DLI Business Associate Addendum HIPAA 09.24.2026.docx

BUSINESS ASSOCIATE AGREEMENT

This business associate agreement is between the ______________________ , with its principle offices located at ___________, and ___________________ , with its principal offices located at _______.

The parties intend to protect the privacy and security of protected health information to which the Business Associate may have access in order to provide goods or services to or on behalf of Covered Entity, in accordance with the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Pub. L. No. 111-5 (Feb. 17, 2009) and related regulations, the HIPAA Privacy Rule (Privacy Rule), 45 C.F.R. Parts 160 and 164, as amended, the HIPAA Security Rule (Security Rule), 45 C.F.R. Parts 160, 162 and 164, ), as amended, 42 C.F.R. §§ 431.301-431.302, 42 C.F.R. Part 2, 45 C.F.R. § 205.50, 42 U.S.C. § 602(a)(1)(A)(iv), 42 U.S.C. § 1396a(a)(7), 35 P.S. § 7607, 50 Pa.C.S. § 7111, 71 P.S. § 1690.108(c), 62 P.S. § 404, 55 Pa. Code Chapter 105, 55 Pa. Code Chapter 5100, the Pennsylvania Breach of Personal Information Notification Act, 73 P.S. § 2301 et seq., and other relevant laws, including subsequently adopted provisions applicable to the use and disclosure of confidential information, and applicable federal agency guidance.

Business Associate may receive PHI from Covered Entity, or may create or obtain PHI from other parties, for use on behalf of Covered Entity. The Business Associate may use, access, and disclose the PHI only in accordance with this agreement and the standards established by standards established by HIPAA, the HITECH Act and related regulations, and other applicable laws and federal agency guidance.

The parties, intending to be legally bound, agree as follows:

1. Definitions. For the purposes of this agreement, the following terms have the following meanings:

“Business Associate” has the meaning set forth in HIPAA, the HITECH Act, applicable regulations, and federal agency guidance and, when used in this agreement is referring to [insert the name of the vendor here].

“Covered Entity” has the meaning set forth in HIPAA, the HITECH Act and applicable regulations and federal agency guidance and, when used in this agreement is referring to [insert the name of the agency here].

“HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191.

“HITECH Act” means the Health Information Technology for Economic and Clinical Health Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Pub. L. No. 111-5 (Feb. 17, 2009).

“PHI” has the meaning set forth in HIPAA, the HITECH Act, and related regulations and federal agency guidance. PHI also includes any information that can be used to identify a current or former applicant or recipient of benefits or services of Covered Entity (or Covered Entity’s contractors or business associates).

“Privacy Rule” means the standards for privacy of individually identifiable health information set forth in 45 C.F.R. Parts 160 and 164, as amended, and related federal agency guidance.

“Security Rule” means the security standards set forth in 45 C.F.R. Parts 160, 162, and 164, as amended, and related federal agency guidance.

“Unsecured PHI” means PHI that is not secured through the use of a technology or methodology as specified in HITECH regulations and federal agency guidance or as otherwise defined in the HITECH Act.

2. Changes in Law. The Business Associate shall timely comply with any changes in HIPAA and other applicable requirements and shall provide the Covered Entity with written certification of compliance with these changes.

3. Permitted Use and Disclosure of PHI. The Business Associate may use, access, or disclose PHI provided by, or obtained on behalf of, the Covered Entity solely for the purpose of providing goods or services under its contract with Covered Entity and only to the extent minimally necessary to provide those goods or services.

4. Business Associate Obligations.

a. Appropriate Safeguards. The Business Associate shall establish and maintain appropriate safeguards to prevent any use, access, or disclosure of PHI other than as provided for by this agreement. Appropriate safeguards must include implementing administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic PHI that is created, received, maintained, or transmitted on behalf of the Covered Entity and limiting use, access, and disclosure to applicable minimum necessary requirements as set forth in applicable federal and state statutory requirements, regulatory requirements, and federal agency guidance.

b. Training and Guidance. The Business Associate shall:

i. provide annual training to its relevant employees, contractors, and subcontractors on how to prevent the improper use, access, or disclosure of PHI; and

ii. comply with annual guidance on the most effective and appropriate administrative, physical, and technical safeguards as required by HIPAA, other applicable law, and as issued by the Secretary of Health and Human Services.

c. Reports of Improper Use or Disclosure. The Business Associate shall report to the Commonwealth of Pennsylvania, Governor’s Office of Administration, Office of Information Technology at OA-SecurityIncidents@pa.gov or 1-877-552-7478, within two days of discovery any use or disclosure of PHI not provided for or allowed by this agreement.

d. Reports of Security Incidents.

i. Reporting Requirements. In addition to the breach notification requirements set forth in section 13402 of the HITECH Act and related regulations, federal agency guidance, and other applicable federal and state laws, the Business Associate shall report to the Office of Administration, Office of Information Technology at OA-SecurityIncidents@pa.gov or 1-877-552-7478, within two days of discovery any security incident of which it becomes aware. An improper use or disclosure or breach will be treated as discovered by the Business Associate on the first day on which it is known to the Business Associate (including any person, other than the individual committing the breach, that is an employee, officer, or other agent of the Business Associate) or should reasonably have been known to the Business Associate to have occurred.

ii. Training Requirements. If any of the Business Associate’s employees, agents, subcontractors, and representatives use or disclose PHI received from, or created or received on behalf of, Covered Entity, or any derivative de-identified information in a manner not provided for in this agreement, the Business Associate shall ensure that the employees, agents, subcontractors, and business representatives receive training on Business Associate’s HIPAA requirements, or be sanctioned or prevented from accessing any PHI Business Associate receives from, or creates or receives on behalf of Covered Entity. Continued use of PHI in a manner contrary to the terms of this agreement will constitute a material breach of the agreement.

e. Breach Notifications. At the sole expense of the Business Associate, the Business Associate shall comply with all federal and state breach notification requirements, including those applicable to the Business Associate and those applicable to the Covered Entity. The Business Associate shall indemnify the Covered Entity for costs associated with any incident involving the acquisition, access, use, or disclosure of PHI in a manner not permitted under federal or state law and federal agency guidance.

f. Subcontractors and Agents. When PHI is provided or made available to the Business Associate’s subcontractors or agents, the Business Associate shall provide only the minimum necessary PHI required for the purpose of the covered transaction and shall first enter into a subcontract or contract with the subcontractor or agent that contains the same terms, conditions, and restrictions on the use and disclosure of PHI as contained in this agreement.

g. Right of Access To PHI. The Business Associate shall allow an individual who is the subject of PHI maintained in a designated record set, to have access to and copy that individual’s PHI within five business days of receiving a written request from the Covered Entity. The Business Associate shall provide PHI in the format requested by the individual, if it is readily producible in the form and format; or if not, in a readable hard copy form or the other form and format as agreed to by the Business Associate and the individual. If the request is for information maintained electronically in one or more designated record sets and if the individual requests an electronic copy of the information, the Business Associate shall provide the individual with access to the PHI in the electronic form and format requested by the individual, if it is readily producible in the form and format; or, if not, in a readable electronic form and format as agreed to by the Business Associate and the individual. If an individual requests access to PHI from the Business Associate, or its agents or subcontractors, the Business Associate shall notify the Covered Entity within five business days. The Business Associate shall further conform with all of the requirements of 45 C.F.R. § 164.524 and other applicable laws, including the HITECH Act and related regulations, and federal agency guidance.

h. Amendment and Incorporation of Amendments. Within five business days of receiving a request from the Covered Entity for an amendment to PHI maintained in a designated record set, the Business Associate shall make the PHI available and incorporate the requested amendment to enable the Covered Entity to comply with 45 C.F.R. §164.526, applicable federal and state law, including the HITECH Act and related regulations, and federal agency guidance. If an individual requests an amendment from the Business Associate or its agents or subcontractors, the Business Associate shall notify the Covered Entity within five business days of the Business Associate’s receipt of the request.

i. Provide Accounting of Disclosures. The Business Associate shall maintain a record of all disclosures of PHI in accordance with 45 C.F.R. § 164.528 and other applicable laws and federal agency guidance, including the HITECH Act and related regulations. For each disclosure, the records must include the date of the disclosure, the name and address of the recipient of the PHI, a description of the PHI disclosed, the name of the individual who is the subject of the PHI disclosed, and the purpose of the disclosure. The Business Associate shall make the record available to the individual or the Covered Entity within five business days of a request for an accounting of disclosures.

j. Requests for Restriction. The Business Associate shall comply with requests for restrictions on disclosures of PHI about an individual if the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for treatment purposes), and the PHI pertains solely to a health care item or service for which the service involved was paid in full out-of-pocket. For other requests for restriction, the Business Associate shall comply with the Security Rule and the Privacy Rule and other applicable statutory and regulatory requirements and federal agency guidance.

k. Access to Books and Records. The Business Associate shall make its internal practices, books, and records relating to the use or disclosure of PHI received from, or created, or received by Business Associate on behalf of the Covered Entity, available to the Covered Entity and the Secretary of Health and Human Services or designee for purposes of determining compliance with applicable laws and federal agency guidance.

l. Return or Destruction of PHI. Upon the termination or expiration of the [contract for goods or services between the parties], the Business Associate shall return or destroy all PHI provided by or obtained on behalf of Covered Entity. The Business Associate shall not retain any copies of the PHI after termination or expiration of this agreement. If return or destruction of the PHI is not feasible, the Business Associate shall extend the protections of this agreement to limit any further use or disclosure until the PHI may be returned or destroyed. If the Business Associate elects to destroy the PHI, the Business Associate shall certify to the Covered Entity that the PHI has been destroyed.

m. Maintenance of PHI. Despite section 4(l) of this agreement, the Business Associate shall retain, and require its and its subcontractors or agents to retain, all PHI throughout the term of the [contract for goods or services between the parties] and this agreement and shall continue to maintain, and require its and its subcontractors or agents to maintain, the information required under section 4(k) for a period of six years after termination or expiration of the [contract for goods or services], unless the parties agree otherwise.

n. Mitigation Procedures. The Business Associate shall establish and, upon the Covered Entity’s request, provide to the Covered Entity procedures for mitigating, to the maximum extent practicable, any harmful effect from the use or disclosure of PHI in a manner contrary to this agreement, the Security Rule, or the Privacy Rule. The Business Associate shall mitigate any harmful effect that is known to the Business Associate of a use or disclosure of PHI in violation of this agreement or applicable laws and federal agency guidance.

o. Sanction Procedures. The Business Associate shall develop and implement a system of sanctions for any of its employee, subcontractor, or agent who violates the provisions of this agreement, the applicable laws, the Security Rule, the Privacy Rule, or federal agency guidance.

p. Grounds for Breach. Non-compliance by the Business Associate with this agreement, the Security Rule, or the Privacy Rule is a breach of the [contract for goods or services between the parties], for which the Commonwealth may terminate this agreement.

q. Termination by Commonwealth. The Commonwealth may terminate the [contract for goods or services between the parties], if the Commonwealth determines, in its sole discretion, that the Business Associate has violated a material term of this agreement.

r. Failure to Perform Obligations. If the Business Associate fails to perform its obligations under this agreement, the Covered Entity may:

i. immediately discontinue providing PHI to Business Associate; and

ii. require the Business Associate to submit and adhere to a plan of compliance, including monitoring by the Covered Entity and reporting by Business Associate, as the Covered Entity in its sole discretion determines to be necessary to maintain compliance with this agreement, applicable laws, and federal agency guidance.

s. Privacy Practices. The Business Associate shall immediately begin using any applicable form, including, but not limited to, any form used for Notice of Privacy Practices, Accounting for Disclosures, or Authorization, provided by the Covered Entity upon the effective date designated by the Covered Entity. The Covered Entity may change the applicable privacy practices, documents, and forms by providing notice to the Business Associate. The Business Associate shall implement the changes as soon as practicable, but not later than 45 days from the date of notice of the change. The Business Associate shall otherwise comply with all applicable laws and federal agency guidance pertaining to notices of privacy practices, including the requirements set forth in 45 C.F.R. § 164.520.

t. Indemnification. The Business Associate shall indemnify the Covered Entity against all claims and actions, whether in law or equity, resulting from the Business Associate’s Breach or other violation of the Security Rule or Privacy Rule. Additionally, the Business Associate shall reimburse the Covered Entity for any civil monetary penalties imposed on the Covered Entity as a result of the Business Associate’s Breach or other violation of the Security Rule and the Privacy Rule.

5. Covered Entity Obligations.

A. Provision of Notice of Privacy Practices. The Covered Entity shall provide to the Business Associate notice of privacy practices that the Covered Entity produces in accordance with applicable law and federal agency guidance, as well as any changes to the notice. The Covered Entity shall post any material changes to its notice of privacy practices on its website by the effective date of the material change.

B. Permissions. The Covered Entity shall provide to the Business Associate notice of any changes in, or revocation of, permission by an individual to use or disclose the individual’s PHI of which the Covered Entity is aware, if the changes affect the Business Associate’s permitted or required uses and disclosures.

C. Restrictions. The Covered Entity shall notify the Business Associate of any restriction to the use or disclosure of PHI that the Covered Entity has agreed to in accordance with 45 C.F.R. § 164.522, other applicable laws, and applicable federal agency guidance, to the extent that the restriction may affect the Business Associate’s use or disclosure of PHI.

[REMAINDER OF PAGE INTENTIONALLY LEFT BLANK.]

The parties, through their authorized representatives, have signed this agreement on the dates indicated below.

[INSERT NAME OF BUSINESS ASSOCIATE]

Signature Date

Printed Name

Title

COMMONWEALTH OF PENNSYLVANIA

[INSERT DEPARTMENT/AGENCY NAME]

[Agency Head/Designee Title] Date

APPROVED AS TO FORM AND LEGALITY:

Office of Chief Counsel Date

Office of General Counsel Date

Office of Attorney General Date