Attachment B Business Associate Agreement.pdf

DEPARTMENT of SHARED ADMINISTRATIVE SERVICES-EMPLOYEE BENEFITS DIVISION

AND

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“Agreement”) is made and entered into effective as of the XX day of XX

XXXX (the “Effective Date”), by and between State of Arkansas, Department of Shared Administrative

Services - Employee Benefits Division (EBD), with a principal business address of 501 Woodlane Street, Suite

500 Little Rock, Arkansas 72201 (“Covered Entity”) and __________________., with a principal business address of __________________________ (“Business Associate”).

RECITALS

WHEREAS, the parties have entered into a business relationship whether by contract, commercial course of dealing, or otherwise, whereby Business Associate provides services to Covered Entity and Business Associate receives, has access to, creates, maintains, or transmits Protected Health Information (as defined below) in order to provide those services; and

WHEREAS, EBD is a “covered entity” as defined by the Health Insurance Portability and Accountability

Act of 1996 and the regulations promulgated thereunder at 45 C.F.R. Parts 160 and 164, as may be amended from time to time (“HIPAA”);

WHEREAS, Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI disclosed to Business Associate in compliance with HIPAA, the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), and regulations promulgated thereunder, as may be amended from time to time (collectively, the “Privacy and Security Regulations”), and other applicable laws; and

WHEREAS, in accordance with the Privacy and Security Regulations, Covered Entity and Business

Associate are required to enter into a contract containing specific requirements as set forth in the Privacy and

Security Regulations;

NOW, THEREFORE, in consideration of the foregoing, and for other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, the parties agree as follows:

1. DEFINITIONS.

Capitalized terms used but not otherwise defined in this Agreement shall have the meaning given to those terms in the Privacy and Security Regulations. The following terms, as used in this Agreement, are defined as follows:

1.1. “Breach” means the unauthorized acquisition, access, use, or disclosure of PHI not permitted by the Privacy and Security Regulations and which compromises the security or privacy of the PHI.

1.2. “Designated Record Set” means a group of records maintained by or for a covered entity that is:

(i) the medical records and billing records about individuals maintained by or for a covered health care provider; (ii) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) Used (defined below), in whole or in part, by or for the covered entity to make decisions about individuals. For purposes of this definition, the term “record” means any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for a covered entity (as defined in the Privacy and Security Regulations).

1.3. “Disclose” and “Disclosure” mean, with respect to PHI, the release, transfer, provision of access to, or divulging in any other manner of PHI outside Business Associate’s internal operations.

1.4. “Electronic PHI” means PHI that is transmitted by Electronic Media or is maintained in

Electronic Media. Examples of Electronic PHI include PHI that is electronically transmitted and maintained on devices such as cell phones, PDAs, text pagers, and USB static discs.

1.5. “PHI” or “Protected Health Information” means protected health information, as defined in the

Privacy and Security Regulations, and shall include but not be limited to any information in any form or medium, including demographic information collected from an individual, that (i) identifies the individual

(or for which there is a reasonable basis for believing that the information can be used to identify the individual); (ii) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (iii) is received by Business Associate from or on behalf of

Covered Entity, is created, maintained or transmitted by Business Associate, or is made accessible to

Business Associate by Covered Entity. PHI includes, without limitation, Electronic PHI.

1.6. “Privacy Rule” means 45 C.F.R. Part 164.

1.7. “Secretary” means the Secretary of the U. S. Department of Health and Human Services or his or her designee.

1.8. “Services” means those activities, functions, or services that Business Associate provides for or on behalf of Covered Entity.

1.9. “Subcontractor” means a person to whom a business associate (as defined in the Privacy and

Security Regulations) delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate.

1.10. “Unsecured PHI” means PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through use of a technology or methodology specified by the Secretary in guidance issued under Section 13402(h)(2) the HITECH Act.

1.11. “Use” and “Uses” mean, with respect to PHI, the sharing, employment, application, utilization, examination, or analysis of such PHI within the internal operations of the entity that maintains such PHI.

2. ASSURANCES BY BUSINESS ASSOCIATE REGARDING PHI.

Business Associate warrants that it shall comply with relevant portions of the Privacy and Security Regulations as those regulations apply to business associates and business associate Subcontractors. More specifically, and insofar as Business Associate has access to, has been provided with, maintains, transmits, or will be creating PHI regarding Covered Entity’s patients, Business Associate warrants and agrees as follows:

2.1. Permitted Uses and Disclosures of PHI. Business Associate shall Use and Disclose PHI in the minimum amount necessary to perform the Services for or on behalf of Covered Entity, provided that such Use or Disclosure would not violate the Privacy and Security Regulations if done by Covered Entity. Further, Business

Associate:

2.1.1. shall Disclose PHI to Covered Entity upon request; or

2.1.2. may Use or Disclose PHI as required by law;

2.1.3 may Use PHI as necessary for the proper management and administration of its business or to carry out its legal responsibilities;

2.1.4 may Disclose PHI as necessary for the proper management and administration of its business or to carry out its legal responsibilities, provided that:

2.1.4.1. the Disclosure is required by law, or

2.1.4.2. Business Associate obtains reasonable assurance from the person to whom the

PHI is Disclosed that the PHI will be held confidentially and Used or further Disclosed only as required by law or for the purpose for which it was Disclosed to the person, and the person agrees to notify Business Associate of any instances of which the person is aware in which the confidentiality of the PHI has been breached.

Business Associate shall not Use or Disclose PHI for any other purpose.

2.2 Prohibition on the Sale of PHI. Except as otherwise permitted by the Privacy and Security

Regulations, Business Associate shall not directly or indirectly receive remuneration in exchange for any of

Covered Entity’s PHI unless Covered Entity or Business Associate first obtains a valid, signed authorization from the individual whose PHI is at issue and such authorization specifies whether the PHI can be further exchanged for remuneration by the entity receiving the PHI.

2.3. Adequate Safeguards for PHI.

2.3.1. Business Associate shall implement and maintain appropriate safeguards, which comply with the Privacy and Security Regulations, to prevent the Use or Disclosure of PHI in any manner other than as permitted by this Agreement.

2.3.2. Business Associate shall implement administrative, physical, and technical safeguards set forth in the Privacy and Security Regulations that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity.

2.3.3. Business Associate shall maintain policies and procedures, conduct ongoing risk assessment and risk management of its security program, identify a security official, and train and discipline its work force in compliance with the relevant portions of the Privacy and Security

Regulations. Business Associate agrees to make its policies and procedures, risk assessments, and training and education documents available to Covered Entity upon Covered Entity’s request.

2.4. Responsibility for Delegated Actions. To the extent that Covered Entity delegates any of its obligations under Subpart E of the Privacy Rule to Business Associate, then Business Associate shall, in the performance of such obligation(s), comply with the requirements of such Subpart E that apply to Covered Entity.

2.5. Availability of Internal Practices, Books and Records to Government Agencies. Business

Associate shall make its internal practices, policies and procedures, books, and records relating to the security, Use and Disclosure of PHI available to the Secretary for purposes of determining Covered Entity’s compliance with the Privacy and Security Regulations. Business Associate shall immediately notify Covered Entity of any requests made by the Secretary and provide Covered Entity with copies of any documents produced in response to such request.

2.6. Access to PHI.

2.6.1. Business Associate shall, at the request and direction of Covered Entity, make PHI maintained by Business Associate in a Designated Record Set available to Covered Entity, or, as directed by Covered Entity, to the individual identified as being entitled to access and copy such

PHI, within five (5) business days of receipt of such a request from Covered Entity.

2.6.2. If Business Associate uses or maintains Electronic PHI, Business Associate must provide access to such PHI in an electronic format, if so requested by Covered Entity or the applicable individual, if the PHI is readily producible in such form or format; or if not, in a readable copy form or such other form and format as agreed by the individual, Covered Entity, and Business

Associate.

2.7. Amendment of PHI. Business Associate shall, within five (5) business days of a request from

Covered Entity, make PHI maintained by Business Associate in a Designated Record Set available to Covered

Entity for the purpose of amendment and, as directed by Covered Entity, shall incorporate such amendments into such PHI within the time and in such a manner as specified by Covered Entity.

2.8. Accounting of Disclosures. Within five (5) business days of Covered Entity’s request, Business

Associate shall make available to Covered Entity the information necessary for Covered Entity to provide an individual with an accounting of each Disclosure of PHI made by Business Associate or its employees, agents, representatives, or Subcontractors.

2.8.1. Business Associate shall implement a process that allows for an accounting to be collected and maintained for any Disclosure of PHI for which Covered Entity is required to maintain such information. Business Associate shall include in the accounting: (a) the date of the Disclosure;

(b) the name, and address if known, of the entity or person who received the PHI; (c) a brief description of the PHI disclosed; and (d) a brief statement of the purpose of the Disclosure or a copy of the written request for the Disclosure. For each Disclosure that requires an accounting under this Section, Business Associate shall document the information specified in (a) through

(d) above and shall securely retain this documentation for six (6) years from the date of the

Disclosure.

2.8.2. For repetitive Disclosures of Covered Entity’s PHI that Business Associate makes for a single purpose to the same person or entity, the Disclosure information that Business Associate must record is either the Disclosure information specified above for each accountable Disclosure, or (a) the Disclosure information specified above for the first of the repetitive accountable

Disclosures; (b) the frequency, periodicity, or number of the repetitive accountable Disclosures;

and (c) the date of the last of the repetitive accountable Disclosures.

2.8.3. If any individual directly requests that Business Associate, its agents or Subcontractors provide an accounting of Disclosures of PHI, Business Associate shall notify Covered Entity within five (5) business days of such request.

2.9. Reporting Breaches, Unauthorized Use or Disclosure of PHI and Security Incidents.

2.9.1. Business Associate shall report to Covered Entity:

2.9.1.1. A Breach of PHI;

2.9.1.2 Each access, acquisition, Use, or Disclosure of PHI that is made by Business

Associate, its employees, representatives, agents, or Subcontractors that is not specifically permitted by this Agreement; and

2.9.1.3. Any Security Incident of which it becomes aware. A “Security Incident” means the attempted or successful unauthorized access, acquisition, Use, Disclosure, modification, or destruction of information, or interference with the system operation of an information system.

2.9.2. Business Associate’s Notice to Covered Entity

2.9.2.1. Business Associate shall notify Covered Entity’s Compliance Officer of the events listed in Section 2.9.1 above by telephone call without unreasonable delay but in any event no later than three (3) business days after the date that (a) Business Associate knows of such

Breach, Unauthorized Use or Disclosure, or Security Incident, or (b) by exercising reasonable diligence, Business Associate would have known of such Breach, Unauthorized Use or

Disclosure, or Security Incident. Business Associate shall notify Covered Entity of all Breaches, even if Business Associate determines there is a low probability that the PHI has been compromised based on its risk assessment.

2.9.2.2. Business Associate shall provide a full written report to Covered Entity’s

Compliance Officer within five (5) business days of verbal notice. Business Associate shall include the following in the written report:

(a) Description of the nature of the Breach, including a description of what occurred, the date of any Breach and the date of the discovery thereof, and whether the

PHI was actually acquired or reviewed;

(b) Identification of Covered Entity’s PHI that was subject to the non-permitted

Use or Disclosure or Breach, including name, demographic information, social security number, and other information involved, including types of identifiers and likelihood of re-identification;

(c) Identification of who made the non-permitted Use or Disclosure and who received the non-permitted Use or Disclosure;

(d) Description of what corrective action the Business Associate took or will take to prevent further non-permitted Uses or Disclosures, to mitigate harmful effects, and to protect against any further Breaches;

(e) Identification of what steps the individuals who are the subject of a Breach should take to protect themselves; and

(f) Such other information as Covered Entity may reasonably request.

3. NOTICES.

Any notice required under this Agreement to be given to a party shall be made to:

If to Covered Entity: If to Business Associate:

Department of Shared Administrative

Services-Employee Benefits Division

501 Woodlane St. Ste 500

Little Rock, AR 72201

Attention: EBD Compliance Officer

Phone: (501) 682-5500

Facsimile No.: (501) 682-1168

Attn: Grant Wallace, and Kimberly G. DuVall

4. MITIGATION AND COOPERATION.

Business Associate shall use commercially reasonable efforts to mitigate, at Business Associate’s sole cost and expense, any harmful effect that is known to it for the Breach or Use or Disclosure of PHI in violation of this

Agreement.

Covered Entity shall be solely responsible, based upon the facts of the Breach (as disclosed to Covered Entity by

Business Associate), to conduct a risk assessment to determine whether PHI has been compromised and notification to individuals is required. Business Associate shall cooperate with Covered Entity in the notification of individuals as required and in the manner as set forth in the Privacy and Security Regulations. Business

Associate shall not provide any notification directly to individuals regarding a Breach of PHI without Covered

Entity’s prior written consent, unless otherwise required by the Privacy and Security Regulations.

5. REMEDIES IN EVENT OF BREACH OF PHI.

5.1. Business Associate acknowledges and agrees that Business Associate’s failure to comply with this Agreement in any respect could cause irreparable harm to Covered Entity, its patients and employees for which there may be no adequate legal remedy. Business Associate therefor agrees that, in the event of a Breach or threatened Breach of PHI, Covered Entity shall be entitled to specific performance or injunctive or other equitable relief to prevent Business Associate from commencing or continuing any action in violation of this Agreement, and Business Associate further agrees to waive any requirement for the securing or posting of any bond in connection therewith.

5.2. In the event of a Breach of PHI caused by Business Associate, the costs related to notifying the affected individuals shall be borne by Business Associate. Such costs, if appropriate and reasonable under the circumstances, may include the actual cost of notification, setting-up and managing a toll-free number, and credit monitoring.

5.3. Each party shall indemnify, defend, and hold harmless the other party, its directors, officers, employees, and agents from and against any and all claims, actions, demands, liabilities, judgments, losses, damages, penalties, fines, costs, fees, expenses, and reasonable attorney’s fees (collectively, the

“Losses”) that are attributable or allegedly attributable to the acts or omissions of the indemnifying party or indemnifying party’s material breach of this Agreement.

6. COVERED ENTITY OBLIGATIONS.

Covered Entity shall notify Business Associate of:

6.1. Any limitations in Covered Entity’s notice of privacy practices to the extent that such limitation may affect Business Associate’s Use or Disclosure of PHI;

6.2. Any changes in, or revocation of, permission by the individual to Use or Disclose PHI, to the extent that such changes may affect Business Associate’s Use or Disclosure of PHI; and

6.3. Any restriction to the Use or Disclosure of PHI that Covered Entity has agreed to provide to the individual, to the extent that such restriction may affect the Business Associate’s Use or Disclosure of

PHI.

7. TERM AND TERMINATION.

The term of this Agreement shall be the same as the term of the underlying services agreement. In addition to and notwithstanding the termination provisions set forth in the underlying services agreement, both this Agreement and the underlying services agreement may be terminated by Covered Entity immediately and without penalty upon written notice by Covered Entity to Business Associate if Covered Entity determines, in its sole discretion, that Business Associate has violated any material term of this Agreement. The terms and conditions under this

Agreement shall survive the expiration or termination of the underlying services agreement.

8. DISPOSITION OF PHI UPON TERMINATION OR EXPIRATION.

Upon termination or expiration of this Agreement, Business Associate shall either return or destroy, in Covered

Entity’s sole discretion and in accordance with any instructions by Covered Entity, all PHI in the possession or control of Business Associate or its agents and Subcontractors. However, if either return or destruction of PHI is not feasible, Business Associate may retain PHI provided that Business Associate (a) continues to comply with the provisions of this Agreement for as long as it retains PHI, and (b) limits further Uses and Disclosures of PHI to those purposes that make the return or destruction of PHI infeasible.

9. OWNERSHIP OF PHI.

The exchange of Electronic PHI under this Agreement does not change the ownership of such information under state, federal, or any other applicable law. If Electronic PHI has been exchanged for a permitted purpose, it may thereafter be integrated into the records of Business Associate’s participants, and the parties acknowledge that such information cannot be returned upon termination of this Agreement.

10. DOCUMENT RETENTION.

Business Associate shall maintain all documentation required by the Privacy and Security Regulations for a period of six (6) years minimum or for a longer period where required by statute of EBD policy.

11. CONFLICT.

In the event there is a conflict between the language of this Agreement and the underlying services agreement between the parties (if any), the terms and conditions of this Agreement shall control.

12. NO THIRD-PARTY BENEFICIARIES.

There are no third-party beneficiaries to this Agreement.

13. INDEPENDENT CONTRACTOR.

Covered Entity and Business Associate expressly acknowledge and agree that Business Associate is an independent contractor and shall not for any purpose be deemed to be an agent, employee, servant or partner of

Covered Entity.

14. USE OF SUBCONTRACTORS AND AGENTS.

Business Associate shall ensure that: (i) all of its Subcontractors and agents shall implement reasonable and appropriate safeguards to protect Covered Entity’s PHI; (ii) any Subcontractors and agents that create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions and requirements that apply through this Agreement to Business Associate with respect to such information; and (iii) any such Subcontractor or agent agrees to implement reasonable and appropriate safeguards to protect Covered

Entity’s Electronic PHI.

15. INTERPRETATION.

Any ambiguity in this Agreement shall be resolved to permit the parties to comply with the Privacy and Security

Regulations.

16. ENFORCEMENT.

Business Associate acknowledges that, in the event it, or its Subcontractors, violates any applicable provision of the Privacy and Security Regulations or any term of this Agreement that would constitute a violation of the Privacy and Security Regulations, Business Associate will be subject to and will be directly liable for any and all civil and criminal penalties that may result from Business Associate or its Subcontractors’ violation.

IN WITNESS WHEREOF, the parties hereto have executed this Agreement effective as of the Effective

Date.

Business Associate:

By: ______________________________

Name: (Enter Contact Name ) .

Title: __(Enter Contact Title)___________

Dated: ____________________________

Covered Entity:

By: ___________________

Name: Grant Wallace____

Title: __Director, EBD _

Dated:_________________