Exhibit O

BUSINESS ASSOCIATE AGREEMENT

BETWEEN

THE SOUTH DAKOTA STATE EMPLOYEE HEALTH PLAN

AND _______

This Business Associate Agreement (“Agreement”), made and entered into as of the _________, by and between _________________ (“Business Associate”) and the South Dakota State Employee Health Plan administered by the South Dakota Bureau of Human Resources and Administration (the “Covered Entity” or the “State”) (each a “Party” and collectively the “Parties”), and is made a part of that certain service agreement(s) (the “Service Agreement”) pursuant to which Business Associate provides a service or services to Covered Entity that involves the use and/or disclosure of Covered Entity’s Protected Health Information (“PHI”).

NOW, THEREFORE, for good and valuable consideration, the sufficiency of which we hereby acknowledge, the Parties agree as follows:

I. DEFINITIONS:

II. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE

In order that Covered Entity and Business Associate may achieve and maintain compliance with the requirements of HIPAA, Business Associate agrees to:

C. In accordance with 45 CFR §164.502 (e) (1) (ii) and 164.308 (b) (2), ensure that any subcontractors that create, receive, maintain or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions and requirements that apply to the Business Associate with respect to such information.

D. Report to the designated Privacy Official of the Covered Entity any use or disclosure of PHI by Business Associate not provided for by this Agreement of which it becomes aware, including any Breach of Unsecured or Secured PHI as required at 45 CFR§164.410, and any Security Incident involving electronic PHI of which it becomes aware within twelve (12) hours of receiving knowledge of such Use, Disclosure, Breach or Security Incident.

1. Business Associate shall provide the following information to Covered Entity within ten (10) business days of discovery of a breach except when despite all reasonable efforts by Business Associate to obtain the information required, the parties agree that circumstances beyond the control of the Business Associate necessitate additional time. Under such circumstances Business Associate shall provide to Covered Entity the following information as soon as possible and without unreasonable delay, but in no event later than twenty (20) calendar days from the date of discovery of a breach:

a. The date of the breach;

b. The date of the discovery of the breach;

c. A description of the types of unsecured PHI that were involved;

d. Identification of each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed; and

e. Any other details necessary to complete a risk assessment under the presumption of breach standard.

2. Covered Entity will be responsible to provide notification to individuals whose unsecured PHI has been disclosed, as well as the Secretary and the media, as required by Sec. 13402 of the HITECH Act, 42 U.S.C.A. § 17932.

3. Business Associate shall be liable for costs of any associated mitigation if caused by the Business Associate’s acts or omissions, or the acts or omissions of Business Associate’s agents, officers, employees or subcontractors if Covered Entity determines that the breach is significant enough to warrant such measures.

4. Business Associate agrees to establish procedures to investigate the breach, mitigate losses, and protect against any future breaches, and to provide a description of these procedures and the specific findings of the investigation to Covered Entity in the time and manner reasonably requested by Covered Entity and actions taken or that will be taken to mitigate the losses.

E. Limit its uses and disclosures of, and Individual requests for, PHI (a) when practical, to the information making up a Limited Data Set; and (b) in all other cases subject to the requirements of 45 CFR §164.502 (c), to the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure or Individual request as necessary to satisfy Covered Entity’s obligations under 45 CFR §164.524.

F. Make available PHI in a designated record set to the Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 CFR § 164.524.

G. Upon reasonable notice and prior written request, to make available during normal business hours at Business Associate’s offices all records, books, agreements, internal practices, policies and procedures relating to the use or disclosure of PHI to the Secretary, in a time and manner designated by the Secretary, for purposes of determining the Covered Entity’s compliance with the laws and Regulations, subject to the U.S. Department of Health and Human Services attorney-client and other applicable legal privileges. Business Associate will give to Covered Entity a copy of the documents given to the Secretary.

M. Warrants they have taken specific measures with respect to electronic data security measures. Agrees, if requested by Covered Entity, to allow Covered Entity to inspect and/or audit Business Associate’s business, including internal practices, books and records, at mutually agreeable times, during normal business hours, and for up to fifteen (15) business days per year, and not more often than twice per calendar year if not for cause, to verify what electronic data security measures the Business Associate has taken.

III. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATES

A. Business Associate may only use or disclose PHI as necessary to perform the services set forth in the Service Agreement and to otherwise meet its obligations under this Agreement. All other uses and disclosure by Business Associate not authorized by this Agreement or by specific instruction of Covered Entity are prohibited.

B. The Business Associate is authorized to use PHI if the Business Associate de-identifies the information in accordance with 45 CFR § 164.514(a)-(c). De-identified information does not constitute PHI and is not subject to the terms of this Agreement.

C. Business Associate agrees to make uses and disclosures and requests for PHI consistent with the applicable privacy and security rules.

D. Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR §164 if done by Covered Entity except for the specific uses and disclosures set forth in E. and F.

E. Business Associate may use or disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of the Business Associate as required by law. Business Associate agrees to review and understand the HIPAA Rules as it applies to Business Associate, and to comply with the applicable requirements of the HIPAA Rules, as well as any applicable amendments.

F. Business Associate may provide Data Aggregation services relating to the Health Care Operations of the Covered Entity.

IV. OBLIGATIONS AND ACTIVITIES OF COVERED ENTITY

A. Covered Entity shall notify Business Associate of any limitation(s) in the notice of privacy practices of Covered Entity under 45 CFR § 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

B. Covered Entity shall notify Business Associate of any changes in, or revocation of, the permission by an Individual to use or disclose his or her PHI, to the extent that such changes may affect Business Associate's use and disclosure of PHI.

C. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR §164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

V. PERMISSIBLE REQUESTS BY COVERED ENTITY

Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR § 164.

VI. TERM AND TERMINATION:

A. Term. This Agreement shall become effective on _______ and shall terminate on the expiration of the Service Agreement, or if the Service Agreement is renewed upon the expiration of any Service Agreement renewal(s), or on the date Covered Entity terminates for cause as authorized in paragraph B. of this Section, whichever is sooner.

B. Termination for Cause. Either Party may immediately terminate upon written notice this Agreement and the Service Agreement(s) if such Party makes the determination that the other Party has breached a material term of this Agreement. Alternatively, the terminating Party may choose to provide the other Party with ten (10) days written notice of the existence of an alleged material breach and an opportunity to cure the breach.

C. Obligations of Business Associate Upon Termination. Upon termination of this Agreement for any reason, Business Associate, with respect to PHI received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, shall:

1. Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

2. Return to Covered Entity or destroy the remaining PHI that the Business Associate still maintains in any form. In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall extend the protections of this agreement to such PHI and limit further Uses and Disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI;

3. Ensure the destruction of PHI created, received, or maintained by Subcontractors;

4. Continue to use appropriate safeguards and comply with Subpart C of 45 CFR § 164 with respect to electronic PHI to prevent use or disclosure of the PHI;

5. Not use or disclose the PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set out at Section III. under “Permitted Uses and Disclosures By Business Associate” which applied prior to termination; and

6. Return to Covered Entity or destroy the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

D. Survival. The obligations of Business Associate under the Section shall survive the termination of this Agreement.

VII. MISCELLANEOUS:

A. Indemnification. Business Associate agrees to indemnify and hold the Covered Entity, its officers, agents, and employees, harmless from and against any and all actions, suits, damages, liability, or other proceedings which may arise as the result of performing services hereunder. This section does not require the Business Associate to be responsible for or defend against claims or damages arising solely from the errors or omissions of the Covered Entity, its officers, agents, or employees; or from the errors or omissions of third parties that are not officers, employees or agents of the Business Associate, unless such errors or omissions resulted from the acts or omissions of the Business Associate. Nothing in this Agreement is intended to impair the insurance coverage of the Business Associate or any subrogation rights of the Business Associate’s insurers.

B. Amendments. This Agreement may not be modified, nor shall any provision hereof be waived or amended, except in a writing duly signed by authorized representatives of the Parties. The parties agree to take such action as is necessary to amend this Agreement periodically as is necessary to achieve and maintain compliance with the requirements of the HIPAA Rules and any other applicable law.

C. Regulatory References. Any reference herein to a federal regulatory section within the Code of Federal Regulations shall be a reference to such section as it may be subsequently updated, amended, or modified.

D. Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA rules.

E. Conflicts. In the event of a conflict in or between the terms of this Business Associate Agreement and the Agreement to which is attached, the terms of this Business Associate Agreement shall prevail to the extent such an interpretation ensures compliance with the HIPAA Rules.

F. Notices. Any notices hereunder shall be in writing and addressed as follows:

If to the Business Associate:

If to the Covered Entity:

Remainder of Page Left Blank Intentionally

In Witness Whereof, the parties signify their agreement by the signatures affixed below.

FOR BUSINESS ASSOCIATE – ___________

FOR COVERED ENTITY – South Dakota Bureau of Human Resources and Administration

Darin Seeley Commissioner South Dakota Bureau of Human Resources and Administration

Legal ______________________

State of South Dakota and _____ Agreement