WTW_BAA_-_City_of_Wheat_Ridge.pdf

Ver Jun 2020

Business Associate Agreement

This business associate agreement (“Agreement”) is hereby made and entered into this 1st day of , 20 (“Effective Date”), by and between City of Wheat Ridge (“Covered Entity”) and Willis of Colorado on behalf of itself and its affiliates (“Business Associate”) (each a “Party” and collectively, the “Parties”).

WHEREAS, City of Wheat Ridge and Business Associate have entered into one or more underlying services agreement(s) or any agreement whereby Business Associate has been appointed broker of record by Covered Entity and is entitled to receive commissions subject to brokerage terms, conditions and disclosures provided to Covered Entity (each an “Underlying Services Agreement” and collectively the “Underlying Services Agreements”), pursuant to which Business Associate performs services (such as consulting, insurance broking or related services) under which Business Associate and/or its affiliates may receive Protected Health Information (PHI) on behalf of Covered Entity;

WHEREAS, under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations Business Associate and Covered Entity are required to enter into a Business Associate Agreement for any PHI that Business Associate receives on behalf of Covered Entity;

WHEREAS, Covered Entity and Business Associate understand and agree that this Agreement is intended to satisfy their obligations under HIPAA and that, in the event Business Associate receives PHI on behalf of Covered Entity, this Agreement will govern the terms and conditions under which such PHI may be used and/or disclosed and safeguarded by Business Associate;

WHEREAS, the Parties desire to enter into this Agreement, which amends the Underlying Services Agreements but only for the purpose of containing the terms and conditions under which Business Associate may use the PHI;

NOW, THEREFORE, Covered Entity and Business Associate hereto agree to the foregoing and as follows:

1. Definitions

The following terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 C.F.R. Parts 160 -164 and HITECH, as applicable.

a. HIPAA Rules. The “HIPAA Rules” means the Health Insurance Portability and Accountability

Act of 1996 and its implementing regulations, which include the Standards for the Privacy of Individually Identifiable Health Information at 45 C.F.R. Parts 160 and 164 (“Privacy Rule”) and the Security Standards for the Protection of Electronic Protected Health Information at 45 C.F.R. Parts 160 and 164 (“Security Rule”), as amended by the applicable provisions of the Health Information Technology for Economic and Clinical Health Act and its implementing regulations (“HITECH”), as amended by the Final HIPAA regulations (“Final Omnibus Rule”).

b. Protected Health Information or PHI. “Protected Health Information” or “PHI” shall have the same meaning as the term “protected health information” in 45 C.F.R. §160.103 and is limited to the PHI that Business Associate creates or receives from or on behalf of Covered Entity. As used herein, it also includes electronic Protected Health Information.

c. Electronic Protected Health Information or ePHI. “Electronic Protected Health Information” or

“ePHI” shall have the same meaning as the term “electronic protected health information” in 45 C.F.R. §160.103 and refers to electronic Protected Health Information transmitted by, or maintained in, electronic media for or on behalf of Covered Entity.

- 2 -

Ver. July 2020

d. Use of Capitalized Terms and Catch-all Definition. The use of any capitalized terms, including but not limited to the following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information and Use.

2. Obligations and Activities of Business Associate

a. Business Associate agrees to use or disclose PHI only as permitted or required by this Agreement or as Required By Law and in compliance with each applicable requirement of 45 C.F.R. § 164.504(e). Without limiting the generality of the foregoing sentence, to the extent Business Associate is to carry out Covered Entity’s obligations under the Privacy Rule, Business Associate shall comply with the requirements of the Privacy Rule that apply to Covered Entity in the performance of those obligations.

b. Business Associate agrees to (i) implement and use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement; (ii) reasonably and appropriately protect the confidentiality, integrity, and availability of the ePHI that it creates, maintains, or transmits on behalf of the Covered Entity; and (iii) comply with the Security Rule.

c. Business Associate agrees to use reasonable efforts to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Agreement.

d. Business Associate agrees to report to Covered Entity (i) any use or disclosure of the PHI in violation of this Agreement of which it becomes aware; (ii) any Security Incident affecting PHI of which it becomes aware; and (iii) without unreasonable delay and in no case later than sixty

(60) calendar days after discovery, any Breach of any Unsecured PHI in accordance with the security breach notification requirements set forth in the HIPAA Rules. As such, Business Associate shall provide the following information to the Covered Entity, at the time and to the extent it is practicable to do so: (1) a brief description of what happened, including the date of the breach and the date of discovery of the breach, if known; (2) a description of the types of Unsecured PHI that were involved in the breach (such as full name, Social Security number, date of birth, home address, account number, or disability code) and who received the Unsecured PHI; (3) the steps Individuals should take to protect themselves from potential harm resulting from the Breach; (4) a brief description of what the Business Associate is doing to investigate the Breach, to mitigate losses, and to protect against any further Breaches; and (5) any information reasonably available regarding the Breach that the Covered Entity may need to include in its notification to the affected individuals, the media and/or the Secretary as required by the HIPAA Rules.

Notwithstanding the foregoing, pings, port scans, and similar routine attempts on Business Associate’s firewall that are successfully blocked shall not require any reporting except as set forth below due to the infeasibility of recording and reporting all such pings, port scans, and other routine events. Both Covered Entity and Business Associate agree that this Business Associate Agreement shall constitute the documentation, notice and written report of such unsuccessful attempts at unauthorized access or system interference as required above and by 45 C.F.R. Part 164, Subpart C and that no further notice or report of such attempts will be required. If any such Security Incident results in a disclosure not permitted by this Agreement, including a Breach or potential Breach of Covered Entity’s Unsecured Protected Health Information, Business Associate will make a report in accordance with the provisions set forth in the paragraph above.

- 3 -

e. Business Associate agrees (i) to ensure that any agent, including a subcontractor, to whom it provides PHI received from, or created or received by Business Associate on behalf of Covered Entity agrees to substantially the same restrictions and conditions that apply through this Agreement to Business Associate with respect to that information, and (ii) to the extent that Business Associate provides ePHI to an agent, including a subcontractor, ensure that the agent, including a subcontractor, agrees to implement reasonable and appropriate safeguards to protect that information.

f. To the extent that Business Associate maintains a Designated Record Set on behalf of Covered

Entity, Business Associate agrees to provide access, at the request of Covered Entity, and in the time and manner mutually agreed, to PHI in that Designated Record Set, to Covered Entity.

If an Individual requests access to his or her PHI directly from Business Associate, Business Associate shall promptly forward such request to Covered Entity and Covered Entity shall be responsible for responding to such request in order to meet the requirements under 45 C.F.R.

§ 164.524.

g. To the extent that Business Associate maintains a Designated Record Set on behalf of Covered

Entity, Business Associate agrees to make any amendment(s), at the request of Covered Entity, and in the time and manner mutually agreed, to PHI in that Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 C.F.R. § 164.526. If an Individual requests an amendment of his or her PHI directly from Business Associate, Business Associate shall promptly forward such request to Covered Entity and Covered Entity shall be responsible for responding to such request.

h. In the event that Business Associate in connection with the Underlying Services Agreements uses or maintains a Designated Record Set on behalf of Covered Entity, then the Business Associate shall provide an electronic copy (at the request of Covered Entity, and in the time and manner mutually agreed to) of the PHI, to Covered Entity..

i. Business Associate agrees to make its internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity available to the Secretary, in a time and manner mutually agreed or designated by the Secretary, for purposes of the Secretary determining Covered Entity’s compliance with the Privacy Rule and Security Rule.

j. Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528.

k. Business Associate agrees to provide to Covered Entity in a time and manner mutually agreed, information collected in accordance with Section 2.j. of this Agreement, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528.

l. Business Associate shall request, use and/or disclose only the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure; provided that Business Associate shall comply with 42 U.S.C. § 17935(b) and 45 CFR § 164.502(b) .

m. Business Associate shall not directly or indirectly receive remuneration in exchange for any

PHI in compliance with 42 U.S.C. § 17935(d).

n. Business Associate shall not make or cause to be made any communication about a product or service that is prohibited by 42 U.S.C. § 17936(a).

o. Business Associate shall not make or cause to be made any written fundraising communication that is prohibited by 42 U.S.C. § 17936(b).

- 4 -

p. To the extent not provided herein, the Business Associate shall comply with each of the applicable requirements imposed on the Business Associate by the HIPAA Rules. In the event there is additional guidance or regulations, or a change in law, which impacts the terms of this Agreement, parties shall negotiate in good faith any changes to this Agreement.

q. If and to the extent applicable, Business Associate will comply, and will require any subcontractor or agent involved with the conduct of Standard Transactions to comply, with each of the applicable requirements of 45 C.F.R. Part 162.

3. Permitted Uses and Disclosures by Business Associate

a. General Use and Disclosure Provisions. Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of, the Client or Covered Entity as specified in or required by the Underlying Services Agreements (including to Plan Sponsor for permissible Plan administration functions), provided that, except as set forth in Section 3.b., such use or disclosure would not violate the Privacy Rule and Security Rule if done by Covered Entity.

b. Specific Use and Disclosure Provisions.

1) Except as otherwise limited in this Agreement, Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

2) Except as otherwise limited in this Agreement, Business Associate may disclose PHI for the proper management and administration of the Business Associate, provided that disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

3) Business Associate may de-identify any and all PHI obtained by Business Associate, and use such de-identified data on Business Associate’s own behalf, all in accordance with the de-identification requirements of the Privacy Rule. The Parties acknowledge and agree that de-identified data does not constitute PHI.

4) Except as otherwise limited in this Agreement, Business Associate may use PHI to provide Data Aggregation services to Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).

5) Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 C.F.R. § 164.502(j)(1).

6) Business Associate may use PHI to the extent and for any purpose authorized by an Individual under 45 C.F.R. § 164.508.

- 5 -

4. Obligations of Covered Entity

a. Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45 C.F.R. § 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of PHI under this Agreement.

b. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such changes may affect Business Associate’s use or disclosure of PHI under this Agreement.

c. Covered Entity shall notify Business Associate of any restriction on the use or disclosure of PHI to which Covered Entity has agreed in accordance with 45 C.F.R. § 164.522 or 42 U.S.C. § 17935(a), to the extent that such restriction may affect Business Associate’s use or disclosure of PHI under this Agreement (in such case, Business Associate shall abide by such restriction, unless such restriction would unreasonably burden healthcare operations).

d. Covered Entity represents that (i) it is entitled to receive PHI in accordance with 45 C.F.R. §

164.504(f); (ii) it has received a certification from the Plan Sponsor in accordance with 45 C.F.R. § 164.504(f)(2)(ii); and (iii) the Plan documents permit the Plan to receive PHI, including detailed invoices, reports and statements from Business Associate.

e. Covered Entity in performing its obligations and exercising its rights under this Agreement shall use and disclose PHI in compliance with the HIPAA Rules and shall not request Business Associate to use or disclose PHI in any manner that would violate this Agreement or the HIPAA Rules. Covered Entity represents that a request for PHI from Business Associate to Covered Entity shall only be the minimum amount of PHI necessary to accomplish the permitted purpose of the applicable request or use.

5. Term and Termination

a. Term. The Term of this Agreement shall be effective as of the Effective Date and shall terminate upon the final expiration or termination of the last remaining Underlying Services Agreement subject to this Agreement, unless earlier terminated in accordance with this Section 5.

b. Termination for Cause. In accordance with 42 U.S.C. § 17934(b), if either Party knows of a pattern of activity or practice of the other Party that constitutes a material breach or violation of this Agreement then the non-breaching Party shall provide written notice of the breach or violation to the other Party that specifies the nature of the breach or violation. The breaching Party must cure the breach or end the violation on or before thirty (30) days after receipt of the written notice. In the absence of a timely cure reasonably satisfactory to the non-breaching party, or in the event that cure is not possible, then the non-breaching party may immediately terminate this Agreement.

c. Effect of Termination.

1) Except as provided in paragraph (2) of this Section 5.c., upon termination of this

Agreement, for any reason, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. Business Associate shall retain no copies of the PHI.

- 6 -

2) In the event that it is not feasible for Business Associate to return or destroy the PHI, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI. The Parties agree that it would not be feasible for Business Associate to return or destroy the PHI reasonably needed to be retained by Business Associate for its own legal and risk management purposes, including copies of PHI that may be included in information retained for archival purposes.

6. Miscellaneous

a. Amendment of Underlying Services Agreements. The Parties agree that the terms and conditions of this Agreement hereby amend and are incorporated into and made a part of the Underlying Services Agreements as of the Effective Date of this Agreement, and any reference to the Underlying Services Agreements on or after that date shall mean the Underlying Services Agreements as amended by this Agreement. This Agreement supersedes all prior business associate agreements between the parties with respect to the Underlying Services Agreements.

b. Affiliates. Business Associate’s affiliates providing services to Covered Entity under an Underlying Services Agreement may adopt the terms of this Agreement by reference in the Underlying Services Agreement, as though they are Parties to this Agreement.

c. Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

d. Future Amendment. Covered Entity and Business Associate agree to take such action as is necessary to amend this Agreement and the Underlying Services Agreements from time to time as necessary for the Parties to comply with the requirements of the HIPAA Rules.

e. Survival. The respective rights and obligations of Business Associate under Section 5.c. of this

Agreement shall survive the termination of this Agreement.

f. Interpretation. Any ambiguity in this Agreement shall be resolved to permit both Parties to comply with the HIPAA Rules.

g. Relation to Underlying Services Agreements. With the exception of the terms and conditions set forth in this Agreement in regards to PHI, all other terms and conditions of the Underlying Services Agreements shall remain unaltered and in full force and effect. The obligations in this Agreement shall be subject to the terms and conditions in the Underlying Services Agreements, except to the extent there is any conflict between the terms of this Agreement and the Underlying Services Agreements, in which event this Agreement shall govern with respect to the subject matter herein.

h. No Third Party Beneficiary. Nothing express or implied in this Agreement is intended to confer, nor will anything herein confer, upon any person other than the Parties and the permitted respective successors or assigns of the Parties, any rights, remedies, obligations or liabilities whatsoever.

i. Governing Law. Except to the extent preempted by federal law, this Agreement will be governed by and construed in accordance with the laws of the jurisdiction designated in the applicable Underlying Services Agreement.

j. Waiver. No provision of this Agreement shall be waived except by an agreement in writing signed by the waiving party. A waiver of any term or provision shall not be construed as a waiver of any other term or provision.

- 7 -

k. Incorporation of Recitals. The recitals set forth at the beginning of this Agreement are hereby incorporated by reference into this Agreement.

IN WITNESS WHEREOF, Covered Entity and Business Associate have executed the Business Associate Agreement effective as of the Effective Date set forth above.

City of Wheat Ridge

By: _________________________

Print Name: __________________

Print Title: ___________________

Willis of Colorado

By: _________________________

Print Name: Stacy Picone

Print Title: Sr. Associate

Date: 8/16/2022