CGS_FLITS_Attachment_15_Business_Associate_Agreement__HIPPA_.pdf

Request for Proposal

Solicitation No. BPM005633

Foreign Language Interpretation and Translation Services

Arizona Department of Administration

State Procurement Office 100 N 15th Avenue Phoenix, AZ 85007

Attachment 15

Business Associates Addendum (HIPAA)

This Business Associates Agreement is in effect for those State entities that are HIPAA Covered Components. The “State” HIPAA Covered Component entities are:

1. Arizona Health Care Cost Containment System (AHCCCS)

2. Arizona Department of Economic Security (ADES)

3. Arizona Department of Child Safety (ADCS)

4. Arizona Department of Health Services (ADHS)

5. Arizona Department of Administration Benefits section

6. Arizona Veterans Home

For good and valuable consideration, the State and Business Associate agree to be bound to the terms and conditions of this BAA.

STATE and Business Associate agree that the underlying Contract shall comply with the Administrative Simplification requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as set forth in Title 45, Parts 160 and 164 of the Code of Federal Regulations (the "CFR"), as amended. In the event of conflicting terms or conditions, this Addendum shall supersede the underlying Contract.

The State will only consider this BAA to be fully executed if it is signed without any modifications.

1. DEFINITIONS

The following terms used in this Addendum shall have the same meaning as those terms in the HIPAA rules set forth in Title 45, Parts 160 and 164 of the CFR: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE

Business Associate agrees to:

2.1 Not use or disclose protected health information (“PHI”) other than as permitted or required by this Addendum or as required by law;

2.2 Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of protected health information other than as provided for by this Addendum;

2.3 Report to STATE any use or disclosure of PHI not provided for by this Addendum of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR §164.410, and any security incident of which it becomes aware in the following manner;

2.3.1 Reporting. Business Associate shall report to STATE any use or disclosure of PHI that is not authorized by the Contract, by law, or in writing by STATE. Business Associate shall make an initial report to the STATE not more than twenty-four (24) hours after Business Associate learns of such unauthorized use or disclosure. The initial report shall include all of the following information to the extent known to the Business Associate at the time of the initial report:

Foreign Language Interpretation and Translation Services

Arizona Department of Administration

State Procurement Office

a. A description of the nature of the unauthorized use or disclosure, including the number of individuals affected by the unauthorized use or disclosure;

b. A description of the PHI used or disclosed;

c. The date(s) on which the unauthorized use or disclosure occurred;

d. The date(s) on which the unauthorized use or disclosure was discovered;

e. Identify the person(s) who used or disclosed the PHI in an unauthorized manner;

f. Identify the person(s) who received PHI disclosed in an unauthorized manner;

g. A description of actions, efforts, or plans undertaken by the Business associate to mitigate the harm of the unauthorized disclosure;

h. A description of corrective actions undertaken or planned to prevent future similar unauthorized use or disclosure;

i. An assessment of whether a breach, as defined in 45 CFR 164.402, has occurred, including, if necessary, an assessment of the probability of harm, and

j. Such other information, as may be reasonably requested by the STATE Privacy

Official.

2.3.2 Business Associate shall provide STATE with supplemental reports promptly as new information becomes available, as assessments and action plans are developed, and as action plans are implemented. In any event, Business Associate shall provide a comprehensive written report including all of the information listed above no later than thirty (30) days after discovery of the unauthorized use or disclosure.

2.3.3 Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business

Associate in violation of the requirements of the Contract.

2.3.4 Sanctions. Business Associate shall have and apply appropriate sanctions against any employee, subcontractor or agent who uses or discloses STATE PHI in violation of this

Addendum or applicable law.

2.4 In accordance with 45 CFR §164.502(e)(1)(ii) and §164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions and requirements that apply to the Business Associate with respect to such information;

2.5 Make available PHI in a designated record set to STATE as necessary to satisfy STATE’ obligations under 45 CFR §164.524;

2.6 Make any amendment(s) to PHI in a designated record set as directed or agreed to by STATE pursuant to 45 CFR §164.526, or take other measures as necessary to satisfy STATE’ obligations under 45 CFR §164.526;

2.7 Maintain and make available the information required to provide an Accounting of Disclosures to

STATE as necessary to satisfy STATE’ obligations under 45 CFR §164.528;

2.8 To the extent Business Associate is to carry out one or more of STATE’ obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to STATE in the performance of such obligation(s); and

2.9 Make its internal practices, books and records available to STATE and the Secretary for purposes of determining compliance with the HIPAA rules within ten (10) business days of a written request by

STATE.

Foreign Language Interpretation and Translation Services

Arizona Department of Administration

State Procurement Office

3. PERMITTED USES AND DISLOSURES BY BUSINESS ASSOCIATE

3.1 Business Associate may only use or disclose PHI as necessary to perform the services and obligations set forth in the underlying Contract;

3.2 Business Associate may use or disclose protected health information as required by law;

3.3 Business Associate agrees to make uses and disclosures and requests for protected health information consistent with minimum necessary requirements;

3.4 Business Associate may not use or disclose protected health information in a manner that would violate Subpart E of 45 CFR Part 164 if done by STATE, except for the specific uses and disclosures set forth below in (3.5 and 3.6);

3.5 Business Associate may use protected health information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business

Associate; and

3.6 Business Associate may provide data aggregation services relating to the health care operations of

STATE.

4. PROVISIONS FOR STATE TO INFORM BUSINESS ASSOCIATE OF PRIVACY PRACTICES AND

RESTRICTIONS

4.1 STATE shall notify Business Associate of any limitation(s) in the STATE Notice of Privacy Practices under 45 CFR §164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI;

4.2 STATE shall notify Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose his or her PHI, to the extent that such changes may affect Business

Associate’s use or disclosure of PHI; and

4.3 STATE shall notify Business Associate of any restriction on the use or disclosure of PHI that STATE has agreed to or is required to abide by under 45 CFR 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

5. TERM AND TERMINATION

5.1 Term: This Addendum is effective upon the effective date of the underlying Contract and shall terminate on the date STATE terminates the contract for cause as authorized in Section 5.2, or for any other reason permitted under the contract, whichever is sooner.

5.2 Termination for Cause: Business Associate authorizes termination of the Contract by STATE if

STATE determines that Business Associate has breached a material term of this Addendum and

Business Associate has not cured the breach or ended the violation within the time specified by

STATE.

5.3 Obligations of Business Associate Upon Termination: Upon termination, cancellation, expiration or other conclusion of the Contract, Business Associate, with respect to PHI received from STATE, or created, maintained, or received by Business Associate on behalf of STATE, shall:

Foreign Language Interpretation and Translation Services

Arizona Department of Administration

State Procurement Office

5.3.1 Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

5.3.2 Destroy or return to STATE all remaining PHI that the Business Associate still maintains in any form;

5.3.3 Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part

164 with respect to electronic PHI to prevent use or disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate retains the PHI;

5.3.4 Not use or disclose the PHI retained by Business Associate other than for the purposes for which such protected health information was retained and subject to the same conditions set out in this Addendum that applied prior to termination; and

5.3.5 Destroy or return to STATE the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal and contractual responsibilities.

5.4 Survival: The obligations of Business Associate under this Section shall survive the termination of the Contract.

6. INDEMNIFICATION AND MISCELLANEOUS

6.1 Indemnification: Business Associate shall indemnify, hold harmless and defend STATE from and against any and all claims, losses, liabilities, costs, civil and criminal penalties, and other expenses resulting from, or relating to, the acts or omissions of Business Associate, its employees, agents, and sub-contractors in connection with the representations, duties and obligations of Business Associate under this Addendum. The parties’ respective rights and obligations under this Section shall survive termination of the Contract.

6.2 Complete Agreement: If the Business Associate is not awarded a Contract at the end of the

Solicitation process (BPM001416), this BAA shall constitute the entire agreement of the State and Business Associate with respect to the State data given to Business Associate during the

Solicitation process. The State and Business Associate have not made any representations, warranties, inducements, or oral agreements except as expressly set forth herein. Business

Associate and the State may not change, modify, or rescind this BAA except in writing, signed by Contractor and the Procurement Officer.

6.3 Exclusive Remedy: This BAA shall be the exclusive source of remedy for any claim arising out of the subject matter of this BAA.

6.4 Successors: This BAA shall be binding upon, and inure to the benefit of, any successors and assigns of the State and Business Associate.

6.5 Regulatory References: A reference in this Addendum to a section in the HIPAA rules means the section as in effect or as amended.

6.6 Amendment: The parties agree to take such action as is necessary to amend this Addendum from time to time as is necessary for compliance with the requirements of the HIPAA rules or any other applicable law.

Foreign Language Interpretation and Translation Services

Arizona Department of Administration

State Procurement Office

6.7 Interpretation: Any ambiguity in this Addendum shall be interpreted to permit compliance with the HIPAA rules.

6.8 Governing Law: This Addendum and any action related thereto shall be governed by and interpreted under the laws of the State of Arizona. The parties expressly consent to the jurisdiction and venue of the state and federal courts of Phoenix, Arizona for any action arising from or related to this Addendum.

Business Associate hereby acknowledges receipt and acceptance of this HIPAA Business Associate Agreement and that a signed copy must be filed with the Procurement Office.

10/20/2023

Signature Date

Preston Eagleheart

Printed Name

______Managing Director______________________ Title

Cayuse Government Service, LLC

Name of Contractor / Vendor

The above referenced HIPAA Business Associate Agreement is hereby executed this __________ day of _______________ 2022 by the Department of Administration, on behalf of the State of Arizona Benefit Options Health Care Plans subject to HIPAA Privacy and Security.

Statewide Procurement Manager

Printed Name