Standard Agreement Form for Professional Services.docx

STANDARD AGREEMENT FORM FOR PROFESSIONAL SERVICES

The parties’ contract comprises this Standard Agreement Form, as well as its referenced Articles and their associated Appendices.

This contract is between the State of Alaska,

Health hereafter the State, and

7. Contractor hereafter the Contractor

Address

ARTICLE 3. Period of Performance: The initial period of performance for this contract begins , and ends .

NOTICE: By signature on this contract, the contractor certifies that neither it nor its principles are not currently debarred, suspended, proposed for debarment, or declared ineligible for award by any federal or other government entity. The contractor also certifies that all services provided under this contract by the contractor and all subcontractors shall be performed in the United States. Failure to comply with these requirements may the cause the State to cancel the contract.

CERTIFICATION:

I certify that the facts herein and on supporting documents are correct, that this voucher constitutes a legal charge against funds and appropriations cited, that sufficient funds are encumbered to pay this obligation, or that there is a sufficient balance in the appropriation cited to cover this obligation. I am aware that to knowingly make or allow false entries or alternations on a public record, or knowingly destroy, mutilate, suppress, conceal, remove or otherwise impair the verity, legibility or availability of a public record constitutes tampering with public records punishable under AS 11.56.815-.820. Other disciplinary action may be taken up to and including dismissal.

Name of Firm

Typed or Printed Name of Authorized Representative

Title

Date

Health /

Title

NOTICE: This contract has no effect until signed by the head of contracting agency or designee.

APPENDIX A

GENERAL PROVISIONS

2.2 The contractor shall make progress and other reports in the manner and at the times the department reasonably requires.

Article 3. Disputes.

3.1 If the contractor has a claim arising in connection with the contract that it cannot resolve with the State by mutual agreement, it shall pursue the claim, if at all, in accordance with the provisions of AS 36.30.620 – 632.

4.2 The contractor shall state, in all solicitations or advertisements for employees to work on State of Alaska contract jobs, that it is an equal opportunity employer and that all qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, age, disability, sex, marital status, changes in marital status, pregnancy or parenthood.

4.3 The contractor shall send to each labor union or representative of workers with which the contractor has a collective bargaining agreement or other contract or understanding a notice advising the labor union or workers' compensation representative of the contractor's commitments under this article and post copies of the notice in conspicuous places available to all employees and applicants for employment.

4.4 The contractor shall include the provisions of this article in every contract, and shall require the inclusion of these provisions in every contract entered into by any of its subcontractors, so that those provisions will be binding upon each subcontractor. For the purpose of including those provisions in any contract or subcontract, as required by this contract, “contractor” and “subcontractor” may be changed to reflect appropriately the name or designation of the parties of the contract or subcontract.

4.5 The contractor shall cooperate fully with State efforts which seek to deal with the problem of unlawful discrimination, and with all other State efforts to guarantee fair employment practices under this contract, and promptly comply with all requests and directions from the State Commission for Human Rights or any of its officers or agents relating to prevention of discriminatory employment practices.

4.6 Full cooperation in paragraph 4.5 includes, but is not limited to, being a witness in any proceeding involving questions of unlawful discrimination if that is requested by any official or agency of the State of Alaska; permitting employees of the contractor to be witnesses or complainants in any proceeding involving questions of unlawful discrimination, if that is requested by any official or agency of the State of Alaska; participating in meetings; submitting periodic reports on the equal employment aspects of present and future employment; assisting inspection of the contractor's facilities; and promptly complying with all State directives considered essential by any office or agency of the State of Alaska to insure compliance with all federal and State laws, regulations, and policies pertaining to the prevention of discriminatory employment practices.

4.7 Failure to perform under this article constitutes a material breach of contract.

5.2 The Procurement Officer may also, by written notice, terminate this contract under Administrative Order 352 if the contractor supports or participates in a boycott of the State of Israel.

Article 6. No Assignment or Delegation.

The contractor may not assign or delegate this contract, or any part of it, or any right to any of the money to be paid under it, except with the written consent of the Project Director and the Agency Head.

Article 7. No Additional Work or Material.

No claim for additional services, not specifically provided in this contract, performed, or furnished by the contractor, will be allowed, nor may the contractor do any work or furnish any material not covered by the contract unless the work or material is ordered in writing by the Project Director and approved by the Agency Head.

Article 8. Independent Contractor.

The contractor and any agents and employees of the contractor act in an independent capacity and are not officers or employees or agents of the State in the performance of this contract.

Article 9. Payment of Taxes.

As a condition of performance of this contract, the contractor shall pay all federal, State, and local taxes incurred by the contractor and shall require their payment by any Subcontractor or any other persons in the performance of this contract. Satisfactory performance of this paragraph is a condition precedent to payment by the State under this contract.

Article 10. Ownership of Documents.

All designs, drawings, specifications, notes, artwork, and other work developed in the performance of this agreement are produced for hire and remain the sole property of the State of Alaska and may be used by the State for any other purpose without additional compensation to the contractor. The contractor agrees not to assert any rights and not to establish any claim under the design patent or copyright laws. Nevertheless, if the contractor does mark such documents with a statement suggesting they are trademarked, copyrighted, or otherwise protected against the State’s unencumbered use or distribution, the contractor agrees that this paragraph supersedes any such statement and renders it void. The contractor, for a period of three years after final payment under this contract, agrees to furnish and provide access to all retained materials at the request of the Project Director. Unless otherwise directed by the Project Director, the contractor may retain copies of all the materials.

Article 11. Governing Law; Forum Selection This contract is governed by the laws of the State of Alaska. To the extent not otherwise governed by Article 3 of this Appendix, any claim concerning this contract shall be brought only in the Superior Court of the State of Alaska and not elsewhere.

Article 12. Conflicting Provisions.

Unless specifically amended and approved by the Department of Law, the terms of this contract supersede any provisions the contractor may seek to add. The contractor may not add additional or different terms to this contract; AS 45.02.207(b)(1). The contractor specifically acknowledges and agrees that, among other things, provisions in any documents it seeks to append hereto that purport to (1) waive the State of Alaska’s sovereign immunity, (2) impose indemnification obligations on the State of Alaska, or (3) limit liability of the contractor for acts of contractor negligence, are expressly superseded by this contract and are void.

Article 13. Officials Not to Benefit.

Contractor must comply with all applicable federal or State laws regulating ethical conduct of public officers and employees.

Article 14. Covenant Against Contingent Fees.

The contractor warrants that no person or agency has been employed or retained to solicit or secure this contract upon an agreement or understanding for a commission, percentage, brokerage or contingent fee except employees or agencies maintained by the contractor for the purpose of securing business. For the breach or violation of this warranty, the State may terminate this contract without liability or in its discretion deduct from the contract price or consideration the full amount of the commission, percentage, brokerage or contingent fee.

Article 15. Compliance.

In the performance of this contract, the contractor must comply with all applicable federal, state, and borough regulations, codes, and laws, and be liable for all required insurance, licenses, permits and bonds.

Article 16. Force Majeure:

The parties to this contract are not liable for the consequences of any failure to perform, or default in performing, any of their obligations under this Agreement, if that failure or default is caused by any unforeseeable Force Majeure, beyond the control of, and without the fault or negligence of, the respective party. For the purposes of this Agreement, Force Majeure will mean war (whether declared or not); revolution; invasion; insurrection; riot; civil commotion; sabotage; military or usurped power; lightning; explosion; fire; storm; drought; flood; earthquake; epidemic; quarantine; strikes; acts or restraints of governmental authorities affecting the project or directly or indirectly prohibiting or restricting the furnishing or use of materials or labor required; inability to secure materials, machinery, equipment or labor because of priority, allocation or other regulations of any governmental authorities.

Appendix B Indemnity and Insurance

Article 1. Indemnification The contractor shall indemnify, hold harmless, and defend the contracting agency from and against any claim of, or liability for error, omission or negligent act of the contractor under this agreement. The contractor shall not be required to indemnify the contracting agency for a claim of, or liability for, the independent negligence of the contracting agency. If there is a claim of, or liability for, the joint negligent error or omission of the contractor and the independent negligence of the contracting agency, the indemnification and hold harmless obligation shall be apportioned on a comparative fault basis. “Contractor” and “contracting agency”, as used within this and the following article, include the employees, agents and other contractors who are directly responsible, respectively, to each. The term “independent negligence” is negligence other than in the contracting agency’s selection, administration, monitoring, or controlling of the contractor and in approving or accepting the Contractor’s work.

Article 2. Insurance Without limiting contractor's indemnification, it is agreed that contractor shall purchase at its own expense and maintain in force at all times during the performance of services under this agreement the following policies of insurance. Where specific limits are shown, it is understood that they shall be the minimum acceptable limits. If the contractor's policy contains higher limits, the state shall be entitled to coverage to the extent of such higher limits. Certificates of Insurance must be furnished to the contracting officer prior to beginning work and must provide for a notice of cancellation, non-renewal, or material change of conditions in accordance with policy provisions. Failure to furnish satisfactory evidence of insurance or lapse of the policy is a material breach of this contract and shall be grounds for termination of the contractor's services. All insurance policies shall comply with and be issued by insurers licensed to transact the business of insurance under AS 21.

2.1 Workers' Compensation Insurance: The contractor shall provide and maintain, for all employees engaged in work under this contract, coverage as required by AS 23.30.045, and; where applicable, any other statutory obligations including but not limited to Federal U.S.L. & H. and Jones Act requirements. The policy must waive subrogation against the State.

2.2 Commercial General Liability Insurance: covering all business premises and operations used by the Contractor in the performance of services under this agreement with minimum coverage limits of $300,000 combined single limit per claim.

2.3 Commercial Automobile Liability Insurance: covering all vehicles used by the contractor in the performance of services under this agreement with minimum coverage limits of $300,000 combined single limit per claim.

Appendix C Description of Services

Purpose

Order of Precedence The terms and conditions of RFP, Appendices, and Amendments are made part of this contract. The order of precedence for the contract between the Contractor and DOH is established by the order of the following documents:

1. Any amendment to the executed contract with the more recent amendment taking precedent over a less recent amendment.

2. The Standard Agreement Form for Professional Service and Appendix A General Provisions.

3. The RFP.

4. The Contractor’s proposal.

The above numbered documents are, collectively, the “contract.” In the case of any conflict or inconsistency arising under the contract documents, a document identified with a lower number in this subsection shall supersede a higher numbered document to the extent necessary to resolve any such conflict or inconsistency. No conflict or inconsistency shall be deemed to occur in the event an issue is addressed in one of the above-mentioned contract documents but is not addressed in another of such documents.

Where terms and conditions specified in the Contractor's proposal differ from the terms and conditions in contract documents 2 and 3, as identified above in section 2 Order of Precedence, the terms and conditions of documents 2 and 3 shall apply. Where terms and conditions specified in the Contractor’s proposal supplement the terms and conditions in contract documents 2 and 3, as identified above in section 2 Order of Precedence, the supplemental terms and conditions shall apply only if specifically accepted by the Procurement Officer in writing.

Scope of Work

Deliverables

Appendix D Payment for Services The Contractor will be compensated for service rendered to the State of Alaska, Department of Health (DOH) in accordance with the contract terms and conditions, and as follows:

1. The period of performance for the initial contract term shall begin on the Service Commencement Date of [date] and expire on [date].

2. The contract includes the following renewal options, to be exercised at the sole discretion of the State.

(rows will be added/deleted as necessary)

The State will not be responsible for payment of services rendered outside the valid term of this contract. There will be no exceptions.

3. Any contract for which a renewal option is not exercised by the State, shall be considered expired on the expiration date noted above and does not require notification of such by DOH. All exercised renewal options shall be executed via written amendment to the contract. DOH may enter into a month-to-month holdover extension, prior to the expiration of the current contract term. All exercised month-to-month holdover extensions shall be executed via written amendment to the contract. The total cumulative dollar amount of each month-to-month holdover extension shall not exceed the unanticipated amendment limitations stated in Alaska Administrative Manual 81.700. All other terms and conditions specified by the contract shall remain the same during any month-to-month holdover extension period.

4. Payment for services provided shall not exceed [amount] for the initial period of performance of this contract.

5. The compensation for the entire duration of the contract, including all renewal option periods if they are exercised, shall not exceed [amount], and in accordance with Contractor’s cost proposal.

6. The Contractor shall bill for actual services rendered for the performance and completion of the deliverables identified herein. Actual services rendered include actual time spent in preparation and performance of the scope of work and deliverables in the contract. The rate shall be a fully burdened rate and must include all costs associated with the Contractor’s operations, including the provision of all services and materials as needed to perform and meet the requirements herein including, but not limited to, wages, administrative overhead, travel, transportation, lodging, and all other costs associated with the performance of the contract. That rate may not fluctuate for the period of this contract unless otherwise agreed to in writing by both parties and executed as an amendment to the contract. No other costs will be considered for payment. Payment will be considered to be made as either the date a printed warrant is issued, or the date an electronic funds transfer is initiated.

7. Final invoices must be received by DOH no later than 30 days following the termination or expiration date of the contract.

Invoicing The contractor will submit monthly invoices detailing services performed in accordance with Appendix C.

The invoice must:

· Reference the contractor’s name, address and phone number

· Reference the contract number: 1624-0xx

· Include an invoice number

· Reference the Department of Health, Division of

· Itemize the contractual services provided during the period invoiced as described in Appendix C

The contractor shall submit invoices to the address specified below no later than 30 days after the end the period for which services were performed. Failure to include the required information on the invoice may cause an unavoidable delay to the payment process. The State will pay all invoices within thirty (30) days of invoice approval by the Project Director.

Email invoices to:

[email] (please reference the contract in the subject line)

Notwithstanding any other provision of this contract, it is understood and agreed that the State shall withhold payment at any time the contractor fails to perform work as required under this contract.

APPENDIX E

STATE OF ALASKA DEPARTMENT OF HEALTH

HEALTH INSURANCE PORTABILITY ANDACCOUNTABILITY ACT OF 1996 ("HIPAA")

BUSINESS ASSOCIATE AGREEMENT

This HIPAA Business Associate Agreement is between the State of Alaska, Department of Health (“Covered Entity” or “CE”) and the Contractor (“Business Associate” or “BA”).

RECITALS

Whereas, A. CE wishes to disclose certain information to BA, some of which may constitute Protected Health Information ("PHI");

B. It is the goal of CE and BA to protect the privacy and provide for the security of PHI owned by CE that is disclosed to BA or accessed, received, stored, maintained, modified or retained by BA in compliance with HIPAA (42 U.S.C. 1320d – 3120d-8) and its implementing regulations at 45 C.F.R. 160 and 45 C.F.R. 164 (the “Privacy and Security Rule”), the Health Information Technology for Economic and Clinical Health Act of 2009 (P.L. 111-5) (the “HITECH Act”), and with other applicable laws;

C. The purpose and goal of the HIPAA Business Associate Agreement ("BAA") is to satisfy certain standards and requirements of HIPAA, HITECH Act, and the Privacy and Security Rule, including but not limited to 45 C.F.R. 164.502(e) and 45 C.F.R. 164.504(e), as may be amended from time to time;

D. CE may operate a drug and alcohol treatment program that must comply with the Federal Confidentiality of Alcohol and Drug Abuse Patient Records law and regulations, 42 U.S.C. 290dd-2 and 42 C.F.R. Part 2 (collectively “Part 2”); and

E. BA may be a Qualified Service Organization (“QSO”) under Part 2 and therefore must agree to certain mandatory provisions regarding the use and disclosure of substance abuse treatment information.

Therefore, in consideration of mutual promises below and the exchange of information pursuant to the BAA, CE and BA agree as follows:

1. Definitions.

a. General: As used in this BAA, the terms "Protected Health Information," "Health Care Operations," and other capitalized terms have the same meaning given to those terms by HIPAA, the HITECH Act and the Privacy and Security Rule. In the event of any conflict between the mandatory provisions of HIPAA, the HITECH Act or the Privacy and Security Rule, and the provisions of this BAA, HIPAA, the HITECH Act or the Privacy and Security Rule shall control. Where the provisions of this BAA differ from those mandated by HIPAA, the HITECH Act or the Privacy and Security Rule but are nonetheless permitted by HIPAA, the HITECH Act or the Privacy and Security Rule, the provisions of the BAA shall control.

b. Specific:

1) Business Associate: “Business Associate” or “BA” shall generally have the same meaning as the term “business associate” at 45 C.F.R. 160.103.

2) Covered Entity: “Covered Entity” or “CE” shall have the same meaning as the term “covered entity” at 45 C.F.R. 160.103.

3) Privacy and Security Rule: “Privacy and Security Rule” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Part 160 and Part 164.

4) Triennially: “Triennially” shall mean once every three years.

2. Statement of Work and Responsibilities.

As provided by AS 44.21.020 and AS 44.21.160, The BA provides automatic data processing services to the CE. These services include storage, transmission, security, and recovery of electronic information owned by CE. BA is responsible for ensuring continuity of service, delivery, and access to CE electronic information at all times including in the event of a disaster.

1. BA may use or disclose PHI as required by law.

1. BA agrees to make uses and disclosures and requests for PHI consistent with CE’s minimum necessary policies and procedures.

1. BA may not use or disclose PHI in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by CE, except for the specific uses and disclosures set out below.

1. BA may disclose PHI for the proper management and administration of BA or to carry out the legal responsibilities of BA, provided the disclosures are required by law, or BA obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notified BA of any instances of which it is aware in which the confidentiality of the information has been breached.

1. BA may provide data aggregation services related to the health care operations of CE.

4. Obligations of Business Associate.

a. Permitted uses and disclosures: BA may only use and disclose PHI owned by the CE that it creates, receives, maintains, or transmits if the use or disclosure is in compliance with each applicable requirement of 45 C.F.R. 164.504(e) of the Privacy Rule or this BAA. The additional requirements of Subtitle D of the HITECH Act contained in Public Law 111-5 that relate to privacy and that are made applicable with respect to Covered Entities shall also be applicable to BA and are incorporated into this BAA.

To the extent that BA discloses CE’s PHI to a subcontractor, BA must obtain, prior to making any such disclosure: (1) reasonable assurances from the subcontractor that it will agree to the same restrictions, conditions, and requirements that apply to the BA with respect to such information; and (2) an agreement from the subcontractor to notify BA of any Breach of confidentiality, or security incident, within three business days of when it becomes aware of such Breach or incident.

b. Safeguards: 45 C.F.R. 164.308 (administrative safeguards), 164.310 (physical safeguards), 164.312 (technical safeguards), and 164.316 (policies, procedures, and documentation requirements) shall apply to BA in the same manner that such sections apply to CE, and shall be implemented in accordance with HIPAA, the HITECH Act, and the Privacy and Security Rule. The additional requirements of Title XIII of the HITECH Act contained in Public Law 111-5 that relate to security and that are made applicable to Covered Entities shall also apply to BA and are incorporated into this BAA.

Unless CE agrees in writing that this requirement is infeasible with respect to certain data, BA shall secure all paper and electronic PHI by encryption or destruction such that the PHI is rendered unusable, unreadable or indecipherable to unauthorized individuals; or secure paper, film and electronic PHI in a manner that is consistent with guidance issued by the Secretary of the United States Department of Health and Human Services specifying the technologies and methodologies that render PHI unusable, unreadable or indecipherable to unauthorized individuals, including the use of standards developed under Section 3002(b)(2)(B)(vi) of the Public Health Service Act, as added by Section 13101 of the HITECH Act contained in Public Law 111-5.

BA shall not use personally owned devices to create, receive, maintain, or transmit PHI. Devices the BA uses to create, receive, maintain, or transmit CE’s electronic PHI shall be owned and managed by BA or CE.

BA shall patch its operating systems and all applications within two weeks of the release of any patch. BA shall keep its antivirus and antimalware installed and active. BA shall limit its use of administrative accounts for necessary IT operations only.

c. Reporting Unauthorized Disclosures and Breaches: During the term of this BAA, BA shall notify CE within 72 hours of discovering a Breach of security; intrusion; or unauthorized acquisition, access, use or disclosure of CE’s PHI in violation of any applicable federal or state law, including security incidents. BA shall identify for the CE the individuals whose unsecured PHI has been, or is reasonably believed to have been, breached so that CE can comply with any notification requirements if necessary. BA shall also indicate whether the PHI subject to the Breach; intrusion; or unauthorized acquisition, access, use, or disclosure was encrypted or destroyed at the time. BA shall take prompt corrective action to cure any deficiencies that result in Breaches of security; intrusion; or unauthorized acquisition, access, use, and disclosure. BA shall fulfill all breach notice requirements unless CE notifies BA that CE will take over the notice requirements. BA shall reimburse CE for all costs incurred by CE that are associated with any mitigation, investigation and notice of Breach CE undertakes or provides under HIPAA, HITECH Act, and the Privacy and Security Rule as a result of a Breach of CE’s PHI caused by BA or BA’s subcontractor or agent.

If the unauthorized acquisition, access, use or disclosure of CE’s PHI involves only Secured PHI, BA shall notify CE within 10 days of discovering the Breach but is not required to notify CE of the names of the individuals affected.

d. BA is not an agent of CE.

e. BA’s Agents: If BA uses a subcontractor or agent to provide services under this BAA, and the subcontractor or agent creates, receives, maintains, or transmits CE’s PHI, the subcontractor or agent shall sign an agreement with BA containing substantially the same provisions as this BAA and further identifying CE as a third-party beneficiary with rights of enforcement and indemnification from the subcontractor or agent in the event of any violation of the subcontractor or agent agreement. BA shall mitigate the effects of any violation of that agreement.

f. Availability of Information to CE: Within 15 days after the date of a written request by CE, BA shall provide any information necessary to fulfill CE's obligations to provide access to PHI under HIPAA, the HITECH Act, or the Privacy and Security Rule.

g. Accountability of Disclosures: If BA is required by HIPAA, the HITECH Act, or the Privacy or Security Rule to document a disclosure of PHI, BA shall make that documentation. If CE is required to document a disclosure of PHI made by BA, BA shall assist CE in documenting disclosures of PHI made by BA so that CE may respond to a request for an accounting in accordance with HIPAA, the HITECH Act, and the Privacy and Security Rule. Accounting records shall include the date of the disclosure, the name and if known, the address of the recipient of the PHI, the name of the individual who is subject of the PHI, a brief description of the PHI disclosed and the purpose of the disclosure. Within 15 days of a written request by CE, BA shall make the accounting record available to CE.

h. Amendment of PHI: Within 30 days of a written request by CE, BA shall amend PHI maintained, transmitted, created, or received by BA on behalf of CE as directed by CE when required by HIPAA, the HITECH Act or the Privacy and Security Rule, or take other measures as necessary to satisfy CE’s obligations under 45 C.F.R. 164.526.

i. Internal Practices: BA shall make its internal practices, books and records relating to the use and disclosure of CE's PHI available to CE and all appropriate federal agencies to determine CE's and BA's compliance with HIPAA, the HITECH Act and the Privacy and Security Rule.

j. Risk Assessment: Upon agreement execution and triennially thereafter, or upon changes that occur which significantly affect the security posture of the system (whichever comes first), BA shall comply and complete CE’s security assessment. Upon receipt of the security assessment, CE will review BA’s responses prior to granting authority to operate, and provide any necessary instruction to ensure the confidentiality, integrity, and availability of CE’s PHI. BA shall triennially, or upon changes that occur which significantly affect the security posture of the system (whichever comes first), review and update CE security assessment, as required, in order to comply with BA’s current system controls. BA must provide an implementation response for each specific system control. Upon receipt of the updated assessment, CE will review the changes to the system for renewal of authority to operate.

k. To the extent BA is to carry out one or more of CE’s obligations under Subpart E of 45 C.F.R. Part 164, BA must comply with the requirements of that Subpart that apply to CE in the performance of such obligations.

l. Audits, Inspection and Enforcement: CE may, after providing 10 days’ notice to the BA, conduct an inspection of the facilities, systems, books, logs, and records of BA that relate to BA’s use of CE’s PHI, including inspecting logs showing the creation, modification, viewing, and deleting of PHI at BA’s level. Failure by CE to inspect does not waive any rights of the CE or relieve BA of its responsibility to comply with this BAA. CE's failure to detect or failure to require remediation does not constitute acceptance of any practice or waive any rights of CE to enforce this BAA.

Notwithstanding BA’s obligation to report under paragraph 3.c of this BAA, BA shall provide a monthly report to CE detailing the unauthorized, or reasonable belief of unauthorized, acquisition, access, use, or disclosure of CE’s PHI, including any unauthorized creation, modification, or destruction of PHI and unauthorized login attempts. BA shall include privileged and nonprivileged accounts in its audit and report, indicating the unique individual using the privileged account. BA shall also indicate whether CE’s PHI subject to unauthorized activity was encrypted or destroyed at the time of the unauthorized activity.

BA shall provide a yearly report to CE that lists the names of all individuals with technical or physical access to CE’s PHI and the scope of that access.

m. Restrictions and Confidential Communications: Within 10 business days of notice by CE of a restriction upon use or disclosure or request for confidential communications pursuant to 45 C.F.R.164.522, BA shall restrict the use or disclosure of an individual’s PHI. BA may not respond directly to an individual’s request to restrict the use or disclosure of PHI or to send all communication of PHI to an alternate address. BA shall refer such requests to the CE so that the CE can coordinate and prepare a timely response to the requesting individual and provide direction to the BA.

n. Indemnification: BA shall indemnify and hold harmless CE for any civil or criminal monetary penalty or fine imposed on CE for acts or omissions in violation of HIPAA, the HITECH Act, or the Privacy or Security Rule that are committed by BA, a member of its workforce, its agent, or its subcontractor.

b. Reasonable Steps to Cure: In accordance with 45 C.F.R. 164.504(e)(1)(ii), CE and BA agree that, if it knows of a pattern of activity or practice of the other party that constitutes a material breach or violation of the other party’s obligation under the BAA, the nonbreaching party will take reasonable steps to get the breaching party to cure the breach or end the violation and, if the steps taken are unsuccessful, terminate the BAA if feasible, and if not feasible, report the problem to the Secretary of the U.S. Department of Health and Human Services.

c. Effect of Termination: Upon termination of the contract, BA will, at the direction of the CE, either return or destroy all PHI received from CE or created, maintained, or transmitted on CE’s behalf by BA in any form. Unless otherwise directed, BA is prohibited from retaining any copies of PHI received from CE or created, maintained, or transmitted by BA on behalf of CE. If destruction or return of PHI is not feasible, BA must continue to extend the protections of this BAA to PHI and limit the further use and disclosure of the PHI. The obligations in this BAA shall continue until all of the PHI provided by CE to BA is either destroyed or returned to CE.

7. Amendment. The parties acknowledge that state and federal laws relating to electronic data security and privacy are evolving, and that the parties may be required to further amend this BAA to ensure compliance with applicable changes in law. Upon receipt of a notification from CE that an applicable change in law affecting this BAA has occurred, BA will promptly agree to enter into negotiations with CE to amend this BAA to ensure compliance with changes in law.

8. Ownership of PHI. For purposes of this BAA, CE owns the data that contains the PHI it transmits to BA or that BA receives, creates, maintains, or transmits on behalf of CE.

9. Litigation Assistance. Except when it would constitute a direct conflict of interest for BA, BA will make itself available to assist CE in any administrative or judicial proceeding by testifying as witness as to an alleged violation of HIPAA, the HITECH Act, the Privacy or Security Rule, or other law relating to security or privacy.

10. Regulatory References. Any reference in this BAA to federal or state law means the section that is in effect or as amended.

11. Interpretation. This BAA shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HITECH Act, the Privacy and Security Rule and applicable state and federal laws. The parties agree that any ambiguity in BAA will be resolved in favor of a meaning that permits the CE to comply with and be consistent with HIPAA, the HITECH Act, and the Privacy and Security Rule. The parties further agree that where this BAA conflicts with a contemporaneously executed confidentiality agreement between the parties, this BAA controls.

12. No Private Right of Action Created. This BAA does not create any right of action or benefits for individuals whose PHI is disclosed in violation of HIPAA, the HITECH Act, the Privacy and Security Rule or other law relating to security or privacy.

13. Privacy and Security Point of Contact. All communications occurring because of this BAA shall be sent to doh.its.dso@alaska.gov in addition to the CE.

In witness thereof, the parties hereto have duly executed this BAA as of the effective date of this contract.