Business Associate Agreement - BAA~1.pdf

BUSINESS ASSOCIATE AGREEMENT

, (“Covered Entity”)

I. DEFINITIONS

Unless otherwise specified in this BAA, all capitalized terms used in this BAA not otherwise defined have the meanings ascribed by HIPAA and ARRA, as each may be amended from time to time.

A. “ARRA” means the Health Information Technology for Economic and Clinical Health Act provisions of the American Recovery and Reinvestment Act of 2009, Pub. Law No.111-5 and its implementing regulations.

B. “Breach” means the actual or reasonably suspected acquisition, access, Use or Disclosure of PHI in a manner not permitted by the Privacy Rule that compromises the security or privacy of the PHI.

C. “Breach Notice Rule” means the federal breach notification regulations issued pursuant to ARRA, as amended from time to time, 45 C.F.R. Parts 160 and 164.

D. “Compliance Date” means, in each case, the date by which compliance is required under the referenced provision of ARRA’s or HIPAA’s implementing regulations, as applicable.

E. “Discovery” means the first day on which Business Associate, or any workforce member, agent, or Subcontractor of Business Associate, knows, or, by exercising reasonable diligence would have known, of a Breach.

F. “Encrypt” means to use an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key, which process conforms to NIST Special Publications 800–111, 800–52, 800–77, or 800–113, as appropriate, or that is otherwise validated against the Federal Information Processing Standards (FIPS) 140–2.

G. “ePHI” means PHI as defined below, which is transmitted or maintained in electronic media.

H. “HIPAA” means the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations.

I. “PHI” means Protected Health Information, as defined in 45 C.F.R. § 160.103, limited to the Protected

Health Information received from, or received, created, or accessed on behalf of, Covered Entity.

J. “Privacy Rule” means the federal privacy regulations issued pursuant to HIPAA, as amended from time to time, 45 C.F.R. Parts 160 and 164.

K. “Security Incident” means the successful unauthorized access, Use, Disclosure, modification or destruction of ePHI or interference with system operations in an information system. Unsuccessful attempts to breach security, including pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as such incidents do not result in unauthorized access, use or disclosure of PHI, shall not be deemed Security Incidents. However, more than 20 unsuccessful attempts or other patterns of successive attempts, that are not individual deemed Security Incidents in themselves shall be considered Security Incidents due to the number or pattern of such events.

Agreement Action Attachment

Covered Entity and Business Associate agree that under entered into by Covered Entity and Business Associate (the “Agreement”), Business Associate provides services for or on behalf of Covered Entity that may involve access to PHI (as defined below) and that, as such, the parties agree as follows:

Arkansas Department of Human Services, and (“Business Associate”) enter into this Business Associate Agreement (“BAA”) as of (“Effective Date”).

DHS-4001 Rev. 4/2020

L. “Security Rule” means the federal security regulations issued pursuant to HIPAA, as amended from time to time, 45 C.F.R. Parts 160 and 164.

M. “Subcontractor” means Business Associate’s subcontractors and agents that create, receive, maintain or transmit PHI for the purpose of performing any of Business Associate’s obligations under the Agreement.

II. RESPONSIBILITIES OF BUSINESS ASSOCIATE.

A. Business Associate shall provide relevant training on HIPAA and the requirements of this agreement to all persons accessing PHI or ePHI. The training materials and records shall be provided to the covered entity upon request.

B. Business Associate shall implement and use appropriate Technical, Physical and Administrative Safeguards to reasonably and appropriately protect the Confidentiality, Integrity and Availability of PHI and to prevent Use or Disclosure of PHI, other than as permitted by this BAA.

C. Business Associate shall, within the earlier of the Compliance Date or 90-days from the Effective Date, comply with all applicable provisions of the Security Rule. The Business Associate shall conduct a risk assessment to evaluate compliance with the Security Rule and shall, at the request of the Covered Entity, provide a written attestation acknowledging completion and communicating the results of the risk assessment.

D. Business Associate shall Encrypt all transmissions of ePHI and all portable media or storage devices on which ePHI may be stored, including laptops, back-up media, CDs, or USB drives.

E. Within 30-days after receiving a written request from Covered Entity, make available information necessary for Covered Entity to make an accounting of disclosures of PHI about an Individual, as provided in 45 C.F.R. § 164.528; and in accordance with 42 U.S.C. § 17935(c) and its implementing regulations as of the Compliance Date, make that accounting directly to the Individual if directed to do so by Covered Entity.

F. At the request of Covered Entity and in the time, manner, and form designated by Covered Entity, not to exceed 15-days, provide access to PHI in a Designated Record Set to Covered Entity or, if directed by Covered Entity, to an Individual or to a recipient designated by the Individual, in accordance with the requirements of 45 C.F.R. § 164.524. Business Associate shall not charge Covered Entity or any Individual any fee associated with the production of PHI in accordance with this section that exceeds fees described at 45 C.F.R. § 164.524.

G. Make available PHI in a Designated Record Set, no more than 30-days following receipt of a written request by Covered Entity, PHI for amendment and incorporate any amendments to the PHI as directed by Covered Entity, all in accordance with 45 C.F.R. § 164.526.

H. Business Associate shall notify Covered Entity, in writing, no more than 3-days following Business Associate’s receipt directly from an Individual of any request for an accounting of disclosures or access to or amendment of PHI as contemplated in Sections II (D) (E) or (F), above.

I. Business Associate shall require each Subcontractor to agree, in writing, to the same restrictions and conditions that apply to Business Associate. Furthermore, to the extent that Business Associate provides ePHI to Subcontractor, Business Associate shall require Subcontractor to comply with all applicable provisions of the Security Rule upon the earlier of the Compliance Date or 90-days from the Effective Date. If Subcontractor is not subject to the jurisdiction or laws of the United States, or if any use or disclosure of PHI in performing the obligations under this BAA or the Agreement will be outside of the jurisdiction of the United States, Business Associate must require Subcontractor to agree by written contract with Business Associate to be subject to the jurisdiction of the Secretary, the laws, and the courts of the United States, and waive any available jurisdictional defenses that pertain to the parties’ obligations under this BAA, HIPAA, or ARRA.

Agreement Action Attachment

J. Business Associate shall not Use or Disclose PHI except as necessary to perform its obligations under the Agreement or as otherwise required by this BAA, provided that such Use or Disclosure is permitted by applicable law and complies with each applicable requirement of 45 C.F.R. § 164.504(e).

1. In compliance with 45 C.F.R. § 164.502(b)(1), as of its Compliance Date or no more than 90-days following the Effective Date, whichever is earlier, Business Associate shall request, Use, and Disclose only the minimum amount of PHI necessary to accomplish the purpose of the request, Use, or Disclosure.

2. Business Associate shall not use PHI to make or cause to be made any communication that would constitute Marketing.

K. Without unreasonable delay, and in any event, no more than 24-hours after Discovery, Business Associate shall notify Covered Entity of any Breach, Use or Disclosure of PHI not permitted under this BAA, or any Security Incident. Business Associate shall deliver the initial notification of such Breach, in writing, which must include a reasonably detailed description of the Breach and the steps Business Associate is taking and would propose to mitigate or terminate the Breach. Furthermore, Business Associate shall supplement the initial notification, no more than 5 calendar-days following Discovery, with information including the identification of each individual whose PHI was or is believed to have been involved; a reasonably detailed description of the types of PHI involved, and written updates every 5 calendar-days until the event has been concluded; all other information reasonably requested by Covered Entity, including all information necessary to enable Covered Entity to perform and document a risk assessment in accordance with 45 C.F.R. Part 164 subpart D; and all other information necessary for Covered Entity to provide notice to individuals, the U.S. Department of Health & Human Services (“HHS”), or the media, if required. Despite anything to the contrary in the preceding provisions, in Covered Entity’s sole and absolute discretion and in accordance with its directions, Business Associate shall conduct, or pay the costs of conducting, an investigation of any Breach and shall provide or pay the costs of providing any notices required by the Breach Notice Rule or other applicable law.

L. Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate that is not permitted by this BAA.

M. Business Associate shall make available to HHS its internal practices, books, and records, relating to the Use and Disclosure of PHI pursuant to the Agreement for purposes of determining Business Associate’s and Covered Entity’s compliance with the Privacy Rule.

N. Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI.

O. To the extent Business Associate is to carry out one or more of Covered Entity’s obligations under the

Privacy Rule, the Business Associate shall comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of such obligations.

P. Business Associate shall provide contact information for one primary person and one secondary person in Appendix A. Any changes in the contact information shall be forwarded to the Covered Entity.

Q. The Business Associate shall respond in writing within 10 business days to the Covered Entity’s request(s) to attest to the Business Associate’s compliance with the Privacy Rule, the Security Rule, and the Responsibilities of the Business Associate as specified in this BAA. The Business Associate shall make available to the Covered Entity its internal practices, books, and records, relating to the Use and Disclosure of PHI as necessary to substantiate the attestation of compliance.

III. RESPONSIBILITIES OF COVERED ENTITY

Covered Entity shall notify Business Associate, in writing, of an Individual’s request to restrict the Use or Disclosure of such Individual’s PHI, any limitations in Covered Entity’s Privacy Notice relevant to Business Associate’s performance of its obligations under this BAA or the Agreement, or any revocation by an Individual of authorization to Use or Disclose PHI.

Agreement Action Attachment

IV. TERM, TERMINATION AND DAMAGES

A. This BAA is effective as of the Effective Date and terminates when Business Associate and its Subcontractors no longer have access to PHI, and when all of the PHI in Business Associate’s possession, inclusive of PHI in the possession of Business Associate’s Subcontractors, has been returned or destroyed, unless earlier terminated in accordance with Sections IV(B) through (C) of this

BAA.

B. Upon Covered Entity’s determination of a breach of a material term of this BAA by Business Associate, Covered Entity may terminate this BAA. As of the Compliance Date of 45 C.F.R. § 164.504(e)(1)(iii), if either party knows of a pattern of activity or practice of the other party that constitutes a material breach or violation of this BAA, the non-breaching party will provide notice thereof to the other party.

Such notice must clearly specify the nature of the breach or violation. Each party must take reasonable steps to cure the breach or end the violation. If after 30-days or such longer time specified in writing by the non-breaching party, the non-breaching party reasonably determines that such steps are unsuccessful in curing the breach or ending the violation, the non-breaching party may terminate this BAA and the Agreement, if feasible. In the event that termination is not feasible, the non-breaching party shall report the problem to HHS.

C. Except as provided below, Business Associate shall return or destroy all PHI, including all PHI in possession of its Subcontractors, immediately following the termination or expiration of this BAA.

However, in the event that Business Associate is legally obligated to retain such PHI, Business Associate may do so provided that:

1. Business Associate notifies Covered Entity of such legal obligation, in writing, immediately upon

Business Associate’s notice of such legal obligation, which such writing must describe in detail the legal obligation;

2. Business Associate extends all protections, limitations, and restrictions contained in this BAA to Business Associate’s Use or Disclosures of any PHI retained after termination or expiration of this

BAA;

3. Business Associate limits any further Use or Disclosures solely to satisfying such legal obligation for which it has provided Covered Entity with written notice in accordance with Section IV(C)(1), above.

4. Business Associate returns or destroys all PHI when such legal obligation has been fulfilled or has concluded.

D. In addition to any damages recoverable under this BAA, the parties acknowledge that certain breaches or violations of this BAA may result in litigation or investigations pursued by federal or state governmental authorities of the United States resulting in civil liability or criminal penalties. Each party shall cooperate in good faith in all respects with the other party in connection with any request by a federal or state governmental authority for additional information and documents or any governmental investigation, complaint, action, or other inquiry.

V. INDEMNIFICATION

Business Associate shall indemnify Covered Entity, its owners, employees and representatives in the event Business Associate’s performance or failure to perform under this BAA has given rise to liabilities, costs, damages, and losses (including attorneys’ fees) reasonably and properly incurred by Covered Entity in connection with any actual, threatened, or pending, civil, criminal, or administrative cause of action, claim, inquiry, investigation, lawsuit, or other proceeding (collectively a “Claim”). Upon demand by Covered Entity, Business Associate shall defend any Claim brought or threatened against Covered Entity, at Business Associate’s expense, by counsel acceptable to Covered Entity. Business Associate shall not authorize or enter into any settlement without Covered Entity’s written consent.

Agreement Action Attachment

VI. GENERAL TERMS

A. This BAA amends and is made a part of the Agreement. Any changes or modification to this BAA must be in writing and signed by both parties.

B. To the extent not clear, the terms of this BAA are to be construed to allow for compliance by the parties with HIPAA or ARRA. If any provision of the BAA is in conflict with any provision of the Agreement, the conflicting provision of this BAA prevails to the extent necessary for the parties to comply with HIPAA and ARRA.

C. Nothing in this BAA confers upon any person other than the parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities, whatsoever.

D. Sections II(G)(H)(J)(M) and Sections IV, V, VI(E)(F) survive the termination for any reason or expiration of this BAA.

E. In the event Business Associate receives a notification from or on behalf of HHS regarding a compliance review, an audit, or an investigation or inquiry of any kind pertaining to the services provided under the Agreement or Covered Entity, it will notify Covered Entity no more than 3-days following its receipt of that notice.

F. The law of the State of Arkansas without regard to its internal law on the conflict of laws, controls this BAA. The Business Associate consents and submits to the jurisdiction of the federal and/or state courts of Arkansas, and hereby waives any defense based upon venue, inconvenience of forum, or lack of personal jurisdiction in any action or suit brought in connection with or relating to this BAA or related matters. The Business Associate will bring any action or suit concerning this Agreement or related matters in federal or state court or the Arkansas Claims Commission with appropriate subject matter jurisdiction in Little Rock, Arkansas. The Business Associate acknowledges that it has read and understands this clause and agrees willingly to these terms.

G. The parties may execute this BAA in a number of counterparts and each counterpart signature, when taken with the other counterpart signatures, is treated as if executed upon one original of this BAA. A facsimile or pdf signature, or a scanned image of an original signature, of any party to this BAA is binding upon that party as if it were an original.

Agreement Action Attachment

Signed:

BUSINESS ASSOCIATE:

Signed:

Title:

Date:

COVERED ENTITY

Signed:

Title:

Date:

Appendix A: Business Associate Contact Information

Business Associate Primary Contact:

Name:

Title:

Address:

City:

State:

Phone:

Fax:

Email:

Business Associate Secondary Contact:

Name:

Title:

Address:

City:

State:

Phone:

Fax:

Email:

Agreement Action Attachment