HIPAA_Business_Associate_Agreement-1.pdf

TC-0151 (Rev. 7/24) RDA 11266

HIPAA Business Associate Agreement THIS HIPAA BUSINESS ASSOCIATE AGREEMENT (“Agreement”) is between The State of Tennessee, Division of TennCare (“TennCare” or “Covered Entity”), located at 310 Great Circle Road, Nashville, TN 37228 and (“Business Associate”), located at , including all office locations and other business locations at which Business Associate data may be used or maintained. Covered Entity and Business Associate may be referred to herein individually as “Party” or collectively as “Parties.”

BACKGROUND

The Parties acknowledge that they are subject to the Privacy and Security Rules (45 C.F.R. Parts 160 and 164) promulgated by the United States Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Public Law 104-191, and as amended by the final rule modifying the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act (“HITECH”). If Business Associate provides services to Covered Entity pursuant to one or more contractual relationships, said agreements are detailed below and hereinafter referred to as “State Contract” or “State Contracts.”

LIST OF STATE CONTRACTS AFFECTED BY THIS HIPAA BUSINESS ASSOCIATE

AGREEMENT:

In the course of performing services under the State Contract(s), Business Associate may come into contact with, use, or disclose Protected Health Information (“PHI”). Said State Contract(s) is/are hereby incorporated by reference and shall be considered part of this Agreement as if the State Contract(s) was/were fully included herein.

In accordance with the federal privacy and security rules and regulations set forth at 45 C.F.R. Part 160 and Part 164, Subparts A, C, D, and E, which require Covered Entity to have a written memorandum with each of its Business Associates, the Parties agree to establish satisfactory assurances that Business Associate will appropriately safeguard PHI that Business Associate receives from or on behalf of Covered Entity, and therefore, the Parties execute this Agreement.

In the case of any conflict, discrepancy, or ambiguity, between this Agreement and the State Contract(s), this Agreement shall govern as relating to the conflict, discrepancy, or ambiguity only. Absent any conflict, discrepancy, or ambiguity between this Agreement and the State Contract(s), the State Contract governs.

1. DEFINITIONS

All capitalized terms used but not otherwise defined in this Agreement shall have the same meaning as the defined terms in 45 C.F.R. Parts 160 through 164, or other applicable law or regulation. A reference in this Agreement to the Privacy or Security Rule means the rule or section as in effect as of the date of this Agreement or as amended after the execution of this Agreement.

1.1 “Commercial Use” means obtaining PHI with the intent to sell, transfer or use it for commercial or personal gain, or malicious harm; selling to a third party for consumption, resale, or processing for resale; applying or converting data to make a profit or obtain a benefit contrary to the spirit of this Agreement, including but not limited to, presentation of data or examples of data in a presentation, conference, or meeting setting, with a goal of obtaining or gaining new business.

1.2 “Confidential Information” shall mean any non-public, confidential, or proprietary information, whether written, graphic, oral, electronic, visual or fixed in any tangible medium or expression, which is supplied by TennCare to Business Associate under this Agreement. Any information, whether written, graphic, oral, electronic, visual or fixed in any tangible medium or expression, relating to any individual enrolled in the TennCare program (“TennCare Enrollee”), or relating to individual(s) who may potentially enroll in the TennCare program, provided to or obtained through Business Associate’s performance under this Agreement, shall also be treated as Confidential Information to the extent that confidential status is afforded under state and federal laws or regulations to the information provided to, or obtained through, Business Associate’s performance. All Confidential Information shall not be subject to disclosure under the Tennessee Public Records Act.

1.3 “Electronic Signature(s)” means an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record.

1.4 “Marketing” shall have the meaning under 45 C.F.R. § 164.501 and shall include the act or process of promoting, selling, leasing, or licensing any TennCare information or data for profit, advantage, benefit, or similar goal, without the express written permission of TennCare.

2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE (PRIVACY RULE)

2.1 Compliance with the Privacy Rule. Business Associate shall fully comply with the requirements under the Privacy Rule applicable to "business associates," as that term is defined in the Privacy Rule, and not use or further disclose PHI other than as permitted or required by this Agreement, the State Contract(s), or as required by law.

2.2 HIPAA and HITECH Compliance. HITECH and its implementing regulations impose requirements on business associates with respect to privacy, security, and Breach notification. Business Associate hereby acknowledges and agrees that it is functioning as a Business Associate of Covered Entity as obligated by this Agreement and the State Contract(s). Business Associate further acknowledges that it shall comply with any applicable provisions of HIPAA and HITECH. Business Associate and Covered Entity further agree that the provisions of HIPAA and HITECH that apply to business associates, and that are required to be incorporated by reference in a business associate agreement, have been incorporated into this Agreement between Business Associate and Covered Entity. Even if a provision of HIPAA or HITECH is not specifically set forth in this Agreement, all applicable provisions of HIPAA and HITECH are incorporated into this Agreement in their entirety.

2.3 Business Management. Business Associate may use and disclose PHI for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate. Business Associate may provide data aggregation services relating to the Health Care Operations of TennCare, or as required by law. Business Associate is expressly prohibited from using or disclosing PHI other than as permitted by this Agreement, any associated State Contract(s), or as otherwise required by law, and is prohibited from uses or disclosures of PHI that would not be permitted if done by Covered Entity.

2.4 Privacy Safeguards and Policies. Business Associate shall use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by the State Contract(s), this Agreement, or as required by law. This includes the implementation of Administrative, Physical, and Technical Safeguards to appropriately protect Covered Entity’s PHI against any reasonably anticipated threats or hazards utilizing the technology commercially available to Business Associate (See also Agreement Section 3.2). Business Associate shall maintain, a n d provide to TennCare when requested, appropriate documentation of Business Associate’s compliance with the Privacy Rule, except when Business Associate is required by TennCare policies and procedures to provide compliance documents on an established timeframe without request from TennCare. Appropriate documentation of compliance with the Privacy Rule includes, but i s not limited to, Business Associate’s policies and procedures, records of training, records of breaches, and sanctions of members of its Workforce.

2.5 Privacy Provisions in Business Associate Contracts. Business Associate shall require any agent, including a subcontractor, to whom it provides PHI received from, maintained, created, or received by Business Associate on behalf of Covered Entity, or that carries out any duties for Business Associate involving the use, custody, disclosure, creation of, or access to, PHI or other confidential TennCare information, to enter into a written contract that is substantially similar to this Agreement with respect to all privacy provisions. Said substantially similar written contract shall not include less stringent terms or restrictions than this Agreement with Business Associate with respect to the privacy provisions, except for Agreement Section 4.4.2, which shall only apply to Business Associate notwithstanding the requirements in this Agreement Section 2.5.

2.6 Mitigation of Harmful Effect of Violations. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Agreement. Business Associate also agrees to consult with TennCare about any mitigation efforts.

2.7 Reporting of Violations and Reasonably Suspected Violations in Use and Disclosure of PHI. Business Associate shall require its employees, agents, and subcontractors to promptly report to Business Associate immediately upon becoming aware, or upon reasonable suspicion, of any use or disclosure or reasonably suspected use or disclosure of PHI in violation of, or otherwise not provided by, this Agreement. Business Associate shall make its report to Covered Entity immediately upon becoming aware of any use or disclosure or reasonably suspected use or disclosure of PHI not provided by this Agreement, and in no case shall the Business Associate take longer than forty-eight (48) hours to report the discovery to Covered Entity. Reports shall be submitted as provided for in Agreement Section 3.5.

2.8 Breach of Unsecured Protected Health Information. As required by the Breach Notification Rule, Business Associate shall, and shall require its subcontractor(s) to, maintain systems to monitor and detect a Breach of Unsecured PHI whether in paper or electronic form.

2.8.1 Business Associate shall provide to Covered Entity notice of a Breach of Unsecured PHI or a suspected

Breach of Unsecured PHI immediately upon becoming aware or upon reasonable suspicion of the Breach, and in no case later than forty-eight (48) hours after becoming aware or upon reasonable suspicion. Notice shall be submitted as provided for in Agreement Section 3.5.

2.8.2 Business Associate shall cooperate with Covered Entity by timely providing the appropriate and necessary information to Covered Entity, as reasonably anticipated or otherwise requested by Covered Entity.

2.8.3 Covered Entity shall make the final determination on whether the Breach requires notification to affected individuals and whether the notification shall be made by Covered Entity or Business Associate.

2.9 Access of Individual to PHI. In the event an Individual requests access to PHI and Business Associate’s participation is necessary to comply with the request, Business Associate agrees to timely respond as further outlined below.

2.9.1 Requests Submitted to Covered Entity that Require Business Associate’s Participation. Covered Entity shall forward to Business Associate in a timely manner any Individual’s request for access to or a copy of the Individual’s PHI, in any form the Individual chooses if the PHI is readily producible in that format.

2.9.2 Requests Submitted to Business Associate.

(a) If Business Associate receives PHI from Covered Entity in a Designated Record Set, Business

Associate agrees to provide access to PHI in a Designated Record Set to Covered Entity to meet the requirements of 45 C.F.R. § 164.524.

(b) If Business Associate receives a request from an Individual for a copy of the Individual's PHI, and the PHI is in the sole possession of Business Associate, Business Associate will provide the requested copy to the Individual as specified in 2.9.3(a). If Business Associate provides copies of PHI to the Individual, it may charge a reasonable fee for the copies as permitted by applicable regulations. Business Associate is permitted to send to an Individual or Individual’s designee unencrypted emails including Electronic PHI if the Individual requests it, provided Business Associate has advised the Individual of the associated risk and the Individual still chooses to receive the message by unencrypted email.

(c) If Business Associate receives a request for PHI not in its possession and in the possession of Covered Entity or receives a request to exercise other Individual rights as set forth in the Privacy Rule, Business Associate shall promptly forward the request to Covered Entity. Business Associate shall then assist Covered Entity, as necessary, in responding to the request timely.

2.9.3 Timeframes for Response.

(a) The Parties understand that if either Party receives a request for access to or copies of PHI from an Individual that the Party may complete with only its own onsite information, the time for providing a response to the Individual shall be no more than thirty (30) days, or a timeframe otherwise in compliance with 45 C.F.R. § 164.524. Business Associate shall also notify Covered Entity upon completion of the request.

(b) If Covered Entity receives a request from an Individual for access to or copies of PHI, and requires information from Business Associate in addition to Covered Entity’s onsite information to fulfill the request, Business Associate shall have no more than fifteen (15) days, from the date of Covered Entity’s notice, to provide access or deliver such information to Covered Entity so that Covered Entity may timely respond to the Individual within the thirty (30) day requirement of 45 C.F.R. § 164.524.

(c) If the Party responsible for responding to the Individual’s request for access to or copies of PHI is unable to complete the response to the request in the required timeframe, the responsible Party shall provide the Individual, or Individual’s designee, with a written statement of the reasons for the delay and the date by which the Party will complete its action on the request. The Party may extend the response one (1) time for no more than thirty (30) additional days.

2.10 Individual’s Request to Amend PHI. If Business Associate receives PHI from Covered Entity in a Designated Record Set and an Individual requests to amend PHI, Business Associate agrees to make any amendments to PHI in a Designated Record Set that Covered Entity directs or agrees to pursuant to 45 C.F.R. § 164.526. Business Associate shall make the amendment promptly in the time and manner designated by Covered Entity and shall notify Covered Entity upon completion. Business Associate shall have thirty (30) days from Covered Entity’s notice to complete the amendment to the Individual’s PHI.

2.11 Recording of Designated Disclosures of PHI. Business Associate shall document any and all disclosure(s) of PHI by Business Associate or its agents, including information related to such disclosures, as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528.

2.12 Accounting for Disclosures of PHI. In the timeframe and manner designated by Covered Entity, Business Associate agrees to provide to Covered Entity, or an Individual or Individual’s designee, information collected in accordance with this Agreement to enable Covered Entity to respond to a request from an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. Covered Entity shall forward the Individual’s request requiring the participation of Business Associate to Business Associate in a timely manner, after which Business Associate shall provide the accounting of disclosures of PHI to Covered Entity as follows:

(a) If Covered Entity directs Business Associate to provide an accounting of disclosures of the Individual’s

PHI directly to the Individual, Business Associate shall have sixty (60) days from the date of the Individual’s request to provide access or deliver such information to the Individual or Individual’s designee. Covered Entity shall provide notice to Business Associate in time to allow Business Associate a minimum of thirty (30) days to timely complete the Individual’s request.

(b) If Covered Entity elects to provide the accounting to the Individual, Business Associate shall have thirty

(30) days from the date of Covered Entity’s notice requesting information for the Accounting to Covered Entity so that Covered Entity may timely respond to the Individual within the sixty (60) day period.

(c) If either Party is unable to complete the response to the request in the timeframes provided in 2.12(a) or 2.12(b), the Party to complete the response shall notify the Individual with a written statement of the reasons for the delay and the date by which the Party will complete its action on the request. The Parties may extend the response to Individual or Individual’s designee one (1) time for no more than thirty (30) additional days.

(d) The accounting of disclosures shall include at least the following information:

(1) date of the disclosure;

(2) name of the third party to whom the PHI was disclosed,

(3) if known, the address of the third party;

(4) brief description of the disclosed information; and

(5) brief explanation of the purpose and basis for such disclosure.

(e) The Parties shall provide one (1) accounting in any twelve (12) months to the Individual or Individual’s designee without charge. The Parties may charge a reasonable, cost-based fee, for each subsequent request for an accounting by or regarding the same Individual if Individual or Individual Designee is provided notice and the opportunity to modify the request. Such charges shall not exceed any applicable State statutes or rules.

2.13 Minimum Necessary. Business Associate shall use reasonable efforts to limit any use, disclosure, or request for use or disclosure, of PHI to the minimum amount necessary to accomplish the intended purpose of the use, disclosure, or request in accordance with the requirements of the Privacy Rule. Reasonable efforts may include, but are not limited to, application of recognized industry standards on data minimization and retention privacy controls.

2.13.1 Business Associate represents to Covered Entity that all Business Associate’s uses and disclosures of, or requests for, PHI shall be the minimum necessary in accordance with the Privacy Rule requirements.

2.13.2 Covered Entity may, pursuant to the Privacy Rule, reasonably rely on any requested disclosure from

Business Associate as the minimum necessary for the stated purpose.

2.13.3 Business Associate shall adequately and properly maintain all PHI received from, or created or received on behalf of, Covered Entity. Properly maintaining PHI shall include, but is not limited to, use of reasonable efforts to timely deidentify or destroy PHI Business Associate receives that is irrelevant or unnecessary for the purposes of this Agreement and any State Contract(s).

2.14 Privacy Compliance Review Upon Request. Business Associate agrees to provide its internal practices, books and records, and policies and procedures, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity, to Covered Entity or the Secretary of the United States Department of Health in Human Services or the Secretary’s designee, in a timeframe and manner designated by the requester for purposes of determining Covered Entity’s or Business Associate’s compliance with the Privacy Rule.

2.15 Cooperation in Privacy Compliance. Business Associate agrees to fully cooperate in good faith and to assist Covered Entity in complying with the requirements of the Privacy Rule.

3. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE (SECURITY RULE)

3.1 Compliance with Security Rule. Business Associate shall fully comply with the requirements of the Security Rule applicable to "Business Associates", as the term is defined in the Security Rule. In the case of any conflict, ambiguity, or discrepancies in language between this Agreement and the State Contract(s), this Agreement governs as to the applicable conflict, ambiguity, or discrepancies in language. If no conflict, ambiguity, or discrepancy in language exists, the State Contract governs.

3.2 Security Safeguards and Policies. Business Associates shall implement and maintain information security policies that comply with the HIPAA Security Rule. Business Associate shall implement Administrative, Physical, and Technical Safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity as required by the Security Rule. This includes specifically, but is not limited to, the utilization of technology commercially available to Business Associate to protect Covered Entity’s PHI against any reasonably anticipated threats or hazards.

Business Associate understands that it has an affirmative duty to perform a regular review or assessment of security risks, conduct active risk management, and supply best efforts to assure that only authorized persons, entities, programs, or applications, and devices access its computing systems and information storage, and that only authorized transactions are allowed. Business Associate will maintain appropriate documentation of its compliance with the Security Rule.

3.3 Security Provisions in Business Associate Contracts. Business Associate shall ensure that any agent or subcontractor to whom Business Associate provides Electronic PHI received from, maintained, or created for Covered Entity, or that carries out any duties for Business Associate involving the use, custody, disclosure, creation of, or access to PHI supplied by Covered Entity, shall execute a contract with Business Associate (or the appropriate equivalent if the agent is a government entity) that is substantially similar to this Agreement with no less stringent restrictions and conditions as the security provisions are in this Agreement, except for the provision in Section 4.4.2.

3.4 Reporting of Security Incidents. Business Associate shall track all Security Incidents as defined and as required by HIPAA and shall periodically report a summary of the Security Incidents as may be requested by Covered Entity. For the purposes of reporting, Covered Entity shall not consider as Security Incidents, external activities (e.g., port enumeration) typically associated with the “footprinting” of a computing environment as long as such activities have only identified, but not compromised, the logical network perimeter including but not limited to externally facing firewalls and web servers. Business Associate shall reasonably use its own vulnerability assessment of damage potential and monitoring to define levels of Security Incidents and responses for Business Associate’s operations. However, Business Associate shall expediently notify Covered Entity’s Privacy Officer of any related Security Incident immediately upon becoming aware or upon reasonable suspicion of any unauthorized acquisition, including but not limited to, the use, disclosure, modification, or destruction of PHI, by an employee or otherwise authorized or unauthorized user of its system.

3.4.1 Business Associate identifies the following key contact person(s) for all matters relating to this Agreement:

Business Associate shall notify Covered Entity in writing of any change in the key contact(s) during the term of this Agreement within ten (10) business days of the change.

3.5 TennCare Contact for Privacy and Security Incident Notice. Notification for the purposes of Agreement Sections 2.7, 2.8 and 3.4 shall be made in writing immediately upon becoming aware, or upon reasonable suspicion, of the event. Written notice may be submitted via TennCare’s privacy incident reporting form if accessible to Business Associate, email, certified mail, or overnight parcel to:

Division of TennCare Attention: Privacy Office 310 Great Circle Rd.

Nashville, Tennessee 37243 Phone: (866) 797-9469 Email: Privacy.Tenncare@tn.gov

3.6 Security Compliance Review upon Request. Business Associate shall provide its internal practices, books, records, and policies and procedures relating to the security of Electronic PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity, to Covered Entity or the Secretary of the United States Department of Health in Human Services or the Secretary’s designee, in a time and manner designated by the requester for purposes of determining Covered Entity’s or Business Associate’s compliance with the Security Rule.

3.7 Cooperation in Security Compliance. Business Associate shall fully cooperate in good faith to assist Covered Entity in complying with the requirements of the Security Rule.

3.8 Refraining from intimidation or retaliation. Covered Entity or Business Associate may not threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any Individual or other person for: (a) Filing of a complaint under 45 C.F.R. § 160.306; (b) testifying, assisting, or participating in an investigation, compliance review, proceeding, or hearing; or (c) opposing any act or practice made unlawful, provided the Individual or person has a good faith belief that the practice opposed is unlawful, and the manner of opposition is reasonable and does not involve a disclosure of PHI in violation of HIPAA.

4. USES AND DISCLOSURES BY BUSINESS ASSOCIATE

4.1 Use and Disclosure of PHI for Operations on Behalf of Covered Entity. Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI to perform Treatment, Payment, or Health Care Operations for or on behalf of Covered Entity as specified in the State Contract(s), provided that such use or disclosure would not violate the Privacy and Security Rule if done by Covered Entity.

4.2 Business Associate Uses of PHI. Except as otherwise limited in this Agreement, Business Associate may disclose PHI as required for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that the disclosures are required by law and are also permitted by this Agreement and the State Contract(s). Nothing in this Agreement Section 4.2 permits, or should be construed as permitting, the Business Associate to use PHI for Marketing or Commercial Use.

4.3 Third Party Disclosure Confidentiality. If Business Associate discloses any PHI to a third party for a purpose permitted under 4.2, Business Associate agrees that it shall enter into a written agreement with such third party requiring the third party to: (a) maintain the confidentiality, integrity, and availability of PHI and not to use or further disclose PHI except as required by law or for the purpose for which it was disclosed; and (b) notify Business Associate of any instances where third party becomes aware that the confidentiality, integrity, and/or availability of the PHI is Breached.

4.4 Prohibited Uses and Disclosures. Nothing in this Agreement shall authorize Business Associate to share, use or disclose PHI via any form or medium for the purposes outlined in Agreement Subsections 4.4.1 through 4.4.4.

mailto:Privacy.Tenncare@tn.gov

4.4.1 Marketing and Commercial Use. Business Associate shall not share, use, or disclose PHI for the purposes of selling, Marketing, or any Commercial Use, or for any purpose construed by Covered Entity as the selling, Marketing, or Commercial Use of TennCare Enrollee personal or financial information with affiliates or otherwise, even if such sharing would be permitted by federal or state laws.

4.4.2 Offshore Disclosure. Business Associate shall not share, use, or disclose PHI with any third party beyond the boundaries and jurisdiction of the United States without express written authorization from Covered Entity.

4.4.3 Genetic Information for Underwriting Purposes. Business Associate shall not use or disclose PHI that is Genetic Information for underwriting purposes.

4.4.4 Other Uses and Disclosures Strictly Prohibited. Nothing in this Agreement shall permit Business Associate to share PHI with Business Associate’s affiliates, contractors, subcontractors, or other third parties, except for the purposes of the State Contract(s) identified in the “LIST OF STATE CONTRACTS AFFECTED BY THIS HIPAA BUSINESS ASSOCIATE AGREEMENT” on page one (1) of this Agreement.

4.5 Covered Entity Authorization for Additional Uses. Any use of PHI or other Confidential Information by Business Associate, its subcontractors, its affiliates, or Contractors, other than the use permitted for the purposes of this Agreement, shall require express written authorization by Covered Entity, and a Business Associate Agreement or amendment as necessary. Activities which are prohibited include, but are not limited to, Marketing, sharing for Commercial Use, or any purpose construed by Covered Entity as Marketing or Commercial use of TennCare Enrollee personal or financial information with affiliates, even if such sharing would be permitted by federal or state laws.

4.6 Data Use Agreement - Use and Disclosure of Limited Data Set. Business Associate may use and disclose a Limited Data Set that Business Associate creates for Research, public health activity, or Health Care Operations, provided Business Associate complies with the obligations in Agreement Section 3.2 and this Agreement. Business Associate may not make such use and disclosure of the Limited Data Set after any cancellation, termination, expiration, or other conclusion of this Agreement.

4.7 Limitation on Permitted Uses and Disclosures. Business Associate will limit the uses and disclosures of the Limited Data Set to the following: Research, public health activity, or Health Care Operations, to the extent such activities are related to covered functions. Covered functions for purposes of this Agreement Section 4.7 shall include business planning and development, such as: conducting cost-management and planning-related analysis related to managing and operating Business Associate’s functions; formulary development and administration;

development and improvement of methods of payment or coverage policies; and customer service, including the provision of data analysis for policy holders, plan sponsors, or other customers to the extent such activities are related to covered functions. The listed covered functions shall only be permitted if PHI is not disclosed, and disclosure is not prohibited pursuant to any other provisions in this Agreement.

5. OBLIGATIONS OF COVERED ENTITY

5.1 Notice of Privacy Practices. Covered Entity shall provide Business Associate with the Covered Entity’s notice of Privacy Practices in accordance with 45 C.F.R. § 164.520, as well as any changes to the notice of Privacy Practices. Notice may be provided via publication on TennCare’s website.

5.2 Notice of Changes in Individual’s Authorization for Access to PHI. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect Business Associate’s permitted or required uses.

5.3 Notice of Restriction in Individual’s Access to PHI. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate's use of PHI.

5.4 Reciprocity for Requests Received by Business Associate. The Parties agree that Agreement Sections 5.2 through 5.3 are reciprocal, to the extent Business Associate is notified or receives an inquiry from any Individual within Covered Entity’s covered population.

6. TERM AND TERMINATION

6.1 Term. This Agreement shall be effective on the date of the last signatory, or on the signature date if all Parties sign on the same day, and shall terminate when all PHI, regardless of form, provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or if the Parties mutually agree in writing that it is unfeasible to return or destroy PHI, Agreement Subsection 6.3.5 below applies.

6.2 Termination for Cause. This Agreement authorizes, and Business Associate acknowledges and agrees, Covered Entity shall have the right to terminate this Agreement and any State Contracts in the event Business Associate fails to comply with or violates a material provision of this Agreement and any provision of the Privacy and Security Rules. Nothing in Agreement Section 6.2 limits the State’s ability to terminate the State Contract as permissible under the State Contract.

6.2.1 Upon Covered Entity’s knowledge of a breach by Business Associate of the terms of this Agreement or any

State Contract (s), Covered Entity shall either:

(a) Provide notice of breach and an opportunity for Business Associate to reasonably and promptly cure the breach or end the violation. If Business Associate does not cure the breach or end the violation within the reasonable time following notice, as specified by Covered Entity, Covered Entity shall terminate this BAA; or

(b) Immediately terminate this BAA if Business Associate has breached a material term of this BAA and cure is not possible.

6.3 Effect of Termination. Upon termination of this Agreement for any reason, except as provided in Agreement

Subsections 6.3.2 and 6.3.5, Business Associate shall at its own expense either return and/or destroy all PHI and other Confidential Information received from Covered Entity or created or received by Business Associate on behalf of Covered Entity. This provision applies to all Confidential Information regardless of form, including but not limited to, electronic or paper format. This provision shall also apply to PHI and other Confidential Information in the possession of subcontractors or agents of Business Associate.

6.3.1 Business Associate shall consult with Covered Entity as necessary to ensure an appropriate means of return or destruction of PHI and Confidential Information and shall notify Covered Entity in writing when such destruction is complete. If PHI or Confidential Information is to be returned, the Parties shall document when all information has been received by Covered Entity.

6.3.2 Agreement Section 6.3 and its Subsections shall not prohibit the retention of a single separate, archived file of the PHI and other confidential TennCare information by Business Associate if the method of such archiving reasonably protects the continued privacy and security of such information and Business Associate obtains written approval at the time of archival from Covered Entity.

Otherwise, neither Business Associate nor its subcontractors and agents shall retain copies of TennCare Confidential Information including enrollee PHI, except as provided herein in Agreement Subsection 6.3.5.

6.3.3 The Parties agree to anticipate the return or the destruction of PHI and other Confidential Information and understand that removal of the Confidential Information from Business Associate’s information system(s) and premises will be expected in almost all circumstances. Business Associate shall notify Covered Entity whether it intends to return or destroy the PHI or Confidential Information with additional detail as requested by Covered Entity. In the event Business Associate determines that returning or destroying the PHI and other Confidential Information received by or created for Covered Entity at the end or other termination of the State Contract(s) is not feasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction unfeasible.

6.3.4 Except for Business Associate agreements in effect prior to April 21, 2005, for the renewal or amendment of those same agreements, or for other unavoidable circumstances, the Parties contemplate that PHI and other Confidential Information of Covered Entity shall not be merged or aggregated with data from sources unrelated to that agreement, or Business Associate’s other business data, including for purposes of data backup and disaster recovery, until the Parties identify the means of return or destruction of the TennCare data or other Confidential Information of Covered Entity at the conclusion of any State Contract(s), or otherwise make an express alternate agreement consistent with the provisions of Agreement Section 6.3 and its Subsections.

6.3.5 Upon written mutual agreement of the Parties that the return or destruction of PHI or Confidential

Information is unfeasible and upon express agreement as to the means of continued protection of the data, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction unfeasible, for so long as Business Associate maintains such PHI.

7. MISCELLANEOUS

7.1 Amendment. The Parties agree to amend this Agreement from time to time as is necessary for Covered Entity or Business Associate to comply with the requirements of the Privacy and Security Rules and the Health Insurance Portability and Accountability Act, Public Law 104-191. Business Associate and Covered Entity shall comply with any amendment to the Privacy and Security Rules, the Health Insurance Portability and Accountability Act, Public Law 104-191, and related regulations upon the effective date of such amendment, regardless of whether this Agreement has been formally amended, including, but not limited to, changes required by the American Recovery and Reinvestment Act of 2009, Public Law 111-5.

7.2 Survival. The respective rights and obligations of Business Associate under applicable confidentiality provisions and Agreement Sections 4 and its Subsections, and 6.3 and its Subsections, shall survive the termination or expiration of this Agreement.

7.3 Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits Covered Entity and Business Associate to comply with the Privacy and Security Rules.

7.4 Headings. Paragraph Headings used in this Agreement are for the convenience of the Parties and shall have no legal meaning in the interpretation of the Agreement.

7.5 Notices and Communications. Except as specified in Agreement Section 3.5, all instructions, notices, consents, demands, or other communications required or contemplated by this Agreement shall be in writing and shall be delivered by electronic mail, hand, by facsimile transmission, by overnight courier service, or by first class mail, postage prepaid, addressed to the respective party at the appropriate facsimile number or address as set forth below, or to such other party, facsimile number, or address as may be hereafter specified by written notice. (For purposes of Agreement Section 7.6, effective notice to “Respective Party” is not dependent on whether the person named below remains employed by such Party). The Parties agree to use their best efforts to immediately notify the other Party of changes in address, telephone number, and fax numbers and to promptly supplement this Agreement as necessary with corrected information.

Notifications relative to Agreement Sections 2.7, 2.8 and, 3.4 of this Agreement need only be reported to the Privacy Office pursuant to Agreement Section 3.5.

COVERED ENTITY: BUSINESS ASSOCIATE:

Stephen Smith, Director Division of TennCare 310 Great Circle Rd.

Nashville, TN 37243 Fax: (615) 253-5607

All instructions, notices, consents, demands, or other communications shall be considered effectively given as follows: on the date of hand delivery; on the date specified for overnight courier service delivery; as of three (3) business days after the date of mailing by first class mail postage prepaid; on the day the facsimile transmission is received mechanically by the facsimile machine at the receiving location and receipt is verbally confirmed by the sender; or via electronic submission as approved or as directed by TennCare.

7.6 Transmission of PHI or Other Confidential Information. Regardless of the transmittal methods permitted above, Covered Entity and Business Associate agree that all deliverables set forth in this Agreement that are required to be in the form of data transfers shall be transmitted between Covered Entity and Business Associate via the data transfer method specified in advance by Covered Entity. This may include, but shall not be limited to, transfer through Covered Entity’s SFTP system. Failure by Business Associate to transmit such deliverables in the manner specified by Covered Entity may, at the option of Covered Entity, result in liquidated damages as set forth in one (1) or more of the State Contracts between Covered Entity and Business Associate listed above. All such deliverables shall be considered effectively submitted upon receipt or recipient confirmation as may be required.

7.7 Strict Compliance. No failure by any Party to insist on strict compliance with any term or provision of this Agreement, to exercise any option, to enforce any right, or to seek any remedy upon any default of any other Party shall affect, or constitute a waiver of, any Party's right to insist on strict compliance, exercise that option, enforce that right, or seek that remedy with respect to the default or any prior, contemporaneous, or subsequent default. No custom or practice of the Parties at variance with any provision of this Agreement shall affect, or constitute a waiver of, any Party's right to demand strict compliance with all provisions of this Agreement.

7.8 Severability. With respect to any provision of this Agreement finally determined by a court of competent jurisdiction to be unenforceable, such court shall have jurisdiction to reform such provision so that it is enforceable to the maximum extent permitted by applicable law, and the Parties shall abide by such court's determination. If any provision of this Agreement cannot be reformed, such provision shall be deemed to be severed from this Agreement and all other provisions of this Agreement shall remain in full force and effect.

7.9 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of Tennessee except to the extent that Tennessee law has been pre-empted by HIPAA and HITECH and without giving effect to principles of conflicts of law.

7.10 Compensation. There shall be no remuneration for performance under this Agreement except as specifically provided by, in, and through, existing administrative requirements of Tennessee State government and State Contract(s) referenced herein.

7.11 Validity of Execution. Unless otherwise agreed, the Parties may conduct the execution of this Business Associate Agreement transaction by electronic means. The parties may agree that an electronic record of the Agreement containing Electronic Signatures is valid as an executed Agreement.

IN WITNESS WHEREOF, the Parties execute this Agreement to be valid and enforceable from the latest dated signature set out below or on the date of signatures if both Parties sign on the same date:

DIVISION OF TENNCARE BUSINESS ASSOCIATE

By: By:

Stephen Smith, Director Date: Date:

Division of TennCare 310 Great Circle Road Nashville, TN 37243 Fax: (615) 253-5607