Exhibit 2 to Schedule E HIPAA BAA.docx

EXHIBIT 2 to Schedule E – HIPAA BAA RFP No. 260000002410

HIPAA BUSINESS ASSOCIATE AGREEMENT

The parties to this Business Associate Agreement (“Agreement”) are the State of Michigan State Health Plan (“Covered Entity”) and [Insert Contractor Name] (“Business Associate”).

RECITALS

AGREEMENT

Business Associate agrees to:

a. use and disclose PHI only as permitted or required by HIPAA and this Agreement or as required by law.

b. implement and use appropriate safeguards and comply with Subpart C of 45 CFR 164 regarding electronic protected health information, to prevent use or disclosure of PHI other than as provided in this Agreement. Business Associate must maintain, and provide a copy to the Covered Entity within 10 days of a request from the Covered Entity, a comprehensive written information privacy and security program that includes security measures that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI relative to the size and complexity of Business Associate’s operations and the nature and the scope of its activities.

(1) for the proper management and administration of Business Associate or to carry out its legal responsibilities; provided, however, either (A) the disclosures are required by law, or (B) Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached;

(2) as required by law;

(3) for Data Aggregation services relating to the health care operations of the Covered Entity;

(4) to de-identify, consistent with 45 CFR 164.514(a) – (c), PHI it receives from the Covered Entity. If Business Associates de-identifies the PHI it receives from the Covered Entity, Business Associate may use the de-identified information for any purpose not prohibited by the HIPAA Rules; and

(5) In conformance with the provisions and requirements set forth in HIPAA, Business Associate may use PHI to create De-Identified Health Information and Limited Data Sets containing the minimum necessary amount of PHI reasonably needed for Research, Public Health or Health Care Operations activities; and

(6) may use and disclose a Limited Data Set for Research, Public Health or Health Care Operations purposes. Business Associate may make such use and disclosure of the Limited Data Set after any cancellation, termination, expiration, or other conclusion of the underlying agreement between Business Associate and Covered Entity.

Covered Entity agrees to:

a. use its Security Measures to reasonably and appropriately maintain and ensure the confidentiality, integrity, and availability of PHI transmitted to Business Associate under this Agreement until the PHI is received by Business Associate.

b. provide Business Associate with a copy of its Notice of Privacy Practices and must notify Business Associate of any limitations in the Notice of Privacy Practices of the Covered Entity under 45 CFR 164.520 to the extent that such limitation may affect Business Associate’s use or disclosure of PHI.

c. notify Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose the individual’s PHI to the extent that such changes may affect Business Associate’s use or disclosure of PHI.

d. notify Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by under 45 CFR 164.522 to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

e. Covered Entity shall ensure that the data it transmits, or direct another entity to transmit, to Business Associate, is timely, complete, minimum necessary and accurate, contains no social security numbers.

Termination for cause is subject to 6.b:

(1) retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

(2) return to Covered Entity (or, if agreed to by the Covered Entity in writing, destroy) the remaining PHI that Business Associate still maintains in any form;

(3) continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information to prevent use or disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate retains the PHI;

(4) not use or disclose the PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set out at Section 3(a)(1) which applied before termination; and

(5) return to Covered Entity (or, if agreed to by Covered Entity in writing, destroy) the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

Covered Entity Representative:

Bethany C. Beauchine Bureau of Benefits Administration Director Michigan Civil Service Commission P.O. Box 30002 Lansing, MI 48909 517-284-0086 beauchineb@michigan.gov with copy to:

Mary Ostrowski Category Specialist, Services

DTMB CPS

525 W Allegan St Lansing, MI 48933

(517) 249-0438 ostrowskim@michigan.gov Business Associate Representative:

Name:

Title:

Department:

Address:

Phone:

Email:

Any notice given to a party under this Agreement shall be deemed effective, if addressed to such party, upon: (i) delivery, if hand delivered; or (ii) the third Business Day after being sent by certified or registered mail.

Covered Entity State of Michigan State Health Plan Business Associate [Insert Contractor Name]

By: _______________________________

Date: _____________________________

By: ________________________________

Date: _______________________________

Print Name: _______________________

Print Name: _______________________

Title: _____________________________

Title: ______________________________