ATTACHMENT I HIPAA BAA

1 Governor’s Office of Planning and Budget Security Assessment

This document is protected from disclosure by OCGA § 50-18-72(a)(25)(A)(i) (2012)

ATTACHMENT I

Statement of Need 98000-00000-5619 Request for Qualified Contractor: 98000-00000-3088

Department of Community Supervision Security Assessment

BUSINESS ASSOCIATE AGREEMENT

(Return by awardee only prior to issuance of PO)

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (hereinafter referred to as “Agreement”), effective this _____ day of ___________, ____________ (hereinafter the “Effective Date”) is made and entered into by and between the “Insert Agency Name Here” (hereinafter referred to as “Insert Agency Initials”) and [INSERT CONTRACTOR NAME] (hereinafter referred to as “Contractor”) as Attachment [X] to Contract No.

AGENCY NAME HEREX between “Agency Initials” and Contractor dated _______________________ (hereinafter referred to as the “Contract”).

WHEREAS, “Agency Initials” is a “Insert Agency Type Here-hybrid/covered” entity, as defined in the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), and is required by HIPAA to enter into a Business Associate Agreement with certain entities that provide functions, activities, or services on behalf of or in support of health care components of “AGENCY NAME HERE”, which functions, activities or services involve the use of Protected Health Information as defined by HIPAA (“PHI”);

WHEREAS, Contractor, under the Contract provides functions, activities, or services involving the use of PHI;

NOW, THEREFORE, for and in consideration of the mutual promises, covenants and agreements contained herein, and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, “AGENCY NAME HERE” and Contractor (each individually a “Party” and collectively the “Parties”) hereby agree as follows:

2 Governor’s Office of Planning and Budget Security Assessment

1. Terms used but not otherwise defined in this Agreement shall have the same meaning as those terms have in HIPAA and in Title XIII of the American Recovery and Reinvestment Act of 2009 (the Health Information Technology for Economic and Clinical Health Act, or “HITECH”), and in the implementing regulations of HIPAA and HITECH. Implementing regulations are published as the Standards for Privacy and Security of Individually Identifiable Health Information in 45 C.F.R.

Parts 160 and 164. Together, HIPAA, HITECH, and their implementing regulations are referred to in this Agreement as the “Privacy Rule and Security Rule.” If the meaning of any defined term is changed by law or regulation, then this Agreement will be automatically modified to conform to such change. The term “NIST Baseline Controls” means the baseline controls set forth in National Institute of Standards and Technology (NIST) SP 800-53 established for “moderate impact” information.

2. Except as limited in this Agreement, Contractor may use or disclose PHI only to the extent necessary to meet its responsibilities as set forth in the Contract provided that such use or disclosure would not violate the Privacy Rule or the Security Rule, if done by “AGENCY NAME HERE”. Furthermore, except as otherwise limited in this Agreement, Contractor may:

A. Use PHI for internal quality control and auditing purposes.

B. Use or disclose PHI as Required by Law.

C. After providing written notification to “AGENCY NAME HERE”’s Office of Inspector

General, use PHI to make a report to a health oversight agency authorized by law to investigate “AGENCY NAME HERE” (or otherwise oversee the conduct or conditions of the “AGENCY NAME HERE”) about any “AGENCY NAME HERE” conduct that Contractor in good faith believes to be unlawful as permitted by 45 C.F.R. 164.502(j)(1).

Notwithstanding the foregoing, Contractor shall not be required to provide prior written notice to “AGENCY NAME HERE”’s Office of Inspector General if Contractor is provided written instruction otherwise by the health oversight agency authorized by law to investigate “AGENCY NAME HERE”.

D. Use and disclose PHI to consult with an attorney for purposes of determining Contractor’s legal options with regard to reporting conduct by “AGENCY NAME HERE” that Contractor in good faith believes to be unlawful, as permitted by 45 C.F.R. 164.502(j)(1).

3. Contractor represents and warrants that only individuals designated by title or name on Attachments X-1 and X-2 will request PHI from “AGENCY NAME HERE” or access “AGENCY NAME HERE” PHI in order to perform the services of the Contract, and these individuals will only request the minimum necessary amount of information necessary in order to perform the services.

3 Governor’s Office of Planning and Budget Security Assessment

4. Contractor represents and warrants that the individuals listed by title on Attachment X-1 require access to PHI in order to perform services under the Contract. Contractor agrees to send updates to Attachment X-1 whenever necessary. Uses or disclosures of PHI by individuals not described on Attachment X-1 are impermissible.

5. Contractor represents and warrants that the individuals listed by name on Attachment X-2 require access to an “AGENCY NAME HERE” information system in order to perform services under the Contract. Contractor agrees to notify the Project Leader and the Access Control Coordinator named on Attachment X-2 immediately, but at least within 24 hours, of any change in the need for “AGENCY NAME HERE” information system access by any individual listed on Attachment X-2. Any failure to report a change within the 24 hour time period will be considered a security incident and may be reported to Contractor’s Privacy and Security Officer, Information Security Officer and the Georgia Technology Authority for proper handling and sanctions.

6. Contractor agrees that it is a Business Associate to “AGENCY NAME HERE” as a result of the Contract, and represents and warrants to “AGENCY NAME HERE” that it complies with the Privacy Rule and Security Rule requirements that apply to Business Associates and will continue to comply with these requirements. Contractor further represents and warrants to “AGENCY NAME HERE” that it maintains and follows written policies and procedures to achieve and maintain compliance with the HIPAA Privacy and Security Rules that apply to Business Associates, including, but not limited to policies and procedures addressing HIPAA’s requirements that Business Associates use, request and disclose only the minimum amount of PHI necessary to perform their services, and updates such policies and procedures as necessary in order to comply with the HIPAA Privacy and Security Rules that apply to Business Associates and will continue to maintain and update such policies and procedures. These policies and procedures, and evidence of their implementation, shall be provided to “AGENCY NAME HERE” upon request.

7. The Parties agree that a copy of all communications related to compliance with this Agreement will be forwarded to the following Privacy and Security Contacts:

A. At “AGENCY NAME HERE”: “Agency Party Name Here” “Chief Information Security Officer or Title Here” Office Phone: (404) AGENCY NAME HERE- AGENCY NAME HEREX

Email:

4 Governor’s Office of Planning and Budget Security Assessment

B. At Contractor: ________________

8. Contractor further agrees that it will:

A. Not request, create, receive, use or disclose PHI other than as permitted or required by this Agreement, the Contract, or as required by law.

B. Establish, maintain and use appropriate administrative, physical and technical safeguards to prevent use or disclosure of the PHI other than as provided for by this Agreement or the Contract. Such safeguards must include all NIST Baseline Controls, unless “AGENCY NAME HERE” has agreed in writing that the control is not appropriate or applicable.

C. Implement and use administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of “AGENCY NAME HERE”. Such safeguards must include all NIST Baseline Controls, unless “AGENCY NAME HERE” has agreed in writing that the control is not appropriate or applicable.

D. In addition to the safeguards described above, Contractor shall include access controls that restrict access to PHI to the individuals listed on X-1 and X-2, as amended from time to time, shall implement encryption of all electronic PHI during transmission and at rest.

E. Upon “AGENCY NAME HERE”’s reasonable request, but no more frequently than annually, obtain an independent assessment of Contractor’s implementation of applicable HIPAA Privacy and Security Controls and the additional safeguards required by this Agreement

5 Governor’s Office of Planning and Budget Security Assessment with respect to encryption of stored and transmitted “AGENCY NAME HERE” PHI, provide the results of such assessments to “AGENCY NAME HERE”, and ensure that corrective actions identified during the independent assessment are implemented. Contractor shall bear the costs associated with the independent assessment and for the implementation of corrective actions identified as the result of the assessment.

F. Mitigate, to the extent practicable, any harmful effect that may be known to Contractor from a use or disclosure of PHI by Contractor in violation of the requirements of this Agreement, the Contract or applicable regulations. Contractor shall bear the costs of mitigation, which shall include the reasonable costs of credit monitoring or credit restoration when the use or disclosure results in exposure of information commonly used in identity theft.

G. Maintain a business associate agreement with its agents or subcontractors to whom it provides PHI, in accordance with which such agents or subcontractors are contractually obligated to comply with at least the same obligations that apply to Contractor under this Agreement, and ensure that its agents or subcontractors comply with the conditions, restrictions, prohibitions and other limitations regarding the request for, creation, receipt, use or disclosure of PHI, that are applicable to Contractor under this Agreement and the Contract.

H. Report to “AGENCY NAME HERE” any use or disclosure of PHI that is not provided for by this Agreement or the Contract of which it becomes aware.

I. Make an initial report to the “AGENCY NAME HERE” in writing in such form as “AGENCY NAME HERE” may require within three (3) business days after Contractor (or any subcontractor) becomes aware of the unauthorized use or disclosure. This report will require Contractor to identify the following:

i. The nature of the impermissible use or disclosure (the “incident”), which will include a brief description of what happened, including the date it occurred and the date Contractor discovered the incident;

ii. The Protected Health Information involved in the impermissible use or disclosure, such as whether the full name, social security number, date of birth, home address, account number or other information were involved);

6 Governor’s Office of Planning and Budget Security Assessment

iii. Who (by title, access permission level and employer) made the impermissible use or disclosure and who received the Protected Health Information as a result;

iv. What corrective or investigational action Contractor took or will take to prevent further impermissible uses or disclosures, to mitigate harmful effects, and to prevent against any further incidents;

v. What steps individuals who may have been harmed by the incident might take to protect themselves; and

vi. Whether Contractor believes that the impermissible use or disclosure constitutes a Breach of Unsecured Protected Health Information.

Upon request by the “AGENCY NAME HERE” HIPAA Privacy and Security Officer or the “AGENCY NAME HERE” Information Security Officer, Contractor agrees to make a complete report to the “AGENCY NAME HERE” in writing within two weeks of the initial report that includes a root cause analysis and a proposed corrective action plan. Upon approval of a corrective action plan by the “AGENCY NAME HERE”, Contractor agrees to implement the corrective action plan and provide proof of implementation to the “AGENCY NAME HERE” within five (5) business days of “AGENCY NAME HERE”’s request for proof of implementation.

J. Report to the “AGENCY NAME HERE” HIPAA Privacy and Security Officer and the “AGENCY NAME HERE” Agency Information Security Officer any successful unauthorized access, modification, or destruction of PHI or interference with system operations in Contractor’s information systems as soon as practicable but in no event later than three

(3) business days of discovery. If such a security incident resulted in a use or disclosure of PHI not permitted by this Agreement, Contractor shall also make a report of the impermissible use or disclosure as described above. Contractor agrees to make a complete report to the “AGENCY NAME HERE” in writing within two weeks of the initial report that includes a root cause analysis and, if appropriate, a proposed corrective action plan designed to protect PHI from similar security incidents in the future. Upon “AGENCY NAME HERE”’s approval of Contractor’s corrective action plan, Contractor agrees to implement the corrective action plan and provide proof of implementation to the

“AGENCY NAME HERE”.

K. Upon “AGENCY NAME HERE”’s reasonable request and not more frequently than once per quarter, report to the “AGENCY NAME HERE” Agency Information Security Officer any (A) attempted (but unsuccessful) unauthorized access, use, disclosure, modification, 7 Governor’s Office of Planning and Budget Security Assessment or destruction of PHI or (B) attempted (but unsuccessful) interference with system operations in Contractor’s information systems. Contractor does not need to report trivial incidents that occur on a daily basis, such as scans, “pings,” or other routine attempts that do not penetrate computer networks or servers or result in interference with system operations.

L. Cooperate with “AGENCY NAME HERE” and provide assistance necessary for “AGENCY NAME HERE” to determine whether a Breach of Unsecured Protected Health Information has occurred, and whether notification of the Breach is legally required or otherwise appropriate. Contractor agrees to assist “AGENCY NAME HERE” in its efforts to comply with the HIPAA Privacy and Security Rules, as amended from time to time. To that end, the Contractor will abide by any requirements mandated by the HIPAA Privacy and Security Rules or any other applicable laws in the course of this Contract. Contractor warrants that it will cooperate with “AGENCY NAME HERE”, including cooperation with “AGENCY NAME HERE” privacy officials and other compliance officers required by the HIPAA Privacy and Security Rules and all implementing regulations, in the course of performance of this Contract so that both parties will be in compliance with HIPAA.

M. If “AGENCY NAME HERE” determines that a Breach of Unsecured Protected Health Information has occurred as a result of Contractor’s impermissible use or disclosure of PHI or failure to comply with obligations set forth in this Agreement or in the Privacy or Security Rules, provide all notifications to Individuals, HHS and/or the media, on behalf of “AGENCY NAME HERE”, after the notifications are approved by the “AGENCY NAME HERE”. Contractor shall provide these notifications in accordance with the security breach notification requirements set forth in 42 U.S.C. §17932 and 45 C.F.R. Parts 160 & 164 subparts A, D & E as of their respective Compliance Dates, and shall pay for the reasonable and actual costs associated with such notifications.

In the event that “AGENCY NAME HERE” determines a Breach has occurred, without unreasonable delay, and in any event no later than thirty (30) calendar days after Discovery, Contractor shall provide the “AGENCY NAME HERE” HIPAA Privacy and Security Officer a list of Individuals and a copy of the template notification letter to be sent to Individuals. Contractor shall begin the notification process only after obtaining “AGENCY NAME HERE”’s approval of the notification letter.

N. Make any amendment(s) to PHI in a Designated Record Set that “AGENCY NAME HERE” directs or agrees to pursuant to 45 CFR 164.526 within five (5) business days after request of “AGENCY NAME HERE”. Contractor also agrees to provide “AGENCY NAME

8 Governor’s Office of Planning and Budget Security Assessment

HERE” with written confirmation of the amendment in such format and within such time as “AGENCY NAME HERE” may require.

O. In order to meet the requirements under 45 CFR 164.524, regarding an individual’s right of access, Contractor shall, within five (5) business days following “AGENCY NAME HERE”’s request, or as otherwise required by state or federal law or regulation, or by another time as may be agreed upon in writing by the “AGENCY NAME HERE”, provide “AGENCY NAME HERE” access to the PHI in an individual’s Designated Record Set.

However, if requested by “AGENCY NAME HERE”, Contractor shall provide access to the PHI in a Designated Record Set directly to the individual to whom such information relates.

P. Give the Secretary of the U.S. Department of Health and Human Services (the “Secretary”) or the Secretary’s designees access to Contractor’s books and records and policies, practices or procedures relating to the use and disclosure of PHI for or on behalf of “AGENCY NAME HERE” within five (5) business days after the Secretary or the Secretary’s designees request such access or otherwise as the Secretary or the Secretary’s designees may require. Contractor also agrees to make such information available for review, inspection and copying by the Secretary or the Secretary’s designees during normal business hours at the location or locations where such information is maintained or to otherwise provide such information to the Secretary or the Secretary’s designees in such form, format or manner as the Secretary or the Secretary’s designees may require.

Q. Document all disclosures of PHI and information related to such disclosures as would be required for “AGENCY NAME HERE” to respond to a request by an Individual or by the Secretary for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528.

By no later than five (5) business days of receipt of a written request from “AGENCY NAME HERE”, or as otherwise required by state or federal law or regulation, or by another time as may be agreed upon in writing by the “AGENCY NAME HERE” HIPAA Privacy and Security Officer, Contractor shall provide an accounting of disclosures of PHI regarding an Individual to “AGENCY NAME HERE”. If requested by “AGENCY NAME HERE”, Contractor shall provide an accounting of disclosures directly to the individual.

Contractor shall maintain a record of any accounting made directly to an individual at the individual’s request and shall provide such record to the “AGENCY NAME HERE” upon request.

R. In addition to any indemnification provisions in the Contract, indemnify the “AGENCY NAME HERE” from any liability resulting from any violation of the HIPAA Privacy and Security Rules or Breach that arises from the conduct or omission of Contractor or its employee(s), agent(s) or subcontractor(s). Such liability will include, but not be limited

9 Governor’s Office of Planning and Budget Security Assessment to, all actual and direct costs and/or losses, civil penalties and reasonable attorneys’ fees imposed on “AGENCY NAME HERE”.

S. For any requirements in this Agreement that include deadlines, pay performance guarantee payments of $300.00 per calendar day, starting with the day after the deadline and continuing until Contractor complies with the requirement. Contractor shall ensure that its agreements with subcontractors enable Contractor to meet these deadlines.

9. “AGENCY NAME HERE” agrees that it will:

A. Notify Contractor of any new limitation in the applicable Notice of Privacy Practices in accordance with the provisions of the Privacy Rule if, and to the extent that, “AGENCY NAME HERE” determines in the exercise of its sole discretion that such limitation will affect Contractor’s use or disclosure of PHI.

B. Notify Contractor of any change in, or revocation of, authorization by an Individual for

“AGENCY NAME HERE” to use or disclose PHI to the extent that “AGENCY NAME HERE” determines in the exercise of its sole discretion that such change or revocation will affect Contractor’s use or disclosure of PHI.

C. Notify Contractor of any restriction regarding its use or disclosure of PHI that “AGENCY

NAME HERE” has agreed to in accordance with the Privacy Rule if, and to the extent that, “AGENCY NAME HERE” determines in the exercise of its sole discretion that such restriction will affect Contractor’s use or disclosure of PHI.

D. Prior to agreeing to any changes in or revocation of permission by an Individual, or any restriction, to use or disclose PHI, “AGENCY NAME HERE” agrees to contact Contractor to determine feasibility of compliance. “AGENCY NAME HERE” agrees to assume all costs incurred by Contractor in compliance with such special requests.

10. The Term of this Agreement shall be effective on the Effective Date and shall terminate when all of the PHI provided by “AGENCY NAME HERE” to Contractor, or created or received by Contractor on behalf of “AGENCY NAME HERE”, is destroyed or returned to “AGENCY NAME HERE”, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions in this section.

A. Termination for Cause. Upon “AGENCY NAME HERE”’s knowledge of a material breach of this Agreement by Contractor, “AGENCY NAME HERE” shall either:

10 Governor’s Office of Planning and Budget Security Assessment

i. Provide an opportunity for Contractor to cure the breach of Agreement within a reasonable period of time, which shall be within thirty (30) calendar days after receiving written notification of the breach by “AGENCY NAME HERE”;

ii. If Contractor fails to cure the breach of Agreement, terminate the Contract upon thirty (30) calendar days’ notice; or

iii. If neither termination nor cure is feasible, “AGENCY NAME HERE” shall report the breach of Agreement to the Secretary of the Department of Health and Human Services.

B. Effect of Termination.

i. Upon termination of this Agreement, for any reason, “AGENCY NAME HERE” and Contractor shall determine whether return of PHI is feasible. If return of the PHI is not feasible, Contractor agrees to continue to extend the protections of this Agreement to the PHI for so long as the Contractor maintains the PHI and shall limit the use and disclosure of the PHI to those purposes that made return or destruction of the PHI infeasible. If at any time it becomes feasible to return or destroy any such PHI maintained pursuant to this paragraph, Contractor must notify “AGENCY NAME HERE” and obtain instructions from “AGENCY NAME HERE” for either the return or destruction of the PHI.

ii. Contractor agrees that it will limit its further use or disclosure of PHI only to those purposes “AGENCY NAME HERE” may, in the exercise of its sole discretion, deem to be in the public interest or necessary for the protection of such PHI, and will take such additional actions as “AGENCY NAME HERE” may require for the protection of patient privacy and the safeguarding, security and protection of such PHI.

iii. This Effect of Termination section survives the termination of the Agreement.

11. Interpretation. Any ambiguity in this Agreement shall be resolved to permit “AGENCY NAME HERE” and Contractor to comply with applicable laws, rules and regulations, the HIPAA Privacy Rule, the HIPAA Security Rule and any rules, regulations, requirements, rulings, interpretations, procedures or other actions related thereto that are promulgated, issued or taken by or on behalf of the Secretary; provided that applicable laws, rules and regulations and the laws of the State of Georgia shall supersede the Privacy Rule if, and to the extent that, they impose additional

11 Governor’s Office of Planning and Budget Security Assessment requirements, have requirements that are more stringent than or have been interpreted to provide greater protection of patient privacy or the security or safeguarding of PHI than those of the HIPAA Privacy Rule.

12. No Third Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than the Parties and the respective successors or assigns of the Parties, any rights, remedies, obligations or liabilities whatsoever.

13. All other terms and conditions contained in the Contract and any amendment thereto, not amended by this Agreement, shall remain in full force and effect.

(Signatures on following page)

12 Governor’s Office of Planning and Budget Security Assessment

IN WITNESS WHEREOF, Contractor, through its authorized officer and agent, has caused this Agreement to be executed on its behalf as of the date indicated.

CONTRACTOR

BY: ___________________________________________________________

SIGNATURE DATE

TITLE*

* Must be President, Vice President, CEO or Other Officer Authorized to Execute on Behalf of and Bind the Entity to a Contract

13 Governor’s Office of Planning and Budget Security Assessment

ATTACHMENT X-1

List of Individuals Permitted to Receive, Use and Disclose “AGENCY NAME HERE” PHI

The following Position Titles, as employees and/or representatives of Contractor, need access to “AGENCY NAME HERE” Protected Health Information in order for Contractor to perform the services described in the Contract:

Transfers of PHI must comply with “AGENCY NAME HERE” Policy and Procedure 419: Appropriate Use of Information Technology Resources.

Approved methods of secure delivery of PHI between Contractor and “AGENCY NAME HERE”:

• Secure FTP file transfer (preferred)

• Encrypted email or email sent through “secure tunnel” approved by “AGENCY NAME HERE” Information Security Officer

• Email of encrypted document (password must be sent by telephone only)

• Encrypted portable media device and tracked delivery method

Contractor must update this list as needed and provide the updated form to “AGENCY NAME HERE”.

Use of “AGENCY NAME HERE” Protected Health Information by individuals who are not described on this Attachment X-1, as amended from time to time, is impermissible and a violation of the Agreement. Contractor must update this Attachment X-1 as needed and provide the updated form to “AGENCY NAME HERE”.

“AGENCY NAME HERE” Project Leader Contact Information: [INSERT HERE]

14 Governor’s Office of Planning and Budget Security Assessment

15 Governor’s Office of Planning and Budget Security Assessment

ATTACHMENT X-2

Part 1:

Please initial beside the correct option. Please select only one option.

_________ Contractor DOES NOT need any user accounts to access “AGENCY NAME HERE” Information Systems. Do not complete Part 2 of this form.

_________ Contractor DOES need user accounts to access “AGENCY NAME HERE” Information Systems. Please complete Part 2 of this form.

Part 2:

Please complete the table below if you indicated that Contractor DOES need any user accounts to access “AGENCY NAME HERE” Information Systems. Please attach additional pages if needed.

List of Individuals Authorized to Access an “AGENCY NAME HERE” Information System Containing PHI

The following individuals, as employees and/or representatives of Contractor, need access to “AGENCY NAME HERE” Information Systems containing “AGENCY NAME HERE” Protected Health Information in order for Contractor to perform the services described in the Contract:

Full Name Employer “AGENCY NAME HERE” Information System

Type of Access

(Read only? Write?)

16 Governor’s Office of Planning and Budget Security Assessment

The “AGENCY NAME HERE” Project Leader must submit a completed “AGENCY NAME HERE” Network Access Request Form for each individual listed above. Access will be granted and changed in accordance with “AGENCY NAME HERE” Policy and Procedure 435: Managing Authorization, Access and Control of Information Systems.

Contractor must notify the Project Leader identified in the Contract and the “AGENCY NAME HERE” Access Control Coordinator (“AGENCY NAME HERE”ois@”AGENCY NAME HERE”.ga.gov and helpdesk@”AGENCY NAME HERE”.ga.gov) immediately, but at least within 24 hours, after any individual on this list no longer needs the level of access described. Failure to provide this notification on time is a violation of the Agreement and will be reported as a security incident.

Contractor must update this Attachment X-2 as needed and provide the updated form to “AGENCY

NAME HERE”.

“AGENCY NAME HERE” Project Leader Contact Information: [INSERT HERE]

17 Governor’s Office of Planning and Budget Security Assessment