Attachment D BAA (v2) final.doc

Attachment D

STATE OF NEBRASKA

BUSINESS ASSOCIATE AGREEMENT

THIS BUSINESS ASSOCIATE AGREEMENT (“Agreement”) amends and is made a part of all Services Agreements (as defined below) between ________________________(“Business Associate”) and State of Nebraska (“Company”) on behalf of the Group Health Plans sponsored by Company (the “Plan”). This Agreement is effective _______________ or upon the effective date of the underlying Services Agreement, whichever is later (“Effective Date”). This Agreement supersedes and replaces any prior Business Associate Agreements between the parties.

1.

Definitions.

a.

Catch-all definitions. The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Covered Entity, Data Aggregation, Designated Record Set, Disclose or Disclosure, Electronic Protected Health Information, Health Care Operations, Minimum Necessary, Notice of Privacy Practices, Protected Health Information or PHI, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use. Other capitalized terms used but not otherwise defined in this Agreement shall have the meaning ascribed in the HIPAA Rules.

b.

Specific definitions.

(1) “Business Associate” shall generally have the same meaning as the term "Business Associate" at 45 CFR 160.103, and in reference to the party to this Agreement, shall mean the party identified above as Business Associate.

(2) “Business Associate Functions” means functions performed by Business Associate on behalf of the Plan in the course of providing or arranging for plan administration services which involve the creation, receipt, maintenance or transmission of PHI by Business Associate or its agents or Subcontractors. It is anticipated that the services provided by Business Associate will be performed as part of the Plan's “health care operations” as defined in the HIPAA Rules.

(3) “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended at the time the section is to be applied.

(4) “Individual” shall generally have the same meaning ascribed in the HIPAA Rules and shall refer only to Individuals who are covered persons under the Plan.

(5) “Services Agreements” means all agreements whether now in effect or hereafter entered into, between Company and Business Associate for the performance of Business Associate Functions by Business Associate on behalf of the Plan.

2.

Purpose. The Plan is a Covered Entity under HIPAA. The HIPAA Rules require the Plan to obtain, and Business Associate to provide, satisfactory written contractual assurances before Business Associate may create, receive, maintain, or Disclose PHI to perform Business Associate Functions on behalf of the Plan. This Agreement is entered into to provide the contractual assurances required under the HIPAA Rules.

3.

Obligations of Business Associate. As an express condition of performing Business Associate Functions, Business Associate agrees to:

a.

Not Use or Disclose PHI other than as permitted or required by this Agreement or as otherwise Required by Law.

b.

Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to Electronic Protected Health Information, to prevent Use or Disclosure of PHI other than as provided for in this Agreement.

c.

Report to the Plan's designated privacy official, without unreasonable delay but in no event more than three (3) business days after discovery by Business Associate, any Use or Disclosure of PHI not provided for by this Agreement of which Business Associate becomes aware, including any Breach of Unsecured Protected Health Information as required at 45 CFR 164.410, and any Security Incident of which it becomes aware, together with any remedial or mitigating action taken or proposed to be taken with respect thereto. If Business Associate does not have available complete information in satisfaction of 45 CFR 164.410(c) within three (3) business days of discovery of the impermissible Use or Disclosure, Business Associate shall provide all information it has at such time, and immediately update the Plan with additional information as it becomes available through prompt investigation. This Agreement serves as Business Associate's notice to the Plan that attempted but unsuccessful Security Incidents regularly occur and that no further notice will be made by Business Associate unless there has been a successful Security Incident or attempts or patterns of attempts that Business Associate determines to be suspicious.

Business Associate shall cooperate with the Plan in mitigating any harmful effects of any impermissible Use or Disclosure. In the case of a Breach as determined to exist in the sole discretion of the Plan which was due to a violation of this Agreement by Business Associate, Business Associate shall pay for the reasonable costs of investigation, mitigation and notification to affected Individuals. As an alternative to Business Associate reimbursing Company and the Plan for the costs of notification, the Plan may elect to have Business Associate directly provide the notifications to Individuals for breaches caused by Business Associate, provided that Company and the Plan shall have final approval of all content of notifications to Individuals.

d.

In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information.

e.

Within ten (10) business days of request by an Individual or notification by the Plan, make available to the Individual such Individual's PHI maintained by Business Associate in a Designated Record Set in accordance with 45 CFR 164.524. The parties agree that Individuals will be directed to Business Associate to make all requests for access to PHI. Business Associate will provide such access according to its own procedures for such access in accordance with the requirements of 45 CFR 164.524. If the requested PHI is maintained in one or more Designated Record Sets electronically and if the Individual requests an electronic copy of such PHI, Business Associate must provide the Individual with access to PHI in the electronic form and format requested by the Individual, if it is readily producible in such form and format; or, if not, in a readable electronic form and format as agreed to between Business Associate and the Individual. Business Associate shall provide the requested information directly to the Individual, along with a notice to the Individual that a copy of the individual's request has been furnished to the Plan and that the Plan may provide additional information to the Individual in response to the request.

If the Individual's request covers records not maintained by Business Associate, Business Associate shall notify the Plan within three (3) days of the request. The Plan will be responsible for providing access or otherwise responding directly to the Individual pursuant to the HIPAA Rules with respect to PHI not in the possession of Business Associate or an agent or subcontractor of Business Associate. Business Associate may charge the Individual reasonable fees related to this access, as determined by Business Associate, but only in such amounts as permitted by the HIPAA Rules. The Plan authorizes Business Associate to require payment of such fees from the Individual prior to releasing any records.

f.

Business Associate agrees to receive requests for amendment and amend PHI as required by 45 CFR 164.526 on the Plan's behalf for as long as such information is maintained by Business Associate. The parties agree that Individuals will be directed to Business Associate to make all such requests for amendment of PHI. Business Associate will amend such PHI according to its own procedures for such amendment in accordance with the requirements of 45 CFR 164.526. If the Individual's request covers records not maintained by Business Associate, Business Associate shall notify the Plan within three (3) days of such request. The Plan will be responsible for amending or otherwise responding directly to the Individual pursuant to the HIPAA Rules with respect to PHI not in the possession of Business Associate or an agent or contractor of Business Associate. Business Associate shall notify the Plan of any amendments made to PHI.

g.

Business Associate agrees to process all requests for disclosure accounting by Individuals for as long as such information is maintained by Business Associate. Individuals will be directed to Business Associate to make all such requests. Business Associate will provide the accounting that is required under 45 CFR 164.528 on the Plan's behalf directly to the Individual. Business Associate will provide such accounting according to its own procedures for such accounting in accordance with the requirements of 45 CFR 164.528.

Business Associate shall notify the Plan within three (3) days of any request made by an Individual for a disclosure accounting. The Plan will be responsible for responding directly to the Individual (or the Individual's personal representative) pursuant to 45 CFR 164.528 with respect to disclosures of PHI by persons or entities other than Business Associate or a subcontractor or agent of Business Associate. Business Associate shall provide directly to the Individual the requested accounting of disclosures made by Business Associate or a subcontractor or agent of Business Associate, along with a notice to the Individual that a copy of the Individual's request has been furnished to the Plan and that the Plan may provide additional information to the Individual in response to the request.

h.

Make its internal practices, books and records relating to this Agreement available to the Secretary of HHS and to the Plan for purposes of determining the Plan's and Business Associate's compliance with the HIPAA Rules.

i.

So that the Plan may meet its obligations to evaluate requests for restrictions and confidential communications in connection with the disclosure of PHI under 45 CFR 164.522, Business Associate and the Plan agree that, to the extent that communications are within the control of Business Associate, Business Associate will perform these evaluations on behalf of the Plan. Business Associate will evaluate such requests according to its own procedures for such requests, in accordance with the requirements of 45 CFR 164.522, and shall implement such appropriate operational steps as are required by its own procedures. Such evaluation will not relieve the Plan of any additional and independent obligations to evaluate restrictions or implement confidential communications where requested by an Individual. Accordingly, Business Associate will evaluate requests for restrictions and requests for confidential communications, and will respond to these requests as appropriate under Business Associate's procedures. The Plan agrees that it will not agree to such restriction or request that would affect Business Associate without the approval of Business Associate, so that Business Associate can determine whether it can reasonably administer the request.

j.

So that the Plan may meet its obligation to evaluate complaints from Individuals regarding their privacy rights or privacy practices of the Plan or Business Associate, the parties agree that Individuals shall be directed to submit any such complaint to Business Associate for review and evaluation. Business Associate will evaluate such complaints according to its own procedures for complaints, and shall implement appropriate operation steps as are required by its own procedures. The Privacy Officer of the Plan shall cooperate with Business Associate in the evaluation of any such complaint. Business Associate shall provide a copy of all complaints to the Plan within three (3) days of receipt by Business Associate. If the complaint appears to involve handling of PHI by the Plan, Plan Sponsor, or other Business Associate of the Plan, Business Associate shall notify the Plan and it shall be the Plan's responsibility to review and evaluate the complaint.

k.

Limit the Uses and Disclosures of, or requests for, PHI for purposes described in this Agreement to the Minimum Necessary to perform the required Business Associate Functions. Business Associate shall comply with any additional requirements for the determination of Minimum Necessary as are required from time to time by the HIPAA Rules, as amended, or through additional guidance published by the Secretary.

l.

To the extent Business Associate is expressly obligated under the Services Agreements to carry out one or more of the Plan's obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Plan in the performance of such obligation(s).

m.

Except for the specific Uses and Disclosures for the Business Associate's own management and administration or to carry out the legal responsibilities of Business Associate, Business Associate shall not Use or Disclose PHI in a manner that would violate the HIPAA Rules if done by the Plan.

4.

Permitted Uses and Disclosures of PHI. Business Associate shall only Use or Disclose PHI as follows:

a.

Business Associate may Use or Disclose PHI as Required by Law. Business Associate agrees to follow the current law covering the use and disclosure of PHI related to substance abuse and reproductive health.

b.

Business Associate may Use or Disclose PHI as necessary to carry out Business Associate Functions.

c.

Business Associate may Use PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate.

d.

Business Associate may Disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided the Disclosures are Required by Law, or Business Associate obtains reasonable assurances from the person to whom the information is Disclosed that the information will remain confidential and be Used or further Disclosed only as Required by Law or for the purposes for which it was Disclosed to the person, and the person notifies Business Associate in writing of any instances of which it is aware in which the confidentiality of the information has been breached or compromised.

e.

If specifically identified as a Business Associate Function in the Services Agreements, Business Associate may provide Data Aggregation services relating to the Health Care Operations of Covered Entity.

f.

If de-identification is listed as a Business Associate Function in the Services Agreements, or if Business Associate is expressly permitted to de-identify PHI and use data thus de-identified for its own uses in the Services Agreements, Business Associate may Use PHI to de-identify the information in accordance with 45 CFR 164.514(a)-(c). Business Associate may use de-identified data only for the purposes specified in the Services Agreements.

5.

Responsibilities of the Plan. The Plan agrees to:

a.

Notify Business Associate promptly of any restriction on the Use or Disclosure of PHI that the Plan has agreed to or is required to abide by under 45 CFR 164.522, to the extent such restriction may affect Business Associate's Use or Disclosure of PHI.

b.

Notify Business Associate of any changes in, or revocation of, the permission by an Individual to Use or Disclose PHI, to the extent that such changes may affect Business Associate's Use or Disclosure of PHI.

c.

Provide Business Associate with a copy of any amendment to PHI which is accepted by Covered Entity under 45 CFR 164.526 which Covered Entity believes will apply to PHI maintained by Business Associate in a Designated Record Set.

d.

Not request Business Associate to Use or Disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by the Plan, with exception for any Data Aggregation services permitted under Section 4.

6.

Compliance with Electronic Transactions Rule. If Business Associate conducts in whole or part electronic Transactions (as defined in 45 CFR 160.103) on behalf of Covered Entity for which the Secretary of HHS has established standards, Business Associate will comply, and will require any Subcontractor involved with the conduct of such Transactions to comply, with each applicable requirement of the Electronic Transactions Rule at 45 CFR Parts 160 and 162 and of any operating rules adopted by the Secretary of HHS with respect to Transactions.

7.

Supervening Law. Upon the enactment of any law or regulation affecting the Use or Disclosure of PHI, or the publication of any decision of a court of the United States or of this state relating to any such law, or the publication of any interpretive policy or opinion of any governmental agency charged with the enforcement of any such law or regulation, the parties agree to amend this Agreement in such manner as is necessary to comply with such law or regulation. If the parties are unable to agree on an amendment within thirty (30) days, either party may terminate the Services Agreements on not less than thirty (30) days’ written notice to the other.

8.

Liability and Indemnification. Each party shall be responsible for the acts and omissions of its own agents, employees and contractors. Notwithstanding the foregoing, and notwithstanding any limitation of liability or disclaimer of damages in the Services Agreements or elsewhere, to the extent that the Secretary determines that Business Associate is acting as an agent of the Plan under the Services Agreements or this Agreement, Business Associate shall indemnify Company and the Plan for any fines, civil monetary penalties or monetary resolutions incurred by Company or the Plan, plus reasonable attorneys' fees of Company and the Plan, arising out of or relating to the actions or omissions of Business Associate which constitute a breach of this Agreement by Business Associate. This indemnification is in addition to any additional indemnification provided by Business Associate in the Services Agreement.

9.

Term and Termination.

a.

Term. This Agreement shall become effective on the Effective Date and shall continue in effect until all obligations of the parties have been met, including return or destruction of all PHI in Business Associate’s possession (or in the possession of Business Associate’s agents and Subcontractors), unless sooner terminated as provided herein. It is expressly agreed that the terms and conditions of this Agreement designed to safeguard PHI shall survive expiration or other termination of the Services Agreements and shall continue in effect until Business Associate has performed all obligations under this Agreement and has either returned or destroyed all PHI.

b.

Termination. Company may immediately terminate this Agreement and the Services Agreements, if Company and/or the Plan makes the determination that Business Associate has breached a material term of this Agreement. Alternatively, Company may choose to provide Business Associate with written notice of the existence of an alleged material breach, and afford Business Associate an opportunity to cure the alleged material breach upon mutually agreeable terms. Failure to take reasonable steps to cure the breach is grounds for the immediate termination of this Agreement.

c.

Business Associate Obligations Upon Termination. Upon termination of this Agreement for any reason, Business Associate, with respect to PHI received from the Plan, or created, maintained, or received by Business Associate on behalf of the Plan, shall:

(i) Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities or as to which Business Associate reasonably determines such PHI is technically incapable of being returned or destroyed;

(ii) Return to the Plan or, if not provided for in the Services Agreements, destroy the PHI retained under 8.c.(i) that the Business Associate maintains in any form;

(iii) Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to Electronic Protected Health Information retained by Business Associate to prevent Use or Disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate retains the PHI;

(iv) Not Use or Disclose the PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set out at Sections 4.c. and 4.d. which applied prior to termination; and

(v) Return to the Plan or, if not provided for in the Services Agreements, destroy the PHI retained by Business Associate under Section 8.c.(i) when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities, except where Business Associate reasonably determines such PHI is not technically capable of being returned or destroyed.

10.

Miscellaneous.

a.

Applicability. For purposes of this Agreement, and as applicable to the Business Associate Functions of Business Associate under the Services Agreements covered by this Agreement, references to the Plan shall include the named Plan and all other group health plans subject to HIPAA and sponsored by Company that participate in an organized health care arrangement.

b.

Survival. The respective rights and obligations of Business Associate and the Plan or Company hereunder shall survive termination of this Agreement according to the terms hereof and the obligations imposed on the Plan or Company and Business Associate under the HIPAA Rules.

c.

Interpretation; Amendment. This Agreement shall be interpreted and applied in a manner consistent with the Plan's and Business Associate's obligations under the HIPAA Rules. All amendments shall be in writing and signed by both parties, except that this Agreement shall attach to additional Services Agreements entered into between the parties in the future without the necessity of amending this Agreement each time. This Agreement is intended to cover the entire Business Associate relationship between the parties, as amended, from time to time, through Services Agreements or other means.

d.

Waiver. A waiver with respect to one event shall not be construed as continuing, or as a bar to or waiver of any right or remedy as to subsequent events.

e.

No Third-Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than the parties and their respective successors or assigns, any rights, remedies or obligations.

IN WITNESS WHEREOF, each of the undersigned has caused this Agreement to be duly executed in its name and on its behalf.

Company:

State of Nebraska

Signature:

Printed Name:

Title:

Date Signed:

Business Associate:

Signature:

Printed Name:

Title:

Date Signed:

DOCS/1204654.1

\\\DC - 68975/3 - #1284060 v1