LMMS BAA 2026.doc

STATE OF ALASKA

HEALTH INSURANCE PORTABILITY AND

ACCOUNTABILITY ACT OF 1996 ("HIPAA")

BUSINESS ASSOCIATE AGREEMENT

This HIPAA Business Associate Agreement is between the State of Alaska, Department of Law (“Primary Business Associate” or “DOL”) and

(Subcontractor Business Associate (“SBA”) or “

RECITALS

Whereas, A.

DOL acts as business associate to the following Covered Entities: State of Alaska, Department of Health, Department of Family and Community Services, Department of Corrections, and Department of Administration’s Division of Retirement and Benefits (“AK Covered Entities”);

B.

DOL wishes to disclose certain information to SBA, some of which may constitute Protected Health Information ("PHI"); the PHI at issue in this Business Associate Agreement (“BAA”) is owned by the AK Covered Entities as the covered entities regardless of whether it is referred to as AK Covered Entities PHI or DOL PHI;

C.

It is the goal of DOL and SBA to protect the privacy and provide for the security of PHI owned by the AK Covered Entities that is disclosed to SBA or accessed, received, stored, maintained, modified or retained by SBA in compliance with HIPAA (42 U.S.C. 1320d – 3120d-8) and its implementing regulations at 45 C.F.R. 160 and 45 C.F.R. 164 (the “Privacy and Security Rule”), the Health Information Technology for Economic and Clinical Health Act of 2009 (P.L. 111-5) (the “HITECH Act”), and with other applicable laws;

D.

The purpose and goal of the HIPAA BAA is to satisfy certain standards and requirements of HIPAA, HITECH Act, and the Privacy and Security Rule, including but not limited to 45 C.F.R. 164.502(e) and 45 C.F.R. 164.504(e), as may be amended from time to time;

Therefore, in consideration of mutual promises below and the exchange of information pursuant to the BAA, DOL and SBA agree as follows:

1.

Definitions.

a. General: As used in this BAA, the terms "Protected Health Information," "Health Care Operations," and other capitalized terms have the same meaning given to those terms by HIPAA, the HITECH Act and the Privacy and Security Rule. In the event of any conflict between the mandatory provisions of HIPAA, the HITECH Act or the Privacy and Security Rule, and the provisions of this BAA, HIPAA, the HITECH Act, or the Privacy and Security Rule shall control. Where the provisions of this BAA differ from those mandated by HIPAA, the HITECH Act or the Privacy and Security Rule but are nonetheless permitted by HIPAA, the HITECH Act, or the Privacy and Security Rule, the provisions of the BAA shall control.

b.

Specific:

1) Covered Entity: “Covered Entity” shall have the same meaning as the term “covered entity” at 45 C.F.R. 160.103.

2) Primary Business Associate: “Primary Business Associate” or “DOL” shall generally have the same meaning as the term “covered entity” at 45 C.F.R. 160.103.

3) Privacy and Security Rule: “Privacy and Security Rule” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Part 160 and Part 164.

4) Subcontractor Business Associate: “Subcontractor Business Associate” or “SBA” shall generally have the same meaning as the term “business associate” at 45 C.F.R. 160.103.

2.

Permitted Uses and Disclosures by SBA.

a.

SBA may only use or disclose PHI for the following purposes:

1) SBA may use or disclose PHI to fulfill its responsibilities under [CONTRACT ###] 2) SBA may use or disclose PHI as required by law.

3) SBA agrees to make uses and disclosures and requests for PHI consistent with DOL’s minimum necessary policies and procedures.

4) SBA may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by DOL, except for the specific uses and disclosures set out below.

5) SBA may disclose PHI for the proper management and administration of SBA or to carry out the legal responsibilities of SBA, provided the disclosures are required by law, or SBA obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notified SBA of any instances of which it is aware in which the confidentiality of the information has been breached.

b.

SBA may provide data aggregation services related to the health care operations of DOL.

3.

Obligations of Subcontractor Business Associate.

a. Permitted uses and disclosures: SBA may only use and disclose PHI owned by DOL that it creates, receives, maintains, or transmits if the use or disclosure is in compliance with each applicable requirement of 45 C.F.R. 164.504(e) of the Privacy Rule or this BAA. The additional requirements of Subtitle D of the HITECH Act contained in Public Law 111-5 that relate to privacy and that are made applicable with respect to Covered Entities shall also be applicable to SBA and are incorporated into this BAA.

To the extent that SBA discloses DOL’s PHI to a subcontractor, SBA must obtain, prior to making any such disclosure: (1) reasonable assurances from the subcontractor that it will agree to the same restrictions, conditions, and requirements that apply to the SBA with respect to such information; and (2) an agreement from the subcontractor to notify SBA of any Breach of confidentiality, or security incident, within two business days of when it becomes aware of such Breach or incident.

b. Safeguards: 45 C.F.R. 164.308 (administrative safeguards), 164.310 (physical safeguards), 164.312 (technical safeguards), and 164.316 (policies, procedures and documentation requirements) shall apply to SBA in the same manner that such sections apply to DOL, and shall be implemented in accordance with HIPAA, the HITECH Act, and the Privacy and Security Rule. The additional requirements of Title XIII of the HITECH Act contained in Public Law 111-5 that relate to security and that are made applicable to Covered Entities shall also apply to SBA and are incorporated into this BAA.

Unless DOL agrees in writing that this requirement is infeasible with respect to certain data, SBA shall secure all paper and electronic PHI by encryption or destruction such that the PHI is rendered unusable, unreadable or indecipherable to unauthorized individuals; or secure paper, film and electronic PHI in a manner that is consistent with guidance issued by the Secretary of the United States Department of Health and Human Services specifying the technologies and methodologies that render PHI unusable, unreadable, or indecipherable to unauthorized individuals, including the use of standards developed under Section 3002(b)(2)(B)(vi) of the Public Health Service Act, as added by Section 13101 of the HITECH Act contained in Public Law 111-5.

SBA shall not use personally owned devices to create, receive, maintain, or transmit PHI. Devices SBA uses to create, receive, maintain, or transmit DOL’s electronic PHI shall be owned and managed by SBA.

SBA shall patch its high-impact/critical operating system and applications within two weeks of the release of any patch. SBA shall keep its antivirus and antimalware installed and active. SBA shall limit its use of administrative accounts for IT operations only.

c.

Reporting Unauthorized Disclosures and Breaches: During the term of this BAA, SBA shall notify DOL within 24 hours of discovering a Breach of security; intrusion; or unauthorized acquisition, access, use, or disclosure of DOL’s PHI in violation of any applicable federal or state law, including security incidents. SBA shall identify for DOL the individuals whose unsecured PHI has been, or is reasonably believed to have been, Breached so that DOL can comply with any notification requirements if necessary. SBA shall also indicate whether the PHI subject to the Breach; intrusion; or unauthorized acquisition, access, use or disclosure was encrypted or destroyed at the time. SBA shall take prompt corrective action to cure any deficiencies that result in Breaches of security; intrusion; or unauthorized acquisition, access, use, and disclosure. SBA shall work with Department of Health to fulfill all breach notice requirements. SBA shall reimburse DOL for all costs incurred by DOL that are associated with any mitigation, investigation and notice of Breach DOL undertakes or provides under HIPAA, HITECH Act, and the Privacy and Security Rule as a result of a Breach of DOL’s PHI (which is actually the Department of Health’s and the Department of Family and Community Services’ PHI) caused by SBA or SBA’s subcontractor or agent.

If the unauthorized acquisition, access, use or disclosure of DOL’s PHI involves only Secured PHI, SBA shall notify DOL within 10 days of discovering the Breach but is not required to notify DOL of the names of the individuals affected.

d.

Nothing contained in this BAA shall be construed to create a partnership or a joint venture or to authorize SBA to act as a general or special agent of DOL.

e.

SBA’s Agents: If SBA uses a subcontractor or agent to provide services under this BAA, and the subcontractor or agent creates, receives, maintains, or transmits DOL’s PHI, the subcontractor or agent shall sign an agreement with SBA containing substantially the same provisions as this BAA and further identifying DOL as a third-party beneficiary with rights of enforcement and indemnification from the subcontractor or agent in the event of any violation of the subcontractor or agent agreement. SBA shall mitigate the effects of any violation of that agreement.

f.

Availability of Information to DOL: Within 15 days after the date of a written request by DOL, SBA shall provide any information necessary to fulfill DOL's obligations to provide access to PHI under HIPAA, the HITECH Act, or the Privacy and Security Rule.

g.

Accountability of Disclosures: If SBA is required by HIPAA, the HITECH Act, or the Privacy or Security Rule to document a disclosure of PHI, SBA shall make that documentation. If DOL is required to document a disclosure of PHI made by SBA, SBA shall assist DOL in documenting disclosures of PHI made by SBA so that DOL may respond to a request for an accounting in accordance with HIPAA, the HITECH Act, and the Privacy and Security Rule. Accounting records shall include the date of the disclosure, the name and if known, the address of the recipient of the PHI, the name of the individual who is subject of the PHI, a brief description of the PHI disclosed, and the purpose of the disclosure. Within 15 days of a written request by DOL, SBA shall make the accounting record available to DOL.

h.

Amendment of PHI: Within 30 days of a written request by DOL or an individual, SBA shall amend PHI maintained, transmitted, created, or received by SBA on behalf of DOL as directed by DOL or the individual when required by HIPAA, the HITECH Act or the Privacy and Security Rule, or take other measures as necessary to satisfy DOL’s obligations under 45 C.F.R. 164.526.

i.

Internal Practices: SBA shall make its internal practices, books, and records relating to the use and disclosure of DOL's PHI available to DOL and all appropriate federal agencies to determine DOL's and SBA's compliance with HIPAA, the HITECH Act and the Privacy and Security Rule.

j.

Risk Assessment: SBA shall timely (pursuant to HIPAA) undergo a thorough assessment of the potential risks to and vulnerabilities of the confidentiality, integrity, and availability of DOL’s PHI that SBA receives, stores, transmits, or has access to. SBA shall provide DOL, upon request, with a written report detailing the results of the risk assessment within 5 days.

k.

To the extent SBA is to carry out one or more of DOL’s obligations under Subpart E of 45 C.F.R. Part 164, SBA must comply with the requirements of that Subpart that apply to DOL in the performance of such obligations.

l.

Audits, Inspection and Enforcement: DOL may, after providing reasonable notice to the SBA, conduct an inspection of the facilities, systems, books, logs, and records of SBA that relate to SBA’s use of DOL’s PHI, including inspecting logs showing the creation, modification, viewing, and deleting of PHI at SBA’s level. Failure by DOL to inspect does not waive any rights of the DOL or relieve SBA of its responsibility to comply with this BAA. DOL's failure to detect or failure to require remediation does not constitute acceptance of any practice or waive any rights of DOL to enforce this BAA.

Upon request, but in no event more often than annually, SBA shall provide a report to DOL that lists the names of all individuals with technical or physical access to DOL’s PHI and the scope of that access.

m.

Restrictions and Confidential Communications: Within 10 business days of notice by DOL of a restriction upon use or disclosure or request for confidential communications pursuant to 45 C.F.R.164.522, SBA shall restrict the use or disclosure of an individual’s PHI. SBA may not respond directly to an individual’s request to restrict the use or disclosure of PHI or to send all communication of PHI to an alternate address. SBA shall refer such requests to the DOL so that the DOL can coordinate and prepare a timely response to the requesting individual and provide direction to the SBA.

n.

Indemnification:

SBA shall indemnify and hold harmless DOL for any HIPAA-based civil or criminal monetary penalty or fine imposed on DOL for acts or omissions in violation of HIPAA, the HITECH Act, or the Privacy or Security Rule that are committed by SBA, a member of its workforce, its agent, or its subcontractor.

4.

Obligations of DOL. DOL will be responsible for using legally appropriate safeguards to maintain and ensure the confidentiality, privacy, and security of PHI transmitted to SBA under the BAA until the PHI is received by SBA. DOL will not request SBA to use or disclose PHI in any manner that would not be permissible under HIPAA, the HITECH Act or the Privacy and Security Rule if done by DOL.

5.

Termination.

a.

Breach: A breach of a material term of the BAA by SBA that is not cured within a reasonable period of time will provide grounds for the immediate termination of the contract.

b.

Reasonable Steps to Cure: In accordance with 45 C.F.R. 164.504(e)(1)(ii), DOL and SBA agree that, if it knows of a pattern of activity or practice of the other party that constitutes a material breach or violation of the other party’s obligation under the BAA, the nonbreaching party will take reasonable steps to get the breaching party to cure the breach or end the violation and, if the steps taken are unsuccessful, terminate the BAA if feasible, and if not feasible, report the problem to the Secretary of the U.S. Department of Health and Human Services.

c.

Effect of Termination: Upon termination of the contract, SBA will, at the direction of the DOL, either return or destroy all PHI received from DOL or created, maintained, or transmitted on DOL’s behalf by SBA in any form. Unless otherwise directed, SBA is prohibited from retaining any copies of PHI received from DOL or created, maintained, or transmitted by SBA on behalf of DOL. If destruction or return of PHI is not feasible, SBA must continue to extend the protections of this BAA to PHI and limit the further use and disclosure of the PHI. The obligations in this BAA shall continue until all of the PHI provided by DOL to SBA is either destroyed or returned to DOL.

6.

Amendment. The parties acknowledge that state and federal laws relating to electronic data security and privacy are evolving, and that the parties may be required to further amend this BAA to ensure compliance with applicable changes in law. Upon receipt of a notification from DOL that an applicable change in law affecting this BAA has occurred, SBA will promptly agree to enter into negotiations with DOL to amend this BAA to ensure compliance with changes in law.

7.

Ownership of PHI. For purposes of this BAA, the AK Covered Entities own the data that contains the PHI they transmit to SBA directly or through DOL or that SBA receives, creates, maintains, or transmits on behalf of DOL.

8.

Litigation Assistance. Except when it would constitute a direct conflict of interest for SBA, SBA will make itself available to assist DOL in any administrative or judicial proceeding by testifying as witness as to an alleged violation of HIPAA, the HITECH Act, the Privacy or Security Rule, or other law relating to security or privacy.

9.

Regulatory References. Any reference in this BAA to federal or state law means the section that is in effect or as amended.

10.Interpretation. This BAA shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HITECH Act, the Privacy and Security Rule, and applicable state and federal laws. The parties agree that any ambiguity in BAA will be resolved in favor of a meaning that permits the DOL to comply with and be consistent with HIPAA, the HITECH Act, and the Privacy and Security Rule. The parties further agree that where this BAA conflicts with a contemporaneously executed confidentiality agreement between the parties, this BAA controls.

11.No Private Right of Action Created. This BAA does not create any right of action or benefits for individuals whose PHI is disclosed in violation of HIPAA, the HITECH Act, the Privacy and Security Rule, or other law relating to security or privacy.

12.Privacy and Security Point of Contact. All communications occurring because of this BAA shall be sent to pamela.post@alaska.gov.

In witness thereof, the parties hereto have duly executed this BAA as of the effective date.

LMMS BAA

LMMS BAA