EQRO BUSINESS ASSOCIATE AGREEMENT.docx

BUSINESS ASSOCIATE AGREEMENT

THE DIVISION OF MEDICAID

IN THE OFFICE OF THE GOVERNOR OF THE STATE OF MISSISSIPPI

THIS BUSINESS ASSOCIATE AGREEMENT (“Agreement”) is entered into by and between the DIVISION OF MEDICAID IN THE OFFICE OF THE GOVERNOR, an administrative agency of the STATE OF MISSISSIPPI (hereinafter “DOM”), and VENDOR NAME (hereinafter “Business Associate”) , hereinafter collectively referred to as the Parties, and modifies any other prior existing agreement for this purpose. In consideration of the mutual promises below and the exchange of information pursuant to this Agreement and in order to comply with all legal requirements for the protection of this information, the Parties therefore agree as follows:

I. RECITALS

a. DOM is a state agency that acts both as an employer and as a Health Plan for public benefit.

b. Pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”) of 1996 (as amended by the Genetic Information Nondiscrimination Act (“GINA”) of 2008 and the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”), Title XIII of Division A, and Title IV of Division B of the American Recovery and Reinvestment Act (“ARRA”) of 2009) and its implementing regulations, including 45 C.F.R. Parts 160 and 164, Subparts A and E (“Privacy Rule”), and Subparts A and C (“Security Rule”):

i. DOM, as a Covered Entity, enters into this Agreement to obtain satisfactory assurances that Business Associate will comply with and appropriately safeguard all Protected Health Information (“PHI”) created, received, maintained, or transmitted by Business Associate from or on behalf of DOM, and

ii. Certain provisions of HIPAA and its implementing regulations apply to Business Associate in the same manner as they apply to DOM and such provisions are incorporated into this Agreement.

c. DOM desires to engage Business Associate to perform the following functions, activities, or services to, for, or on behalf of DOM involving the Disclosure of PHI by DOM to Business Associate, and/or the creation, receipt, maintenance, or transmission of PHI by Business Associate, and Business Associate desires to perform such functions, activities, or services:

The selected External Quality Review Organization (EQRO) will be responsible for analyzing and evaluating aggregated data concerning the quality, timeliness, and accessibility of services covered under Medicaid and CHIP, as delivered by Managed Care Organizations (MCOs).

d. This Agreement shall apply solely to the work described in Paragraph (c).

II. DEFINITIONS

All terms defined in 45 CFR Parts 160 and 164 shall have the meanings as therein defined. Additionally, the terms listed below will have the following meanings:

a. Affiliate: Any entity that controls, is controlled by, or is under common control with the Business Associate as well an any entity that is a subsidiary of an entity that controls the Business Associate.

b. Business Associate: Includes all workforce members, representatives, agents, successors, heirs, and permitted assigns of Business Associate.

c. ePHI: Electronic Protected Health Information.

d. Incident: With respect to PHI in Business Associate’s custody or control, (i) any successful Security Incident, (ii) Breach of Unsecured PHI, or (iii) any loss, destruction, alteration, or other event in which PHI cannot be account for. Unless otherwise required by applicable laws, Successful Security Incidents shall not include pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service, and any combination of the above, so long as no such incident results in or is related to unauthorized Access, Use, or Disclosure of PHI.

e. Secretary: Secretary of the Department of Health and Human Services or his/her designee.

All other terms not defined herein shall have their plain and ordinary meaning.

III. OBLIGATIONS OF BUSINESS ASSOCIATE

a. Business Associate agrees to not Use or Disclose PHI other than as required to perform the services described in Article I(c) herein or as Required by Law.

b. Business Associate shall use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI (ePHI) to prevent Use or Disclosure of PHI other than as provided for by this Agreement.

c. Business Associate agrees to notify DOM without unreasonable delay and no later than seventy-two (72) hours after discovery, of any Use or Disclosure of PHI not provided for by this Agreement of which it becomes aware, and any Security Incident of which it becomes aware.

d. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in Violation of the requirements of this Agreement and take prompt steps to prevent the recurrence of any Incident, including any action required by applicable federal and state laws and regulations.

e. Business Associate agrees to notify DOM without unreasonable delay, and no later than seventy-two (72) hours after discovery of any actual or suspected Breach of Unsecured PHI, all in accordance with 45 C.F.R. § 164.410. The notification shall include, to the extent possible and subsequently as the information becomes available, the identification of all Individuals whose Unsecured PHI is reasonably believed by Business Associate to have been Breached along with any other available information that is required to be included in the notification to the Individual, HHS, and/or the media, all in accordance with the data Breach notification requirements set forth in 45 C.F.R.§ 164.410.

f. Once an actual or suspected Breach is reported to DOM, Business Associate agrees to provide a written assessment to determine whether the incident is reportable within ten (10) working days. An impermissible Use or Disclosure of protected health information is presumed to be a Breach unless the DOM or Business Associate, as applicable, demonstrates there is a low probability the PHI has been compromised or one of the exceptions to the definition of Breach applies, all in accordance with 45 C.F.R. § 164.410.

g. Business Associate agrees to fully cooperate, coordinate with, and assist DOM in gathering information necessary to notify the affected individuals and government agencies following an Incident to ensure that any notices sent in connection with the Incident are, subject to 45 C.F.R. §164.412, sent without unreasonable delay, and in no case more than 60 days after discovery of the Incident, and perform such notifications if so required by DOM in its sole discretion.

h. Business Associate agrees to be solely responsible for all costs and expenses incurred as a result of an Incident, including costs associated with mitigation of the Incident and preparation and delivery of notices to affected individuals and government agencies.

i. Business Associate agrees to promptly notify DOM upon notification or receipt of any administrative, civil, or criminal claims, demands, causes of action, lawsuits, or governmental enforcement actions (“Actions”) arising out of or related to this Agreement or PHI, or relating to Business Associate’s conduct or status as a business associate for DOM, regardless of whether DOM and/or Business Associate are named as parties to such Actions.

j. In accordance with 45 C.F.R. §§ 164.502(e)(1)(ii) and 164.308(b)(2), Business Associate agrees to ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information.

k. Business Associate agrees to take any action necessary to allow DOM to appropriately provide an Individual a Designated Record Set as defined by 45 CFR § 164.524; make any amendments to PHI as DOM directs or agrees to pursuant to 45 CFR § 164.526; document such Disclosures of PHI and information related to such Disclosures as would be required for DOM to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 CFR § 164.528 and to provide DOM such documentation upon return or destruction of all DOM PHI governed by this Agreement.

l. Business Associate agrees that it shall only use or disclose the minimum PHI necessary to perform functions, activities, or services for, or on behalf of, DOM as specified in Article I(c). Business Associate agrees to comply with any guidance issued by the Secretary on what constitutes “minimum necessary” for purposes of the Privacy Rule, and any minimum necessary policies and procedures communicated to Business Associate by DOM.

m. Business Associate agrees that to the extent that Business Associate carries out DOM’s obligations under the Privacy Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to DOM in the performance of such obligation.

n. Business Associate agrees to make internal practices, books, and records, including policies and procedures, available to the Secretary for purposes of determining Business Associate’s and/or DOM's compliance with the Privacy Rule pursuant to 45 C.F.R. § 160.310.

o. Business Associate agrees that nothing in this Agreement shall permit Business Associate to access, store, share, maintain, transmit or use or disclose PHI in any form via any medium with any third party, including Business Associate’s Subcontractors, beyond the boundaries and jurisdiction of the United States without express written authorization from DOM.

IV. PERMITTED USES BY BUSINESS ASSOCIATE

a. Business Associate may only Use or Disclose PHI to perform functions, activities, or services for, or on behalf of, DOM as specified Article 1(c), provided that such Use or Disclosure would not violate what is required by Law or the Privacy Rule if done by DOM.

b. If Business Associate must disclose PHI pursuant to law or legal process, Business Associate shall notify DOM without unreasonable delay and at least five (5) days in advance of any disclosure so that DOM may take appropriate steps to address the disclosure, if needed.

V. OBLIGATIONS OF DOM

a. DOM shall provide, via its external website at www.medicaid.ms.gov, Business Associate with the Notice of Privacy Practices that DOM produces in accordance with 45 C.F.R. § 164.520.

b. To the extent it may affect Business Associate’s Use or Disclosure of PHI, DOM shall notify Business Associate of any limitation(s) in its Notice of Privacy Practices, any changes to permission by an Individual to use or disclose PHI, and/or any restriction to the use or disclosure of PHI that DOM has agreed to in accordance with 45 C.F.R. § 164.522.

c. DOM shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by DOM.

VI. TERM AND TERMINATION

a. The effective date of this Agreement is the first day that Business Associate is provided, or has access to, PHI relating to the purposes described in Article (I)(c). This Agreement shall terminate when all of the PHI provided by DOM to Business Associate, or created or received by Business Associate on behalf of DOM, is destroyed or returned to DOM.

b. Upon completion of the services described in Article I(c), Business Associate shall return or destroy all remaining PHI received from, or created or received by Business Associate on behalf of, DOM in accordance with Privacy and Security Rule guidelines. This provision shall apply to PHI that is in the possession of Subcontractors or agents of Business Associate. Business Associate shall retain no copies of the PHI. Business Associate shall certify the return and/or destruction/sanitization of the PHI in writing within 5 business days of completion of the services.

VII. MISCELLANEOUS

a. The Parties agree to take such action as is necessary to amend this Agreement as is necessary to effectively comply with any subsequent changes or clarifications of statutes, regulations, or rules related to this Agreement. The Parties further agree to take such action as is necessary to comply with the requirements of HIPAA, its implementing regulations, and other applicable law relating to the security and privacy of PHI.

b. Any ambiguity in this Agreement shall be resolved to permit DOM to comply with HIPAA, its implementing regulations, and all other applicable law relating to the security and privacy of PHI.

c. To the fullest extent allowed by law, Business Associate shall indemnify, defend, save and hold harmless, protect, and exonerate DOM, its employees, agents, and representatives, and the State of Mississippi from and against all claims, demands, liabilities, suits, actions, damages, losses, and costs of every kind and nature whatsoever including, without limitation, court costs, investigative fees and expenses, and attorney’s fees, arising out of or caused by Business Associate and/or its partners, principals, agents, and employees in the performance of or failure to perform this Agreement. In DOM’s sole discretion, Business Associate may be allowed to control the defense of any such claim, suit, etc. In the event Business Associate defends said claim, suit, etc., Business Associate shall use legal counsel acceptable to DOM. Business Associate shall be solely responsible for all costs and/or expenses associated with such defense, and DOM shall be entitled to participate in said defense. Business Associate shall not settle any claim, suit, etc. without DOM’s concurrence, which DOM shall not unreasonably withhold.

d. DOM makes no warranty or representation that compliance by Business Associate with this Agreement, HIPAA, its implementing regulations, or other applicable law will be adequate or satisfactory for Business Associate’s own purposes or that any information in Business Associate’s possession or control, or transmitted or received by Business Associate, is or will be secure from unauthorized Use or Disclosure. Business Associate is solely responsible for all decisions made by Business Associate regarding the safeguarding of PHI.

e. Any notice from one party to the other under this Agreement shall be in writing and may be either hand delivered, delivered by Certified United States Postal Service Mail, Return Receipt Requested, postage fully prepaid, or by other carrier that requires signature upon receipt addressed to each party at the addresses which follow or addresses the Parties may hereinafter designate in writing. The party providing notice shall also provide a copy of any notice under this section via email with return receipt requested to the email address in the signature block below. Any such notice shall be deemed to have been given as of the date the original is transmitted.

FOR DIVISION OF MEDICAID:

DOM Privacy Officer Mississippi Division of Medicaid Post Office Box 2222 Jackson, Mississippi 39225 privacyofficer@medicaid.ms.gov contracts@medicaid.ms.gov

FOR BUSINESS ASSOCIATE:

f. It is understood and agreed by the Parties hereto that if any part, term, or provision of this Agreement is by the courts or other judicial body held to be illegal or in conflict with any law, the validity of the remaining portions or provisions shall not be affected and the obligations of the parties shall be construed in full force as if the Agreement did not contain that particular part, term, or provision held to be invalid.

g. This Agreement shall be construed broadly to implement and comply with the requirements relating to HIPAA and its implementing regulations. All other aspects of this Agreement shall be governed by and construed in accordance with the laws of the State of Mississippi, excluding its conflicts of laws provisions.

h. This Agreement contains the entire agreement between the Parties for the purposes of Article I(a) and supersedes all prior discussions, instructions, directions, understandings, negotiations, agreements, and services for like services.

i. Business Associate shall make itself and any workforce members, contractors, subcontractors, representatives, agents, affiliates, or subsidiaries assisting Business Associate in the fulfillment of its obligations under this Agreement, available to DOM, at no cost to DOM, to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against DOM, its directors, officers, or any other workforce member based upon claimed Violation of HIPAA, its implementing regulations, or other applicable law, except where Business Associate or its workforce members, contractors, subcontractors, representatives, agents, affiliates, or subsidiaries are a named adverse party.

j. Business Associate agrees that any violation of the terms and conditions of this Agreement shall cause irreparable harm for which there exists no adequate remedy at law. In addition to any other remedies available to DOM at law or in equity, DOM shall be entitled to an injunction or other decree of specific performance with respect to any violation of this Agreement or explicit threat thereof, without the necessity of demonstrating actual damages.

k. No failure to exercise and no delay in exercising any right, remedy, or power hereunder shall operate as a waiver thereof, nor shall any single or partial exercise of any right, remedy, or power hereunder preclude any other or further exercise thereof or the exercise of any other right, remedy, or power provide herein or by law or in equity.

IN WITNESS WHEREOF, the Parties hereto have duly executed this Business Associate Agreement to be effective on the date provided for in Article (VI)(a) of this Agreement.

MISSISSIPPI DIVISION OF MEDICAID VENDOR NAME

Vendor Name External Quality Review Organization (EQRO) Business Associate Agreement image1.jpg image2.jpeg