Schedule P - HIPAA Business Associate Agreement.docx

STATE OF MICHIGAN

RFP No. 200000001290

SCHEDULE P

HIPAA BUSINESS ASSOCIATE AGREEMENT

HIPAA BUSINESS ASSOCIATE AGREEMENT

The parties to this Business Associate Agreement (“Agreement”) are the State of Michigan, acting by and through the Department of Technology Management and Budget, on behalf of the Office of Retirement Services (State) and [INSERT NAME] (Contractor). This Agreement supplements and is made a part of the existing contract(s) or agreement(s) between the parties including the following Contract: [INSERT CONTRACT NUMBER] (Contract).

For purposes of this Agreement, the State is (check one):

(X) Covered Entity (CE)

(X) Business Associate (Associate)

RECITALS

A. Under the terms of the Contract, CE wishes to disclose certain information to Associate, some of which may constitute Protected Health Information. In consideration of the receipt of such information, Associate agrees to protect the privacy and security of the information as set forth in this Agreement.

B. CE and Associate intend to protect the privacy and provide for the security of Protected Health Information disclosed to Associate pursuant to the Contract in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH Act) and regulations promulgated by the U.S. Department of Health and Human Services (HIPAA Rules) and other applicable laws, as amended.

The HIPAA Rules require CE to enter into an agreement containing specific requirements with Associate before CE may disclose Protected Health Information to Associate.

In consideration of the mutual promises below and the exchange of information pursuant to this Agreement, the parties agree as follows:

1. Definitions.

a. Except as otherwise defined herein, capitalized terms in this Agreement have the same meaning as those terms under HIPAA and the HIPAA Rules.

b. “Agent” has the same meaning given to the term under the federal common law of agency.

c. “Agreement” means the Contract and this Agreement, as read together.

d. “Breach” means the acquisition, access, Use or Disclosure of Protected Health Information in a manner not permitted under the Privacy Rule that compromises the security or privacy of such information, as defined in 45 CFR § 164.402.

e. “Contract” means the underlying written agreement or purchase order between the parties for the goods or services to which this Agreement is added. Contract also includes all amendments and agreements to the original contract, both effective before and effective after the date of this Agreements.

f. “Designated Record Set” has the same meaning as the term under 45 CFR §164.501.

g. “Disclosure” has the same meaning as the term under 45 CFR §160.103.

h. “Electronic Protected Health Information” or “Electronic PHI” has the same meaning as the term under 45 CFR §160.103, limited to the information created, received, maintained or transmitted by Associate on behalf of CE.

i. “HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

j. “HITECH Act” means The Health Information Technology for Economic and Clinical Health Act, part of the American Recovery and Reinvestment Act of 2009, specifically Division A: Title XIII Subtitle D—Privacy, and its corresponding regulations as enacted under the authority of the Act.

k. “Individual” has the same meaning as the term under 45 CFR §160.103 and includes a person who qualifies as a personal representative in accordance with 45 CFR §165.502(g).

l. “Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E.

m. “Protected Health Information,” “Protected Information,” or “PHI” has the meaning given to the term under the Privacy Rule, 45 CFR §160.103.

n. “Security Incident” means the attempted or successful unauthorized access, Use, Disclosure, modification, or destruction of Protected Health Information or interference with system operations in an information system.

o. “Security Rule” means the Standards for Security of Electronic Protected Health Information at 45 CFR parts §160 and §164, Subparts A and C.

p. “Subcontractor” means a person or entity that creates, receives, maintains, or transmits Protected Health Information on behalf of Associate and who is now considered a Business Associate, as the latter term is defined in 45 CFR §160.103.

q. “Unsecured Protected Health Information” or “Unsecured PHI” means Protected Health Information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of technology or methodology specified by DHHS as defined in the Breach Rule, 45 CFR § 164.402.

r. “Use” has the same meaning as the term under 45 CFR §164.103.

2. Obligations and Activities of Associate.

a. Permitted Uses and Disclosures. Associate may Use and Disclose Protected Health Information only as necessary to perform services owed CE under the Contract and meet its obligations under this Agreement, provided that such Use or Disclosure would not violate Subpart E of 45 CFR 164. All other Uses or Disclosures by Associate not authorized by this Agreement, or by specific written instruction of CE, are prohibited. Except as otherwise limited by this Agreement, Associate may Use and Disclose Protected Health Information as follows:

i. Associate may Use Protected Health Information for the proper management and administration of the Associate or to carry out the legal responsibilities of the Associate.

ii. Associate may Disclose Protected Health Information for the proper management and administration of the Associate, provided that

Disclosures are Required by Law; or Associate obtains reasonable assurances from the person to whom the information is Disclosed that it will remain confidential and Used, or further Disclosed, only as Required by Law, or for the purpose for which it was Disclosed to the person, and the person notifies the Associate of any instances of which it is aware that the confidentiality of the information has been breached.

iii. Except as otherwise limited in this Agreement, Associate may Use Protected Health Information to provide Data Aggregation services to CE for the Health Care Operations of CE, as permitted by 45 CFR §164.504(e)(2)(i)(B). Associate agrees that said services shall not be provided in a manner that would result in Disclosure of Protected Health Information in a manner inconsistent with the HIPAA Rules. Further, Associate agrees that any such wrongful Disclosure of Protected Health Information may constitute a Breach and, after performing the required risk analysis under the HIPAA Rules, shall be reported to CE in accordance with this Agreement.

iv. Associate may Use Protected Health Information to report violations of law to appropriate federal and state authorities, consistent with 45 CFR §164.502(j)(1).

b. Appropriate Safeguards. Associate must implement and maintain appropriate administrative, physical, and technical safeguards, and comply with Subpart C of 45 CFR 164 regarding Electronic PHI, to prevent the Use or Disclosure of Protected Health Information other than as provided in this Agreement. These safeguards shall comport with HIPAA Rules and include at minimum:

i. Achieving and maintaining compliance with the HIPAA Security Rule, as necessary in conducting operations on behalf of CE under this Agreement.

ii. Maintaining a comprehensive written information privacy and security program that reasonably and appropriately protects the confidentiality, integrity, and availability of Protected Health Information.

c. Security Incidents. Associate must notify and report to CE in the manner described herein any Security Incident, whether actual or suspected, and any Use or Disclosure of Protected Information in violation of this Agreement of which it becomes aware, including breaches of Unsecured Protected Health Information as required by 45 CFR §164.410, and any Security Incident of which it becomes aware, and take the following actions:

i. Notice to CE. Associate must notify CE, via e-mail and telephone, within three (3) business days of the discovery of any Use or Disclosure of Protected Health Information in violation of this Agreement, or any Security Incident of which it becomes aware. Associate must follow its notification to CE with a report that meets the requirements outlined immediately below.

ii. Investigate; Report to CE. Associate must promptly investigate any Security Incident. Within ten (10) business days of the discovery, Associate must submit a preliminary report to CE identifying, to the extent known at the time, any information relevant to ascertaining the nature and scope of the Security Incident. Within fifteen (15) business days of the discovery of the Security Incident and unless otherwise directed by CE in writing, Associate must provide a complete report of the investigation to CE. Such report shall identify, to the extent possible: (a) each Individual whose Protected Health Information has been, or is reasonably believed by Associate to have been accessed, acquired, Used or Disclosed; (b) the type of Protected Health Information accessed, acquired, Used or Disclosed (e.g., name, social security number, date of birth) and whether such information was Unsecured; (c) who made the access, acquisition, Use, or Disclosure; and (d) an assessment of all known factors relevant to a determination of whether a Breach occurred under applicable provisions of the HIPAA Rules or any other applicable federal or state regulations. If Associate determines that a Breach of Unsecured PHI did occur, the report shall also include a full, detailed corrective action plan, including information on measures that were taken to halt and/or contain any improper Use or Disclosure. If CE requests information in addition to that listed in the report, Associate shall make reasonable efforts to provide CE with such information. Associate agrees that CE reserves the right to review and recommend changes to any corrective action plan and make a final determination as to whether a Breach of PHI occurred and whether any notifications may be required under applicable state or federal regulations, including specifically 45 CFR §§164.404-408. In the event of a Breach of Unsecured PHI, as determined by CE, Associate agrees, consistent with 45 CFR §164.404(c), to provide CE with information and documentation in its control necessary to meet the requirements of said sections, and in a manner and format to be reasonably specified by CE.

iii. Mitigation. Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Associate of a Security Incident or a Use or Disclosure of Protected Health Information in violation of the requirements of this Agreement. Associate must take: (a) prompt corrective action to cure any such violation and (b) any other action pertaining to such unauthorized Use or Disclosure required by applicable federal and state laws and regulations.

d. Responsibility for Notifications. If the cause of a Breach of Protected Health Information is attributable to Associate or its Agents or Subcontractors, Associate is responsible for all required reporting and notification(s) of the Breach, as specified in and in accordance with 45 CFR §§164.404-408. CE’s authorized representative shall provide input on the time, manner, and content of any such notification. In the event of such Breach, and without limiting Associate’s obligations of indemnification as further described in this Agreement, Associate must indemnify, defend, and hold harmless CE for any and all claims or losses, including reasonable attorneys’ fees, costs, and expenses incidental thereto, which may be suffered by, accrued against, charged to, or recoverable from CE in connection with the occurrence.

e. Associate’s Agents and Subcontractors. If Associate uses one or more Subcontractors or Agents to provide services under the Agreement, and such Agents or Subcontractors receive or have access to Protected Health Information, each Subcontractor or Agent must sign an agreement with Associate containing substantially the same provisions as this Agreement and in conformance with 45 CFR §164.504(e)(2), and to assume toward Associate all of the obligations and responsibilities that the Associate, by this Agreement, assumes toward CE. Associate agrees to provide said Agents or Subcontractors Protected Health Information in accordance with the HIPAA Rules and other applicable federal and state law and must: (i) implement and maintain sanctions against Subcontractors and Agents that violate such restrictions and conditions; and (ii) mitigate, to the extent practicable, the effects of any such violation.

f. Access to Protected Health Information. Associate agrees to make Protected Health Information regarding an Individual maintained by Associate or its Agents or Subcontractors in a Designated Record Set available to CE or to such Individual for inspection and copying in order to meet CE’s obligations under 45 CFR §164.524. Associate must permit such access within ten (10) days of a request. An Individual’s request for access must be submitted on standard request forms available from Associate. If CE receives a request for access, CE, in addition to addressing the request on its behalf, will forward the request in writing to Associate in a timely manner. If Associate or its Agents or Subcontractors maintain Electronic Health Records for CE, then Associate must provide, where applicable, electronic access to the Electronic Health Records.

g. Amendment of Protected Health Information. Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record Set as directed by CE pursuant to 45 CFR §164.526, or take other measures as necessary to satisfy CE’s obligations under 45 CFR §164.526. If an Individual requests an amendment of Protected Health Information directly from Associate or its Agents or Subcontractors, Associate must notify CE in writing within ten (10) days of the request, and then, in that case, only CE may either grant or deny the request.

h. Accounting Rights. Associate agrees to maintain, and within ten (10) days of a request from CE or an Individual for an accounting of Disclosures of Protected Health Information, make available the information in accordance with 45 CFR §164.528. An Individual’s request for an accounting of disclosures must be submitted on standard request forms available from Associate. If CE receives a request for an accounting, CE, in addition to addressing the request on its own behalf, will forward the request in writing to Associate in a timely manner.

i. Access to Records and Internal Practices. Unless otherwise protected or prohibited from discovery or Disclosure by law, Associate must make its internal practices, books, and records, including policies and procedures (collectively “Compliance Information”), relating to the Use or Disclosure of PHI and the protection of same, available to the Secretary of DHHS (hereinafter, “Secretary”) for purposes of the Secretary determining CE’s compliance with the HIPAA Rules. Associate shall have a reasonable time within which to comply with requests for such access, consistent with this Agreement. In no case shall access be required in less than five (5) business days after Associate’s receipt of such request, unless otherwise designated by the Secretary.

j. Minimum Necessary. Associate (and its Agents or Subcontractors) shall only request, Use and Disclose the minimum amount of Protected Health Information necessary to accomplish the purpose of the request, Use or Disclosure, in accordance with the Minimum Necessary requirements of the Privacy Rule, including, but not limited to 45 CFR §§ 164.502(b) and 164.514(d).

k. Compliance.

i. To the extent that Associate carries out one or more of CE’s obligations under the HIPAA Rules, Associate must comply with all requirements that would be applicable to CE.

ii. CE shall consult with Associate before CE agrees to an Individual’s request to restrict the Use or Disclosure of the Individual’s PHI that may affect Associate. Associate will respond to all requests submitted directly by Individuals to restrict the Use or Disclosure of their PHI. CE will promptly notify Associate in writing of any request for restriction on the Use or Disclosure of PHI. Any restriction requests must be submitted on Associate’s request forms.

l. Retention of Protected Health Information. Notwithstanding Section 5(d) of this Agreement, Associate and its Subcontractors or Agents shall retain all Protected Health Information throughout the term of the Contract and shall continue to maintain the information required under Section 2(h) of this Agreement for a period of six (6) years from the date of creation or the date when it last was in effect, whichever is later, or as Required by Law. This obligation shall survive the termination of the Contract.

m. Destruction of Protected Health Information. Associate must implement policies and procedures for the final disposition of Protected Health Information, including Electronic PHI, and/or the hardware and equipment on which it is stored, including but not limited to, removal before re-Use, in accordance with the Security Rule, and other applicable laws relating to the final disposition of PHI.

n. Audits, Inspection, and Enforcement. Within ten (10) days of a written request by CE, Associate and its Agents or Subcontractors must allow CE to conduct a reasonable inspection of the facilities, systems, books, records, agreements, policies and procedures relating to the Use or Disclosure of Protected Health Information pursuant to this Agreement for the purpose of determining whether Associate has complied with this Agreement; provided, however, that: (i) Associate and CE shall mutually agree in advance upon the scope, timing and location of such an inspection; (ii) CE shall protect the confidentiality of all confidential and proprietary information of Associate to which CE has access during the course of such inspection; and (iii) CE or Associate shall execute a nondisclosure agreement, if requested by Associate or CE. The fact that CE inspects, or fails to inspect, or has the right to inspect, Associate’s facilities, systems, books, records, agreements, policies and procedures does not relieve Associate of its responsibility to comply with this Agreement, nor does CE’s (i) failure to detect or (ii) detection, but failure to notify Associate or require Associate’s remediation of any unsatisfactory practices, constitute acceptance of such practice or a waiver of CE’s enforcement rights under this Agreement. If Associate is the subject of an audit, compliance review, or complaint investigation by DHHS that is related to the performance of its obligations pursuant to this Agreement, Associate must notify CE and provide CE with a copy of any Protected Health Information that Associate provides to DHHS concurrently with providing such information to DHHS. Associate is responsible for all civil penalties assessed due to an audit or investigation of Associate by DHHS.

o. Audit Findings. Associate must implement any appropriate Safeguards, as identified by CE in an audit conducted under paragraph 2(o).

p. Safeguards During Transmission. Associate must utilize safeguards that reasonably and appropriately maintain and ensure the confidentiality, integrity, and availability of Protected Health Information transmitted to CE pursuant to this Agreement, in accordance with the standards and requirements of the HIPAA Rules and other applicable federal or state regulations, until such Protected Health Information is received by CE, and in accordance with any specifications set forth in Attachment A.

q. Due Diligence. Associate must exercise due diligence and take reasonable steps to ensure that it remains in compliance with this Agreement and is in compliance with applicable provisions of HIPAA, the HIPAA Rules, and other applicable laws or regulations pertaining to

PHI, and that its Agents, Subcontractors and vendors are in compliance with their obligations as required by this Agreement.

r. Sanctions and/or Penalties. Associate understands that a failure to comply with the provisions of HIPAA, the HIPAA Rules or any other state or federal regulation that is applicable to Associate may result in the imposition of sanctions and/or penalties on Associate under HIPPA, the HIPAA Rules, or any other applicable laws or regulations pertaining to PHI.

s. Loss of Data. In the event of a Breach of Protected Health Information, Associate must, at CE’s sole discretion, provide third-party credit and identity monitoring services to each of the affected individuals who comprise the Protected Health Information for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twenty-four (24) months following the date of notification to such individuals. Associate must also reimburse the State for the cost of any audit of Associate’s handling and remediation of the Breach. This section shall survive termination of the Agreement.

3. Obligations of CE.

a. Safeguards During Transmission. CE must utilize safeguards that reasonably and appropriately maintain and ensure the confidentiality, integrity, and availability of Protected Health Information transmitted to Associate pursuant to this Agreement, in accordance with the standards and requirements of the HIPAA Rules and other applicable federal or state regulations, until such Protected Health Information is received by Associate, and in accordance with any specifications set forth in Attachment A.

b. Notice of Limitations and Changes. CE must notify Associate of any limitation(s) in its notice of privacy practices in accordance with 45 CFR §164.520, or any restriction to the Use or Disclosure of PHI that CE has agreed to in accordance with 45 CFR §164.522, to the extent that such limitation may affect Associate’s Use or Disclosure of PHI. CE must also notify Associate of any changes in, or revocation of, permission by Individual to Use or Disclose PHI of which it becomes aware, to the extent that such changes may affect Associate’s Use or Disclosure of PHI.

4. Term. This Agreement shall continue in effect as to each Contract to which it applies until such Contract is terminated or is replaced with a new contract between the parties containing provisions meeting the requirements of the HIPAA Rules, whichever first occurs. However, certain obligations will continue as specified in this Agreement.

5. Termination.

a. Material Breach. Except as otherwise provided in the Contract, a breach by Associate of any provision of this Agreement, as determined by CE, shall constitute a material breach of the Agreement and provide grounds for CE to terminate the Agreement for cause, subject to section 5(b):

i. Default. If Associate refuses or fails to timely perform any of the provisions of this Agreement, CE may notify Associate in writing of the non-performance, and if not corrected within thirty (30) days, CE may immediately terminate the Agreement. Associate agrees to continue performance of the Agreement to the extent it is not terminated.

ii. Duties. Notwithstanding termination of the Agreement, and subject to any reasonable directions from the CE, Associate agrees to take timely, reasonable and necessary action to protect and preserve property in the possession of the Associate in which CE has an interest.

iii. Erroneous Termination for Default. If after such termination it is determined, for any reason, that Associate was not in default, or that Associate’s action/inaction was excusable, such termination shall be treated as a termination for convenience, and the rights and obligations of the parties shall be the same as if the Contract had been terminated for convenience, as described in this Agreement or in the Contract.

b. Reasonable Steps to Cure Breach. If CE knows of a pattern of activity or practice of Associate that constitutes a material breach or violation of the Associate’s obligations under the provisions of this Agreement or another arrangement and does not terminate the Agreement pursuant to Section 5(a), then CE shall take reasonable steps to cure such breach or end such violation, as applicable. If CE’s efforts to cure such breach or end such violation are unsuccessful, CE may terminate the Agreement.

c. Reserved.

d. Effect of Termination.

i. At the direction of CE, and except as provided in section 5(d)(ii), upon termination of the Agreement for any reason, Associate must return or destroy all Protected Health Information that Associate or its Agents or Subcontractors still maintain in any form, and shall retain no copies of such information. If CE directs Associate to destroy the Protected Health Information, Associate must certify in writing to CE that such information has been destroyed. If CE directs associate to return such information, Associate must do so promptly in any format reasonably specified by CE.

ii. If Associate believes that returning or destroying the Protected Health Information is not feasible, including but not limited to, a finding that record retention requirements provided by law make return or destruction infeasible, Associate must promptly provide CE written notice of the conditions making return or destruction infeasible. Upon mutual agreement of CE and Associate that return or destruction of Protected Health Information is infeasible, Associate must continue to extend the protections of this Agreement to such information, and must limit further Use of such Protected Health Information to those purposes that make the return or destruction of such Protected Health Information infeasible.

6. Reserved.

7. No Waiver of Immunity. No term or condition of this Agreement shall be construed or interpreted as a waiver, express or implied, of any of the immunities, rights, benefits, protection, or other provisions of applicable laws, including the Michigan Governmental Immunity Act, MCL 691.1401, et seq., the Court of Claims Act, MCL 600.6401, et seq., the Federal Tort Claims Act, 28 U.S.C. 2671, et seq., or the common law, as applicable, as now in effect or hereafter amended.

8. Reserved.

9. Disclaimer. CE makes no warranty or representation that compliance by Associate with this Agreement, HIPAA, the HIPAA Rules, or other applicable laws pertaining to Protected Health Information will be adequate or satisfactory for Associate’s own purposes. Associate is solely responsible for all decisions made by Associate regarding the safeguarding of Protected Health Information.

10. Reserved.

11. Amendment.

a. Amendment to Comply with Law. The parties agree to take such action as is necessary to amend this Agreement from time to time as may be necessary for CE and Associate to comply with and implement the standards and requirements of HIPAA, the HIPAA Rules, and other applicable laws relating to the security or privacy of PHI. Upon the request of either party, the other party agrees to promptly enter into negotiations concerning the terms of an amendment to this Agreement embodying written assurances consistent with the standards and requirements of HIPAA, the HIPAA Rules or other applicable laws. Either party may terminate the Agreement upon thirty (30) days written notice if (i) the other does not promptly enter into negotiations to amend this Agreement when requested by the requesting party under this Section or (ii) the non- requesting party does not enter into an amendment to this Agreement when requested providing assurances regarding the safeguarding of PHI that the requesting party, in its sole discretion, deems sufficient to satisfy the standards and requirements of HIPAA, the HIPAA Rules, and other applicable laws.

b. Amendment of Attachment A. Attachment A may be modified or amended by mutual agreement of the parties in writing from time to time without formal amendment of this Agreement.

12. Assistance in Litigation or Administrative Proceedings. Associate must make itself, and any Subcontractors, employees or Agents assisting it in the performance of its obligations under this Agreement available to CE, at no cost to CE, to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against a party, its directors, officers or employees, departments, agencies, or divisions based upon a claimed violation of HIPAA, the HIPAA Rules, or other laws relating to security and privacy of Protected Health Information, except where the other party or its Subcontractor, employee or Agent is a named adverse party.

13. No Third Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than CE, Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.

14. Effect on Contract. Except as specifically required to implement the purposes of this Agreement, or to the extent inconsistent with this Agreement, all other terms of the Contract shall remain in force and effect. This Agreement is incorporated into the Contract as if set forth in full therein. The parties expressly acknowledge and agree that sufficient mutual consideration exists to make this Agreement legally binding in accordance with its terms. Associate and CE expressly waives any claim or defense that this Agreement is not part of the Agreement between the parties under the Contract.

15. Interpretation and Order of Precedence. This Agreement is incorporated into and becomes part of each Contract identified herein. Together, this Agreement and each separate Contract constitute the Agreement of the parties with respect to their Business Associate relationship under HIPAA and the HIPAA Rules. The provisions of this Agreement shall prevail over any provisions in the Contract that may conflict or appear inconsistent with any provision in this Agreement. This Agreement and the Contract shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA Rules, and applicable state laws. The parties agree that any ambiguity in this Agreement shall be resolved in favor of a meaning that complies and is consistent with HIPAA, the HIPAA Rules, and applicable state laws. This Agreement supersedes and replaces any previous separately executed HIPAA agreement between the parties. In the event of any conflict between the mandatory provisions of the HIPAA Rules and the provisions of this Agreement, the HIPAA Rules shall control. Where the provisions of this Agreement differ from those mandated by the HIPAA Rules, but are nonetheless permitted by the HIPAA Rules, the provisions of this Agreement shall control.

16. Effective Date. This Agreement is effective upon receipt of the last approval necessary and the affixing of the last signature required.

17. Survival of Certain Contract Terms. Notwithstanding anything herein to the contrary, Associate’s obligations under Section 5(d) (Effect of Termination) and record retention laws and Section 13 (No Third Party Beneficiaries) shall survive termination of this Agreement and shall be enforceable by CE as provided herein in the event of such failure to perform or comply by the Associate.

18. Representatives and Notice.

a. Representatives. For the purpose of this Agreement, the individuals identified in the Contract shall be the representatives of the respective parties. If no representatives are identified in the Contract, the individuals listed below are hereby designated as the parties’ respective representatives for purposes of this Agreement. Either party may from time to time designate in writing new or substitute representatives.

b. Notices. Except as otherwise provided in this Agreement, all required notices shall be in writing and shall be hand delivered or given by certified or registered mail to the representatives at the addresses set forth below.

Covered Entity Representative:

Name: Title: Department and Division: Address:

Business Associate Representative:

Name: Title: Department and Division: Address:

Any notice given to a party under this Agreement shall be deemed effective, if addressed to such party, upon: (i) delivery, if hand delivered; or (ii) the third (3rd) business day after being sent by certified or registered mail.

IN WITNESS WHEREOF, the parties hereto have duly executed this Agreement as of the Agreement Effective Date.

[INSERT NAME]

By:

[INSERT NAME]

By:

ATTACHMENT A

This Attachment sets forth additional terms to the HIPAA Business Associate Agreement dated , between and (Agreement) and is effective as of (the Attachment Effective Date). This Attachment applies to the specific contracts listed below covered by the Agreement. This Attachment may be amended from time to time as provided in Section 11(b) of the Agreement.

1. Specific Contract Covered. This Attachment applies to the following specific contract covered by the Agreement:

2. Additional Permitted Uses. In addition to those purposes set forth in Section 2(a) of the Agreement, Associate may Use Protected Health Information as follows:

3. Additional Permitted Disclosures. In addition to those purposes set forth in Section 2(b) of the Agreement, Associate may Disclose Protected Health Information as follows:

4. Subcontractor(s). The parties acknowledge that the following subcontractors or agents of Associate shall receive Protected Health Information in the course of assisting Associate in the performance of its obligations under the Contract and the Agreement:

5. Receipt. Associate’s receipt of Protected Health Information pursuant to the Contract and Agreement shall be deemed to occur as follows, and Associate’s obligations under the Agreement shall commence with respect to such Protected Health Information upon such receipt:

6. Additional Restrictions on Use of Data. CE is a Business Associate of certain other Covered Entities and, pursuant to such obligations of CE, Associate shall comply with the following restrictions on the Use and Disclosure of Protected Health Information:

7. Additional Terms. [This section may include specifications for disclosure format, method of transmission, use of an intermediary, use of digital signatures or PKI, authentication, additional security of privacy specifications, de-identification or re-identification of data and other additional terms.]

[INSERT NAME]

By:

[INSERT NAME]

By: