ESBD_397356_1740042019924_Draft Contract.docx

Teacher Retirement System of Texas Contract Signature Page

This Contract is entered into effective on the date of last signature below or [Insert month, date, and year] , whichever comes later (the “Effective Date”), by and between the Teacher Retirement System of Texas (TRS), with the principal place of business at 1000 Red River Street, Austin, Texas 78701 and [Insert Contractor Name] (Contractor) with a principal place of business at [Insert Address, City, State, Zip Code]. TRS and Contractor are referred to collectively as “Parties” and each, “Party.” Comment by Bledsoe, Jacob: Note for Contractor: TRS will complete the highlighted sections throughout this document once a vendor selection has been made.

TRS Contract Number: [Insert Contract Number]

TRS Contract Name: [Insert Contract Name]

The Contract Not to Exceed Amount: $[Insert Not to Exceed Amount] This amount is for the Initial Term of the Contract. TRS does not guarantee a minimum contract amount. TRS may increase the “Contract Not to Exceed Amount” through an amendment when exercising Renewal Options.

The Effective Date: the date of the latest signature below or January 1, 2026, whichever comes later.

The Expiration Date: December 31, 2029

Renewal Option(s): No renewal options

Description of Work: Pension and Healthcare Actuarial Services

Teacher Retirement System of Texas

(TRS)

<<Vendor Name>>> (Contractor)

By:

By:

Date:

Date:

Vendor ID Number:

Procurement and Contracts Representative:

Printed Name:

Public Certification(s):

Date:

Contract Documents List

Contract Documents List

The entire Contract between TRS and the Contractor consists of the Contract Documents listed on this page. In the event of any conflict or contradiction between or among the documents attached to or otherwise incorporated into this Contract, the following order of precedence will govern this Contract in the following order:

1. Contract Signature Page

2. Contract Documents List

3. Business Associate Agreement (BAA)

4. TRS General Terms and Conditions

5. Scope of Work

6. Notices, Representatives, and Records Location

7. List of Key Personnel

8. Approved Price Form

9. Insurance Requirements

10. Contractor’s Insurance Certificate (incorporated by reference)

11. Historically Underutilized Business (HUB) Requirements

12. HSP Progress Assessment Report Form

13. Approved HUB Subcontracting Plan (HSP) and HUB Progress Assessment Report (PAR) Form (incorporated by reference)

14. Code of Ethics for Contractors (Incorporated by Reference)

15. Sample Release of Claims Form to be returned with final invoice

16. HIPAA Compliance – Supplemental Assessment (incorporated by reference)

17. Third-Party Assessment Form or current SOC2 Type II Report (incorporated by reference)

18. Confidentiality Policy

19. Confidential Information Procedures and Standards

20. BAA Certification Regarding TRS Personal Health Information

21. Contractor’s Best and Final Offer (incorporated by reference)

22. Solicitation number TRS000552 posted on Month Day, Year and related addenda (incorporated by reference)

23. Contractor’s Response to Solicitation (incorporated by reference)

Business Associate Agreement (BAA)

The Teacher Retirement System of Texas (“TRS”) is a Covered Entity under the terms of the Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act of 2009, and its corresponding regulations and ex-regulatory guidance (“HIPAA”).

According to 45 C.F.R. § 164.502(e), a Covered Entity may only disclose protected health information (“PHI”) to a Business Associate and may allow a Business Associate to create, receive, maintain, or transmit PHI on its behalf if the Covered Entity obtains satisfactory assurances that the Business Associate will appropriately safeguard the PHI, and those reasonable assurances are documented through a written contract that meets the requirements of 45 C.F.R. § 164.504(e).

The contractor will have access to PHI from TRS, and therefore, will be a “Business Associate” of TRS. Accordingly, the Business Associate must execute TRS’ HIPAA-compliant Business Associate Agreement (“BAA”).

HIPAA BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“BAA”), under the Health Insurance Portability and Accountability Act of 1996, Public Law No. 104-191, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), Public Law No. 111-5, and the regulations and ex-regulatory guidance issued thereunder (together hereinafter referred to as “HIPAA”), is effective on ____________, 20______ (the “Effective Date”), by and between the Teacher Retirement System of Texas (“TRS” or “Covered Entity”) and _______________________ (“Business Associate”), regarding Business Associate’s obligations as a business associate of TRS for purposes of complying with HIPAA. TRS and the Business Associate are referred to collectively as “Parties” and individually as “Party.”

RECITALS

TRS is a covered entity as such term is defined under HIPAA, and is acting in its capacity as trustee of the TRS Pension Trust System under Chapters 821-825 of the Texas Government Code (hereinafter the “System”), the Texas Public School Retired Employees Group Benefits Program under Chapter 1575 of the Texas Insurance Code, and the Texas School Employees Uniform Group Health Coverage Program under Chapter 1579 of the Texas Insurance Code (together hereinafter referred to as the “Programs”);

TRS and Business Associate have entered into TRS Contract No. ______________________________ (the “Agreement”) under which Business Associate contracted to provide certain functions, activities, or services to TRS, and in the continued performance of these Services, may access, create, receive, maintain, retain, modify, record, store, transmit, destroy, or otherwise hold, Use, Disclose, or have access to Protected Health Information (“PHI”) from or on behalf of TRS;

The Parties agree that this BAA shall be attached to the Agreement and incorporated therein for all purposes as if restated in full;

This BAA is intended to ensure that Business Associate will establish and implement appropriate safeguards, including certain physical, administrative, and technical security requirements, for the PHI the Business Associate and all of its agents, contractors, and Subcontractors that create or receive PHI in connection with the Services may access, create, receive, maintain, retain, modify, record, store, transmit, destroy, or otherwise hold, Use, Disclose, or have access to PHI in connection with the Services; and

The Parties agree that this BAA shall apply to all Services provided by the Business Associate under the Agreement for as long as such Agreement is effective, including any extensions and renewals thereunder.

Therefore, in consideration of the Parties' continuing obligations under the Agreement, in compliance with HIPAA, and for other good and valuable consideration, the sufficiency of which is hereby acknowledged, the Parties agree to the provisions of this BAA to address the obligations imposed by HIPAA upon each Party and to protect the interests of the Parties.

The recitals set forth hereinabove are true and correct in all respects and are incorporated into this BAA by reference fully as if set forth herein.

I. DEFINITIONS

The following terms used in this BAA shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclose or Disclosure, Health Care Operations, Minimum Necessary, Notice of Privacy Practices, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured PHI, and Use. Terms used but not otherwise defined in this BAA shall have the same meaning as those terms in the HIPAA Rules.

A. Artificial Intelligence. “Artificial Intelligence” means a machine-based system that for a given set of human-defined objectives, can make predictions, recommendations, or decisions influencing real or virtual environments.

B. Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 C.F.R. § 160.103, and in reference to this BAA, shall mean the Party referenced in this document as the Business Associate. If Business Associate provides its Services through agents, contractors, or Subcontractors which access, create, receive, maintain, retain, modify, record, store, transmit, destroy, or otherwise hold, Use, Disclose, or have access to Covered Entity’s PHI in connection with the Services, the term Business Associate will also include such agents, contractors, or Subcontractors.

C. Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 C.F.R. § 160.103, and in reference to the Party to this BAA, shall mean the System, the Programs, and the Teacher Retirement System of Texas, acting in its capacity as trustee of the System and Programs.

D. HHS. “HHS” shall mean United States Department of Health and Human Services.

E. HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160, 162, and 164.

F. HITECH. “HITECH” shall mean the Health Information Technology for Economic and Clinical Health Act (enacted as part of the American Recovery and Reinvestment Act of 2009), including Sections 164.308, 164.310, 164.312, and 164.316 of Title 45 of the Code of Federal Regulations.

G. Individual. “Individual” shall have the same meaning as the term “individual” in the HIPAA Rules and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g).

H. Privacy Rule. “Privacy Rule” shall mean the Standards of Privacy of Individually Identifiable Health Information at 45 C.F.R. Parts 160 and 164, Subparts A and E, et seq., and as amended from time to time.

I. Programs. “Programs” shall mean the group program established under Texas Insurance Code, Chapter 1575 relating to the Texas Public School Retired Employees Group Benefits Program (also known as TRS-Care) and the program established under Texas Insurance Code Chapter 1579, relating to the Texas School Employees Uniform Group Health Coverage Program (also known as TRS-ActiveCare).

J. Protected Health Information (“PHI”). “PHI” regardless of its format shall have the same meaning as the term “protected health information” in the HIPAA Rules, limited to the information created or received by Business Associate from or on behalf of Covered Entity.

K. Reproductive Health Care. “Reproductive Health Care” is health care that affects the health of an individual in matters relating to the reproductive system and its functions and processes.

L. Security. “Security” shall have the same meaning as the term “security” at 45 C.F.R. § 164.304.

M. Security Incident. “Security Incident” shall mean any attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

N. Security Rule. “Security Rule” shall mean those provisions found in 45 C.F.R. Part 164, Subpart C (45 C.F.R. § 164.302 - § 164.318) and as amended from time to time.

O. Services. “Services” shall mean the functions, activities, or services that Business Associate provides to TRS under the Agreement and through which Business Associate or its agents, contractors, or Subcontractors may access, create, receive, maintain, retain, modify, record, store, transmit, destroy, or otherwise hold, Use, Disclose, or have access to PHI from or on behalf of TRS.

II. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE

0. Business Associate shall comply with all requirements of HIPAA including, but not limited to, the HIPAA Rules, HIPAA regulations, the requirements of HITECH, rules adopted by the Secretary regarding Breaches of Unsecured PHI, as well as all other applicable state and federal security and privacy laws. In so doing, Business Associate shall adopt applicable privacy and security policies and procedures consistent with the requirements of the HIPAA Rules and HITECH.

0. Business Associate shall not Use or Disclose PHI other than as permitted or required by this BAA or as permitted under law or Required by Law. Subject to Section II. A. immediately above, Business Associate shall follow all written instructions received from Covered Entity with respect to restricting the Uses and Disclosures of PHI. Business Associate shall ensure that the PHI is not Used or Disclosed in a manner that would violate such restriction, unless otherwise directed by Covered Entity.

0. Business Associate shall implement, maintain, and use appropriate safeguards (e.g., administrative safeguards, physical safeguards, and technical safeguards) that (i) protect the confidentiality, integrity, and availability of PHI as required by the HIPAA Rules and (ii) comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI. Business Associate shall prevent Use or Disclosure of PHI other than as provided for by the HIPAA Rules and this BAA. Business Associate’s safeguards shall include, without limitation, implementing written policies and procedures in compliance with HIPAA, the HIPAA Rules, and HITECH; conducting a security risk assessment; conducting risk assessments concerning possible Breaches; and training its employees who will have access to PHI with respect to the policies and procedures required by HIPAA, the HIPAA Rules, and HITECH.

0. Business Associate shall report to Covered Entity any Use or Disclosure of PHI by Business Associate that is not provided for by the HIPAA Rules or by this BAA, including Breaches of Unsecured PHI as required under 45 C.F.R. § 164.410, and shall report to Covered Entity any Security Incident of which Business Associate becomes aware. All such reports and notices shall be sent to the TRS Privacy Officer: PrivacyOfficer@TRS.Texas.gov.

0. Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of this BAA or of any Security Incident of which it becomes aware.

0. Business Associate shall ensure that any agency and any agent, contractor, or Subcontractor of Business Associate that accesses, creates, receives, maintains, retains, modifies, records, stores, transmits, destroys, or otherwise holds, Uses, or Discloses PHI in connection with the Services agrees to the same restrictions, conditions, and requirements that apply through this BAA to Business Associate with respect to PHI.

0. In accordance with the HIPAA Rules, Business Associate shall provide reasonable access to PHI in a Designated Record Set to Covered Entity, or as directed by Covered Entity, to an Individual in order to meet the requirements under 45 C.F.R. § 164.524.

0. Business Associate shall make any amendment(s) to PHI in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 C.F.R. § 164.526 at the request of Covered Entity or an Individual in a reasonable time and manner, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.526.

0. For purposes of the Secretary determining Covered Entity’s compliance with the HIPAA Rules or this BAA, Business Associate shall make internal practices, books, and records, including policies and procedures relating to the Use and Disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity, available to Covered Entity or to the Secretary (or its agents) in a reasonable time and manner or a time and manner designated by the Covered Entity or the Secretary.

0. Business Associate shall document and maintain such Disclosures of PHI and information related to such Disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 C.F.R. § 164.528.

0. At Covered Entity’s request, Business Associate shall provide to Covered Entity or an Individual, in a reasonable time and manner, information collected in accordance with subsection J. of this section to permit Covered Entity to respond to a request by an Individual for an accounting of Disclosures of PHI in accordance with 45 C.F.R. § 164.528.

0. When necessary to accommodate an Individual’s reasonable requests for confidential communications, Business Associate shall communicate with an Individual regarding his/her PHI only in the manner and/or location instructed by Covered Entity.

0. Business Associate will comply with the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 Fed. Reg. 32976 (April 26, 2024)), any amendments thereto, and applicable administrative guidance. Business Associate will not use or disclose PHI potentially related to Reproductive Health Care for health oversight activities (45 C.F.R. § 164.512(d)), judicial or administrative proceedings (45 C.F.R. § 164.512(e)), law enforcement purposes (45 C.F.R. § 164.512(f)), or to coroners and medical examiners about decedents (45 C.F.R. § 164.512(g)(1)). Business Associate understands that this means that Reproductive Health Care PHI may not be disclosed: (1) to conduct a criminal, civil, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided; (2) to impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided; and (3) for the identification of any person for the purpose of conducting such investigation or imposing such liability. If Business Associate receives a request for PHI that is potentially related to Reproductive Health Care for health oversight activities, judicial and administrative proceedings, law enforcement purposes, and/or authorized duties and activities of coroners and medical examiners, Business Associate must, in compliance with 45 C.F.R. § 164.509(b) and (c), obtain a signed and dated attestation from the person or entity requesting the PHI. The attestation must: (1) state that the requested use or disclosure of PHI is not for a prohibited purpose and (2) provide a statement of notice of criminal penalties for persons who knowingly obtain or disclose individually identifiable health information in violation of HIPAA.

0. If applicable, Business Associate shall comply with the Final Rule issued on February 8, 2024 (89 Fed. Reg. 12472 (February 16, 2024)), including provisions that Business Associate must obtain a patient’s consent for uses and disclosures of 42 C.F.R. Part 2 records for treatment, payment, and health care operations purposes. Business Associate will include information about the prohibitions on uses and disclosures of PHI related to Reproductive Health Care and restrictions related to the confidentiality of substance use disorder treatment records in its Notice of Privacy Practices on or before February 16, 2026.

0. If Business Associate accesses, creates, receives, maintains, retains, modifies, records, stores, transmits, destroys, or otherwise holds, Uses, or Discloses Unsecured PHI, it shall notify the Covered Entity within five (5) business days after the discovery of a Breach of Unsecured PHI relating to the Covered Entity or Breach of Unsecured PHI belonging to the Covered Entity. Notifications to Covered Entity should be made to the TRS Privacy Officer: PrivacyOfficer@TRS.Texas.gov. In the event of a Breach, Business Associate will provide as much information as is available at the given point in the investigation, as follows: (1) the identification of each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been accessed, acquired, or Disclosed during such Breach; (2) a brief description of what happened, including the date of the Breach and discovery of the Breach; (3) a description of the type of Unsecured PHI that was involved in the Breach; (4) a description of the investigation into and risk assessment concerning the Breach, mitigation of harm to the Individual(s), and protection against further Breaches; (5) the results of any and all investigations and risk assessments performed by Business Associate related to the Breach; and (6) contact information of the most knowledgeable individual with the Business Associate for Covered Entity to contact relating to the Breach and its investigation into and risk assessment concerning the Breach. The Business Associate shall bear all financial costs associated with a Breach arising out of or relating to the performance of, or failure to perform, negligence, willful misconduct, or breach of obligations under this BAA by Business Associate, except to the extent such Breach is due to the gross negligence or willful misconduct of the Covered Entity. Upon request by the Covered Entity’s Privacy Officer, as to Breaches caused by Business Associate, Business Associate shall provide notification to Individuals concerning a Breach that involves the Individuals as set forth in 45 C.F.R. § 164.404, and when necessary, shall provide notification to the HHS as set forth in 45 C.F.R. § 164.408 and the media as set forth in 45 C.F.R. § 164.406. Within ten (10) business days of receiving all the information necessary to make its decision, the Covered Entity’s Privacy Officer shall inform Business Associate of its decision as to whether notification is required and whether it is requesting Business Associate to perform the individual, Secretary, and/or media notification.

0. Business Associate shall maintain at its own expense insurance covering all claims, losses, liabilities, judgments, settlements, lawsuits, regulatory actions, fines, and other costs or damages arising out of its performance under the Agreement and this BAA, including any negligent or otherwise wrongful acts or omissions by the Business Associate and/or its agents, contractors, partners, employees, Subcontractors, consultants, or assignees. This includes, but is not limited to, any breach of HIPAA, the HIPAA Rules, HITECH, the Omnibus Final Rule, or any other law or regulation governing the confidentiality of PHI.

The insurance must not exclude or limit coverage for the Business Associate’s liability for:

1. Network security and privacy liability;

1. Data breach liability;

1. Cyber liability (ransom costs; lost data; lost use or delay/suspension in business; denial of service with e-business; the Internet; networks and informational assets, such as privacy, virus transmission, extortion, sabotage, or web activities; security and privacy liability, including privacy breach response costs, regulatory fines, and penalties);

1. Electronic media liability, including infringement of copyright, trademark, and trade dress;

1. Commercial crimes; or

1. Commercial general liability (including advertising injury and personal injury liability).

0. The policy or policies comprising the above-required insurance coverage shall together provide limits of liability of at least $10 million in the aggregate. By requiring this insurance amount, Business Associate understands Covered Entity does not represent that coverage and limits will be adequate to indemnify or address the liabilities arising out of a breach of PHI, and such insurance and limits shall not limit Business Associate’s liability under this Agreement.

Upon Covered Entity’s request, Business Associate shall provide Covered Entity with a copy of all certificates or verifications of insurance evidencing the existence of the above-required insurance coverage.

Failure of Business Associate to obtain and maintain the required insurance is a material breach of this BAA, which may result in termination for cause of the BAA and the Agreement to which it is attached, at the option of Covered Entity.

0. Business Associate shall indemnify, protect, defend (with counsel selected by Covered Entity in consultation with the Attorney General that at a minimum does not have any conflict of interest under applicable law, the public policy of the State of Texas, the Texas Rules of Disciplinary Conduct, or the TRS Code of Ethics for Contractors), and hold harmless Covered Entity, their respective trustees, officers, directors, employees, agents, the System and Programs, and the respective fund of the System and each Program (collectively “Indemnitees”) from and against any and all claims, causes of action, liabilities, damages, losses, lawsuits, liens, judgments, or expenses (including attorney fees) of any nature, kind, or description, including indemnification for administrative penalties and fines, costs expended to notify participants and/or to prevent or remedy possible identity theft or any other claims related to a Breach (“Indemnified Amounts”) incurred by any Indemnitees arising out of or relating to the performance of, or failure to perform, negligence, willful misconduct or breach of obligations under this BAA by Business Associate and/or its agents, partners, employees, Subcontractors, consultants, or assignees, except to the extent such Indemnified Amounts are due to the gross negligence or willful misconduct of any Indemnitee. The provisions of this section shall not be construed to eliminate or reduce any other indemnification or right which Covered Entity has by law.

The duty to indemnify, defend, and hold harmless is independent of the duty to insure and continues to apply even in the event insurance coverage required in this BAA or the Agreement is denied, or coverage rights are reserved by any insurance carrier.

To the extent permitted by law, Business Associate’s obligation to defend, indemnify, and hold harmless any Indemnitee, including but not limited to Covered Entity, shall survive the expiration or termination of the Agreement or this BAA.

0. In the event that Business Associate transmits or receives any Covered Electronic Transaction on behalf of Covered Entity, it shall comply with all applicable provisions of the Standards for Electronic Transactions Rule in 45 C.F.R. Part 162 to the extent Required by Law.

0. Covered Entity and Business Associate recognize and agree that in some instances Business Associate may have compliance obligations as a health care provider under the HIPAA Rules and nothing herein shall prohibit, restrict, or otherwise limit compliance with any such obligations by Business Associate under the HIPAA Rules.

0. To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 C.F.R. Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s).

V. Before Business Associate or any Subcontractors may use any tools that incorporate or are expected to incorporate Artificial Intelligence (“AI”), and such tools will involve any PHI, even if the PHI is de-identified, Business Associate shall seek advance written permission from the Covered Entity’s Privacy Officer. This request must include: (1) a description of such tools and (2) how Business Associate oversees, monitors, and evaluates the performance and legal compliance of such AI tools. Business Associate or its Subcontractors will not be authorized to use or disclose any PHI, including de-identified PHI, with any AI tool without Covered Entity’s prior written consent. Business Associate recognizes that PHI used or disclosed in AI datasets will be subject to the return or destruction requirements in Section V. of this BAA.

III. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE

1. Business Associate shall create, receive, Use, or Disclose PHI only as specified in this BAA and the Agreement to which this BAA is an exhibit, provided that any Use or Disclosure of PHI would not violate (i) the HIPAA Rules if done by Covered Entity or (ii) the Minimum Necessary standards Required by Law.

1. Business Associate may Disclose PHI when such Disclosure is Required by Law.

1. Business Associate may Use PHI as Required by Law or to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. § 164.502(j)(1).

1. Business Associate may Use PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate as provided in 45 C.F.R. § 164.502(e)(2)(i)(A) and 45 C.F.R. § 164.502(e)(4).

1. Business Associate may Use PHI to de-identify the information in accordance with 45 C.F.R. § 164.514(a)-(c).

IV. OBLIGATIONS OF COVERED ENTITY

A. Covered Entity shall notify Business Associate of any limitation(s) in its Notice of Privacy Practices of Covered Entity in accordance with 45 C.F.R. § 164.520, to the extent that such limitation(s) affect Business Associate’s permitted Use or Disclosure of PHI.

B. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an Individual to Use or Disclose PHI, to the extent that such changes affect Business Associate’s permitted Use or Disclosure of PHI.

C. Covered Entity shall notify Business Associate of any restriction to the Use or Disclosure of PHI that Covered Entity has agreed to or is required to abide by in accordance with 45 C.F.R. § 164.522, to the extent that such restriction affects Business Associate’s permitted Use or Disclosure of PHI.

D. Covered Entity shall not request Business Associate to Use or Disclose PHI in any manner that would be impermissible under the HIPAA Rules if done by Covered Entity.

V. TERM AND TERMINATION

1. Term. This BAA shall be effective as of the Effective Date. This BAA shall remain in effect during the term of the Agreement, including any extensions, amendments, and renewals of the Agreement, until the Agreement is terminated and all requirements of this section are met regarding the return or destruction of PHI.

1. Business Associate shall destroy or return all PHI to Covered Entity within ninety (90) days of the termination of the Agreement. Upon such destruction or return, Business Associate shall provide a written certification to the Covered Entity that includes all of the following: (1) a statement confirming that all of the PHI has been destroyed or returned to the Covered Entity; (2) a detailed description of the PHI that was destroyed or returned to the Covered Entity; and (3) a statement that describes the mechanism by which all of the PHI was destroyed or returned to the Covered Entity. This certification shall be provided to the TRS Privacy Officer at PrivacyOfficer@TRS.Texas.gov.

In the event that Business Associate’s return or destruction of all or part of Covered Entity’s PHI is infeasible at the termination of the Agreement, Business Associate shall notify Covered Entity of the reason(s) that makes such return or destruction infeasible and the duration for which the PHI must be retained (“retention period”). Business Associate shall continue to safeguard such information under the terms and conditions set forth in this BAA for as long as Business Associate retains it and shall return and/or destroy the PHI when the retention period has expired. Business Associate shall send a certification to the TRS Privacy Officer at PrivacyOfficer@TRS.Texas.gov when the return or destruction has been accomplished, as set forth in the paragraph above.

1. Upon the termination of the Agreement, this BAA shall terminate when the Business Associate (1) destroys or returns to Covered Entity all of the PHI described immediately above and (2) provides the above-described written certification to the Covered Entity’s Privacy Officer.

1. Termination for Cause. Upon Covered Entity’s knowledge of a material breach of this BAA, HIPAA, the HIPAA Rules, HIPAA regulations, and/or HITECH by Business Associate, Covered Entity shall either:

1. Provide an opportunity for Business Associate to cure the breach, end the violation, or terminate this BAA; or

2. If Business Associate does not cure the breach or end the violation within the time specified by Covered Entity and cure is not possible, immediately terminate this BAA if Business Associate has breached a material term of this BAA; or

3. If neither termination nor cure is feasible, report the violation to the Secretary.

The Parties agree that if Covered Entity terminates this BAA pursuant to this section, it shall also terminate all provisions of the Agreement that relate to Business Associate’s Use or Disclosure of PHI, and Covered Entity shall have the discretion to terminate the Agreement in its entirety and pursue all remedies available under the Agreement.

VI. MISCELLANEOUS

1. A reference in this BAA to a section in the HIPAA Rules means the section in effect at the time the BAA is entered into and as subsequently amended.

1. Covered Entity and Business Associate agree to take such action as is necessary to amend this BAA from time to time as required for Covered Entity and/or Business Associate to comply with the provisions of HIPAA, the HIPAA Rules, HITECH, and any other applicable law.

1. The terms of the HIPAA Rules may be expressly amended from time to time by HHS, or as a result of interpretations by HHS, a court, or another regulatory agency with authority over the Parties. In such an event, the Parties will work together in good faith to determine the impact on the Parties’ obligations and whether the specific event requires the need to amend this BAA.

1. Modification of the terms of this BAA shall not be effective or binding upon the Parties unless and until such modification is committed to writing and executed by the Parties hereto.

1. Any ambiguity in this BAA shall be interpreted and resolved to permit compliance with HIPAA, the HIPAA Rules, and HITECH.

1. In the event of a conflict or inconsistency between the terms of this BAA and the Agreement, the provisions of this BAA shall prevail.

1. In the event of an inconsistency between the terms of this BAA and the mandatory terms of the HIPAA Rules, the mandatory terms of the HIPAA Rules shall prevail. Where the terms of this BAA are different from those included in the HIPAA Rules but the terms of the HIPAA Rules are permissive, the terms of this BAA shall control.

1. Business Associate is solely responsible for all decisions made by Business Associate, and those of its agents, contractors, and Subcontractors that access, create, receive, maintain, retain, modify, record, store, transmit, destroy, or otherwise hold, Use, or Disclose PHI in connection with the Agreement, regarding the safeguarding of PHI. Notwithstanding the above, this section does not relieve any agency, and any agent, contractor, or Subcontractor of the Business Associate of any responsibility or liability in connection with their respective actions and omissions.

1. Should any provision of this BAA be found unenforceable, it shall be deemed severed and the balance of the BAA shall continue in full force and effect as if the unenforceable provision had never been made a part hereof.

1. This BAA does not create or confer any rights or remedies onto third Parties.

1. This BAA, including such portions as are incorporated by reference herein, constitutes the entire BAA by, between, and among the Parties, and such Parties acknowledge by their signature hereto that they do not rely upon any representations or undertakings by any person or Party, past or future, not expressly set forth in writing herein.

1. This BAA shall be binding upon the Parties hereto, their respective legal representatives, trustees, receivers, successors, and permitted assigns.

1. To the extent not preempted by federal law, this BAA and the rights and obligations of the Parties hereunder shall in all respects be governed by and construed in accordance with the laws of the State of Texas, including all matters of construction, validity, and performance.

1. All notices and communications required or permitted to be given by Business Associate to Covered Entity hereunder shall be sent to the TRS Privacy Officer: PrivacyOfficer@TRS.Texas.gov.

1. The provisions of Sections II. A., II. B., II. C., II. D., II. E., II. G., II. H., II. I., II. J., II. K., II. P., II. Q., II. R., II. S., II. T., II. U., Section V., and Section VI. shall survive termination of this BAA.

THE REMAINDER OF THIS PAGE HAS

INTENTIONALLY BEEN LEFT BLANK

IN WITNESS WHEREOF, the Parties have executed this BAA on the date indicated below.

(Business Associate)

By:

Printed Name:

Title:

Date: _____________________________

TEACHER RETIREMENT SYSTEM OF TEXAS

By:

Brian K. Guthrie

Group Benefits Program, and the Texas School Employees Uniform Group Health Coverage Program

Date:

TRS General Terms and Conditions

Teacher Retirement System of Texas General Terms and Conditions

These General Terms and Conditions ("Terms and Conditions") are incorporated for all purposes into the contract (“Contract”) between the Teacher Retirement System of Texas ("TRS") and Contractor. To the extent that any provision contained in these Terms and Conditions conflicts with any provision contained elsewhere in the Contract, it is expressly understood and agreed that the provision contained in these Terms and Conditions shall control to the extent necessary to resolve the conflict.

1. Independent Contractor. Contractor and its employees, representatives, agents, subcontractors, suppliers, and third-party contractors shall serve as independent contractors in providing the services under this Contract. This Contract shall not create any joint venture, partnership, agency, or employment relationship between Contractor and TRS. Neither Contractor nor TRS is an agent of the other and neither may make any commitments on the other party’s behalf. Contractor shall have no claim against TRS for vacation pay, sick leave, retirement benefits, social security, worker’s compensation, health or disability benefits, unemployment insurance benefits, or employee benefits of any kind.

2. E-Verify Program. Contractor certifies that for contracts for services, it shall utilize the U.S. Department of Homeland Security's E-Verify system to determine the eligibility of all persons hired by Contractor during the term of the contract to perform duties in Texas and all persons, including subcontractors, assigned by Contractor during the term of the Contract to perform work pursuant to the Contract within the United States of America.

3. Subcontractors. For purposes of this clause, “subcontractor” does not include an affiliate of Contractor. Contractor may not subcontract the work or obligations due under this Contract without the prior written approval of TRS. Contractor expressly understands and acknowledges that in entering such subcontract(s), TRS is in no manner liable to any subcontractor(s) of Contractor and all acts and omissions of any subcontractor(s) are imputed to Contractor. In no event shall this provision relieve Contractor of the responsibility for ensuring that the services performed under all subcontracts are rendered in compliance with this Contract.

4. Criminal Background Checks. Contractor shall comply with, and cause any subcontractor provided by Contractor to comply with, TRS’ Background Check Policy ("BCP"). Contractor agrees pursuant to the BCP that when TRS determines that a criminal background check ("CBC") is required, TRS will conduct the CBC and Contractor shall reimburse TRS for the costs incurred by TRS in conducting the CBC. All information pertaining to a CBC shall only be provided to an authorized representative of TRS’ Organizational Excellence division.

5. No Conflicts of Interest. Contractor represents and warrants that the provision of goods and services or other performance under the Contract will not constitute an actual or potential conflict of interest or reasonably create an appearance of impropriety. Contractor will not have any relationship with a third party that could be construed as a violation of the TRS Code of Ethics for Contractors (“TRS Code”). Contractor shall give notice to TRS of any actual, apparent, or potential conflict of interest as defined in, and in the manner required by, the TRS Code or applicable law.

6. Dealings with Public Servants Affirmation. Contractor represents and warrants that it has not given, offered to give, nor intends to give at any time hereafter any economic opportunity, future employment, gift, loan, gratuity, special discount, trip, favor, or service to a public servant in connection with this Contract.

7. Financial Participation Prohibited Affirmation. Contractor certifies that neither Contractor nor any person or entity represented by Contractor has received compensation from TRS to participate in the preparation of the specifications or solicitation on which this Contract is based. Contractor certifies that the individual or business entity named in this Contract is not ineligible to receive the specified contract and acknowledges that this Contract may be terminated, and payment withheld, if this certification is inaccurate.

8. Intellectual Property. To the extent services include deliverables created and produced by Contractor pursuant to this Contract, the term “Work” is defined as all work products, designs, specifications, systems, software, programs, intellectual property, deliverables, or other property generated for the benefit of TRS in connection with the services provided under this Contract. TRS and Contractor each consider the Work and all products and results of the services to be a work made for hire. Contractor agrees that the Work, and all rights therein, belongs to and shall be the sole and exclusive property of TRS. If for any reason the Work would not be considered a work-for-hire under applicable law, Contractor does hereby sell, assign, and transfer to TRS, its successors and assigns, the entire right, title, and interest in and to the copyright in the Work and all works based upon, derived from, or incorporating the Work. Contractor shall execute all papers and perform such other property rights, as TRS may deem necessary to secure for TRS the rights herein assigned. Failure to timely deliver such Work to TRS shall constitute a material breach of this Contract. Contractor shall not retain any copies of the Work without the prior written consent of TRS. To the extent Work includes intellectual property created before the Effective Date or otherwise independent of this Contract (“Independent Assets”), Contractor hereby grants to TRS a perpetual, irrevocable, royalty free license solely for TRS’ internal business purposes to use, reproduce, create derivative works from, and distribute any such Independent Assets embodied in or delivered in conjunction with Work.

TRS, at its discretion, may publicly release, distribute, and post any reports in accordance with Section 2254.041 of the Texas Government Code.

9. Taxes. Purchases made for State of Texas use are exempt from the State Sales Tax and Federal Excise Tax. TRS will furnish Tax Exemption Certificates upon request. Contractor represents and warrants that it shall pay all taxes or similar amounts resulting from the Contract, including, but not limited to, any federal, State, or local income, sales or excise taxes of Contractor or its employees. TRS shall not be liable for any taxes resulting from the Contract.

10. Excess Obligations Prohibited. This Contract is subject to termination or cancellation, without penalty to TRS, either in whole or in part, subject to the availability of state funds. Contractor understands that nothing in the Contract creates an obligation or liability exceeding budgeted funds currently available to TRS during the current biennium, except to the extent that TRS' Board of Trustees ("Board") determines that expenditure of pension trust funds exceeding the amounts currently budgeted to compensate Contractor for performance of services is necessary for fulfilling the Board's fiduciary duties.

11. Invoices and Payment. Contractor shall submit invoices through the TRS Procurement and Vendor E-System (PAVES). Vendors will be required to activate an account in PAVES to submit invoices. Payment to Contractor will be made within thirty (30) days of TRS’ receipt of Contractor’s undisputed invoice. No increase in any amount due by TRS under this Contract shall be binding on TRS without TRS’ prior written consent. Interest for late payments shall be governed by the Texas Prompt Payment Act, chapter 2251 of the Texas Government Code. Contractor shall not bill TRS for required training pursuant to the Non-TRS Workers (Contract Workers, Unpaid Interns and Volunteers) Policy, unless such costs are specifically authorized in this Contract. In the event such costs are specifically authorized, they shall be itemized in Contractor’s invoice.

12. Reimbursement for Travel. Travel reimbursement is limited to actual costs incurred by Contractor and shall not exceed the maximum allowed for State employees by the Texas Comptroller of Public Accounts. Contractor will not be compensated for any travel expenses, unless contemplated by this Contract and otherwise pre-approved by TRS in writing. Under no circumstances will Contractor be compensated for off-duty hours while traveling.

13. Release of Payment Claims by Contractor. The final invoice submitted by Contractor shall be accompanied by a complete and legally effective release of TRS from all known and unknown payment claims relating to this Contract on a form provided by TRS. Contractor’s acceptance of final payment constitutes a waiver of all known or unknown payment claims against TRS related to this Contract, other than those specifically excepted in the release.

14. Contracting Information Responsibilities. In accordance with Section 552.372 of the Texas Government Code, Contractor agrees to (1) preserve all contracting information related to this Contract as provided by the records retention requirements applicable to TRS for the duration of the Contract, (2) promptly provide to TRS any contracting information related to the Contract that is in the custody or possession of Contractor on request of TRS, and (3) on termination or expiration of the Contract, either provide at no cost to TRS all contracting information related to the Contract that is in the custody or possession of Contractor or preserve the contracting information related to the Contract as provided by the records retention requirements applicable to TRS. Except as provided by Section 552.374(c) of the Texas Government Code, the requirements of Subchapter J, Chapter 552, Government Code, may apply to this Contract and Contractor agrees that the Contract can be terminated if Contractor knowingly or intentionally fails to comply with a requirement of that subchapter.

15. Records Retention; Inspection of Records. Contractor shall maintain and retain all records relating to the performance of this Contract, including supporting fiscal documents adequate to ensure that claims for contract funds are in accordance with applicable State of Texas requirements. Contractor shall maintain and retain these records in accordance with TRS' records retention schedule for a period of seven (7) years after the expiration date of the Contract or until all associated audit, claim, and litigation matters are resolved, whichever is later. During the initial and any renewal term of this Contract, Contractor shall, at reasonable times and upon reasonable notice, permit TRS, its agents, and authorized state and federal agencies to have access to all records pertaining to this Contract, as necessary, for purposes of inspection, monitoring, copying, audit, and evaluation.

16. TRS Data and Confidentiality.

16.1 The term “TRS Data” refers to all TRS information, as well as other entity information in the possession of TRS, that is processed, stored, or transmitted by a computer, including data that is generated by Contractor in the performance of services under the Contract. For purposes of this Contract, TRS Data maintained by or for TRS constitutes confidential information and includes information confidential by law or otherwise excepted from disclosure under the TPIA. Contractor shall maintain the confidentiality of TRS Data and prevent unauthorized disclosure. Contractor will not collect, access, use, disclose, or retain TRS Data other than as necessary to perform the services under this Contract or as otherwise authorized in writing by TRS. Contractor will restrict access to TRS Data to only those personnel who must have the information on a “need to know” basis. Contractor will not use TRS Data, or any information derived from TRS Data, for its own benefit or the benefit of any other person or entity. Contractor will not share TRS Data with its parent company or other affiliate without TRS’ express written consent.

Contractor shall not disclose TRS Data to any third party, except as specifically provided in this Contract or as required by applicable law or court order. Contractor shall notify third parties to whom TRS Data is disclosed of the confidentiality terms of this Contract. Where disclosure of TRS Data to any third party is required by applicable law or court order, Contractor, as permitted by law, shall notify TRS prior to the disclosure.

16.2 Contractor shall disclose to TRS all AI technology it uses to provide services to TRS and shall use its best efforts to mitigate risks associated with the use of AI.