Schedule D WI BAA with Contract.pdf

DEPARTM ENT OF HEALTH SERV ICES STATE OF WISCONSIN

Division of Enterprise Services

F-00759 (06/2020)

Contract Name:

Contract Number:

BUSINESS ASSOCIATE AGREEMENT

With Contract

This Business Associate Agreement, herein referred to as “Agreement”, is incorporated into the Underlying Contract which is referenced above as the Contract Name and Contract Number and is made between the Wisconsin Department of Health Services, (“Covered Entity”), and the (“Business Associate”), collectively the “Parties.”

This Agreement is specific to those services, activities, or functions performed by the Business Associate on behalf of the Covered Entity when such services, activities, or functions are covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including all pertinent regulations (45 CFR Parts 160 and 164) issued by the U.S.

Department of Health and Human Services. Services, activities, or functions covered by this Agreement include, but are not limited to:

The Covered Entity and Business Associate agree to modify the Contract to incorporate the terms of this Agreement and to comply with the requirements of HIPAA addressing confidentiality, security, and the transmission of individually identifiable health information created, used, or maintained by the Business Associate during the performance of the Contract and after Contract termination. The parties agree that any conflict between provisions of the Contract and the Agreement will be governed by the terms of the Agreement.

1. DEFINITIONS

For purposes of this Agreement, the terms used herein, unless otherwise defined, shall have the same meanings as used in the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), or the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and any amendments or implementing regulations, (collectively "HIPAA Rules").

“Qualified Service Organization Agreement” shall have the same meaning as defined in 42 CFR 2.12(c)(4).

2. RESPONSIBILITIES OF BUSINESS ASSOCIATE

a. Business Associate shall not use or disclose any Protected Health Information (PHI) except as permitted or required by the Agreement, as permitted or required by law, or as otherwise authorized in writing by the Covered Entity, if done by the Covered Entity. Unless otherwise limited herein, Business Associate may use or disclose Protected Health Information for Business Associate’s proper management and administrative services, to carry out legal responsibilities of Business Associate, and to provide data aggregation services relating to health care operations of the Covered Entity if required under the Agreement. Business Associate is not authorized to create de-identified information from PHI unless approved by the Covered Entity.

b. To the extent that in performing its services for or on behalf of Covered Entity, Business Associate uses, discloses, maintains, or transmits protected health information that is protected by 42 CFR Part 2, Business Associate acknowledges and agrees that it is a Qualified Service Organization for the purpose of such federal law; acknowledges and agrees that in receiving, storing, processing or otherwise dealing with any such patient records, it is fully bound by the Part 2 regulations; and, if necessary will resist in judicial proceedings any efforts to obtain access to patient records except as permitted by the Part 2 regulations.

F-00759 Page 2

Protected health information includes records per 42 CFR 2.11, created by, received, or acquired by a Part 2 program relating to a patient (e.g., diagnosis, treatment and referral for treatment information, billing information, both paper and electronic records. Check one that applies: No Yes

c. Business Associate shall not request, use, or disclose more than the minimum amount of Protected Health Information necessary to accomplish the purpose of the use or disclosure.

d. In the event that Business Associate is to carry out one or more Covered Entity’s obligations under the Privacy Rule, Business Associate shall comply with such requirements apply to Covered Entity in the performance of such obligations.

e. Business Associate shall inform the Covered Entity if it or its subcontractors will perform any work outside the U.S. that involves access to, or the disclosure of, Protected Health Information.

3. SAFEGUARDING AND SECURITY OF PROTECTED HEALTH INFORMATION

a. Business Associate shall use appropriate safeguards, including complying with Subpart C of 45 CFR Part 164 with respect to electronic Protected Health Information, to prevent use or disclosure of Protected Health Information other than as provided for by the Agreement.

b. Business Associate shall cooperate in good faith in response to any reasonable requests from the Covered Entity to discuss, review, inspect, and/or audit Business Associate’s safeguards.

4. REPORTING OF A VIOLATION TO COVERED ENTITY BY BUSINESS ASSOCIATE

a. Reporting to Covered Entity. The Business Associate must inform the Covered Entity by telephone call, plus email or fax, within five business days of any use or disclosure of PHI not provided for by this Agreement, including breaches of unsecured PHI in accordance with 45 CFR Subpart D of 45 CFR 164 ("Breach Notification Rule"), and any successful security incident, of which it becomes aware. Business Associate shall cooperate at all times with Covered Entity's investigation, analysis, notification and mitigation activities, and shall be responsible for reasonable costs incurred by Covered Entity for those activities to the extent allowed per Wisconsin law. Any failure or refusal by the Business Associate to cooperate at all times with the Covered Entity’s investigation, analysis, notification, or mitigation activities shall be considered a breach of this Agreement whereby the Covered Entity shall have the right to pursue any and all legal action(s) due to such breach(s) of this Agreement.

i. The Violation shall be treated as “discovered” as of the first day on which the Violation is known to the

Business Associate or, by exercising reasonable diligence would have been known to the Business Associate.

ii. Notification shall be provided to one of the contact persons as listed in section 4.c.

b. Mitigation of Harmful Effects. The Business Associate shall take immediate steps to mitigate any harmful effects of the unauthorized use, disclosure, or loss of Protected Health Information (PHI). The Business Associate shall cooperate with the Covered Entity’s efforts to seek appropriate injunctive relief and otherwise prevent or curtail such threatened or actual breach, or to recover its Protected Health Information, including complying with a reasonable Corrective Action Plan.

c. Covered Entity Contact Information. To direct communications to above-referenced Covered Entity’s staff, the Business Associate shall initiate contact as indicated herein. The Covered Entity reserves the right to make changes to the contact information by giving written notice to the Business Associate.

DHS Program Manager: DHS Privacy Officer:

c/o Office of Legal Counsel Department of Health Services 1 W. Wilson Street Madison, WI 53707 608-266-5484

5. USE OR DISCLOSURE OF PROTECTED HEALTH INFORMATION BY SUBCONTRACTORS OF THE BUSINESS

ASSOCIATE

In accordance with 45 CFR 164.502(e)(1) and 164.308(b), if applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information.

6. ACCESS TO PROTECTED HEALTH INFORMATION

At the direction of the Covered Entity, the Business Associate agrees to provide access, in accordance with 45 CFR 164.524, to any Protected Health Information held by the Business Associate, which Covered Entity has

F-00759 Page 3 determined to be part of Covered Entity’s Designated Record Set, in the time and manner designated by the Covered Entity. This access will be provided to Covered Entity, or (as directed by Covered Entity) to an Individual, in order to meet requirements under the Privacy Rule.

7. AMENDMENT OR CORRECTION TO PROTECTED HEALTH INFORMATION

At the direction of the Covered Entity, the Business Associate agrees to amend or correct Protected Health Information held by the Business Associate, which the Covered Entity has determined is part of the Covered Entity’s Designated Record Set, in the time and manner designated by the Covered Entity in accordance with

45 CFR 164.526.

8. DOCUMENTATION OF DISCLOSURES OF PROTECTED HEALTH INFORMATION BY THE BUSINESS

ASSOCIATE

The Business Associate agrees to document and make available to the Covered Entity , or (at the direction of the Covered Entity) to an Individual, such disclosures of Protected Health Information to respond to a proper request by the Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

9. INTERNAL PRACTICES

The Business Associate agrees to make its internal practices, books, and records relating to the use and disclosure of Protected Health Information available to the federal Secretary of Health and Human Services (HHS) in a time and manner determined by the HHS Secretary, or designee, for purposes of determining compliance with the requirements of HIPAA.

10. JUDICIAL AND ADMINSTRATIVE PROCEEDINGS

In the event Business Associate receives a subpoena(s), court or administrative order(s) or other discovery request(s) or mandate(s) for release of PHI, the Business Associate shall consult with the Covered entity regarding its response(s) to such request(s). Business Associate shall notify Covered Entity of the request(s) as soon as reasonably practicable, but in any event within five (5) calendar days of receipt of such request(s).

11. TERM AND TERMINATION OF AGREEMENT

a. The Business Associate agrees that if in good faith the Covered Entity determines that the Business Associate has materially breached any of its obligations under this Agreement, the Covered Entity may:

i. Exercise any of its rights to reports, access, and inspection under this Agreement;

ii. Require the Business Associate within a 30 calendar day period to cure the breach(s) or end the violation(s);

iii. Terminate this Agreement if the Business Associate does not cure the breach(s) or end the violation(s) within the time specified by the Covered Entity;

iv. Immediately terminate this Agreement if the Business Associate has breached a material term of this

Agreement and cure is not possible.

b. Before exercising either 11.a.ii. or 11.a.iii, the Covered Entity will provide written notice of preliminary determination to the Business Associate describing the violation(s) and the action(s) that the Covered Entity intends to pursue.

12. RETURN OR DESTRUCTION OF PROTECTED HEALTH INFORMATION

Upon termination, cancellation, expiration, or other conclusion of this Agreement, the Business Associate will:

a. Return to the Covered Entity or at the Covered Entity’s direction, destroy all Protected Health Information and any compilation of Protected Health Information in any media or form, or stored in any storage system. This provision shall apply to PHI that is in the possession of Business Associate’s subcontractor(s) and agent(s) of the Business Associate. Business Associate and subcontractor(s) of Business Associate shall retain no copies in whole or in part of PHI. The Business Associate agrees to complete the return or destruction of all Protected Health Information within the time limit as specified by the Covered Entity, but not more than 30 business days after the conclusion of this Agreement. The Business Associate will provide written documentation evidencing that return or destruction of all Protected Health Information has been completed.

b. If the Business Associate believes that the return or destruction of Protected Health Information is not feasible, the Business Associate shall provide written notification of the conditions that make return or destruction not feasible. If the Business Associate determines that return or destruction of Protected Health Information is not feasible, the Business Associate shall extend the protections of this Agreement to Protected Health Information and prohibit further uses or disclosures of the Protected Health Information of the Covered Entity without the express written authorization of the Covered Entity. Subsequent use or disclosure of any Protected Health Information subject to this provision will be limited to the use or disclosure that makes return or destruction not feasible.

F-00759 Page 4

13. COMPLIANCE WITH STATE LAW

The Business Associate acknowledges that Protected Health Information from the Covered Entity may be subject to state confidentiality laws. Business Associate shall comply with the more restrictive protection requirements between state and federal law for the protection of Protected Health Information.

14. MISCELLANEOUS PROVISIONS

a. Indemnification for Breach. Business Associate shall, to the extent allowed by Wisconsin law, indemnify the

Covered Entity for costs associated with any Incident arising from the acquisition, access, use, or disclosure of Protected Health Information by the Business Associate in a manner not permitted under HIPAA Rules.

b. Owner of PHI. Under no circumstances shall Business Associate be deemed in any respect to be owner of any PHI created or received by Business Associate on behalf of Covered Entity.

c. Third Party Rights. The terms of this Agreement do not grant any rights to any parties other than Business Associate and Covered Entity.

d. Independent Contractor Status. For the purposes of this Agreement, Business Associate is an independent contractor of Covered entity and shall not be considered an agent of Covered Entity.

e. Automatic Amendment. This Agreement shall automatically and retroactively incorporate any change or modification of applicable state or federal law(s) as of the effective date of such change or modification. The Business Associate agrees to maintain compliance with all changes or modifications to applicable state or federal law(s).

f. Interpretation of Terms and Conditions of Agreement. Any ambiguity in this Agreement shall be construed and resolved in favor of a meaning that permits the Covered Entity and Business Associate to comply with applicable state and federal law(s).

g. Survival. All terms of this Agreement that by their language or nature would survive the termination or other conclusion of this Agreement shall survive.

IN WITNESS WHEREOF, the undersigned have caused this Agreement to be duly executed by their respective representatives.

COVERED ENTITY

SIGNATURE – Covered Entity Representative Date Signed

Print Name Title

COVERED ENTITY

SIGNATURE – Covered Entity Representative Date Signed

BUSINESS ASSOCIATE

SIGNATURE – Business Associate Representative Date Signed

F-00759 Page 5