Attachment I - KRS Business Associate Agreement.pdf

ATTACHMENT I – KRS BUSINESS ASSOCIATE AGREEMENT

THIS BUSINESS ASSOCIATE AGREEMENT ("Agreement") is entered into on this _1st day of July, 2019 by and between Kentucky Retirement Systems on behalf of the group health plan(s) sponsored by Kentucky Retirement Systems (hereinafter referred to as "Covered Entity") and _________(hereinafter referred to as "Business Associate").

RECITALS

Covered Entity (or Sponsor on behalf of Covered Entity) has engaged Business Associate to provide certain functions, activities, and services (collectively "Services") to Covered Entity. In order for

Business Associate to perform the Services, Covered Entity will make available and/or transfer to Business

Associate certain Protected Health Information and Electronic Health Information (collectively, "PHI") that is confidential and must be afforded special treatment and protection pursuant to the Health Insurance

Portability and Accountability Act of 1996 ("HIPAA"), and its implementing regulations, the Standards for

Privacy of Individually Identifiable Health Information (the "Privacy Rule") and the Security Standards for

Protection of Electronic Health Information (the "Security Rule").

Business Associate will have access to and/or receive from Covered Entity certain PHI created or received by Covered Entity that can be used or disclosed only in accordance with this Agreement and the

Privacy Rule.

Covered Entity and Business Associate intend to protect the privacy and provide for the security of

PHI disclosed to Business Associate pursuant to this Agreement in compliance with HIPAA and the Privacy

Rule, the Security Rule, and other applicable laws.

As part of the Privacy Rule, Covered Entity must enter into a contract with Business Associate containing specific requirements as set forth in, but not limited to, Title 45, Sections 164.308(b), 164.314(a), 164.502(e) and 164.504(e) of the Code of Federal Regulations ("CFR") and contained in this Agreement, prior to the disclosure of PHI.

NOW, THEREFORE, Covered Entity and Business Associate agree as follows:

ARTICLE I.

Definitions

1.1. Meaning of Terms. The following terms shall have the meaning ascribed to them in this

Section:

(a) Breach shall have the meaning set forth at 45 CFR § 164.402, as amended, and generally means the unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of such information.

(b) Business Associate shall mean ______________.

(c) Covered Entity shall mean the Kentucky Retirement Systems.

(d) Designated Record Set shall mean a group of records maintained by or for Covered Entity that is: (a) the medical records and billing records about individuals maintained by or for a covered health care provider; (b) the enrollment, payment, claims adjudication, and case

- 2 -or medical management record systems maintained by or for a health plan; or (c) used in whole or in part, by or for Covered Entity to make decisions about Individuals. For these purposes, the term record means any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for Covered Entity.

(e) Electronic Health Information means Protected Health Information that is transmitted or maintained by or in electronic media, as defined by 45 CFR § 160.103.

(f) Health Plans shall mean the health plans that may be sponsored, from time to time, by

Sponsor for its eligible members and their eligible dependents to which Business Associate provides Services or to which Business Associate will provide Services during the term of this Agreement, and which are covered entities as defined by 45 CFR § 160.103.

(g) HHS shall mean the United States Department of Health and Human Services.

(h) HIPAA shall mean the Health Insurance Portability and Accountability Act of 1996, as amended or modified by HITECH or other applicable laws or regulations.

(i) HITECH shall mean the Health Information Technology for Economic and Clinical

Health Act of 2009, as amended.

(j) Individual shall mean the person who is the subject of the PHI, and shall have the same meaning as the term "individual" as defined in 45 CFR § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).

(k) Limited Data Set shall have the same meaning as the term "limited data set" in 45 CFR §

164.514(e)(2).

(l) Parties shall mean Business Associate and Covered Entity.

(m) Privacy Rule shall mean the Standards for Privacy of Individually Identifiable Health

Information at 45 CFR Parts 160 and 164, as amended or modified by HITECH or other applicable laws or regulations.

(n) Protected Health Information ("PHI") shall have the same meaning as the term

"protected health information" in 45 CFR § 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity.

(o) Required By Law shall have the same meaning as the term "required by law" in 45 CFR

§ 164.103.

(p) Secretary shall mean the Secretary of the Department of Health and Human Services

("HHS") or his or her designee.

(q) Security Incident shall have the same meaning as the term "security incident" in 45 CFR

§ 164.304, which generally means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

- 3 -

(r) Security Rule shall mean the Security Standards for Protecting Electronic Health

Information at 45 CFR Parts 160 and 164, as amended or modified by HITECH or other applicable laws or regulations.

(s) Sponsor shall mean Kentucky Retirement Systems.

(t) Transaction Standards shall mean the standards adopted by the Secretary under 45 CFR

Part 162.

(u) Unsecured Protected Health Information ("Unsecured PHI") shall have the meaning set forth at 45 CFR § 164.402, as amended, and generally means PHI that is not secured through the use of technologies and methodologies that render such PHI unusable, unreadable, or indecipherable to unauthorized individuals, as described by the Secretary in guidance.

1.2. Other Terms. Other capitalized terms shall have the meaning ascribed to them in the context in which they first appear. Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR Parts 160, 162, and 164. Any reference to a regulation or section in the Code of Federal Regulations ("CFR") shall include any corresponding regulation subsequently issued regardless of the date of issue.

ARTICLE II.

General Terms

2.1. Interpretation of Provisions. In the event of an inconsistency between the provisions of this Agreement and the mandatory terms of the Privacy Rule or the Security Rule (as they may be expressly amended from time to time by the HHS or as a result of final interpretations by HHS, an applicable court, or another applicable regulatory agency with authority over the Parties), the Privacy Rule or the Security

Rule, as applicable, shall prevail.

2.2. Provisions Permitted by Privacy Rule or Security Rule. Where provisions of this

Agreement are different from those mandated by the Privacy Rule or the Security Rule, but are nonetheless permitted by the Privacy Rule or the Security Rule, the provisions of the Agreement shall control.

ARTICLE III.

Obligations and Activities of Business Associate

3.1. Limits on Use and Disclosure. Business Associate agrees to not use or further disclose

PHI other than as permitted or required by this Agreement or as Required By Law. Further, Business

Associate shall use and disclose PHI in accordance with Covered Entity's Notice of Privacy Practices as provided by Covered Entity to Business Associate pursuant to Section 6.1.

3.2. Safeguards. Business Associate agrees to use reasonable and appropriate administrative, physical and technological safeguards to: (i) prevent use or disclosure of the PHI other than as provided for by this Agreement, and (ii) to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI that it creates, receives, maintains or transmits on behalf of Covered Entity as required by the Security Rule. Business Associate represents and warrants that it has implemented, and during the term of this Agreement shall maintain, comprehensive written privacy and security policies and procedures and the necessary administrative, technical and physical safeguards appropriate to the size and complexity of Business Associate's operations

- 4 -and the nature and scope of its activities. Business Associate will comply with the Security Rule requirements set forth in 45 CFR §§ 164.308, 164.310, 164.312, and 164.316, all of which are hereby incorporated into the Agreement.

3.3. Application of Privacy Provisions. Business Associate may use and disclose PHI that

Business Associate obtains or creates only if such use or disclosure is in compliance with each applicable requirement of 45 CFR § 164.504(e), relating to business associate agreements. The additional requirements of Subtitle D of HITECH (42 U.S.C. § 17921 et. seq.) that relate to privacy and that are made applicable with respect to Covered Entity shall also be applicable to Business Associate and are hereby incorporated into this Agreement.

3.4. Mitigation of Harm. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate, or any agent or subcontractor of Business Associate, in violation of the requirements of this Agreement, the

Privacy Rule, or the Security Rule.

3.5. Report of Improper Use or Disclosure or of Security Incidents. Business Associate agrees promptly to report to Covered Entity any actual or suspected breach of security, intrusion, or unauthorized use or disclosure of the PHI not provided for by this Agreement, or any Security Incident of which Business

Associate (or any of its agents or subcontractors) becomes aware. Such report shall be in writing and shall be reported to Covered Entity as soon as practicable after Business Associate becomes aware of such use or disclosure or Security Incident, but in no event more than forty-eight (48) hours following such date.

Business Associate shall take prompt corrective action to cure any such deficiencies and any action pertaining to such unauthorized disclosure required by applicable Federal and State laws and regulations.

3.6. Report of Breach of Unsecured PHI. In addition to the general obligations of Business

Associate under Section 3.5 regarding reporting the improper use or disclosure of PHI and Security

Incidents, Business Associate shall also promptly notify Covered Entity of a Breach of Unsecured PHI within forty-eight (48) hours of when Business Associate discovers such Breach. A Breach shall be treated as discovered by Business Associate as of the first day on which such Breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the Breach, who is an employee, officer, or other agent of Business Associate. Business Associate's notification shall be in writing and shall include identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been subject to the Breach. Business Associate shall include the following information in its notification of Breach to Covered Entity:

(a) A description of the Breach, including the date of the Breach and the date of the discovery of the Breach, if known;

(b) A description of the types of Unsecured PHI that were involved in the Breach (such as whether full name, social security number, date of birth, home address, account number, credit card numbers, diagnosis, disability code or other types of PHI were involved);

(c) Any steps that Individuals should take to protect themselves from potential harm resulting from the Breach;

(d) A description of what Business Associate is doing to investigate the Breach, to mitigate the harm to Individuals and to protect against further Breaches; and

(e) Contact procedures for Individuals to ask questions or learn additional information, which shall include a toll free telephone number, an e-mail address, Web site or postal address.

- 5 -

In the event that some of the above listed information is not known by Business Associate at the time of notification of Covered Entity of the Breach, Business Associate shall provide such information to

Covered Entity as soon as it becomes available to Business Associate, but in no event later than thirty (30) days after Business Associate discovers such Breach. Business Associate shall also provide such assistance and further information with regard to the Breach to Covered Entity as reasonably requested by Covered

Entity.

3.7. Agents and Subcontractors. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides PHI received from, or created or received by Business Associate on behalf of, Covered Entity, agrees in writing to the same restrictions and conditions that apply through this

Agreement to Business Associate with respect to PHI. Such written agreement shall also require the agent or subcontractor to implement reasonable and appropriate administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI that it creates, receives, maintains or transmits on behalf of Covered Entity.

3.8. Availability of Internal Practices, Books and Records. Business Associate shall make internal practices, books, and records relating to the use and disclosure of PHI received from, or received by Business Associate on behalf of, Covered Entity available to the Secretary or Covered Entity, in a time and manner designated by Covered Entity or the Secretary, for purposes of determining Covered Entity's compliance with the Privacy Rule or the Security Rule. Business Associate shall notify Covered Entity, in writing, of any request by the Secretary under this Section, and shall provide Covered Entity with a copy of any practices, books, and records that Business Associate provides to the Secretary concurrently with providing such materials to the Secretary.

3.9. Access to Records.

(a) Business Associate shall provide access, at the request of Covered Entity, and in the time and manner designated by Covered Entity, to PHI in a Designated Record Set to Covered

Entity or, as directed by Covered Entity, to an Individual, in order to meet the requirements under 45 CFR § 164.524 with regard to providing an Individual with a right to access the

Individual's PHI.

(b) Business Associate shall, at the request of Covered Entity and in the time and manner designated by Covered Entity, make PHI maintained by Business Associate available to

Covered Entity, or as directed by Covered Entity, to a person or entity other than an

Individual, for use and disclosure pursuant to a valid written authorization and maintain appropriate documentation for the period, including, but not limited to, copies of any written authorization by an Individual or his or her legal representative, to enable Covered

Entity to fulfill its obligations under the Privacy Rule, including, but not limited to, 45 CFR

§ 164.508.

(c) If any Individual requests access to, or the release pursuant to an authorization or otherwise of, PHI directly from Business Associate or its agents or subcontractors, Business

Associate shall notify Covered Entity in writing within three (3) days of the request.

Covered Entity shall have sole authority and responsibility to approve or deny such a request, and shall notify Business Associate, in writing, of its decision to approve or deny any such request.

3.10. Amendments to PHI. Business Associate agrees, in the time and manner designated by

Covered Entity, to make PHI contained in a Designated Record Set available for any amendments that

Covered Entity agrees to make pursuant to 45 CFR § 164.526 or to otherwise allow Covered Entity to

- 6 -comply with its obligations under 45 CFR § 164.526. If any Individual requests an amendment of PHI contained in a Designated Record Set directly from Business Associate or its agents or subcontractors, Business Associate shall notify Covered Entity in writing within three (3) days of the request. Covered

Entity shall have sole authority and responsibility to approve or deny such a request, and shall notify

Business Associate, in writing, of its decision to approve or deny any such request.

3.11. Documentation of Disclosures.

(a) Business Associate shall document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528. For each such disclosure, Business Associate shall document the following information: (i) the date of the disclosure; (ii) the name of the entity or person who received the PHI and, if known, the address of such entity or person; (iii) a brief description of the PHI disclosed; and (iv) a brief statement of the purpose of the disclosure that reasonably states the basis for the disclosure.

(b) Business Associate shall provide to Covered Entity or an Individual, in the time and manner designated by Covered Entity, information collected in accordance with subsection (a) of this Section of this Agreement, to permit Covered Entity to respond to a request by an

Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

In the event that a request for an accounting is delivered directly to Business Associate or its agent or subcontractor by an Individual or a party other than Covered Entity, Business

Associate shall within three (3) days of such request forward it to Covered Entity in writing.

Business Associate shall, unless otherwise directed by Covered Entity or as Required By

Law, supply an accounting of disclosures of PHI only to Covered Entity.

3.12. Disclosure of Minimum PHI. Business Associate agrees that it and its agents and subcontractors shall request, use and/or disclose, to the extent practicable, only the Limited Data Set of PHI necessary, or if needed, the minimum amount and content of PHI necessary, to meet the requirements of

Business Associate's obligations to Covered Entity. Upon issuance of guidance by the Secretary on what constitutes "minimum necessary" for purposes of 45 CFR § 164.502(b) (pursuant to 42 U.S.C. §

17935(b)(1)(B)), Business Associate agrees that it and its agents and subcontractors shall request, use and/or disclose only the "minimum necessary" PHI as described in such guidance.

3.13. Training. Business Associate shall provide appropriate training to its workforce in security, privacy, and confidentiality issues and regulations relating to PHI.

3.14. Response to Subpoena. Business Associate shall notify Covered Entity within forty-eight

(48) hours if it receives a subpoena or other legal process seeking the disclosure of PHI in order to allow

Covered Entity a reasonable amount of time to respond to the subpoena, object to the subpoena, or to otherwise intervene in the action to which the subpoena pertains.

3.15. Notification of Claims. Business Associate shall notify Covered Entity within forty-eight

(48) hours of notification or receipt of any civil or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions arising out of or related to this Agreement or the PHI, regardless of whether Covered Entity and/or Business Associate are named as parties in such claims, demands, causes of action, lawsuits, or enforcement actions.

3.16. Assistance in Litigation or Administrative Proceedings. Business Associate shall make itself and any subcontractors, employees or agents assisting Business Associate in the performance of its

- 7 -obligations under this Agreement, available to Covered Entity to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against Covered Entity, its directors, officers, or employees based upon a claimed violation of HIPAA, the Privacy Rule, the Security Rule, or other laws relating to security and privacy, except where Business Associate or its subcontractor, employee, or agent is named as an adverse party.

3.17. Recordkeeping and Document Retention. Business Associate shall retain any documentation it creates or receives relating to its duties under this Agreement for the duration of this

Agreement. Covered Entity shall have the right to reasonably access and copy and such documentation during the term of the Agreement. At the termination of this Agreement, Business Associate shall, at

Covered Entity's election, return or destroy all such documentation.

3.18. Transaction Standards. If Business Associate performs any transactions for Covered Entity for which a standard has been adopted by the Secretary under 45 CFR Part 162, the following shall apply:

(a) Business Associate, its agents and subcontractors, shall conduct all transmissions of data required under the Agreement that are subject to the Transaction Standards in compliance with the Transaction Standards, as they may be amended from time to time. With respect to any such Transactions, neither Party shall: (i) change the definition, data condition, or use of a data element or segment in a Transaction Standard; (ii) add any data elements or segments to the maximum defined data set; (iii) use any code or data elements that are either marked “not used” in the Transaction Standard’s implementation specification or are not in the Transaction Standard’s implementation specification(s); or (iv) change the meaning or intent of the Transaction Standard’s implementation specification(s).

(b) Each Party, at its own expense, shall provide and maintain the hardware, software, services and testing necessary to effectively and reliably conduct the applicable Transaction

Standards.

3.19. Restrictions on Remuneration, Marketing, and Fundraising. To the extent the Agreement would otherwise allow Business Associate to receive remuneration for PHI, Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI as prohibited by 42 U.S.C. § 17935(d).

To the extent that Business Associate is otherwise authorized under this Agreement to communicate about a product or service, it shall not make or cause to be made any communication about a product or service that is prohibited by 42 U.S.C. § 17936(a). To the extent that Business Associate is otherwise authorized under this Business Associate Agreement to make a fundraising communication, it shall not make or cause to be made any written fundraising communication that is prohibited by 42 U.S.C. § 17936(b).

ARTICLE IV.

Permitted Uses and Disclosures by Business Associate

4.1. Use or Disclosure to Perform Functions, Activities, or Services. Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI to perform the Services that

Business Associate performs for, or on behalf of, Covered Entity, provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity. Any such use or disclosure shall be limited to those reasons and those individuals as necessary to meet Business Associate's obligations.

4.2. Disclosures to Workforce. Business Associate shall not disclose PHI to any member of its workforce unless necessary to fulfill a purpose described in Section 4.1 and unless Business Associate has advised such person of Business Associate's obligations under this Agreement and of the consequences for such person and for Business Associate of violating this Agreement. Business Associate shall take

- 8 -appropriate disciplinary action against any member of its workforce who uses or discloses PHI in contravention of this Agreement or the Privacy Rule.

4.3. Appropriate Uses of PHI. Except as otherwise limited in this Agreement, Business

Associate may use PHI for the following purposes: (a) the proper management and administration of

Business Associate; (b) to carry out the legal responsibilities of Business Associate; or (c) to report violations of law to appropriate Federal and State authorities, consistent with 42 CFR § 164.502(j)(1).

4.4. Appropriate Disclosures of PHI; Confidentiality Assurances and Notification. Except as otherwise limited in this Agreement, Business Associate may disclose PHI to a third party to carry out the functions described in Section 4.1 or for the proper management and administration of Business Associate, or to carry out the legal responsibilities of Business Associate, provided that disclosures are Required By

Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

ARTICLE V.

Indemnification and Insurance

5.1. Indemnification. Business Associate shall indemnify and hold harmless Covered Entity and Sponsor against, and reimburse Covered Entity and Sponsor for, any expenses, losses, damages, legal fees, or costs arising out of or related to any civil or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions, whether brought by a third party or asserted by Business Associate, arising out of or related to Business Associate's actual or alleged acts and omissions (or those of its agents or subcontractors) associated with Business Associate's or its agents' or subcontractors' obligations under this Agreement or their use or disclosure of PHI. Such indemnification shall include, but not be limited to, the payment of all reasonable attorney fees associated with any claim, demand, action, cause of action, or lawsuit arising out of or related to such acts or omissions. In addition to the foregoing, in the event of a

Breach of Unsecured PHI or any other breach of personal information that would require notification to an

Individual under any other federal, state, or local law that arose out of or is related to Business Associate's actual or alleged acts and omissions (or those of its agents or subcontractors), Business Associate shall indemnify Covered Entity and Sponsor against, and reimburse Covered Entity and Sponsor for, all costs and expenses incurred by Covered Entity and Sponsor that are associated with complying with the notification requirements under 42 U.S.C. § 17932 or any other federal, state, or local law (and their respective implementing regulations and guidance). Such indemnification shall include, without limitation, all costs related to: notifying Covered Entity, Sponsor, Individuals, the U.S. Department of Health and

Human Services, or any other persons or entities under applicable law; any remediation necessitated by the

Breach or other breach; any fines or penalties arising out of the Breach or other breach; and any other actions required to be taken pursuant to 42 U.S.C. § 17932 or any other federal, state, or local law (and their respective implementing regulations and guidance).

5.2. Insurance. Business Associate shall obtain and maintain at its sole expense, and in amounts consistent with industry standards, insurance to support its obligations under Section 5.1. A certificate of insurance coverage shall be provided to Covered Entity or Sponsor upon request.

- 9 -

ARTICLE VI.

Obligations of Covered Entity

6.1. Notice of Privacy Practices. Covered Entity shall provide Business Associate with the notice of privacy practices that Covered Entity produces in accordance with 45 CFR § 164.520, as well as any changes to such notice.

6.2. Change or Revocation of Permission. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect Business Associate's permitted or required uses and disclosures. Business Associate shall comply with any such changes or revocations.

6.3. Restrictions on Use or Disclosure. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR §

164.522. Business Associate shall comply with any such restriction.

6.4. No Request to Use or Disclose in Impermissible Manner. Except as necessary for the management and administrative activities of Business Associate as allowed in Sections 4.3 and 4.4, Covered

Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by Covered Entity.

ARTICLE VII.

Term and Termination

7.1. Term. The Term of this Agreement shall be effective as of the date set forth above, and shall terminate when all PHI provided by Covered Entity to Business Associate, or received by Business

Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity.

7.2. Termination with Cause. Upon either Party's knowledge of a material breach by the other

Party, the non-breaching Party, in its discretion, may take either or both of the following actions:

(a) Provide an opportunity (in a time frame to be determined by the non-breaching Party) for the breaching Party to cure the breach or end the violation, and if the breaching Party does not cure the breach or end the violation, terminate this Agreement and any agreement related to the Services; or

(b) Immediately terminate this Agreement and any agreement related to the Services if the breaching Party, in the non-breaching Party's discretion, has breached a material term of this Agreement and cure is not possible.

If termination of this Agreement is not feasible, the non-breaching Party shall report the breach to the

Secretary.

7.3. Judicial or Administrative Proceedings. Either Party may terminate this Agreement and any other agreement or relationship between the Parties related to the Services by written notice to the other

Party, effective immediately, if: (a) the other Party is named as a defendant in a criminal proceeding for a violation of HIPAA, the Privacy Rule, the Security Rule, or other security or privacy laws; or (b) a finding or stipulation that the other Party has violated any standard or requirement of HIPAA, the Privacy Rule, the

Security Rule, or any other security or privacy laws is made in any administrative or civil proceeding in which the Party has been joined.

- 10 -

7.4. Changes in Law. In the event of passage of a law or promulgation of a regulation or an action or investigation by any regulatory body which would prohibit the relationship between the Parties, or the operations of either Party with regard to the subject of this Agreement, the Parties shall attempt in good faith to renegotiate the Agreement to delete the unlawful provision(s) so that the Agreement can continue. If the Parties are unable to renegotiate the Agreement within thirty (30) days, the Agreement and any other agreement or relationship between the Parties related to the Services shall terminate immediately, upon written notice of either Party.

7.5. Effect of Termination.

(a) Except as provided in paragraph (b) of this Section 7.5, upon termination of this Agreement for any reason, Business Associate shall return or destroy (at Covered Entity's election and in a time frame to be determined by Covered Entity) all PHI received from Covered Entity, or received by Business Associate on behalf of Covered Entity. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate. Business

Associate shall retain no copies of the PHI. If Business Associate is directed to destroy the

PHI, Business Associate shall certify in writing to Covered Entity that such PHI has been destroyed.

(b) In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to Covered Entity written notification of the conditions that make return or destruction infeasible. Upon Covered Entity's approval, which shall not be unreasonably withheld, Business Associate may retain the PHI, but shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as

Business Associate maintains such PHI.

ARTICLE VIII.

Miscellaneous

8.1. Assignment. This Agreement shall be binding upon and inure to the benefit of the respective legal successors of the Parties. Neither this Agreement nor any rights or obligations hereunder may be assigned, in whole or in part, without the prior written consent of the other Party.

8.2. Disclaimer. Covered Entity makes no warranty or representation that compliance by

Business Associate with this Agreement, HIPAA, the Privacy Rule, or the Security Rule will be adequate or satisfactory for Business Associate's own purposes. Business Associate is solely responsible for all decisions made by Business Associate regarding the safeguarding of PHI.

8.3. Property Rights. All PHI shall be and remain the exclusive property of Covered Entity.

Business Associate agrees that it acquires no title or rights to the PHI, including any de-identified information, as a result of this Agreement.

8.4. Preemption of Other Agreements and Liability Limitations/Exclusions. Any limitations on liabilities or exclusions from liability previously agreed upon by the Parties, whether written or oral, shall not be applicable to breaches of this Agreement, HIPAA, the Privacy Rule, the Security Rule, and other confidentiality and privacy requirements regarding PHI under this Agreement. To the extent that any provision of this Agreement conflicts with any other agreement between the Parties, whether written or oral, the provisions of this Agreement shall govern. Furthermore, and by way of example and not limitation, the termination provisions of this Agreement shall supersede the termination provisions of any other

- 11 -agreement, including, but not limited to, any limitations on terminating any other agreement (such as notice periods) or any provisions requiring a period to cure.

8.5. Right to Cure. Business Associate agrees that Covered Entity has the right, but not the obligation, to cure any and all breaches of Business Associate's privacy, security and confidentiality obligations under this Agreement. Any expenses or costs associated with Covered Entity's cure of Business

Associate's breach(es) shall be borne solely by Business Associate. The exercise by Covered Entity of its rights under this Section shall not act as a waiver of any remedies, whether at law or in equity, that Covered

Entity may seek against Business Associate for any breach by Business Associate of its privacy, security, and confidentiality obligations under this Agreement.

8.6. Injunctive Relief. Business Associate agrees that breach of the terms and conditions of this

Agreement shall cause irreparable harm and there exists no adequate remedy of law. Covered Entity retains all rights to seek injunctive relief to prevent or stop any breach of the terms of this Agreement, including, but not limited to the unauthorized use or disclosure of PHI by Business Associate or any agent, contractor or third party that received PHI from Business Associate. The exercise by Covered Entity of its rights under this Section shall not act as a waiver of any remedies, whether at law or in equity, that Covered Entity may seek against Business Associate for any breach by Business Associate of its privacy, security, and confidentiality obligations under this Agreement.

8.7. Survival. The respective rights and obligations of Business Associate under Sections 5.1, 5.2, and 7.5 of this Agreement shall survive the termination of this Agreement.

8.8. Amendment and Compliance with HITECH. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the Privacy Rule, the Security Rule, and HIPAA. The Parties acknowledge that federal agencies are in the process of developing regulations and guidance to implement HITECH. In the absence of such regulations and guidance, and notwithstanding any other provision of the Agreement, the parties agree to endeavor in good faith to comply with all requirements under HITECH, and to reevaluate provisions under this Agreement as necessary from time to time to comply with regulations and guidance issued in connection with HITECH. The Parties shall conform their actions under this Agreement to any such regulations or guidance upon the compliance date of such regulation or guidance, and shall promptly amend this Agreement to reflect any such regulations or guidance.

8.9. Regulatory References. A reference in this Agreement to a section in the Privacy Rule or the Security Rule means the section as in effect or as amended, and for which compliance is required.

8.10. Entire Agreement. This document, together with any written schedules, amendments and addenda, constitute the entire agreement of the Parties and supersedes all prior oral and written agreements or understandings between them with respect to the matters provided for herein.

8.11. Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the Commonwealth of Kentucky to the extent that the provisions of HIPAA, the Privacy Rule, or the Security Rule do not preempt the laws of the Commonwealth of Kentucky.

8.12. Modifications. Any modifications to this Agreement shall be valid only if made in writing and signed by a duly authorized agent of both Parties.

8.13. Notice. Any notice required or permitted to be given by either Party under this Agreement shall be sufficient if in writing and hand delivered (including delivery by courier) or sent by postage prepaid certified mail return receipt requested, as follows:

- 12 -

If to Covered Entity: If to Business Associate:

Kentucky Retirement Systems

Attention: ____________ Attention:

Perimeter Park West _____________________

1260 Louisville Road

Frankfort, KY 40601

8.14. Severability. The Parties agree that if a court determines, contrary to the intent of the

Parties, that any of the provisions or terms of this Agreement are unreasonable or contrary to public policy, or invalid or unenforceable for any reason in fact, law, or equity, such unenforceability or validity shall not affect the enforceability or validity of the remaining provisions and terms of this Agreement. Should any particular provision of this Agreement be held unreasonable or unenforceable for any reason, then such provision shall be given effect and enforced to the fullest extent that would be reasonable and enforceable.

8.15. Waiver of Breach. No failure or delay by either Party in exercising its rights under this

Agreement shall operate as a waiver of such rights, and no waiver of any breach shall constitute a waiver of any prior, concurrent, or subsequent breach.

8.16. Titles. Titles or headings are used in this Agreement for reference only and shall not have any effect on the construction or legal effect of this Agreement.

8.17. Independent Contractors. For purposes of this Agreement, Covered Entity and Business

Associate are and will act at all times as independent contractors. None of the provisions of this Agreement are intended to create, nor shall be deemed or construed to create, any relationship other than that of independent entities contracting with each other for the purpose of effecting this Agreement. None of the provisions of this Agreement shall establish or be deemed or construed to establish any partnership, agency, employment agreement or joint venture between the Parties.

8.18. No Third Party Beneficiaries. It is the intent of the Parties that this Agreement is to be effective only in regards to their rights and obligations with respect to each other. It is expressly not the intent of the Parties to create any independent rights in any third party or to make any third-party beneficiary of this Agreement and no privity of contract shall exist between third parties and each Party.

- 13 -

Each Party to this Agreement warrants that it has full power and authority to enter into this

Agreement, and the person signing this Agreement on behalf of either Party warrants that he/she has been duly authorized and empowered to enter into this Agreement.

KENTUCKY RETIREMENT SYSTEMS COMPANY/PERSON NAME HERE

By: By: ______________________________________

Title: Title: ____________________________________

Date: Date: ____________________________________