Attachment D Business Associate Agreement.pdf

Business Associate Agreement - Revised: 6.26.2026 1

UNIVERSITY OF MASSACHUSETTS ACTING BY AND THROUGH ITS

UNIVERSITY OF MASSACHUSETTS CHAN MEDICAL SCHOOL

ATTACHMENT BUSINESS ASSOCIATE AGREEMENT

(consisting of pages)

The University of Massachusetts, acting by and through its University of Massachusetts Chan Medical School (“University)" and (“Contractor”) (collectively the “Parties”) agree to the following:

1. Definitions

1.1 All terms used but not otherwise defined in this Business Associate Agreement (“BAA”) shall have the same meaning as those terms in the HIPAA Rules, Mass. Gen. Laws c. 93H, and other applicable state or federal privacy or security laws.

1.2 “Breach”: shall mean the acquisition, access, use or disclosure of Personal Information in a manner not permitted under Subpart E of 45 CFR Part 164, M.G.L. c. 93H, or other applicable states’ security breach statutes.

1.3 “Business Associate”: shall have the same meaning as the term “business associate” in 45 CFR Part 160 and Part 164.

1.4 “Business Associate Agreement”: shall mean satisfactory assurances in writing between a Covered Entity and a Business Associate, and a Business Associate and any subcontractor that meet the applicable requirements of 45 CFR §164.504(e).

1.5 “Contract”: shall mean the Contract as defined in the second paragraph of the Contract for Services Purchased, including this Business Associate Agreement, and any Contract Amendments.

1.6 “Covered Entity”: shall have the same meaning as the term “covered entity” at 45 CFR §160.103 and for purposes of this agreement shall mean the entity that owns the Personal Information as defined herein.

1.7 “Discovers”: shall mean the first day on which a use or disclosure of Personal Information not permitted under the Contract, Breach or Security Incident is known to Contractor (including any person, other than the individual committing the Breach, that is an employee, officer, or other agent of Contractor), or should reasonably have been known to Contractor, to have occurred.

1.8 “HIPAA Rules”: shall mean the Privacy, Security, Breach Notification and Enforcement rules at 45 CFR Part 160 and Part 164, promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology Economic and Clinic Health Act (HITECH) provisions in Title XIII of the American Recovery and Reinvestment Act of 2009, and any modifications to those rules.

1.9 “Personal Information”: shall mean “personal information” (as defined in Mass. Gen. Laws c. 93H or other states’ breach notification laws), or “protected health information” (as defined in 45 CFR §160.103), or “personal data” (as defined in Mass. Gen. Laws c. 66A), “patient identifying information” as defined in 42 CFR Part 2 and any other individually identifiable information defined as confidential under state or federal law. All of the foregoing are considered “Personal Information” if not fully de-identified in accordance with 45 CFR §164.514.

1.10 “Privacy Rule”: shall mean the HIPAA Privacy Rule at 45 CFR Part 164 Subpart E.

1.11 “Required By Law”: shall have the same meaning as used in the Privacy Rule.

1.12 “Secretary”: shall mean the Secretary of the U.S. Department of Health and Human Services or her designee.

1.13 “Security Incident”: shall have the same meaning as the term “security incident” at 45 CFR §164.304 or as referenced in applicable state security breach statutes.

1.14 “Security Information”: shall mean all materials pertaining to the manner in which an organization protects its information technology system and data; the disclosure of which could expose the system to external threats.

Security Information includes, but is not limited to, diagrams, system schematic drawings, user account information, passwords, threat or vulnerability assessments and other measures to detect, document and counter threats.

Business Associate Agreement - Revised: 6.26.2026 2

1.15 “Security Rule”: shall mean the HIPAA Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Parts 160 and 164 Subpart C.

2. Obligations and Activities of Contractor

2.1 Contractor acknowledges and agrees that it is functioning as the University’s subcontractor by performing services, which the University is obligated to perform for the Covered Entity. Contractor acknowledges in the performance of the Contract it meets the definition of Business Associate and agrees to comply with the applicable provisions of HIPAA, HITECH, and the HIPAA Rules.

2.2 Contractor agrees that it shall comply with all other applicable federal and state laws and regulation relating to the confidentiality, privacy and security of the Personal Information. This includes, if relevant, but is not limited to, 42 CFR Part 431 Subpart F and 42 CFR Part 2, and Massachusetts laws and regulations at M.G.L. c. 66A;

801 CMR 3.00; c. 93H; and 201 CMR 17.

2.3 Contractor further agrees that it shall comply with all other privacy and security obligations applicable to any Personal Information under the Contract based on the University or the Covered Entity having entered into an agreement with a third party (including, but not limited, to the Social Security Administration or the Massachusetts Department of Revenue) to obtain or access the data. Such agreements may include a written compliance acknowledgment or confidentiality agreement. The Contractor shall comply with other privacy and security obligations required by the third party for access to data from the third party or to any system or database containing any such data or through which such data could be accessed.

2.4 To the extent that Contractor obtains access to any University or third party Security Information, Contractor agrees that it shall not divulge such information and agrees to only use such information for the purposes for which it obtained access. Contractor shall apply all applicable requirements set forth in this BAA, to protect such information. Contractor shall not retain any University or third party Security Information obtained pursuant to this Contract upon termination of this Contract.

2.5 Contractor agrees to use appropriate safeguards to prevent use or disclosure of the Personal Information other than as provided for by this Contract. Contractor further agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the electronic Personal Information that it creates, receives, maintains, or transmits pursuant to this Contract, as required by 45 CFR Part 164 Subpart C [Security Standards].

2.6 In addition to requirements set forth in 2.5 above, Contractor agrees to implement the following specific security measures:

2.6.1 If the University gives the Contractor access to any University or Covered Entity database, system or information technology resource, Contractor shall comply with all University or Covered Entity policies, processes and mechanisms established for access. Contractor shall maintain and make available at the request of the University a current list of personnel who have access to such database. Contractor shall give the University or Covered Entity timely notice of a change in personnel whenever the change requires a termination or modification of any password, user ID, or other security mechanisms or codes.

2.6.1.1 Any Contractor system interconnected (through an active connection, such as a network link, or a passive connection, such as a nightly data feed) with a Massachusetts Executive Office of Health and Human Services (“EOHHS”) system containing federal Hub-derived Personal Information shall be maintained consistent with the principles set forth in the National Institute of Standards and Technology standard: NIST 800-53 – Information Security moderate standard.

2.6.1.2 If Contractor accesses any of Massachusetts EOHHS’ Personal Information, systems, or technology resources, Contractor shall comply with Commonwealth of Massachusetts security and information technology policies, standards, and procedures established by the Massachusetts Executive Office of Technology Services and EOHHS for access to Personal Information.

2.6.2 Contractor shall not store the Personal Information on portable media or devices that may be transported off Contractor’s premises except when copying data onto storage media for secure transport to the University or to Contractor’s backup facility, and then only in encrypted format, meeting standards set forth by the Secretary in the Guidance Specifying the Technologies and

Business Associate Agreement - Revised: 6.26.2026 3

Methodologies that Render Protected Health Information Unusable, Unreadable or Indecipherable to Unauthorized Individuals issued under section 13402 (h)(2) of Pub.L. 111-5 (posted at:

http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html).

2.6.3 Contractor shall employ valid encryption processes for all Personal Information at rest and in motion in compliance with the Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable or Indecipherable to Unauthorized Individuals issued under section 13402 (h)(2) of Pub.L. 111-5 (posted at:

http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html).

2.6.4 Contractor shall not permit its employees to access the Personal Information remotely, unless pursuant to a written information security plan for secure access that ensures compliance with the terms of this

BAA.

2.6.5 Contractor shall not host or maintain any Personal Information outside the United States.

2.7 Contractor agrees to verbally report to the University’s Privacy Officer by phone (508-856-8326) and in writing by email (PrivacyandCompliance@umassmed.edu), within three (3) business days of when Contractor Discovers any Breach, use or disclosure of Personal Information not provided for by this Contract, or Security Incident (hereinafter collectively referred to as “event”). Notice shall include: (i) the date(s) of occurrence of the event and the date of discovery of the event; (ii) nature of such event(s) (e.g. cause, contributing factors, chronology of events); (iii) date of Discovery of such event(s); (iv) nature and extent of Personal Information involved (complete list of type of identifiers); (v) nature of unauthorized persons who received Personal Information;

(vi) the number of individuals involved; (vii) the harmful effects of the event known to the Contractor and steps Contractor has taken or plans to take to mitigate risk of harm from such event(s); and (vii) any other information necessary to complete a risk assessment, including sample forms or documents involved in event. When, despite all reasonable efforts by Contractor to timely obtain the information required for such notice, circumstances beyond the control of the Contractor necessitate additional time, the Contractor shall provide the above information to the University as soon as possible and without unreasonable delay, but in no event later than thirty (30) calendar days from the date on which it Discovers the event; provided that Contractor shall provide verbal notice of the event and all information then available within three (3) business days of Discovery of the event, and the additional information as soon thereafter as it is available. Upon request, Contractor shall provide to the University a summary of the nature and scope of Contractor’s investigation, and a summary of steps taken to prevent such events in the future.

2.7.1 Contractor agrees to immediately retrieve, to the extent possible, upon becoming aware of the event, any Personal Information used or disclosed in the non-permitted manner; mitigate to the extent possible, the risk to the Personal Information resulting from the event; and take any further action required by any applicable state or federal law concerning the privacy and security of the Personal Information.

2.7.2 Contractor agrees to cooperate and provide access to information necessary for the University and the Contractor to determine the scope of the event and to fulfill any mitigation or notification obligation. If the Covered Entity or University determines that Contractor’s Breach triggers consumer notification, Contractor agrees to assist the University. Contractor further agrees to comply with its obligations under the HIPAA Rules and other state security breach statutes, but shall not provide notice directly to consumers or the Secretary.

2.7.3 Contractor agrees to reimburse University for reasonable costs incurred associated with notification and mitigation, to the extent that such costs are due to Contractor’s: (a) failure to meet its responsibilities under, or in violation of, any provision of the Contract; (b) violation of law; (c) negligence; (d) failure to protect Personal Information under its control with encryption that constitutes a safe-harbor or exception to any requirement to give notice under such laws; and (e) any activity or omission of its employees, agents, or subcontractors resulting in or contributing to an event triggering such notice or mitigation.

2.8 Contractor shall report any non-permitted access, use or disclosure of Security Information to the University immediately (no later than twenty-four (24) hours) in the same manner as described in subsection 2.7 above, and shall take all reasonable and legal actions to retrieve such information.

2.9 Contractor shall ensure that any agent or subcontractor it engages to perform any services under this Contract involving Personal Information agrees in writing to the same restrictions and conditions that apply through this BAA to the Contractor. Contractor is solely responsible for its agents’ and subcontractors’ compliance with this http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html mailto:PrivacyandCompliance@umassmed.edu

Business Associate Agreement - Revised: 6.26.2026 4 and all other provisions in this BAA and shall not be relieved of any obligation because the Personal Information was in the possession of its agents or subcontractors.

2.10 Contractor agrees to make its internal practices, policies, procedures, books, and records available to the Secretary and the University for purposes of determining compliance with the HIPAA Rules.

2.11 Contractor agrees to report in writing to the University Privacy Officer within two (2) business days of receipt, as indicated above, any instance where an individual or an individual’s legal representative makes a request to Contractor: (1) for a copy of the Personal Information pertaining to that individual; (2) that the Personal Information pertaining to that individual be amended; (3) that the Personal Information be disclosed to a third party; (4) a list of disclosures made by Contractor of the Personal Information pertaining to that individual, and:

2.11.1 Contractor agrees to make available Personal Information to the individual or the individual’s representative within the time and in the manner necessary to satisfy all requirements of 45 CFR §164.524.

2.11.2 Contractor agrees to amend an individual’s Personal Information within the time and in the manner necessary to satisfy all requirements of 45 CFR §164.526.

2.11.3 Contractor agrees to comply with all requirements of the Privacy Rule and applicable state and federal privacy laws regarding disclosure of Personal Information to a third party.

2.11.4 Contractor agrees to document disclosures of Personal Information and make available the information required to provide an accounting of disclosures of Personal Information within the time and in the manner necessary to comply with all requirements of 45 CFR §164.528.

2.11.5 Contractor agrees to comply with all laws and regulations applicable to an individual’s rights to Personal Information.

2.12 Contractor agrees to report to the University Privacy Officer, by phone and in writing by email, as indicated above, any instance in which the Personal Information is subpoenaed or becomes the subject of a court or administrative order or other legal process. In no event shall the Contractor’s reporting obligations under this paragraph be delayed beyond two (2) business days preceding the return date in the subpoena or legal process, or two (2) business days from obtaining such request for data, whichever is shorter. In response to such legal process, Contractor agrees to take all necessary steps to comply with M.G.L. c. 66A, 42 CFR §431.306(f), 42 CFR Part 2, and any other applicable federal or state law or regulation. Contractor agrees to respond to such legal process within a time and manner that complies with all requirements of the Privacy Rule, and applicable state and federal laws.

2.13 Contractor agrees to adopt employee policies and procedures to ensure that its employees comply with the requirements of this BAA. Contractor further agrees to train its employees, servants or agents handling the Personal Information under this Contract or the laws and regulations relating to security, confidentiality, and privacy.

2.14 Contractor acknowledges that it has no ownership rights in the Personal Information or in any data derived or extracted from the Personal Information.

2.15 Contractor agrees to furnish the University upon request a description of the steps it has taken to protect the security of the Personal Information and will allow authorized representatives of the University access to the premises where the Personal Information is stored or accessed, for purposes of inspecting privacy and security arrangements.

2.16 Upon termination or expiration of the Contract or as otherwise applicable, Contractor shall return to the University or Covered Entity, as directed by the University, or properly dispose of all Personal Information and Security Information in compliance with the Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable or Indecipherable to Unauthorized Individuals as Issued under section 13402 (h)(2) of Pub.L. 111-5 (posted at:

http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html). Contractor shall attest in writing to the University that all the Personal Information and Security Information has been returned or destroyed in compliance with the above-listed guidance, including a description of the steps taken.

This provision shall apply to all Personal Information and Security Information in the possession of Contractor’s subcontractors or agents, and Contractor shall ensure that all such data in the possession of subcontractors or http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/brguidance.html

Business Associate Agreement - Revised: 6.26.2026 5 agents have been returned or destroyed and no subcontractors or agents retain any copies of such data in any form.

3. Permitted Uses and Disclosures By Contractor

3.1 Contractor may use or disclose Personal Information only to perform the services or other obligations set forth in the Contract, provided that such use or disclosure complies with the Privacy Rule and is consistent with subsections 3.3 and 3.4 herein, and, if applicable, 42 CFR Part 2, other privacy or security laws or regulations, and third party agreements governing or restricting Contractor’s use, disclosure, and maintenance of Personal Information under this Contract.

3.2 Contractor may use or disclose Personal Information as Required By Law, consistent with restrictions set forth in laws, regulations or agreements as referenced in 3.1 of this section.

3.3 Contractor agrees to make uses, disclosures, and requests for Personal Information consistent with minimum necessary principles necessary to perform services under this Contract. Contractor further agrees to ensure that each member of its workforce accesses, uses, discloses, transmits, or maintains the minimum necessary Personal Information required to perform services under the Contract.

3.4 Contractor shall not use or disclose Personal Information in a manner that would violate Subpart E of 45 CFR Part 164 if done by the University or the Covered Entity.

4. Obligation of University

4.1 The University shall not request Contractor to use or disclose Personal Information in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by the University or the Covered Entity.

4.2 If notified by the Covered Entity and if related to services performed under the Contract, the University shall notify Contractor’s Privacy Officer of changes to the Covered Entity’s Notice of Privacy Practices, changes in authorizations, restrictions to the use and disclosure of Personal Information, and other changes related to individual rights.

5. Termination/Expiration Provisions

5.1 The University reserves the right to terminate the Contract, upon any material breach of this BAA as set forth in the Contract.

5.2 Contractor’s obligations upon termination are set forth in the Contract and section 2.16 of this BAA.

5.3 Notwithstanding any other provision concerning the term of this Contract, all protections pertaining to the Personal Information and Security Information shall survive the termination or expiration of the Contract and shall continue to apply until such time as all the Personal Information are returned to the University or destroyed in accordance with section 2.16 of this BAA.

6. Miscellaneous Provisions

6.1 A reference in this BAA to a section in the HIPAA Rules means the section as in effect or as amended, and for which compliance is required.

6.2 Contractor shall not publish or otherwise disclose Personal Information or other data it receives under this Contract in any form or any statistical tabulations or results derived from such data regardless of whether the Personal Information or data can be linked to a specific individual or are de-identified in accordance with 45 CFR §164.514, without prior written permission from the University.

6.3 The Parties shall take such action as is necessary to amend this BAA from time to time as is necessary for compliance with the requirements of the HIPAA Rules and other applicable law. No provision of this BAA may be modified, waived or amended, except in writing signed by authorized representatives of the Parties.

6.4 The respective rights and obligations of Contractor under section 5.3 of this BAA shall survive the termination of this Contract.

6.5 Any ambiguity in this Contract shall be resolved in favor of a meaning that permits compliance with applicable federal or state laws.

Business Associate Agreement - Revised: 6.26.2026 6

6.6 Nothing express or implied in this Contract is intended to confer, nor shall anything confer, upon any person other than the University and the Contractor and their respective successors or assigns, any rights remedies, obligations, or liabilities. Notwithstanding the foregoing, The Covered Entity shall be considered a direct third party beneficiary of this Business Associate Agreement with Contractor, who will be receiving PHI pursuant to this Business Associate Agreement, with rights of enforcement from such Contractor.

Contractor Privacy Officer: The Contractor designates as Privacy Officer, and shall notify the University within two (2) business days if the designation is changed.

Contractor Security Officer: The Contractor designates as Security Officer, and shall notify the University within two (2) business days if the designation is changed.

UMass Chan Senior Privacy Officer: 508-856-8326 and PrivacyandCompliance@umassmed.edu.

University of Massachusetts acting by and through its University of Massachusetts Chan Medical School: Contractor:

Signature

Printed Name

Title

Signature

Printed Name

Title mailto:PrivacyandCompliance@umassmed.edu