S000000357 Attachment B- EBD Business Associate Agreement.pdf

DEPARTMENT of TRANSFORMATION & SHARED SERVICES-EMPLOYEE BENEFITS DIVISION

AND

(BUSINESS ASSOCIATE)

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“Agreement”) is made and entered into effective as of the XX day of MONTH 2024 (the “Effective Date”), by and between State of Arkansas, Department of Transformation & Shared Services - Employee Benefits Division (“EBD”), with a principal business address of 501 Woodlane Street, Suite 500 Little Rock, Arkansas 72201 (“Covered Entity”) and (Insert Business Associate ) with a principal business address of (insert address)(“Business Associate”).

RECITALS

WHEREAS, the parties have entered into a relationship whereby Business Associate provides services to Covered Entity and Business Associate receives, has access to, creates, maintains, or transmits Protected Health Information (as defined below) in order to provide those services; and

WHEREAS, EBD is a “covered entity” as defined by the Health Insurance Portability and Accountability Act of 1996 and the regulations promulgated thereunder at 45 C.F.R. Parts 160 and 164, as may be amended from time to time (“HIPAA”);

WHEREAS, Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI disclosed to Business Associate in compliance with HIPAA, the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), and regulations promulgated thereunder, as may be amended from time to time (collectively, the “Privacy and Security Regulations”), and other applicable laws; and

WHEREAS, in accordance with the Privacy and Security Regulations, Covered Entity and Business Associate are required to enter into a contract containing specific requirements as set forth in the Privacy and Security Regulations;

NOW, THEREFORE, in consideration of the foregoing, and for other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, the parties agree as follows:

1. DEFINITIONS.

Capitalized terms used but not otherwise defined in this Agreement shall have the meaning given to those terms in the Privacy and Security Regulations. The following terms, as used in this Agreement, are defined as follows:

1.1. “Breach” means the unauthorized acquisition, access, use, or disclosure of PHI not permitted by the Privacy and Security Regulations and which compromises the security or privacy of the PHI.

1.2. “Designated Record Set” means a group of records maintained by or for a covered entity that is:

(i) the medical records and billing records about individuals maintained by or for a covered health care provider; (ii) the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) Used (defined below), in whole or in part, by or for the covered entity to make decisions about individuals. For purposes of this definition, the term “record” means any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for a covered entity (as defined in the Privacy and Security Regulations).

1.3. “Disclose” and “Disclosure” mean, with respect to PHI, the release, transfer, provision of access to, or divulging in any other manner of PHI outside Business Associate’s internal operations.

1.4. “Electronic PHI” means PHI that is transmitted by Electronic Media or is maintained in Electronic Media. Examples of Electronic PHI include PHI that is electronically transmitted and maintained on devices such as cell phones, PDAs, text pagers, and USB static discs.

1.5. “PHI” or “Protected Health Information” means protected health information, as defined in the Privacy and Security Regulations, and shall include but not be limited to any information in any form or medium, including demographic information collected from an individual, that (i) identifies the individual (or for which there is a reasonable basis for believing that the information can be used to identify the individual); (ii) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (iii) is received by Business Associate from or on behalf of Covered Entity, is created, maintained or transmitted by Business Associate, or is made accessible to Business Associate by Covered Entity. PHI includes, without limitation, Electronic PHI.

1.6. “Privacy Rule” means 45 C.F.R. Part 164.

1.7. “Secretary” means the Secretary of the U. S. Department of Health and Human Services or his or her designee.

1.8. “Services” means those activities, functions, or services that Business Associate provides for or on behalf of Covered Entity.

1.9. “Subcontractor” means a person to whom a business associate (as defined in the Privacy and Security Regulations) delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate.

1.10. “Unsecured PHI” means PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through use of a technology or methodology specified by the Secretary in guidance issued under Section 13402(h)(2) the HITECH Act.

1.11. “Use” and “Uses” mean, with respect to PHI, the sharing, employment, application, utilization, examination, or analysis of such PHI within the internal operations of the entity that maintains such PHI.

2. ASSURANCES BY BUSINESS ASSOCIATE REGARDING PHI.

Business Associate warrants that it shall comply with relevant portions of the Privacy and Security Regulations as those regulations apply to business associates and business associate Subcontractors. More specifically, and insofar as Business Associate has access to, has been provided with, maintains, transmits, or will be creating PHI regarding Covered Entity’s patients, Business Associate warrants and agrees as follows:

2.1. Permitted Uses and Disclosures of PHI. Business Associate shall Use and Disclose PHI in the minimum amount necessary to perform the Services for or on behalf of Covered Entity, provided that such Use or Disclosure would not violate the Privacy and Security Regulations if done by Covered Entity. Further, Business Associate:

2.1.1. shall Disclose PHI to Covered Entity upon request; or

2.1.2. may Use or Disclose PHI as permitted or required by law;

2.1.3 may Use PHI as necessary for the proper management and administration of its business or to carry out its legal responsibilities;

2.1.4 may Disclose PHI as necessary for the proper management and administration of its business or to carry out its legal responsibilities, provided that:

2.1.4.1. the Disclosure is permitted or required by law, or

2.1.4.2. Business Associate obtains reasonable assurance from the person to whom the

PHI is Disclosed that the PHI will be held confidentially and Used or further Disclosed only as required by law or for the purpose for which it was Disclosed to the person, and the person agrees to notify Business Associate of any instances of which the person is aware in which the confidentiality of the PHI has been breached.

Business Associate shall not Use or Disclose PHI for any other purpose.

2.2 Prohibition on the Sale of PHI. Except as otherwise permitted by the Privacy and Security Regulations, Business Associate shall not directly or indirectly receive remuneration in exchange for any of Covered Entity’s PHI unless Covered Entity or Business Associate first obtains a valid, signed authorization from the individual whose PHI is at issue and such authorization specifies whether the PHI can be further exchanged for remuneration by the entity receiving the PHI.

2.3. Adequate Safeguards for PHI.

2.3.1. Business Associate shall implement and maintain appropriate safeguards, which comply with the Privacy and Security Regulations, to prevent the Use or Disclosure of PHI in any manner other than as permitted by this Agreement.

2.3.2. Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI that it creates, receives, maintains, or transmits on behalf of Covered Entity.

2.3.3. Business Associate agrees to take reasonable steps to ensure compliance with this Agreement and to ensure that the actions or omissions of its employees or agents do not cause Business Associate to breach the terms of this Agreement.

2.4. Responsibility for Delegated Actions. To the extent that Covered Entity expressly delegates in writing any of its obligations under Subpart E of the Privacy Rule to Business Associate, then Business Associate shall, in the performance of such obligation(s), comply with the requirements of such Subpart E that apply to Covered Entity.

2.5. Availability of Internal Practices, Books and Records to Government Agencies. Business

Associate shall make its internal practices, policies and procedures, books, and records relating to the security, Use and Disclosure of PHI available to the Secretary for purposes of determining Covered Entity’s compliance with the Privacy and Security Regulations. Business Associate shall immediately notify Covered Entity of any requests made by the Secretary and provide Covered Entity with copies of any documents produced in response to such request. Business Associate and Covered Entity agree that any disclosure or access obligations in this Agreement shall not require Business Associate to disclose or provide access to privileged, confidential, or proprietary information of clients of Business Associate other than client(s) associated with the rendering of services in connection with this Agreement.

2.6. Access to PHI.

2.6.1. Business Associate shall, at the request and direction of Covered Entity, make PHI maintained by Business Associate in a Designated Record Set available to Covered Entity, or, as directed by Covered Entity, to the individual identified as being entitled to access and copy such PHI, within five (5) business days of receipt of such a request from Covered Entity.

2.6.2. If Business Associate uses or maintains Electronic PHI, Business Associate must provide access to such PHI in an electronic format, if so requested by Covered Entity or the applicable individual, if the PHI is readily producible in such form or format; or if not, in a readable copy form or such other form and format as agreed by the individual, Covered Entity, and Business Associate.

2.7. Amendment of PHI. Business Associate shall, within five (5) business days of a request from Covered Entity, make PHI maintained by Business Associate in a Designated Record Set available to Covered Entity for the purpose of amendment and, as directed by Covered Entity, shall incorporate such amendments into such PHI within a reasonable time and in such a manner as specified by Covered Entity.

2.8. Accounting of Disclosures. Within five (5) business days of Covered Entity’s request, Business Associate shall make available to Covered Entity the information necessary for Covered Entity to provide an individual with an accounting of each Disclosure of PHI made by Business Associate or its employees, agents, representatives, or Subcontractors.

2.8.1. Business Associate shall implement a process that allows for an accounting to be collected and maintained for any Disclosure of PHI for which Covered Entity is required to maintain such information. Business Associate shall include in the accounting: (a) the date of the Disclosure;

(b) the name, and address if known, of the entity or person who received the PHI; (c) a brief description of the PHI disclosed; and (d) a brief statement of the purpose of the Disclosure or a copy of the written request for the Disclosure. For each Disclosure that requires an accounting under this Section, Business Associate shall document the information specified in (a) through

(d) above and shall securely retain this documentation for six (6) years from the date of the Disclosure.

2.8.2. For repetitive Disclosures of Covered Entity’s PHI that Business Associate makes for a single purpose to the same person or entity, the Disclosure information that Business Associate must record is either the Disclosure information specified above for each accountable Disclosure, or (a) the Disclosure information specified above for the first of the repetitive accountable Disclosures; (b) the frequency, periodicity, or number of the repetitive accountable Disclosures;

and (c) the date of the last of the repetitive accountable Disclosures.

2.8.3. If any individual directly requests that Business Associate, its agents or Subcontractors provide an accounting of Disclosures of PHI, Business Associate shall notify Covered Entity within five (5) business days of such request.

2.8.4. The Accounting of Disclosures referenced in this Agreement shall not apply to the exchange of PHI between Business Associate and its legal representation associated with the rendering of services in connection with this Agreement or any Subcontractor pursuant to an executed Subcontractor Business Associate Agreement.

2.8.5. The Accounting of Disclosures referenced in this Agreement shall not apply to the exchange of PHI or the delivery of PHI to any litigant or potential litigant in any anticipated or pending legal proceeding if (a) the Disclosure is made pursuant to a duly entered, HIPAA-compliant protective order, or (b) the PHI is made to a litigant or potential litigant that may possess or may have possessed, or received or may have received, the same PHI pursuant to another Business Associate Agreement or another type of agreement that governs the delivery, possession, or use of the same PHI that Business Associate may Disclose to any such litigant or potential litigant.

2.9. Reporting Breaches, Unauthorized Use or Disclosure of PHI and Security Incidents.

2.9.1. Business Associate shall report to Covered Entity:

2.9.1.1. A Breach of PHI;

2.9.1.2 Each access, acquisition, Use, or Disclosure of PHI that is made by Business

Associate, its employees, representatives, agents, or Subcontractors that is not specifically permitted by this Agreement; and

2.9.1.3. Any Security Incident of which it becomes aware. A “Security Incident” means the attempted or successful unauthorized access, acquisition, Use, Disclosure, modification, or destruction of information, or interference with the system operation of an information system.

2.9.2. Business Associate’s Notice to Covered Entity

2.9.2.1. Business Associate shall notify Covered Entity’s Compliance Officer of the events listed in Section 2.9.1 above by telephone call without unreasonable delay but in any event no later than three (3) business days after the date that (a) Business Associate knows of such Breach, Unauthorized Use or Disclosure, or Security Incident, or (b) by exercising reasonable diligence, Business Associate would have known of such Breach, Unauthorized Use or Disclosure, or Security Incident. Business Associate shall notify Covered Entity of all Breaches, even if Business Associate determines there is a low probability that the PHI has been compromised based on its risk assessment.

2.9.2.2. Business Associate shall provide a full written report to Covered Entity’s

Compliance Officer within five (5) business days of verbal notice. Business Associate shall include the following in the written report:

(a) Description of the nature of the Breach, including a description of what occurred, the date of any Breach and the date of the discovery thereof, and whether the PHI was actually acquired or reviewed;

(b) Identification of Covered Entity’s PHI that was subject to the non-permitted

Use or Disclosure or Breach, including name, demographic information, social security number, and other information involved, including types of identifiers and likelihood of re-identification;

(c) Identification of who made the non-permitted Use or Disclosure and who received the non-permitted Use or Disclosure;

Department of Transformation & Shared Services-Employee Benefits Division 501 Woodlane St. Ste 500 Little Rock, AR 72201 Attention: XXXXXX Phone: (501) 682-5500 Facsimile No.: (501) 682-1168 Email:

(d) Description of what corrective action the Business Associate took or will take to prevent further non-permitted Uses or Disclosures, to mitigate harmful effects, and to protect against any further Breaches;

(e) Identification of what steps the individuals who are the subject of a Breach should take to protect themselves; and

(f) Such other information as Covered Entity may reasonably request.

3. NOTICES.

Any notice required under this Agreement to be given to a party shall be made to:

If to Covered Entity: If to Business Associate:

4. MITIGATION AND COOPERATION.

Business Associate will take reasonable efforts to mitigate, at Business Associate’s sole cost and expense, any harmful effect that is known to it for the Breach or Use or Disclosure of PHI in violation of this Agreement.

Covered Entity shall be solely responsible, based upon the facts of the Breach (as disclosed to Covered Entity by Business Associate), to conduct a risk assessment to determine whether PHI has been compromised and notification to individuals is required. Business Associate shall cooperate with Covered Entity in the notification of individuals as required and in the manner as set forth in the Privacy and Security Regulations. Business Associate shall not provide any notification directly to individuals regarding a Breach of PHI without Covered Entity’s prior written consent, unless otherwise required by the Privacy and Security Regulations.

5. REMEDIES IN EVENT OF BREACH OF PHI.

The parties agree that any claims, actions, demands, liabilities, judgments, losses, damages, penalties, fines, costs, fees, expenses, and reasonable attorney’s fees that are attributable or allegedly attributable to the acts or omissions of a party in the performance of this Agreement shall be brought in the Arkansas State Claims Commission.

Nothing in this provision shall be construed as an attempted waiver of the sovereign immunity of the parties.

6. COVERED ENTITY OBLIGATIONS.

Covered Entity shall notify Business Associate of:

6.1. Any limitations in Covered Entity’s notice of privacy practices to the extent that such limitation may affect Business Associate’s Use or Disclosure of PHI;

Business Name ATTN: Contact Address Line Address Line Direct: (XXX) XXX-XXXX Email: Email Address

6.2. Any changes in, or revocation of, permission by the individual to Use or Disclose PHI, to the extent that such changes may affect Business Associate’s Use or Disclosure of PHI; and

6.3. Any restriction to the Use or Disclosure of PHI that Covered Entity has agreed to provide to the individual, to the extent that such restriction may affect the Business Associate’s Use or Disclosure of

PHI.

7. TERM AND TERMINATION.

The term of this Agreement shall continue until the Services are complete.

8. DISPOSITION OF PHI UPON TERMINATION OR EXPIRATION.

Upon termination or expiration of this Agreement, Business Associate shall either return or destroy, in Covered Entity’s sole discretion and in accordance with any instructions by Covered Entity, all PHI in the possession or control of Business Associate or its agents and Subcontractors. However, if either return or destruction of PHI is not feasible, Business Associate may retain PHI provided that Business Associate (a) continues to comply with the provisions of this Agreement for as long as it retains PHI, and (b) limits further Uses and Disclosures of PHI to those purposes that make the return or destruction of PHI infeasible. In the event of a conflict between preservation, return, or destruction provisions of this Agreement and any preservation obligations that may be legally imposed upon Business Associate pursuant to any protective order or imposed by operation of law, statute, regulation, or decision due to the prospect or pendency of any legal proceeding, then the most restrictive preservation obligation shall apply.

9. OWNERSHIP OF PHI.

The exchange of Electronic PHI under this Agreement does not change the ownership of such information under state, federal, or any other applicable law. If Electronic PHI has been exchanged for a permitted purpose, it may thereafter be integrated into the records of Business Associate’s participants, and the parties acknowledge that such information cannot be returned upon termination of this Agreement.

10. DOCUMENT RETENTION.

Business Associate shall maintain all documentation required by the Privacy and Security Regulations for a period of six (6) years minimum or for a longer period where required by statute or EBD policy.

11. NO THIRD-PARTY BENEFICIARIES.

There are no third-party beneficiaries to this Agreement.

12. INDEPENDENT CONTRACTOR.

Covered Entity and Business Associate expressly acknowledge and agree that Business Associate is an independent contractor and shall not for any purpose be deemed to be an agent, employee, servant or partner of Covered Entity.

13. USE OF SUBCONTRACTORS AND AGENTS.

Business Associate shall ensure that: (i) all of its Subcontractors and agents shall implement reasonable and appropriate safeguards to protect Covered Entity’s PHI; (ii) any Subcontractors and agents that create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions and requirements that apply through this Agreement to Business Associate with respect to such information; and (iii) any such Subcontractor or agent agrees to implement reasonable and appropriate safeguards to protect Covered Entity’s Electronic PHI.

14. MISCELLANEOUS.

14.1 Amendment. The terms of this Agreement shall not be waived, altered, modified, supplemented, or amended in any manner without written approval of both parties.

14.2 Sovereign Immunity. Nothing in this Agreement shall waive or abridge the sovereign immunity of the State of Arkansas or its entities, including, but not limited to, Business Associate.

14.3 Interpretation. Any ambiguity in this Agreement shall be resolved to permit the parties to comply with the Privacy and Security Regulations.

IN WITNESS WHEREOF, the parties hereto have executed this Agreement effective as of the Effective Date.

Business Associate:

By: ______________________________

Name: ________________

Title: _____________________________

Dated: ____________________________

Covered Entity:

By: ______________________________

Name: Grant Wallace_______________

Title: Director, TSS EBD____________

Dated:____________________________