SMCO-Appendix-A-BAA-032425.pdf

BUSINESS ASSOCIATE AGREEMENT

This Agreement (“Agreement”) is effective upon execution by and between _____________________________________________ Business Associate”) and Summit County Government Employee Benefit Plan (“Health Plan”).

Health Plan and Business Associate mutually agree to comply with the requirements of the implementing regulations at 45 Code of Federal Regulations (“C.F.R.”) Parts 160-64 for the Administrative Simplification provisions of Title II, Subtitle F of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). This Agreement shall supersede any prior business associate agreement.

1. Privacy and Security of Protected Health Information.

a) Permitted Uses and Disclosures. Business Associate is permitted to use and disclose Protected Health Information that it creates or receives on Health Plan’s behalf or receives from Health Plan (or another business associate of Health Plan) and to request Protected Health Information on Health Plan’s behalf (collectively, “Health Plan’s Protected Health Information”) only:

i) Functions and Activities on Health Plan’s Behalf. This agreement is for functions, activities, or services for, or on behalf of Health Plan, and is limited in scope and duration. Business Associate may not use or disclosure information that would violate 45 C.F.R. Part 164, Subpart E “Privacy of Individually Identifiable Health Information” (the “Privacy Rule”) or 45 C.F.R. Part 164, Subpart C "Security Standards for the Protection of Electronic Protected Health Information" (the "Security Rule") if done by Health Plan. Functions, activities or services are limited to:

A) Geo Access Analysis: Business Associate may use provided PHI to perform geographic access analysis to determine the accessibility of healthcare providers to members. This includes mapping provider locations and analyzing travel distances and times for members to reach providers.

B) Provider Disruption Reports: Business Associate may use PHI to generate provider disruption reports. This involves analyzing the impact on members if there are changes in the provider network, such as providers leaving or joining the network. The analysis includes identifying affected members and the potential disruption to their care.

C) Claims Re-Pricing: Business Associate may use PHI to re-price claims based on the terms of the new or existing provider contracts. This includes evaluating the cost impact of claims under different pricing scenarios and providing detailed reports on the financial implications for the covered entity.

D) Claims Report History: Business Associate may use PHI to analyze historical claims data. This includes identifying trends, evaluating the effectiveness of past claims processing, and generating reports to improve future claims management.

E) Health Plan Budget History: Business Associate may use PHI to review and analyze the health plan's budget history. This involves assessing past expenditures, identifying cost-saving opportunities, and providing insights to optimize future budgeting and financial planning.

F) Large Claimant Data: Business Associate may use PHI to analyze data related to large claimants. This includes evaluating high-cost claims, identifying patterns or common factors among large claimants, and providing recommendations to manage and mitigate the financial impact of large claims.

ii) Business Associate’s Operations. For Business Associate’s proper management and administration or to carry out Business Associate’s legal responsibilities, provided that, with respect to disclosure of Health Plan’s Protected Health Information, either:

A) The disclosure is Required by Law; or

B) Business Associate obtains reasonable assurance from any person or entity to which Business Associate will disclose Health Plan’s Protected Health Information that the person or entity will:

1) Hold Health Plan’s Protected Health Information in confidence and use or further disclose Health Plan’s Protected Health Information only for the purpose for which Business Associate disclosed Health Plan’s Protected Health Information to the person or entity or as Required by Law; and

2) Promptly notify Business Associate (who will in turn notify Health Plan in accordance with Section 4(a)) of any instance of which the person or entity becomes aware in which the confidentiality of Health Plan’s Protected Health Information was Breached.

iii) Minimum Necessary. Business Associate will, in its performance of the functions, activities, services, and operations specified in Section 1(a), make reasonable efforts to use, to disclose, and to request only the minimum amount of Health Plan’s Protected Health Information reasonably necessary to accomplish the intended purpose of the use, disclosure or request, except that Business Associate will not be obligated to comply with this minimum necessary limitation if neither Business Associate nor Health Plan is required to limit the use, disclosure or request to the minimum necessary. Business Associate and Health Plan acknowledge that the phrase “minimum necessary” shall be interpreted in accordance with the American Recovery and Reinvestment Act and government guidance on the definition.

b) Prohibition on Unauthorized Use or Disclosure. Business Associate will neither use nor disclose Health Plan’s Protected Health Information, except as permitted or required by this Agreement or in writing by Health Plan or as Required by Law. This Agreement does not authorize Business Associate to use or disclose Health Plan’s Protected Health Information in a manner that will violate the Privacy Rule or the Security Rule if done by Health Plan, except as set forth in Section 1(a)(ii).

c) Information Safeguards.

i) Privacy of Health Plan’s Protected Health Information. Business Associate will develop, implement, maintain, and use appropriate administrative, technical, and physical safeguards to protect the privacy of Health Plan’s Protected Health Information. The safeguards must reasonably protect Health Plan’s Protected Health Information from any intentional or unintentional use or disclosure in violation of the Privacy Rule and limit incidental uses or disclosures made pursuant to a use or disclosure otherwise permitted by this Agreement.

ii) Security of Health Plan’s Electronic Protected Health Information.

Business Associate will develop, implement, maintain, and use administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic Protected Health Information that Business Associate creates, receives, maintains, or transmits on Health Plan’s behalf as required by the Security Rule, 45 C.F.R. Part 164, Subpart C. Such safeguards will include, but not be limited to, Business Associate conducting periodic risk assessments with respect to Health Plan's Electronic Protected Health Information. Business Associate shall, to the extent reasonably possible, implement and follow recognized security practices consistent with H.R. 7898, enacted into law on January 5, 2021. Business Associate shall provide Health Plan with all information reasonably requested about such safeguards, including whether Business Associate follows such recognized security practices and, if so, which practice or practices.

d) Subcontractors and Agents. Business Associate will require any of its subcontractors and agents, to which Business Associate is permitted by this Agreement or in writing by Health Plan to disclose Health Plan’s Protected Health Information and / or Electronic Protected Health Information, to agree to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information, including but not limited to compliance with the applicable requirements of 45 C.F.R. Parts 160, 162 and 164. Such agreement between Business Associate and the subcontractor or agent must be made in writing and must comply with the terms of this Agreement and the requirements outlined at 45 C.F.R. §§ 164.504(e) and 164.314. To the extent required by applicable law or other binding regulatory guidance, Business Associate shall not disclose Health Plan's Protected Health Information to a "tracking technology vendor" (as defined in guidance issued by the United States Department of Health and Human Services ("DHHS")) unless: (i) Business Associate has entered into an agreement with such tracking technology vendor in accordance with this Section 1(d); and

(ii) such disclosure is permitted or required under the Privacy Rule and this Agreement.

e) Prohibition on Certain Activities. Business Associate shall not: (i) sell Protected Health Information (within the meaning of 45 C.F.R. § 164.508); (ii) use or disclose Protected Health Information for fundraising purposes (within the meaning of 45 C.F.R.§ 164.514); (iii) use or disclose Protected Health Information for research (within the meaning of 45 C.F.R.§ 164.512); (iv) use genetic information for underwriting purposes (within the meaning of 45 C.F.R.§ 164.514); or (v) use or disclose Protected Health Information for marketing purposes (within the meaning of 45 C.F.R.§ 164.508). Business Associate shall not de-identify Health Plan's Protected Health Information except if required to perform activities on behalf of Health Plan, as specified in Section 1(a)(i) of this Agreement.

f) Reproductive Health Information. Business Associate shall comply with all requirements imposed on business associates under the HIPAA Privacy Rule to Support Reproductive Health Care Privacy promulgated by DHHS, including, but not limited to, the attestation requirement under 45 C.F.R. § 164.509.

g) Substance Use Disorder Information. The parties acknowledge and agree that records subject to 42 C.F.R. Part 2 ("Part 2") may be used and disclosed only as permitted under Part 2.

2. Compliance with Transaction Standards. If Business Associate conducts in whole or part electronic Transactions on behalf of Health Plan for which DHHS has established Standards, Business Associate will comply, and will require any subcontractor or agent it involves with the conduct of such Transactions to comply, with each applicable requirement of the Transaction

Rule, 45 C.F.R. Part 162 and any related operating rules. Business Associate shall comply with the National Provider Identifier requirements, if and to the extent applicable. Business Associate shall provide to Health Plan any documentation of compliance with the Transaction Rule which

Health Plan may reasonably need, if any, pursuant to section 1104(b) of the Patient Protection and Affordable Care Act, as amended. Business Associate will not enter into, or permit its subcontractors or agents to enter into, any Trading Partner Agreement in connection with the conduct of Standard Transactions on behalf of Health Plan that:

a) Changes the definition, data condition, or use of a data element or segment in a Standard

Transaction;

b) Adds any data element or segment to the maximum defined data set;

c) Uses any code or data element that is marked “not used” in the Standard Transaction’s implementation specification or is not in the Standard Transaction’s implementation specification;

or

d) Changes the meaning or intent of the Standard Transaction’s implementation specification.

3. Individual Rights.

a) Access. Business Associate will, within 30 calendar days following Health Plan’s request, make available to Health Plan or, at Health Plan’s direction, to an individual (or the individual’s personal representative) for inspection and obtaining copies Health Plan’s Protected Health Information about the individual that is in Business Associate’s custody or control, so that Health Plan may meet its access obligations under 45 C.F.R. § 164.524.

Effective as of September 23, 2013 and thereafter, if the Protected Health Information is held electronically in a designated record set, then the individual shall have a right to obtain from Business Associate a copy of such information in the electronic form and format requested by the individual, if it is readily producible in such form and format. If it is not so readily producible, Business Associate will provide it in a readable electronic form and format as reasonably requested by Health Plan or, if Business Associate is dealing directly with the individual, the individual. Business Associate shall provide such a copy to Health Plan or, alternatively, to the individual directly, if such alternative choice is clearly, conspicuously and specifically made by the individual or Health Plan. In addition, if the individual's request for access directs that the Protected Health Information be transmitted directly to another person designated by the individual, Business Associate must provide the copy to the person designated by the individual, provided the individual's request: (i) is in writing; (ii) is signed by the individual; and (iii) clearly identifies the designated person and where to send the copy of Protected Health Information. If Business Associate provides such a copy to that designated person, Business Associate will promptly notify Health Plan of this fact.

b) Amendment. Business Associate will, within 30 calendar days following notice from Health Plan, amend or permit Health Plan access to amend any portion of Health Plan’s Protected Health Information, so that Health Plan may meet its amendment obligations under 45 C.F.R. § 164.526.

c) Disclosure Accounting. So that Health Plan may meet its disclosure accounting obligations under 45 C.F.R. § 164.528:

A) Disclosure Information Generally. Except for repetitive disclosures of Health Plan’s Protected Health Information as specified in Section 3(c)(iii)(B) below, the Disclosure Information that Business Associate must record for each accountable disclosure is (i) the disclosure date, (ii) the name and (if known) address of the entity to which Business Associate made the disclosure, (iii) a brief description of Health Plan’s Protected Health Information disclosed, and (iv) a brief statement of the purpose of the disclosure.

B) Disclosure Information for Multiple Disclosures. For multiple disclosures of Health Plan’s Protected Health Information that Business Associate makes for a single purpose to the same person or entity (including Health Plan), the Disclosure Information that Business Associate must record is either the Disclosure Information specified in Section 3(c)(iii)(A) above for each accountable disclosure, or (i) the Disclosure Information specified in Section 3(c)(iii)(A) above for the first of the repetitive accountable disclosures, (ii) the frequency, periodicity, or number of the repetitive accountable disclosures, and (iii) the date of the last of the repetitive accountable disclosures.

i) Disclosures Subject to Accounting. Business Associate will record the information specified in Section 3(c)(iii) below (“Disclosure Information”) for each disclosure of Health Plan’s Protected Health Information, not excepted from disclosure accounting as specified in Section 3(c)(ii) below, that Business Associate makes to Health Plan or to a third party.

ii) Disclosures Not Subject to Accounting. Business Associate will not be obligated to record Disclosure Information or otherwise account for disclosures of Health Plan’s Protected Health Information if Health Plan need not account for such disclosures.

iii) Disclosure Information. With respect to any disclosure by Business Associate of Health Plan’s Protected Health Information that is not excepted from disclosure accounting by Section 3(c)(ii) above, Business Associate will record the following Disclosure Information as applicable to the type of accountable disclosure made:

iv) Availability of Disclosure Information. Business Associate will maintain the Disclosure Information for at least 6 years following the date of the accountable disclosure to which the Disclosure Information relates.

Business Associate will make the Disclosure Information available to Health Plan within 30 calendar days following Health Plan’s request for such Disclosure

Information to comply with an individual’s request for disclosure accounting.

d) Restriction Agreements and Confidential Communications. Business Associate will comply with any agreement that Health Plan makes that either (i) restricts use or disclosure of Health Plan’s Protected Health Information pursuant to 45 C.F.R. § 164.522(a), or (ii) requires confidential communication about Health Plan’s Protected Health Information pursuant to 45 C.F.R. § 164.522(b), provided that Health Plan notifies Business Associate in writing of the restriction or confidential communication obligations that Business Associate must follow. Health Plan will promptly notify Business Associate in writing of the termination of any such restriction agreement or confidential communication requirement and, with respect to termination of any such restriction agreement, instruct Business Associate whether any of Health Plan’s Protected Health Information will remain subject to the terms of the restriction agreement.

4. Breaches and Security Incidents.

a) Reporting.

A) Identify the nature of the Breach or other non-permitted use or disclosure, which will include a brief description of what happened, including the date of any Breach and the date of the discovery of any Breach;

B) Identify Health Plan’s Protected Health Information that was subject to the non-permitted use or disclosure or Breach (such as whether full name, social security number, date of birth, home address, account number or other information were involved) on an individual-by-individual basis;

C) Identify who made the non-permitted use or disclosure and who received the non-permitted disclosure;

D) Identify what corrective or investigational action Business Associate took or will take to prevent further non-permitted uses or disclosures, to mitigate harmful effects and to protect against any further Breaches;

E) Identify what steps the individuals who were subject to a Breach should take to protect themselves;

F) Provide such other information, including a written report, as Health Plan may reasonably request.

i) Privacy or Security Breach. Business Associate will report to Health Plan any use or disclosure of Health Plan’s Protected Health Information not permitted by this Agreement or in writing by Health Plan, along with any Breach or possible Breach of Health Plan’s Unsecured Protected Health Information. In connection with this report to Health Plan, Business Associate will prepare a written risk assessment for each Breach or possible Breach and shall provide a copy of such risk assessment to Health Plan. Business Associate will treat the Breach as being Discovered in accordance with HIPAA’s requirements. Business Associate will make the report to Health Plan’s Privacy Official not more than 30 calendar days after Business Associate learns of such non-permitted use or disclosure. If a delay is requested by a law enforcement official in accordance with 45 C.F.R. § 164.412, Business Associate may delay notifying Health Plan for the time period specified by such regulation. Business Associate’s report will at least:

ii) Security Incidents. Business Associate will report to Health Plan within 30 calendar days any attempted or successful (A) unauthorized access, use, disclosure, modification, or destruction of Health Plan’s Electronic Protected Health Information or (B) interference with Business Associate’s system operations in Business Associate’s information systems, of which Business Associate becomes aware. Business Associate will make this report upon Health Plan’s request, except if any such security incident resulted in a disclosure or Breach of Health Plan’s Protected Health Information or Electronic Protected

Health Information not permitted by this Agreement, Business Associate will make the report in accordance with Section 4(a)(i) above.

b) Termination of Agreement.

A) Return or Destruction of Health Plan’s Protected Health Information as Feasible. Upon termination or other conclusion of Agreement, Business Associate will, if feasible, return to Health Plan or destroy all of Health Plan’s Protected Health Information in whatever form or medium, including all copies thereof and all data, compilations, and other works derived therefrom that allow identification of any individual who is a subject of Health Plan’s Protected Health Information. Business Associate will require any subcontractor or agent, to which Business Associate has disclosed Health Plan’s Protected Health Information as permitted by Section 1(e) of this Agreement, to if feasible return to Business Associate (so that Business Associate may return it to Health Plan) or destroy all of Health Plan’s Protected Health Information in whatever form or medium received from Business Associate, including all copies thereof and all data, compilations, and other works derived therefrom that allow identification of any individual who is a subject of Health Plan’s Protected Health Information, and certify on oath to Business Associate that all such information has been returned or destroyed. Business Associate will complete these obligations as promptly as possible, but not later than 30 calendar days following the effective date of the termination or other conclusion of Agreement.

B) Procedure When Return or Destruction Is Not Feasible.

Business Associate will identify any of Health Plan’s Protected Health Information, including any that Business Associate has disclosed to subcontractors or agents as permitted by Section 1(e) of this Agreement, that cannot feasibly be returned to Health Plan or destroyed and explain why return or destruction is infeasible. Business Associate will limit its further use or disclosure of such information to those purposes that make return or destruction of such information infeasible. Business Associate will require such subcontractor or agent to limit its further use or disclosure of Health Plan’s Protected Health Information that such subcontractor or agent cannot feasibly return or destroy to those purposes that make the return or destruction of such information infeasible. Business Associate will complete these obligations as promptly as possible, but not later than

i) Termination Resulting from the End of Relationship, Functions or Services. This Agreement shall terminate upon completion of Health Plan’s Request for Proposal RFP: SCG03242025. As such time, the underlying relationship, functions, or services that give rise to the necessity of a Business Associate Agreement terminate.

ii) Right to Terminate for Breach. Health Plan may terminate Agreement if it determines, in its sole discretion, that Business Associate has breached any provision of this Agreement. Health Plan may exercise this right to terminate Agreement by providing Business Associate written notice of termination. Any such termination will be effective immediately or at such other date specified in Health Plan’s notice of termination.

iii) Obligations on Termination.

30 calendar days following the effective date of the termination or other conclusion of Agreement.

C) Continuing Privacy and Security Obligation. Business Associate’s obligation to protect the privacy and safeguard the security of Health Plan’s Protected Health Information as specified in this Agreement will be continuous and survive termination or other conclusion of this Agreement.

5. General Provisions.

a) Inspection of Internal Practices, Books, and Records. Business Associate will make its internal practices, books, and records relating to its use and disclosure of Health Plan’s Protected Health Information available to Health Plan and to DHHS to determine Health Plan’s compliance with the Privacy Rule, 45 C.F.R. Part 164, Subpart E.

b) Definitions. All terms that are used but not otherwise defined in this Agreement shall have the meaning specified under HIPAA, including its statute, regulations and other official government guidance. For purposes of this Agreement, Health Plan’s Protected Health Information encompasses Health Plan’s Electronic Protected Health Information.

c) Amendment to Agreement. Upon the compliance date of any final regulation or amendment to final regulation promulgated by DHHS that affects Business Associate’s use or disclosure of Health Plan’s Protected Health Information or Standard Transactions this Agreement will automatically amend such that the obligations imposed on Business Associate remain in compliance with the final regulation or amendment to final regulation.

d) No Third Party Beneficiaries. Nothing in this Agreement shall be construed as creating any rights or benefits to any third parties.

e) Delegation to Business Associate. To the extent the parties agree that Business

Associate will carry out directly one or more of Health Plan's obligations under the Privacy

Rule, Business Associate will comply with the requirements of the Privacy Rule that apply to Health Plan in the performance of such obligations.

f) No Agency Relationship. Both parties agree that Business Associate is not, and shall not be deemed to be, an agent of Health Plan.

IN WITNESS WHEREOF, Health Plan and Business Associate execute this Agreement in multiple originals to be effective March 31, 2025.

____________________________ Summit County Government

By: ________________________ By:

Its: Its:

Date: Date: