Compliance Office, 401 Hathaway Building, Cheyenne, Wyoming 82002.

J. Notice and Approval of Proposed Sale or Transfer of the Business Associate. The Business Associate shall provide the Agency with the earliest possible advance notice of any proposed sale or transfer or any proposed merger or consolidation of the assets of the Business Associate. Such notice shall be provided in accordance with the notice provision of this Agreement.

K. Ownership and Destruction of Documents. Agency owns all protected health information, documents, data compilations, reports, computer programs, photographs, and other work provided to or produced by the Business Associate in the performance of this Agreement.

L. Prior Approval. This Agreement shall not be binding upon either party and no services shall be performed under the terms of this Agreement which involve the Business Associate in the use or disclosure of individually identifiable health information until this Agreement has been reduced to writing and approved as to form by the Office of the Attorney General.

M. Severability. Should any portion of this Agreement be judicially determined to be illegal or unenforceable, the remainder of the Agreement shall continue in full force and effect, and the Parties may renegotiate the terms affected by the severance.

N. Sovereign Immunity. The State of Wyoming and the Agency do not waive sovereign immunity by entering into this Agreement and specifically retain immunity and all defenses available to them as sovereigns pursuant to Wyo. Stat. § 1-39-104(a) and all other state or federal law. Designations of venue, choice of law, enforcement actions, and similar provisions should not be construed as a waiver of sovereign immunity. The Parties agree that any ambiguity in this Agreement shall not be strictly construed, either against or for either party, except that any ambiguity as to sovereign immunity shall be construed in favor of sovereign immunity.

O. Termination. This Agreement may be terminated, without cause, by the Agency upon sixty (60) days written notice, or by mutual assent of the Parties, or for cause if the Business Associate materially violates the terms of this Agreement.

i. Material Violation of Agreement. Any violation by the Business Associate of any provision of this Agreement or any other contract with the Agency which involves the use or disclosure of protected health information, as determined by the Agency, shall constitute a material violation and shall entitle the Agency to terminate the Agreement immediately and seek related remedies.

ii. Cure. If the Agency receives evidence of a material violation of the obligations set forth herein, and the Agency does not terminate the Agreement pursuant to subsection “i” above, then the Agency may provide an opportunity to cure or end such violation, as applicable, within a reasonable timeframe specified by the Agency. If the Business Associate’s efforts to cure or end such violation are unsuccessful within the time specified, the Agency may terminate the Agreement, where feasible, or if termination is not feasible, may report the Business Associate’s violation to the Secretary of Health and Human Services or his designee.

iii. Effect of Termination. Upon termination of this Agreement for any reason, the Business Associate shall return or destroy all protected health information, regardless of form so that the Business Associate retains no copies of protected health information received or created on behalf of the Agency. If return or destruction of all protected health information is not feasible, Business Associate shall notify the Agency of the conditions that make return or destruction infeasible. Upon agreement between the parties that the return or destruction of the protected health information is infeasible, the Business Associate shall extend the protections of this Agreement to such information, and further limit the use and disclosure of such information only to those purposes that make its return or destruction infeasible, for so long as the Business Associate maintains the information.

iv. This provision shall also apply to protected health information that is in the possession of subcontractors or agents of the Business Associate.

P. Time is of the Essence. Time is of the essence in all provisions of this Agreement.

Q. Titles not Controlling. Titles of paragraphs are for reference only and shall not be used to construe the language in this Agreement.

R. Waiver. The waiver of any violation of any term or condition of this Agreement shall not be deemed a waiver of any prior or subsequent violation. Failure to object to a violation shall not constitute a waiver.

REMAINDER OF PAGE INTENTIONALLY LEFT BLAN

10. Signatures. The Parties to this Agreement, either personally or through their duly authorized representatives, have executed this Agreement on the dates set out below, and certify that they have read, understood, and agreed to the terms and conditions of this Agreement.

The effective date of this Agreement is the date of the signature last affixed to this page.

FOR THE WYOMING DEPARTMENT OF ENTERPRISE TECHNOLOGY SERVICES:

Jeff Clines, Director Date Product Owner Anna Jacknitsky Date FOR THE BUSINESS ASSOCIATE:

[Name and Title] Date WYOMING ATTORNEY GENERAL’S OFFICE APPROVAL AS TO FORM:

Bobbie K. Owen, Assistant Attorney General Date

Business Associate Agreement between Enterprise Technology Services (ETS) and (Business Associate) Page of 8 Template Version March 2019