HMO_Attachment F - BAA.pdf

Revised September 2021 ITN No.: DMS-22/23-072 Attachment F: Privacy, Security, and Confidentiality Business Associate Agreement Page 1 of 11

DMS-22/23-072

THIRD PARTY ADMINISTRATIVE SERVICES FOR HMO HEALTH SERVICES

ATTACHMENT F: PRIVACY, SECURITY, AND CONFIDENTIALITY

BUSINESS ASSOCIATE AGREEMENT

This Privacy, Security, and Confidentiality Business Associate Agreement (“Agreement”) is between the State of Florida, Department of Management Services (“Agency”), and {Insert Contractor Name} (“Business Associate”), with an effective date of the last date of execution below.

WHEREAS, Business Associate has agreed to perform services for or on behalf of the Division of State Group Insurance (“Covered Entity”), a division of the Agency;

WHEREAS, such services may involve the use or disclosure of Protected Health Information that is protected under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act of 2009 (the “HITECH Act”), and the regulations promulgated thereunder; and section 110.123(9), Florida Statutes; and

WHEREAS, this Agreement is intended to satisfy the requirements for Business Associate contracts under 45 C.F.R. § 164, subparts C and E, and the HITECH Act, and to address the confidentiality requirements of section 110.123(9), Florida Statutes.

NOW THEREFORE, in consideration of the mutual covenants provided herein and other good and valuable consideration, Covered Entity hereby agrees to provide certain information to Business Associate, and Business Associate hereby agrees to comply with this Agreement; the applicable provisions of 45 C.F.R. §§ 160 and 164; the HITECH Act; and sections 110.123(9) and 501.171, Florida Statutes; and to assist Covered Entity with its compliance therewith, as follows:

1. DEFINITIONS

Terms used but not otherwise defined in this Agreement shall have the same meaning as defined in 45 C.F.R. §§ 160 and 164 and/or the HITECH Act.

(a) “Agency” means the Department of Management Services, an executive agency of the State of Florida, which includes the Division of State Group Insurance, with its principal place of business at 4050 Esplanade Way, Tallahassee, FL 32399- 0950.

(b) “Agreement” means this Privacy, Security, and Confidentiality Business Associate Agreement.

(c) “Breach” when referring to a breach of PHI means the acquisition, access, use, or disclosure of PHI that is not permitted by 45 C.F.R. § 164, subpart E, which compromises the security or privacy of PHI.

(d) “Business Associate” refers to {Insert Contractor Name}, which hereby agrees to provide services to the Covered Entity as a business associate, as that term is defined in 45 CFR §160.103.

(e) “Business Day” refers to the ordinary business hours of 8:00 a.m. until 5:00 p.m.

E.T., Monday through Friday, inclusive, excluding holidays observed pursuant to section 110.117, Florida Statutes.

(f) “Covered Entity” shall generally have the same meaning as the term “covered

Attachment F: Privacy, Security, and Confidentiality Business Associate Agreement Page 2 of 11 entity” in 45 CFR § 160.103, and in reference to the party to this agreement, shall mean the Division of State Group Insurance, a division of the Agency.

(g) “Contract” means the contract awarded to the Business Associate pursuant to

DMS-22/23-072.

(h) “Health Insurance Portability and Accountability Act of 1996” (“HIPAA”) means 45 C.F.R. §§ 160 and 164.

(i) “Health Information Technology for Economic and Clinical Health Act of 2009” (the “HITECH Act”) means 42 U.S.C. §300jj et seq.; §§17901 et seq.; and any regulations promulgated thereunder.

(j) “Individual” has the same meaning as the term “individual” in 45 C.F.R. § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g).

(k) “Parties” mean collectively the Agency and Business Associate. A “Party” means either the Agency or Business Associate.

(l) “Protected Health Information” (“PHI”) means individually identifiable health information as defined in 45 C.F.R. § 160.103, whether secured or unsecured, and in any format.

(m) “Plans” means the insurance coverages offered through Covered Entity, as authorized in section 110.123, Florida Statutes.

(n) “Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information set forth in 45 C.F.R. § 160 and 45 C.F.R. § 164, subparts A and E, as amended.

(o) “Secretary” means the Secretary of the U.S. Department of Health and Human Services or designee.

(p) “Security Incident” has the same meaning as the term “security incident” in 45 C.F.R. § 164.304, which currently reads, “the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.”

(q) “Security Rule” means the security provisions set forth in 45 C.F.R. § 160 and § 164, subparts A and C, as amended.

(r) “Standard Transaction” has the same meaning as the term “standard transaction” in 45 C.F.R. § 162.103.

2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE

Business Associate agrees to:

(a) Comply with all applicable provisions of 45 C.F.R. §§ 160 and 164, subparts A, C, and E; the HITECH Act; sections 110.123(9) and 501.171, Florida Statutes; and the terms of this Agreement.

(b) Not use or disclose PHI other than as permitted or required by this Agreement or

Attachment F: Privacy, Security, and Confidentiality Business Associate Agreement Page 3 of 11 as required under federal or Florida law.

(c) Ensure the confidentiality, integrity, and availability of all PHI Business Associate creates, receives, maintains, or transmits.

(d) Ensure that every agent and subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees to and complies with the restrictions, conditions, and requirements contained in this Agreement, HIPAA, and the HITECH Act.

(e) Make any amendment(s) to PHI in a designated record set that Covered Entity or an Individual directs or agrees to pursuant to 45 C.F.R. § 164.526 in a prompt and reasonable manner and to take other measures as necessary to satisfy Covered Entity’s obligation(s) under 45 C.F.R. § 164.526.

(f) Create and retain all records necessary to determine compliance with HIPAA, the HITECH Act, and any other applicable federal or Florida law.

(g) Make its internal practices, books, and records available to the Secretary in a time and manner designated by Covered Entity or the Secretary, for purposes of determining compliance with HIPAA and the HITECH Act.

(h) Cooperate with any investigations by the Secretary to determine compliance with HIPAA and the HITECH Act.

(i) Document disclosures of PHI and provide to an Individual, at the request of Covered Entity or an Individual, an accounting of such disclosures in accordance with 45 C.F.R. § 164.528. Business Associate shall assist Covered Entity in complying with HIPAA regulations relating to the required disclosure, amendment, and accounting of disclosures of PHI pursuant to 45 C.F.R. § 164.

(j) Certify that it is in compliance with all applicable provisions of HIPAA standards for electronic transactions and code sets, also known as the “Electronic Data Interchange (“EDI”) Standards,” in accordance with 45 C.F.R. § 162; and the annual guidance as issued by the Secretary pursuant to section 42 U.S.C. § 17931.

Business Associate further agrees to ensure that every agent and subcontractor that conducts Standard Transactions on its behalf agrees to comply with the EDI Standards and the annual guidance.

(k) Use the Minimum Necessary type and amount of PHI required to perform services in accordance with 45 C.F.R. § 164, subpart E.

(l) Comply with all requirements of 45 C.F.R. § 164, subpart E, that apply to Covered Entity to the extent Business Associate carries out any obligations(s) of the Covered Entity under 45 C.F.R. § 164 subpart E.

3. PERMITTED AND REQUIRED USES AND DISCLOSURES OF PHI BY BUSINESS

ASSOCIATE

(a) Use to Provide Contract Services. Business Associate may use or disclose PHI as necessary and required for the purpose of performing its obligations for Covered Entity pursuant to the Contract.

Attachment F: Privacy, Security, and Confidentiality Business Associate Agreement Page 4 of 11

(b) Disclosure to Third Parties. Except as expressly permitted in this Agreement or the Contract or as required by law, Business Associate shall not divulge, disclose, or communicate PHI to any third party without prior written approval from Covered Entity.

(c) Data Aggregation Services. Except as otherwise limited in this Agreement, Business Associate may use PHI to provide data aggregation services to Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).

(d) Compliance with Subpart E. Business Associate must comply with 45 C.F.R. § 164, subpart E, and may not use or disclose PHI in violation of 45 C.F.R. § 164, subpart E.

(e) Reporting Violations of Law. Business Associate may use and disclose PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. § 164.502(j)(1).

(f) Use for Management and Administration. Business Associate may use and disclose PHI for Business Associate’s proper management and administration, provided that: (1) Business Associate obtains reasonable assurances from the person to whom PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person; and (2) the person notifies Business Associate of any instances of the Breach of PHI for which it is aware. Business Associate also may make disclosures that are required by law. Business Associate’s use of PHI as described in this paragraph is subject to and limited as described in 45 C.F.R. § 164.504(e)(2) and (4).

(g) Limited Data Sets. Business Associate may create a Limited Data Set pursuant to 45 C.F.R. § 164.514 only as necessary and required for the purpose of performing its obligations and services for Covered Entity, provided that Business Associate complies with the provisions of this Agreement.

(h) Disclosure to the Secretary. Business Associate shall disclose PHI when required by the Secretary to investigate or determine Covered Entity’s or Business Associate’s compliance with 45 C.F.R. § 164, subpart E.

(i) Designated Record Sets. Business Associate shall provide access to PHI in a designated record set as required under 45 C.F.R. § 164.524.

(j) Disclosure to Covered Entity and Individual. Business Associate shall, upon request by Covered Entity or Individual, disclose PHI to Covered Entity, Individual, or Individual’s designee, as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. §§ 164.502(a)(4)(ii), 164.524(c)(2)(ii), and 164.524(c)(3)(ii) with respect to an Individual’s request.

4. OBLIGATIONS OF COVERED ENTITY

Covered Entity agrees to:

(a) Notify Business Associate, upon request, of any limitation(s) in Covered Entity’s Notice of Privacy Practices in accordance with 45 C.F.R. § 164.520, to the extent

Attachment F: Privacy, Security, and Confidentiality Business Associate Agreement Page 5 of 11 that such limitation(s) may affect Business Associate’s use or disclosure of PHI.

(b) Notify Business Associate of any changes in, or revocation of, authorization by an Individual or his or her personal representative regarding the use or disclosure of PHI, if such changes affect Business Associate's use or disclosure thereof.

(c) Notify Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 C.F.R. § 164.522, if such restriction may affect Business Associate's use or disclosure thereof.

(d) Not provide Business Associate with more PHI than that which is minimally necessary for Business Associate to provide the services and, where possible, Covered Entity shall provide any PHI needed by Business Associate to perform the services in the form of a Limited Data Set, in accordance with 45 C.F.R.

§ 164.504(e)(3)(iv).

(e) Not request that Business Associate use or disclose PHI in any manner that would violate HIPAA, the HITECH Act, or applicable federal or Florida law.

(f) Obtain all authorizations necessary for any use or disclosure of any PHI as contemplated under the Contract.

5. PHI SECURITY REQUIREMENTS

(a) Protection of PHI. Business Associate shall protect against any reasonably anticipated threats or hazards to the confidentiality, security, or integrity of PHI and protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under 45 C.F.R. § 164, subpart E. Business Associate shall implement policies and procedures to prevent, detect, contain, and correct security violations.

(b) Security of PHI. Business Associate shall develop, implement, maintain, and use administrative, technical, and physical safeguards to prevent security violations and the unpermitted acquisition, access, use, or disclosure of PHI in accordance with 45 C.F.R. § 164, subpart C.

(c) Business Associate’s Due Diligence. Business Associate shall make a good-faith effort to identify any unpermitted acquisition, access, use, or disclosure of any type of PHI or unauthorized acquisition, access, use, or disclosure of information or interference with system operations in an information system.

(d) Compliance. Business Associate shall ensure that its agents and subcontractors comply with 45 C.F.R. § 164, subparts A, C, and E, and all applicable standards relating to all PHI.

(e) Compliance Date. Business Associate certifies compliance with this section of the Agreement on or before the date on which its representative signs this Agreement as set forth in the signature blocks at the end of this document.

6. NOTIFICATION AND REPORTING REQUIREMENTS

(a) Reporting of Security Incidents. Within two (2) Business Days of discovery, Business Associate shall report to the Covered Entity any Security Incident that

Attachment F: Privacy, Security, and Confidentiality Business Associate Agreement Page 6 of 11 involves the (1) unpermitted acquisition, access, use, or disclosure of PHI; (2) modification or destruction of PHI; (3) interference with system operations in an information system containing PHI. For any other type of Security Incident, Business Associate shall report such incident to Covered Entity upon request.

Such reports shall include a description of the incident, identification of any Individuals affected, and the types of PHI involved (if any). The day the Security Incident is discovered or would have been discovered with the exercise of reasonable diligence will be considered the first Business Day of the reporting period.

(b) Notification to Covered Entity Regarding a Breach of PHI. Within two (2) Business Days of discovery, Business Associate shall notify Covered Entity of any Breach of unsecured PHI in accordance with 45 C.F.R. § 164.410. The notice pursuant to this subparagraph shall comply with the notification requirements of 45 C.F.R. § 164.410(c), including the identification of each affected Individual, the types of PHI involved in the Breach, and a description of the incident. The day the Breach is discovered or would have been discovered with the exercise of reasonable diligence will be considered the first Business Day of the reporting period.

(c) Notification to Individuals. In the case of a Breach of unsecured PHI, Business Associate shall first notify Covered Entity of the details of the Breach within two (2) Business Days of discovery of the Breach. Upon approval by Covered Entity, Business Associate shall notify each Individual whose unsecured PHI was Breached in accordance with 45 C.F.R. § 164.404. Notification shall be in writing and delivered by first-class mail to the Individual, the Individual’s personal representative, or the Individual’s next of kin (if the individual is deceased) at the last known address of the Individual, next of kin, or personal representative, as applicable. The notification may be delivered by e-mail if requested by the recipient. When there is insufficient or out-of-date contact information (including a phone number, email address, or any other form of appropriate communication) that precludes written or electronic notification, a substitute form of notice shall be provided. When there are ten (10) or more Individuals for whom there is insufficient or outdated contact information, Business Associate shall place a conspicuous posting on its website or run the notice in major print or broadcast media, including major media in the geographic areas where the Individuals likely reside. In any case deemed by Business Associate to require urgency due to possible imminent misuse of unsecured PHI, Business Associate may also provide information to Individuals by telephone or other means, as appropriate.

(d) Notification to Media. When Business Associate reasonably believes there has been a Breach of unsecured PHI involving more than 500 persons, after prior approval by Covered Entity, Business Associate shall provide notice to prominent media outlets serving the state or the relevant portion of the state involved, in accordance with 45 C.F.R. § 164.406.

(e) Notification to the Secretary. Business Associate shall cooperate with Covered Entity to provide notice to the Secretary of the Breach of unsecured PHI in accordance with 45 C.F.R. § 164.408. When Business Associate reasonably believes that there has been a Breach of Unsecured PHI involving 500 or more individuals, such notice must be provided immediately. If the Breach was with respect to fewer than 500 individuals, Business Associate may maintain a log of

Attachment F: Privacy, Security, and Confidentiality Business Associate Agreement Page 7 of 11 the Breach and annually submit such log to Covered Entity so that it may satisfy its obligation to notify the Secretary of Breaches.

(f) Content of Notices. All notices must comply with the minimum notice provisions set forth in 45 C.F.R. §§ 164.404, 164.406, 164.408, and 164.410, and section 13402(f) of the HITECH Act, as applicable, except that any references therein to a “covered entity” shall be read as references to Business Associate.

(g) Financial Responsibility. Business Associate shall be responsible for reasonable costs related to the notices required under this Agreement.

(h) Mitigation. Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate regarding the access, acquisition, use, modification, destruction, or disclosure of any type of PHI not permitted by this Agreement.

(i) Florida Law. The requirements related to notification and reporting of breaches pursuant to section 501.171, Florida Statutes, are addressed in the Contract.

7. SECURITY AND CONFIDENTIALITY UNDER FLORIDA LAW

(a) Section 110.123(9), Florida Statutes, Requirements. Business Associate agrees to observe the confidentiality requirements of section 110.123(9), Florida Statutes.

In general, the referenced statute provides that patient medical records and medical claim records of state employees, former state employees, and their covered dependents are confidential and exempt from the provisions of section 119.07(1), Florida Statutes. Any person who willfully, knowingly, and without authorization discloses or takes data, programs, or supporting documentation, including those residing or existing internal and external to Covered Entity’s computer system, commits an offense in violation of section 815.04, Florida Statutes.

(b) Subpoena. These confidentiality requirements protect the disclosure of all Covered Entity’s records and information, in whatever form, including the copying or verbally relaying of confidential information. If Business Associate is served with a subpoena requiring the production of Covered Entity’s records or information, Business Associate shall immediately contact the Agency’s Office of the General Counsel, at (850) 487-1082.

A subpoena is an official summons issued by a court or an administrative tribunal, which requires the recipient to do one or more of the following:

i. Appear at a deposition to give sworn testimony and/or require that certain records be brought to be examined as evidence.

ii. Appear at a hearing or trial to give evidence as a witness and/or require that certain records be brought to be examined as evidence.

iii. Produce certain records for examination.

(c) Agents and Subcontractors. Business Associate acknowledges that the confidentiality requirements herein apply to all its agents and subcontractors.

Attachment F: Privacy, Security, and Confidentiality Business Associate Agreement Page 8 of 11

(d)

(e) Data Access and Storage. Unless otherwise agreed to in writing, Business Associate shall not allow any PHI to be accessed or stored outside of the United States.

8. TERM AND TERMINATION OF AGREEMENT

(a) Term. This Agreement shall commence as of the Effective Date of this Agreement and will naturally terminate when (i) the Contract terminates or expires, or (ii) all of the PHI in Business Associate’s possession, custody, or control is destroyed or returned to Covered Entity or, if it is not feasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provision in this section, whichever is later.

(b) Termination for Cause. Without limiting any other termination rights of the Parties, Covered Entity may terminate this Agreement and the Contract if Covered Entity determines Business Associate has violated a material term of the Agreement.

Covered Entity may provide Business Associate an opportunity to cure the breach or end the violation. If the Business Associate does not cure the breach or end the violation within a reasonable time as specified by Covered Entity, Covered Entity shall have the right to immediately terminate the Agreement. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary.

(c) Return or Destruction of PHI Upon Termination. Upon termination or expiration of the Contract, Business Associate, with respect to PHI received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity, shall:

i. Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

ii. Return to Covered Entity or, if agreed to by Covered Entity, destroy the remaining PHI that the Business Associate still maintains in any form;

iii. Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI to prevent use or disclosure of the PHI, other than as provided for in this Section, for as long as Business Associate retains the PHI;

iv. Not use or disclose the PHI retained by Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set forth in Section 3 of this Agreement which applied prior to termination; and

v. Return to Covered Entity or, if agreed to by Covered Entity, destroy the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

Upon notice of termination of this Agreement, Business Associate shall destroy or return to Covered Entity any and all PHI created or received by Business Associate in the same manner required for all state data under the Contract.

Attachment F: Privacy, Security, and Confidentiality Business Associate Agreement Page 9 of 11

Within fifteen (15) calendar days of any notice of termination of this Agreement, Business Associate shall notify Covered Entity in writing as to whether Business Associate elects to return or destroy such PHI.

Except as provided in subsection (d), within thirty (30) calendar days of the notice of termination of this Agreement, Business Associate shall return to Covered Entity or destroy any and all PHI maintained by Business Associate in any form and shall retain no copies thereof. Business Associate also shall recover and return or destroy, within such time period, any and all PHI in the possession of its subcontractors or agents.

If Business Associate elects to destroy PHI, Business Associate shall obtain written confirmation from Covered Entity that such actions will not violate the State of Florida’s record retention policies. Upon destruction, Business Associate shall provide written certification to Covered Entity that such PHI has been destroyed. If any subcontractor or agent of Business Associate elects to destroy PHI, Business Associate shall require that such subcontractor or agent to provide written certification to Business Associate and to Covered Entity when such PHI has been destroyed.

(d) Written Explanation. If it is not feasible for Business Associate to return or destroy any PHI, Business Associate shall notify Covered Entity in writing that Business Associate has determined that it is not feasible to return or destroy the PHI and the specific reasons for such determination.

If it is not feasible for Business Associate to obtain any PHI in the possession of the subcontractor or agent, Business Associate shall provide a written explanation to Covered Entity and require the subcontractor or agent to agree to extend any and all protections, limitations, and restrictions set forth in this Agreement to the subcontractor’s or agent’s use or disclosure of any PHI retained after the termination of this Agreement, and to limit any further use or disclosure to the purposes that make the return or destruction of the PHI not feasible.

9. MISCELLANEOUS

(a) Material Breach. A violation of any provision of this Agreement shall be deemed a material breach of this Agreement and the Contract.

(b) Warranties and Representations. Covered Entity makes no warranty or representation that compliance by Business Associate with this Agreement, HIPAA, or HITECH Act will be adequate or satisfactory for Business Associate’s own purposes.

(c) Assignment. Except as provided in the Contract, Business Associate shall not assign either its obligations or benefits under this Agreement without the express written consent of Covered Entity, which shall be at the sole discretion of Covered Entity.

(d) Regulatory References. A reference in this Agreement to a section of HIPAA, the Privacy Rule, the Security Rule, or HITECH Act means the section as in effect or as amended and for which compliance is required.

Attachment F: Privacy, Security, and Confidentiality Business Associate Agreement Page 10 of 11

(e) Amendment. Upon the enactment of any law or regulation affecting the use or disclosure of PHI, Standard Transactions, the security of PHI, HIPAA, or the HITECH Act; the publication of any decision of a court of the United States or any state relating to any such law; or the publication of any interpretive policy or opinion of any governmental agency charged with the enforcement of any such law or regulation, either Party may, by written notice to the other Party, amend this Agreement in such manner as such Party determines necessary to comply with such law or regulation. If the other Party disagrees with such Amendment, it shall notify the first Party in writing within thirty (30) calendar days’ notice. If the Parties are unable to agree on an amendment within thirty (30) calendar days thereafter, then either of the Parties may terminate the Agreement on thirty (30) calendar days written notice to the other Party.

(f) Survival. The terms and conditions of this Agreement which by their nature would extend beyond the termination or expiration of this Agreement shall continue until fulfilled. This includes, but is not limited to, Business Associate’s rights and obligations under Section 8 of this Agreement.

(g) Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits Covered Entity to comply with HIPAA, the HITECH Act, and Florida Statutes.

(h) No Third-Party Beneficiary. Nothing expressed or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than the Parties and the respective successors or assignees of the Parties, any rights, remedies, obligations, or liabilities whatsoever.

(i) Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the State of Florida to the extent not preempted by applicable federal law.

(j) Venue. The exclusive venue of any proceedings shall be the appropriate federal or state court in Leon County, Florida.

(k) Liability and Indemnification. Business Associate’s liability and indemnity requirements hereunder are the same as those required by the Contract and, for the avoidance of doubt, this Business Associate Agreement will be treated as a part of the Contract for such purposes.

(l) Independent Entities. Business Associate and Covered Entity are independent entities, and this Agreement will not establish any relationship of partnership, joint venture, employment, franchise, or agency between Business Associate and Covered Entity. Neither Business Associate nor Covered Entity will have the power to bind the other or incur obligations on the other Party’s behalf without the other Party’s prior written consent, except as otherwise expressly provided in this Agreement.

(m) Conflicts. In the event that any terms of this Agreement are inconsistent herein or with the terms of any other contract between the Parties, the more restrictive of the terms will control.

Attachment F: Privacy, Security, and Confidentiality Business Associate Agreement Page 11 of 11

DEPARTMENT OF

MANAGEMENT SERVICES

{Director Name}, Director of Division of State Group Insurance

Date

{INSERT CONTRACTOR NAME}

Signature

Print Name and Title

Date