Extracted text (via pymupdf_layout)
25466 characters
EXHIBIT F BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement (“BAA”) is entered into by and between Businessolver.com, Inc. (“Business Associate”) and Maricopa County (the “Plan Sponsor”), on behalf of the health benefits programs provided under the Maricopa County Health & Welfare Benefits Plan (the “Plans”). RECITALS WHEREAS, Plan Sponsor and Business Associate are entering into a Contract (“Contract”) in which Business Associate provides enrollment and eligibility services and certain other services for, or on behalf of, the Plans, and in the event and to the extent that Business Associate receives, has access to, or creates Protected Health Information in order to perform such services; and WHEREAS, the Plans are subject to the Administrative Simplification requirements of the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and the regulations thereunder (“HIPAA”), including but not limited to the Privacy Standards (45 C.F.R. Parts 160 and 164), the Standards for Electronic Transactions (45 C.F.R. Parts 160 and 162), and the Security Standards (45 C.F.R. Parts 160 and 164), and the Breach Notification Standards (45 C.F.R. Parts 160 and 164) (collectively, the “Standards”); and WHEREAS, Business Associate acknowledges that to the extent that Protected Health Information is disclosed to the Business Associate, Business Associate is also subject to 45 C.F.R 164.308, 164.310, 164.312, and 164.316 of the Standards; and WHEREAS, the Plans and, to the extent that Protected Health Information is disclosed to the Business Associate, the Business Associate are subject to the requirements of the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009 (“HITECH”), and the regulations issued thereunder; and WHEREAS, HIPAA requires Plan Sponsor to enter into a contract, on behalf of the Plans, with Business Associate to provide for the protection of the privacy and security of Protected Health Information, and HIPAA prohibits the disclosure to or use of Protected Health Information by Business Associate if such a contract is not in place, AGREEMENT NOW, THEREFORE, in consideration of the mutual promises and covenants in this BAA, the parties agree as follows: ARTICLE I GENERAL PROVISIONS Section 1.1 Amendment. Business Associate and Plan Sponsor, on behalf of the Plans, agree to amend this BAA to the extent necessary to allow either Business Associate or the Plans to comply with the Standards or such other rules or regulations to be promulgated by the Secretary of the United States Department of Health and Human Services (the “Secretary”) and other applicable federal or state regulations or statutes. Business Associate and the Plans will fully comply with all applicable Standards and other applicable federal or state regulations or statutes and will amend this BAA to incorporate any material required by the Standards, such regulations, or statutes. Section 1.2 Definitions. Capitalized terms used herein without definition shall have the respective meanings assigned to such terms under the Standards. ARTICLE II OBLIGATIONS OF BUSINESS ASSOCIATE Section 2.1 Use and Disclosure of Protected Health Information. (a) Business Associate may use and disclose Protected Health Information on behalf of the Plans in any manner the Plans would be permitted or required to use and disclose Protected Health Information under the Standards, including for purposes of Treatment, Payment, and Health Care Operations, but only as permitted by this BAA or as required by law. For purposes of this BAA, Protected Health Information shall mean Individually Identifiable Health Information transmitted or maintained in any form or medium that Business Associate creates or receives from or on behalf of the Plans in the course of fulfilling its obligations under this BAA. EXHIBIT F (Continued) (b) Business Associate shall not, and shall ensure that its directors, officers, employees, contractors, subcontractors, and agents do not use or disclose Protected Health Information in any manner that would constitute a violation of the Privacy Standards if done by the Plans, except that Business Associate may use Protected Health Information if necessary (i) for the proper management and administration of Business Associate, (ii) to carry out the legal responsibilities of Business Associate, or (iii) to provide Data Aggregation services relating to the Health Care Operations of the Plans. Except for payments from the Plans or from the Plan Sponsor for services performed pursuant to this BAA, Business Associate shall not directly or indirectly receive remuneration in exchange for an Individual’s Protected Health Information. (c) Business Associate may disclose Protected Health Information for its proper management and administration or to carry out its legal responsibilities if the disclosure is required by law or if Business Associate obtains reasonable written assurances from the person to whom Protected Health Information will be disclosed that (i) the Protected Health Information will be held confidentially and used or further disclosed only for the purpose for which it was disclosed to such person or only as required by law, and (ii) such person will notify Business Associate of any instances of which it becomes aware in which the confidentiality of the Protected Health Information was breached. (d) At the Plan Sponsor’s written request and direction, Business Associate shall disclose or make available Protected Health Information or Summary Health Information to other business associates (as defined at 45 C.F.R. 160.103) of the Plans. (e) Business Associate hereby acknowledges that, as between Business Associate and the Plans, all Protected Health Information shall be and remain solely the property of the Plans, including any and all forms thereof developed by Business Associate in the course of fulfilling its obligations pursuant to this BAA. (f) In performing services for the Plans in accordance with this BAA, Business Associate will use or disclose only the Minimum Necessary Protected Health Information, in accordance with the Privacy Standards and Section 13405(b) of HITECH, any regulations issued thereunder, and the Standards. Business Associate further represents and agrees that, to the extent Business Associate requests the Plans to disclose Protected Health Information to Business Associate, such request is only for the Minimum Necessary Protected Health Information for the accomplishment of Business Associate’s purpose. Section 2.2 Disclosure of Protected Health Information to Plan Sponsor. Plan Sponsor acknowledges and agrees that, under the Privacy Standards, the Plans may permit Business Associate to disclose or provide access to Protected Health Information only to those employees or other persons under the control of Plan Sponsor who are identified by name or position in the Plan documents as the persons who are authorized to use and disclose Protected Health Information solely to carry out the particular Plan administration functions that Plan Sponsor performs for the Plans (“Designated Plan Sponsor Employees”). Accordingly, Business Associate shall disclose or make available Protected Health Information to Designated Plan Sponsor Employees for the purpose of carrying out the plan administration functions that the Plan Sponsor performs for the Plans. Notwithstanding the foregoing, Business Associate may disclose or provide access to Protected Health Information to the Plan Sponsor, including to an employee representative of Plan Sponsor who is not a Designated Plan Sponsor Employee, as follows: (a) Business Associate may disclose Summary Health Information for the purpose of obtaining premium bids for the provision of health insurance, HMO, or stop-loss coverage for the Plans, or for the purpose of modifying, amending or terminating the Plans; and (b) Business Associate may disclose whether an individual is participating in the Plans or has enrolled in or disenrolled from a health insurance issuer or HMO offered by the Plans. Section 2.3 Safeguards Against Misuse of Information. Business Associate will develop, implement, maintain, and use all appropriate administrative, technical, and physical safeguards to prevent the use or disclosure of Protected Health Information other than pursuant to the terms and conditions of this BAA or as required by law. Business Associate represents that it has implemented policies and procedures to safeguard Protected Health Information. Section 2.4 Reporting of Violations. Business Associate shall, within five (5) days of becoming aware of any use or disclosure of Protected Health Information in violation of this BAA by Business Associate or any of its officers, directors, employees, contractors, or agents, report such use or disclosure to Plan Sponsor. In the event of a Breach, as defined in Section 13400(1) of HITECH, by Business Associate or any of its officers, directors, employees, subcontractors or agents, Business Associate shall immediately notify Plan Sponsor in accordance with the requirements of Section 13402 of HITECH. Section 2.5 Agreements by Third Parties. Business Associate shall enter into and maintain an agreement with each of its agents, partners and subcontractors that has or will have access to Protected Health Information under which the agent, partner or subcontractor is legally bound by the same restrictions with respect to Protected Health Information that apply to Business Associate pursuant to this BAA, the Standards, and HIPAA, as amended by HITECH. EXHIBIT F (Continued) Section 2.6 Access to Information. Within fifteen (15) days of a request from the Plans for access to Protected Health Information about an Individual contained in a Designated Record Set, Business Associate shall make available to the Plans, or at the Plan Sponsor’s direction to the Individual requesting the Protected Health Information (or the Individual’s authorized personal representative), such Protected Health Information. In the event any Individual requests access to his or her Protected Health Information directly from Business Associate, Business Associate shall notify the Plan Sponsor within two (2) days of such request. Any decision to deny access to the requested Protected Health Information shall be the responsibility of the Plan Sponsor. Business Associate agrees to provide access to Protected Health Information contained in a Designated Record Set in the time and manner required by law in accordance with the requirements under 45 C.F.R. 164.524 and any subsequent legislation or guidance regarding an Individual’s right to access his or her Protected Health Information, including, but not limited to, the requirements of Sections 13405 of HITECH and the regulations thereunder. Section 2.7 Availability of Protected Health Information for Amendment. Within thirty (30) days of receipt of a request from the Plans for the amendment of an Individual’s Protected Health Information or a record regarding an Individual contained in a Designated Record Set, Business Associate shall provide such information to the Plans, or at the Plan Sponsor’s direction to the Individual requesting the Protected Health Information (or the Individual’s authorized personal representative), for amendment and shall incorporate any such amendments in the Protected Health Information as required by 45 C.F.R. §164.526 and any subsequent legislation or guidance regarding an Individual’s right to request amendment of his or her Protected Health Information. Any decision to deny a requested amendment shall be the responsibility of the Plan Sponsor. Section 2.8 Accounting of Disclosures. Within thirty (30) days of receipt of notice from the Plans that it has received a request for an accounting of disclosures of Protected Health Information, other than disclosures excepted under 45 C.F.R. §164.528(a), Business Associate shall provide to the Plans, or at the Plan Sponsor’s direction to the Individual requesting the accounting of disclosures of Protected Health Information (or the Individual’s authorized personal representative), the information in Business Associate’s possession that is required for the Plans to make the accounting required by 45 C.F.R. §164.528(b) and (c). At a minimum, Business Associate shall provide the Plans with the following information for each disclosure: (a) the date of the disclosure, (b) the name of the entity or person who received the Protected Health Information and, if known, the address of such entity or person, (c) a brief description of the Protected Health Information disclosed, and (d) a brief statement of the purpose of such disclosure which includes an explanation of the basis for such disclosure. In the event an Individual’s request for an accounting is delivered directly to Business Associate, Business Associate shall within two (2) days forward such request to the Plans. Business Associate hereby agrees to implement an appropriate recordkeeping process to enable it to comply with the requirements of this section. If Business Associate is unable to provide an accounting within the above time frame, Business Associate shall inform the Plans in writing within twenty-five (25) days of the request so that the Plans may request an extension from the Individual. Section 2.9 Availability of Books and Records. Business Associate hereby agrees to make its internal practices, books and records relating to the use and disclosure of Protected Health Information available to the Secretary for purposes of determining the Plans’ compliance with the Privacy Standards. Section 2.10 Injunction. Business Associate hereby agrees that the Plans and Plan Sponsor will suffer irreparable damage upon Business Associate’s breach of its obligations under this BAA, and that such damages shall be difficult to quantify. Business Associate hereby agrees that the Plans or Plan Sponsor may file, and Business Associate will not contest, an action for an injunction to enforce the terms of this BAA against Business Associate, in addition to any other remedy the Plans or Plan Sponsor may have. Section 2.11 Request for Disclosure to an Alternative Location or Alternative Means; Restrictions. Business Associate shall permit an Individual to make a reasonable request that Protected Health Information relating to the Individual be supplied at alternative locations and/or by alternative means, or to make a request for restriction of the use and/or disclosure of Protected Health Information. If such request is made directly to Business Associate, Business Associate shall provide a copy of such request (and any change thereto) to Plan Sponsor within five (5) days of receipt of such request. Business Associate agrees to comply with the requirements of Section 13405(a) of HITECH regarding requests for restriction on the disclosure of Protected Health Information to health plans for payment and health care operations purposes. Except to the extent a request must be granted under Section 13405(a) of HITECH, Business Associate is prohibited from agreeing to any restriction on the use or disclosure of Protected Health Information or any alternative communication of Protected Health Information requested by an Individual without prior approval of Plan Sponsor. Section 2.12 Authorizations. Business Associate shall provide, upon the request of an Individual, a HIPAA- compliant Authorization form that may be used by such Individual to request a use or disclosure of such Individual’s Protected Health Information that is not otherwise permitted hereunder. Business Associate shall not require an Authorization to use or disclose Protected Health Information unless such an Authorization is required by the Privacy Standards. Business Associate shall receive prior approval from Plan Sponsor before attempting to obtain an Individual’s Authorization for the use or disclosure of Protected Health Information for any purpose other than to satisfy its obligations under the BAA, such as for marketing purposes. A copy of such authorization shall be provided to the Plans participant and maintained by the Business Associate for a minimum of six (6) years, or if lesser the term of this BAA. EXHIBIT F (Continued) Section 2.13 Sanctions and Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of this BAA. In the event of a Breach, as defined in Section 13400(1) of HITECH, by Business Associate or any of its officers, directors, employees, subcontractors, partners or agents, Business Associate shall cooperate with the Plan Sponsor to notify, at Business Associate’s expense, the affected Individuals pursuant to Section 13402 of HITECH and the regulations thereunder. Business Associate agrees to implement and apply sanctions against its employees, agents, or subcontractors who provide services with respect to the Contract or this BAA in the event such employee, agent, or subcontractor fails to comply with the applicable requirements of this BAA. The parties acknowledge and agree that Business Associate is not an agent of the Plans or the Plan Sponsor and is performing services as an independent contractor. Section 2.14 Research or Marketing. Business Associate agrees not to use or disclose Protected Health Information for research or marketing purposes without first receiving prior written approval from the Plan Sponsor and obtaining the necessary Authorization from the affected Individuals. Section 2.15 Standard Transactions. To the extent that Standard Transactions are possible, applicable, and the Plans’ carriers and vendors accept and comply with Standard Transactions, Business Associate shall comply, and shall require any subcontractor or agent involved with the conduct of such Standard Transactions to comply, with each applicable requirement of 45 C.F.R. Part 162. Section 2.16 Security Standards. Business Associate shall: (a) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of the Plans; (b) Ensure that any partner, agent or subcontractor, to whom it provides such information agrees to implement reasonable and appropriate safeguards to protect Electronic Protected Health Information; (c) Report to the Plan Sponsor on behalf of the Plans any security incident of which Business Associate becomes aware; and (d) Accept termination of this BAA and the Contract by the Plan Sponsor, if the Plan Sponsor determines that the Business Associate has violated a material term of the BAA and fails to correct the breach within the Cure Period set forth in Article IV of this BAA. Section 2.17 Notices to Plan Sponsor: For purposes of this BAA and complying with the Standards and this BAA’s provisions, including all reporting, notification, and disclosures required hereunder or in accordance with the Standards and other applicable law, Business Associate shall direct all communications to the following: Maricopa County Employee Benefits Division, Attn: Benefits Manager, 301 West Jefferson Street, Suite 3200, Phoenix, AZ 85003- 2143; Phone (602) 506-1010. ARTICLE III OBLIGATIONS OF PLAN SPONSOR Section 3.1 Privacy Notice. Plan Sponsor shall notify Business Associate of any limitation(s) in the Plans’ notice of privacy practices to the extent such limitation(s) may affect Business Associate’s use or disclosure of Protected Health Information. Section 3.2 Designated Plan Sponsor Employees. Plan Sponsor shall identify for Business Associate the Designated Plan Sponsor Employees and shall promptly notify Business Associate of any additions to or deletions from the list of Designated Plan Sponsor Employees. Section 3.3 Amendment of Plan Document and Certification. Plan Sponsor hereby represents that it has provided certification to the Plans that the Plan documents have been amended to incorporate, and Plan Sponsor agrees to, the provisions required by the Privacy Standards as a precondition to disclosure of Protected Health Information to Plan Sponsor. Section 3.4 Permissions. Plan Sponsor shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect Business Associate’s permitted or required uses and disclosures thereof. Section 3.5 Restrictions. Plan Sponsor shall notify Business Associate of any restriction on the use or disclosure of PHI agreed to by Plan Sponsor in accordance with 45 CFR §164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI. ARTICLE IV TERMINATION OF AGREEMENT Section 4.1 Termination Upon Breach of Provisions Applicable to Protected Health Information. Notwithstanding any other provision herein, this BAA may be terminated by either party upon thirty (30) days prior written notice to the other party in the event that the other party materially breaches any obligation of this BAA and fails to cure the breach within such thirty (30)-day period; provided, however, that in the event that termination of this BAA is not feasible, the breaching party acknowledges that the non-breaching party shall have the right to report the breach to the Secretary. Section 4.2 Return or Destruction of Protected Health Information Upon Termination. Upon termination of the Contract or this BAA, Business Associate agrees to return or destroy all Protected Health Information if it is feasible to do so. Prior to doing so, Business Associate further agrees to recover any Protected Health Information in the possession of its agents or subcontractors. If it is not feasible for Business Associate to return or destroy the Protected Health Information, Business Associate will promptly notify the Plans in writing. The notifications shall include (a) an identification of the Protected Health Information at issue, (b) a statement that Business Associate has determined that it is infeasible for it to return or destroy the Protected Health Information in its possession and/or in the possession of its agents or subcontractors, and (c) the specific reasons for such determination. Business Associate further agrees to extend any and all protections, limitations, and restrictions contained in this BAA to its or its agent’s or subcontractor’s use and/or disclosure of any Protected Health Information retained after the termination of the Contract, and to limit any further uses and/or disclosure to the purposes that make the return or destruction of the Protected Health Information infeasible. Section 4.3 Plan Sponsor’s Right of Cure. Plan Sponsor shall have the right to cure, at the expense of Business Associate, any breach of Business Associate’s obligations under this BAA. Plan Sponsor shall give Business Associate notice of its election to cure any such breach, and Business Associate shall cooperate fully in the efforts by Plan Sponsor to cure Business Associate’s breach. Section 4.4 Transition Assistance. Following the termination of the Contract for any reason, and subject to any Transition of Services provision therein, Business Associate agrees to provide transition services for the benefit of the Plans, including the continued provision of its services required under the Contract and this BAA, until notified by Plan Sponsor that another provider of services is able to take over the provision of such services and the transfer of the Protected Health Information and other data held by Business Associate related to its services under the Contract has been completed. ARTICLE V MISCELLANEOUS Section 5.1 Modification of Agreement. No alteration, amendment, or modification of the terms of this BAA shall be valid or effective unless in writing and signed by Business Associate and Plan Sponsor. Section 5.2 Non-Waiver. A failure of any party to enforce at any time any term, provision or condition of this BAA, or to exercise any right or option herein, shall in no way operate as a waiver thereof, nor shall any single or partial exercise preclude any other right or option herein. In no way whatsoever shall a waiver of any term, provision, or condition of this BAA be valid unless in writing, signed by the waiving party, and only to the extent set forth in such writing. Section 5.3 Agreement Drafted by All Parties. This BAA is the result of arm’s length negotiations between the parties and shall be construed to have been drafted by all parties such that any ambiguities in this BAA shall not be construed against either party. Section 5.4 Severability. If any provision of this BAA is found to be invalid or unenforceable by any court, such provision shall be ineffective only to the extent that it is in contravention of applicable laws without invalidating the remaining provisions hereof. Section 5.5 Section Headings. The section headings contained herein are for convenience in reference and are not intended to define or limit the scope of any provision of this BAA. Section 5.6 Third Party Beneficiaries. There are no third party beneficiaries to this BAA.