Exhibit 2 to Schedule E HIPAA BAA.docx

Exhibit 1 to Schedule E - HIPAA BAA RFP No. 250000002307

HIPAA BUSINESS ASSOCIATE ADDENDUM

Effective for Plan Year XXXX

The parties to this Business Associate Addendum (Addendum) are the State of Michigan, acting by and through the Department of Technology Management and Budget, on behalf of the Michigan Office of Retirement Services (State) and ________________ (Contractor). This Addendum supplements and is made a part of the existing contract(s) or agreement(s) between the parties including the following Contract(s):__________________ (Contract #).

For purposes of this Addendum, the State is (check one):

( X) Covered Entity (CE)

( ) Business Associate (Associate) and the Contractor is (check one):

( ) Covered Entity (CE)

(X ) Business Associate (Associate)

RECITALS

A. Under the terms of the Contract, CE wishes to disclose certain information to Associate, some of which may constitute Protected Health Information and/or Personally Identifiable Information (collectively, Protected Information). In consideration of the receipt of such information, Associate agrees to protect the privacy and security of the information as set forth in this Addendum.

B. CE and Associate intend to protect the privacy and provide for the security of Protected Information disclosed to Associate pursuant to the Contract in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act) and regulations promulgated by the U.S. Department of Health and Human Services (HIPAA Rules) and other applicable laws, as amended.

C. The HIPAA Rules require CE to enter into an agreement containing specific requirements with Associate before CE may disclose PHI.

In consideration of the mutual promises below and the exchange of information pursuant to this Addendum, the parties agree as follows:

1. Definitions.

a. Except as otherwise defined herein, capitalized terms in this Addendum have the same meaning as those terms under HIPAA and the HIPAA Rules.

b. “Agent” has the same meaning given to the term under the federal common law of agency.

c. “Agreement” means the Contract and this Addendum, as read together.

d. “Breach” means the acquisition, access, Use or Disclosure of Protected Health Information or Personal Identifying Information in a manner not permitted under the Privacy Rule or the Michigan Identify Theft Protection Act, as applicable, which compromises the security or privacy of such information.

e. “Contract” means the underlying written agreement or purchase order between the parties for the goods or services to which this Addendum is added. Contract also includes all amendments and addendums to the original contract, both effective before and effective after the date of this Addendum.

f. “Data Aggregation” has the same meaning as the term under 45 CFR §164.501.

g. “Designated Record Set” has the same meaning as the term under 45 CFR §164.501.

h. “Disclosure” means, the release, transfer, provision of access to, or divulging of Protected Information in any manner outside the entity holding the information.

i. “Electronic Health Record” has the same meaning as the term under Section 13400 of the HITECH Act.

j. “Electronic Protected Health Information” or “Electronic PHI” has the same meaning as the term under 45 CFR §160.103, limited to the information created, received, maintained or transmitted by Associate on behalf of CE.

k. “HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

l. “Identity Theft Protection Act” means Public Act 452 of 2004, MCL 445.61, et seq.

m. “HITECH Act” means The Health Information Technology for Economic and Clinical Health Act, part of the American Recovery and Reinvestment Act of 2009, specifically Division A: Title XIII Subtitle D—Privacy, and its corresponding regulations as enacted under the authority of the Act.

n. “Individual” has the same meaning as the term under 45 CFR §160.103 and includes a person who qualifies as a personal representative in accordance with 45 CFR §165.502(g).

o. “Personal Identifying Information” or “PII” has the same meaning as the term Section 3(q) of the Identity Theft Protection Act.

p. “Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E.

q. “Protected Health Information” or “PHI” has the meaning given to the term under the Privacy Rule, 45 CFR §160.103, limited to the information created, received, maintained or transmitted by Associate on behalf of CE.

r. “Protected Information” means PHI and PII created, received, maintained or transmitted by Associate on behalf of CE.

s. “Security Incident” means the attempted or successful unauthorized access, Use, Disclosure, modification, or destruction of Protected Information or interference with system operations in an information system.

t. “Security Rule” means the Standards for Security of Electronic Protected Health Information at 45 CFR Part 160 and Part 164, Subparts A and C.

u. “Subcontractor” means a person or entity that creates, receives, maintains, or transmits Protected Information on behalf of Associate and who is now considered a Business Associate, as the latter term is defined in 45 CFR §160.103.

v. “Unsecured Protected Health Information” or “Unsecured PHI” means Protected Health Information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of technology or methodology specified by DHHS as defined in the Breach Rule, 45 CFR § 164.402.

w. “Use” means, with respect to Protected Information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.

2. Obligations and Activities of Associate.

a. Permitted Uses and Disclosures. Associate may Use and Disclose Protected Information only as necessary to perform services owed CE under the Contract and meet its obligations under this Addendum, provided that such Use or Disclosure would not violate Subpart E of 45 CFR 164 or the Identity Theft Protection Act, if done by CE. All other Uses or Disclosures by Associate not authorized by this Addendum, or by specific written instruction of CE, are prohibited. Except as otherwise limited by this Addendum, Associate may Use and Disclose Protected Information as follows:

i. Associate may Use Protected Information for the proper management and administration of the Associate or to carry out the legal responsibilities of the Associate.

ii. Associate may Disclose Protected Information for the proper management and administration of the Associate, provided that Disclosures are Required by Law; or Associate obtains reasonable assurances from the person to whom the information is Disclosed that it will remain confidential and Used, or further Disclosed, only as Required by Law, or for the purpose for which it was Disclosed to the person, and the person notifies the Associate of any instances of which it is aware that the confidentiality of the information has been breached.

iii. Associate may Use Protected Health Information to provide Data Aggregation services to CE for the Health Care Operations of CE, as permitted by 45 CFR §164.504(e)(2)(i)(B). Associate agrees that said services shall not be provided in a manner that would result in Disclosure of Protected Health Information to another CE who was not the originator and/or lawful possessor of said information. Further, Associate agrees that any such wrongful Disclosure of Protected Health Information constitutes a Breach and shall be reported to CE in accordance with this Addendum.

iv. Associate may Use Protected Health Information to report violations of law to appropriate federal and state authorities, consistent with 45 CFR §164.502(j)(1).

b. Appropriate Safeguards. Associate must implement and maintain appropriate administrative, physical, and technical safeguards, and comply with Subpart C of 45 CFR Part 164 regarding Electronic PHI, to prevent the Use or Disclosure of Protected Information other than as provided in this Addendum. These safeguards shall comport with HIPAA Rules and include at minimum:

i. Achieving and maintaining compliance with the HIPAA Security Rule, as necessary in conducting operations on behalf of CE under this Addendum.

ii. Providing a level and scope of security that is at least comparable to the level and scope of security established by the National Institute of Standards and Technology (NIST) in NIST 800-53, Recommended Security Controls for Federal Information Systems, Annex 2: Consolidated Security Controls-Moderate Baseline. The oldest acceptable version is the most recently approved version of NIST that has been approved for 6 months or more; however, Associate is encouraged to adopt newly approved versions of NIST as soon as practicable. If Associate chooses to use the Control Objectives for Information and Related Technology (COBIT), Information Systems Audit and Control Association (ISACA), or International Organization for Standardization (ISO) standards, Associate must demonstrate and document how each aspect of the chosen standard comports with the applicable version of NIST and make such documentation available to CE upon request. If Associate uses a standard other than those described in this subsection, Associate must demonstrate and document how each aspect of the chosen standard comports with the appropriate version of NIST and present to CE for review and approval. In case of a conflict between any of the security standards contained in any of these enumerated sources, the most stringent shall apply. The most stringent means those safeguards that provide the highest level of protection to PHI from unauthorized Disclosure. Further, Associate must comply with changes to these standards that occur after the effective date of this agreement.

iii. Maintaining a comprehensive written information privacy and security program that reasonably and appropriately protects the confidentiality, integrity, and availability of Protected Information.

c. Security Incidents. Associate must notify and report to CE in the manner described herein any Use or Disclosure of Information in violation of this Addendum of which it becomes aware, including breaches of Unsecured Protected Health Information as required by 45 CFR §164.410, and any Security Incident of which it becomes aware, and take the following actions:

i. Notice to CE. Associate must notify CE, via e-mail and telephone, within three (3) business days of the discovery of any Use or Disclosure of Protected Information in violation of this Addendum, or any Security Incident of which it becomes aware. Associate must follow its notification to CE with a report that meets the requirements outlined immediately below.

ii. Investigate; Report to CE. Associate must promptly investigate any Security Incident. Within ten (10) business days of the discovery, Associate must submit a preliminary report to CE identifying, to the extent known at the time, any information relevant to ascertaining the nature and scope of the Security Incident. Within fifteen (15) business days of the discovery of the Security Incident and unless otherwise directed by CE in writing, Associate must provide a complete report of the investigation to CE. Such report shall identify, to the extent possible: (a) each individual whose Protected Information has been, or is reasonably believed by Associate to have been accessed, acquired, Used or Disclosed; (b) the type of Protected Information accessed, Used or Disclosed (e.g., name, social security number, date of birth) and whether such information was Unsecured; (c) who made the access, Use, or Disclosure; and (d) an assessment of all known factors relevant to a determination of whether a Breach occurred under applicable provisions of the HIPAA Rules, or a Breach of Security under the Identity Theft Protection Act, or any other applicable federal or state regulations. The report shall also include a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain any improper Use or Disclosure. If CE requests information in addition to that listed in the report, Associate shall make reasonable efforts to provide CE with such information. Associate agrees that CE reserves the right to review and recommend changes to any corrective action plan and make a final determination as to whether a Breach of PHI or Security Breach of PII occurred and whether any notifications may be required under applicable state or federal regulations, including specifically 45 CFR §§164.404-408. In the event of a Breach of Unsecured PHI or of PII, as determined by CE, Associate agrees, consistent with 45 CFR §164.404(c) and Section 12 of the Identity Theft Protection Act, as applicable, to provide CE with information and documentation in its control necessary to meet the requirements of said sections, and in a manner and format to be reasonably specified by CE.

iii. Mitigation. Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Associate of a Security Incident or a Use or Disclosure of Protected Information in violation of the requirements of this Addendum. Associate must take: (a) prompt corrective action to cure any such violation and (b) any other action pertaining to such unauthorized Use or Disclosure required by applicable federal and state laws and regulations.

d. Responsibility for Notifications. If the cause of a Breach of Protected Information is attributable to Associate or its Agents or Subcontractors, Associate will cooperate with CE in issuing any required notices, including determining who should give the notice, and will comply with the notification requirements of the HIPAA Rules. In all cases, CE’s authorized approval must be obtained before the notification is made. In the event of such Breach, and without limiting Associate’s obligations of indemnification as further described in this Addendum, Associate must indemnify, defend, and hold harmless CE for any and all claims or losses, including reasonable attorneys’ fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from CE in connection with the occurrence.

e. Associate’s Agents and Subcontractors. If Associate uses one or more Subcontractors or Agents to provide services under the Agreement, and such Agents or Subcontractors receive or have access to Protected Information, each Subcontractor or Agent must sign an agreement with Associate containing substantially the same provisions as this Addendum and in conformance with 45 CFR §164.504(e)(2), and to assume toward Associate all of the obligations and responsibilities that the Associate, by this Addendum, assumes toward CE. Upon CE’s request, Associate agrees to provide CE with copies of the portions of such agreements that evidence compliance with this Section. Associate further agrees to provide said Agents or Subcontractors PHI in accordance with the HIPAA Rules, and PII in accordance with applicable federal and state law and must: (i) implement and maintain sanctions against Subcontractors and Agents that violate such restrictions and conditions; and (ii) mitigate, to the extent practicable, the effects of any such violation.

f. Access to Protected Health Information. Associate agrees to make PHI regarding an Individual maintained by Associate or its Agents or Subcontractors in a Designated Record Set available to CE or to such Individual for inspection and copying in order to meet CE’s obligations under 45 CFR §164.524. Associate must permit such access within ten (10) days of a request. An Individual’s request for access must be submitted on standard request forms available from Associate. If CE receives a request for access, CE, in addition to addressing the request on its behalf, will forward the request in writing to Associate in a timely manner. If Associate or its Agents or Subcontractors maintain Electronic Health Records for CE, then Associate must provide, where applicable, electronic access to the Electronic Health Records.

g. Amendment of Protected Health Information. Associate agrees to make any amendment(s) to PHI in a Designated Record Set as directed by CE pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy CE’s obligations under 45 CFR 164.526. If an Individual requests an amendment of PHI directly from Associate or its Agents or Subcontractors, Associate must notify CE in writing within ten (10) days of the request, and then, in that case, only CE may either grant or deny the request.

h. Accounting Rights. Associate agrees to maintain, and within ten (10) days of a request from CE or an Individual for an accounting of Disclosures of PHI, make available the information in accordance with 45 CFR §164.522. An Individual’s request for an accounting of disclosures must be submitted on standard request forms available from Associate. If CE receives a request for an accounting, CE, in addition to addressing the request on its own behalf, will forward the request in writing to Associate in a timely manner.

i. Access to Records and Internal Practices. Unless otherwise protected or prohibited from discovery or Disclosure by law, Associate must make its internal practices, books, and records, including policies and procedures (collectively “Compliance Information”), relating to the Use or Disclosure of PHI and/or PII and the protection of same, available to CE or to the Secretary of DHHS (hereinafter, “Secretary”) for purposes of the Secretary determining CE’s compliance with the HIPAA Rules. Associate shall have a reasonable time within which to comply with requests for such access, consistent with this Addendum. In no case shall access be required in less than five (5) business days after Associate’s receipt of such request, unless otherwise designated by the Secretary.

j. Minimum Necessary. Associate (and its Agents or Subcontractors) shall only request, Use and Disclose the minimum amount of Protected Information necessary to accomplish the purpose of the request, Use or Disclosure, in accordance with the Minimum Necessary requirements of the Privacy Rule, including, but not limited to 45 CFR §§ 164.502(b) and 164.514(d).

k. Compliance.

i. To the extent that Associate carries out one or more of CE’s obligations under the HIPAA Rules, Associate must comply with all requirements that would be applicable to CE.

ii. Associate must honor all restrictions consistent with 45 CFR §164.522 that CE or the Individual makes Associate aware of, including the Individual’s right to restrict certain Disclosures of PHI to a health plan where the Individual pays out of pocket or in full for the healthcare item or service.

l. Data Ownership. Unless otherwise specified in this Addendum, Associate agrees that Associate has no ownership rights with respect to the Protected Health Information and that CE retains all rights with respect to ownership of such information. Associate further agrees not to receive remuneration, directly or indirectly, in exchange for Protected Health Information, except with the prior written consent of CE.

m. Retention of Protected Information. Notwithstanding Section 5(d) of this Addendum, Associate and its Subcontractors or Agents shall retain all Protected Information throughout the term of the Contract and shall continue to maintain the information required under Section 2(h) of this Addendum for a period of six (6) years from the date of creation or the date when it last was in effect, whichever is later, or as Required by Law. This obligation shall survive the termination of the Contract.

n. Destruction of Protected Information. Associate must implement policies and procedures for the final disposition of Protected Information, including electronic PHI, and/or the hardware and equipment on which it is stored, including but not limited to, removal before re-Use, in accordance with the Security Rule, and other applicable laws relating to the final disposition of PHI and/or PII.

o. Audits, Inspection, and Enforcement. Within ten (10) days of a written request by CE, Associate and its Agents or Subcontractors must allow CE to conduct a reasonable inspection of the facilities, systems, books, records, agreements, policies and procedures relating to the Use or Disclosure of Protected Information pursuant to this Addendum for the purpose of determining whether Associate has complied with this Addendum; provided, however, that: (i) Associate and CE shall mutually agree in advance upon the scope, timing and location of such an inspection; (ii) CE shall protect the confidentiality of all confidential and proprietary information of Associate to which CE has access during the course of such inspection; and (iii) CE or Associate shall execute a nondisclosure agreement, if requested by Associate or CE. The fact that CE inspects, or fails to inspect, or has the right to inspect, Associate’s facilities, systems, books, records, agreements, policies and procedures does not relieve Associate of its responsibility to comply with this Addendum, nor does CE’s (i) failure to detect or (ii) detection, but failure to notify Associate or require Associate’s remediation of any unsatisfactory practices, constitute acceptance of such practice or a waiver of CE’s enforcement rights under this Addendum. If Associate is the subject of an audit, compliance review, or complaint investigation by DHHS that is related to the performance of its obligations pursuant to this Addendum, Associate must notify CE and provide CE with a copy of any PHI that Associate provides to DHHS concurrently with providing such information to DHHS. Associate is responsible for all civil penalties assessed due to an audit or investigation of Associate by DHHS.

p. Audit Findings. Associate must implement any appropriate Safeguards, as identified by CE in an audit conducted under paragraph 2(o).

q. Safeguards During Transmission. Associate must utilize safeguards that reasonably and appropriately maintain and ensure the confidentiality, integrity, and availability of Protected Information transmitted to CE pursuant to this Addendum, in accordance with the standards and requirements of the HIPAA Rules and other applicable federal or state regulations, until such Protected Information is received by CE, and in accordance with any specifications set forth in Attachment A.

r. Due Diligence. Associate must exercise due diligence and take reasonable steps to ensure that it remains in compliance with this Addendum and is in compliance with applicable provisions of HIPAA, the HIPAA Rules, and other applicable laws or regulations pertaining to PHI and/or PII, and that its Agents, Subcontractors and vendors are in compliance with their obligations as required by this Addendum.

s. Sanctions and/or Penalties. Associate understands that a failure to comply with the provisions of HIPAA, the HIPAA Rules or any other state or federal regulation that is applicable to Associate may result in the imposition of sanctions and/or penalties on Associate under HIPPA, the HIPAA Rules, or any other applicable laws or regulations pertaining to PHI and/or PII.

t. Indemnification. Associate shall indemnify, hold harmless and defend CE from and against any and all claims, losses, liabilities, costs and other expenses resulting from, or relating to, the acts or omissions of Associate or its Agents or Subcontractors in connection with the representations, duties, and obligations of Associate under this Addendum, including but not limited to any unauthorized Use or Disclosure of Protected Information. This includes credit-monitoring services, third party audits of Associate’s handling and remediation of the Breach, and reimbursement for State employee time spent handling the Security Incident, as reasonably deemed appropriate by CE. The parties’ respective rights and obligations under this subsection shall survive termination of the Agreement.

3. Obligations of CE.

a. Safeguards During Transmission. CE must utilize safeguards that reasonably and appropriately maintain and ensure the confidentiality, integrity, and availability of Protected Information transmitted to Associate under this Addendum, in accordance with the standards and requirements of the HIPAA Rules and other applicable federal or state regulations, until such Protected Information is received by Associate, and in accordance with any specifications set forth in Attachment A.

b. Notice of Limitations and Changes. CE must notify Associate of any limitation(s) in its notice of privacy practices in accordance with 45 CFR §164.520, or any restriction to the Use or Disclosure of PHI that CE has agreed to in accordance with 45 CFR §164.528, to the extent that such limitation may affect Associate’s Use or Disclosure of PHI. CE must also notify Associate of any changes in, or revocation of, permission by Individual to Use or Disclose PHI of which it becomes aware, to the extent that such changes may affect Associate’s Use or Disclosure of PHI.

4. Term. This Addendum shall continue in effect as to each Contract to which it applies until such Contract is terminated or is replaced with a new contract between the parties containing provisions meeting the requirements of the HIPAA Rules, whichever first occurs. However, certain obligations will continue as specified in this Addendum.

5. Termination.

a. Material Breach. Except as otherwise provided in the Contract, a breach by Associate of any provision of this Addendum, as determined by CE, shall constitute a material breach of the Agreement and provide grounds for CE to terminate the Agreement for cause, subject to section 5(b):

i. Default. If Associate refuses or fails to timely perform any of the provisions of this Addendum, CE may notify Associate in writing of the non-performance, and if not corrected within thirty (30) days, CE may immediately terminate the Agreement. Associate agrees to continue performance of the Agreement to the extent it is not terminated.

ii. Duties. Notwithstanding termination of the Agreement, and subject to any reasonable directions from the CE, Associate agrees to take timely, reasonable and necessary action to protect and preserve property in the possession of the Associate in which CE has an interest.

iii. Erroneous Termination for Default. If after such termination it is determined, for any reason, that Associate was not in default, or that Associate’s action/inaction was excusable, such termination shall be treated as a termination for convenience, and the rights and obligations of the parties shall be the same as if the Contract had been terminated for convenience, as described in this Addendum or in the Contract.

b. Reasonable Steps to Cure Breach. If CE knows of a pattern of activity or practice of Associate that constitutes a material breach or violation of the Associate’s obligations under the provisions of this Addendum or another arrangement and does not terminate the Agreement under Section 5(a), then CE shall take reasonable steps to cure such breach or end such violation, as applicable. If CE’s efforts to cure such breach or end such violation are unsuccessful, CE shall either (i) terminate the Agreement, if feasible or (ii) if termination of the Agreement is not feasible, CE shall report Associate’s breach or violation to the Secretary.

c. Reserved.

d. Effect of Termination.

i. At the direction of CE, and except as provided in section 5(d)(ii), upon termination of the Agreement for any reason, Associate must return or destroy all Protected Information that Associate or its Agents or Subcontractors still maintain in any form, and shall retain no copies of such information. If CE directs Associate to destroy the Protected Information, Associate must certify in writing to CE that such information has been destroyed. If CE directs associate to return such information, Associate must do so promptly in any format reasonably specified by CE.

ii. If Associate believes that returning or destroying the Protected Information is not feasible, including but not limited to, a finding that record retention requirements provided by law make return or destruction infeasible, Associate must promptly provide CE written notice of the conditions making return or destruction infeasible. Upon mutual agreement of CE and Associate that return or destruction of Protected Information is infeasible, Associate must continue to extend the protections of this Addendum to such information, and must limit further Use of such Protected Information to those purposes that make the return or destruction of such Protected Information infeasible.

6. Reserved.

7. No Waiver of Immunity. No term or condition of this Addendum shall be construed or interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection, or other provisions of applicable laws, including the Michigan Governmental Immunity Act, MCL 691.1401, et seq., the Court of Claims Act, MCL 600.6401 et seq., the Federal Tort Claims Act, 28 U.S.C. 2671, et seq., or the common law, as applicable, as now in effect or hereafter amended.

8. Reserved.

9. Disclaimer. CE makes no warranty or representation that compliance by Associate with this Addendum, HIPAA, the HIPAA Rules, or other applicable laws pertaining to Protected Information will be adequate or satisfactory for Associate’s own purposes. Associate is solely responsible for all decisions made by Associate regarding the safeguarding of Protected Information.

10. Reserved.

11. Amendment.

a. Amendment to Comply with Law. The parties agree to take such action as is necessary to amend this Addendum from time to time as may be necessary for CE and Associate to comply with and implement the standards and requirements of HIPAA, the HIPAA Rules, the Identity Theft Protection Act, and other applicable laws relating to the security or privacy of PHI and/or PII. Upon the request of either party, the other party agrees to promptly enter into negotiations concerning the terms of an amendment to this Addendum embodying written assurances consistent with the standards and requirements of HIPAA, the HIPAA Rules, the Identity Theft Protection Act, or other applicable laws. Either party may terminate the Agreement upon thirty (30) days written notice if (i) the other does not promptly enter into negotiations to amend this Agreement when requested by the requesting party under this Section or (ii) the non-requesting party does not enter into an amendment to this Agreement when requested providing assurances regarding the safeguarding of PHI and/or PII that the requesting party, in its sole discretion, deems sufficient to satisfy the standards and requirements of HIPAA, the HIPAA Rules, the Identity Theft Protection Act, and other applicable laws.

b. Amendment of Attachment A. Attachment A may be modified or amended by mutual agreement of the parties in writing from time to time without formal amendment of this Addendum.

12. Assistance in Litigation or Administrative Proceedings. Associate must make itself, and any Subcontractors, employees or Agents assisting it in the performance of its obligations under this Addendum available to CE, at no cost to CE, to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against a party, its directors, officers or employees, departments, agencies, or divisions based upon a claimed violation of HIPAA, the HIPAA Rules, the Identity Theft Protection Act, or other laws relating to security and privacy of Protected Information, except where the other party or its Subcontractor, employee or Agent is a named adverse party.

13. No Third Party Beneficiaries. Nothing express or implied in this Addendum is intended to confer, nor shall anything herein confer, upon any person other than CE, Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.

14. Effect on Contract. Except as specifically required to implement the purposes of this Addendum, or to the extent inconsistent with this Addendum, all other terms of the Contract shall remain in force and effect. This Addendum is incorporated into the Contract as if set forth in full therein. The parties expressly acknowledge and agree that sufficient mutual consideration exists to make this Addendum legally binding in accordance with its terms. Associate and CE expressly waive any claim or defense that this Addendum is not part of the Agreement between the parties under the Contract.

15. Interpretation and Order of Precedence. This Addendum is incorporated into and becomes part of each Contract identified herein. Together, this Addendum and each separate Contract constitute the Agreement of the parties with respect to their Business Associate relationship under HIPAA and the HIPAA Rules. The provisions of this Addendum shall prevail over any provisions in the Contract that may conflict or appear inconsistent with any provision in this Addendum. This Addendum and the Contract shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA Rules, and applicable state laws. The parties agree that any ambiguity in this Addendum shall be resolved in favor of a meaning that complies and is consistent with HIPAA, the HIPAA Rules, and applicable state laws. This Addendum supersedes and replaces any previous separately executed HIPAA addendum between the parties. In the event of any conflict between the mandatory provisions of the HIPAA Rules and the provisions of this Addendum, the HIPAA Rules shall control. Where the provisions of this Addendum differ from those mandated by the HIPAA Rules, but are nonetheless permitted by the HIPAA Rules, the provisions of this Addendum shall control.

16. Effective Date. This Addendum is effective upon receipt of the last approval necessary and the affixing of the last signature required until the completion of the same contract year.

17. Survival of Certain Contract Terms. Notwithstanding anything herein to the contrary, Associate’s obligations under Section 5(d) (Effect of Termination) and record retention laws and Section 13 (No Third Party Beneficiaries) shall survive termination of this Agreement and shall be enforceable by CE as provided herein in the event of such failure to perform or comply by the Associate.

18. Representatives and Notice.

a. Representatives. For the purpose of this Addendum, the individuals identified in the Contract shall be the representatives of the respective parties. If no representatives are identified in the Contract, the individuals listed below are hereby designated as the parties’ respective representatives for purposes of this Addendum. Either party may from time to time designate in writing new or substitute representatives.

b. Notices. Except as otherwise provided in this Addendum, all required notices shall be in writing and shall be hand delivered or given by certified or registered mail to the representatives at the addresses set forth below.

Covered Entity Representative:

Name: Elizabeth Harrison Title: Business Process Owner Department & Division: Benefit Plan Design – Office of Retirement Services Address:530 W Allegan St.

Lansing, MI 48909

(517) 284-4565 harrisone3@michigan.gov with copy to:

Mary Ostrowski Category Specialist, Services

DTMB CPS

525 W Allegan St Lansing, MI 48933

(517) 249-0438 ostrowskim@michigan.gov Business Associate Representative:

Name:

Title:

Department:

Address:

Phone:

Email:

Any notice given to a party under this Addendum shall be deemed effective, if addressed to such party, upon: (i) delivery, if hand delivered; or (ii) the third (3rd) business day after being sent by certified or registered mail.

IN WITNESS WHEREOF, the parties hereto have duly executed this Addendum as of the Addendum Effective Date.

Associate

Covered Entity

[INSERT NAME]

By:_______________________________

Michigan Office of Retirement Services

By:________________________________

Print Name: ________________________

Print Name:_________________________

Title:______________________________

Date:______________________________

Title:_______________________________

Date:_______________________________

ATTACHMENT A

This Attachment sets forth additional terms to the HIPAA Business Associate Addendum dated ____________________, between __________________ and _________________ (Addendum) and is effective as of (the Attachment Effective Date). This Attachment applies to the specific contracts listed below covered by the Addendum. This Attachment may be amended from time to time as provided in Section 11(b) of the Addendum.

1. Specific Contract Covered. This Attachment applies to the following specific contract covered by the Addendum:________________________________________

2. Additional Permitted Uses. In addition to those purposes set forth in Section 2(a) of the Addendum, Associate may Use Protected Information as follows: Associate may use de-identified PHI for book of business research, benchmarking, analyses, cost comparisons or other purposes of Associate. All de-identification of Protected Health Information will be done in accordance with the HIPAA Rules.

3. Additional Permitted Disclosures. In addition to those purposes set forth in Section 2(b) of the Addendum, Associate may Disclose Protected Information as follows:

4. Subcontractor(s). The parties acknowledge that the following subcontractors or agents of Associate shall receive Protected Information in the course of assisting Associate in the performance of its obligations under the Contract and the Addendum:

5. Receipt. Associate’s receipt of Protected Information pursuant to the Contract and Addendum shall be deemed to occur as follows, and Associate’s obligations under the Addendum shall commence with respect to such Protected Information upon such receipt:

6. Additional Restrictions on Use of Data. CE is a Business Associate of certain other Covered Entities and, pursuant to such obligations of CE, Associate shall comply with the following restrictions on the Use and Disclosure of Protected Information:

7. Additional Terms. [This section may include specifications for disclosure format, method of transmission, use of an intermediary, use of digital signatures or PKI, authentication, additional security of privacy specifications, de-identification or re-identification of data and other additional terms.]

Associate

Covered Entity

[INSERT NAME]

By:_______________________________

Michigan Office of Retirement Services

By:_______________________________

Print Name: ________________________

Print Name: ________________________

Title:______________________________

Title: ______________________________

Date:______________________________

Date:______________________________