HomeMy WebLinkAbout5278Contract Number:
Vendor
Sub�ect
Department:
File Class
Begin Date:
End Date
Review Date:
Vault Date
5278
DISCOVERY BENEFITS, INC.
Business Associate Agreement
Human Resources
LEG 12-1
9/19/2013
9/1/2014
Comments
BUSINESS ASSOCIATE AGREEMENT
GPID: 15475
This Business Associate Agreement (the "AgreemenY') is made and entered mto effective as of July 30,
2013 (Effectwe Date), by and between Discovery Benefits, Inc and its subsidiaries and affiliate companies ("DBI")
and City of Bremerton Health Ptan (the "Plan°), which is sponsored by City of Bremerton (the "Sponsor")
WITNESSETH
WHEREAS, DBI shall provide certain admmistrative services, activities or functions m connection with the
Plan (the "Services") pursuant to a Services Agreement between DBI and the Sponsor (the "Services AgreemenY'),
and
WHEREAS, the parties desire to enter mto this Agreement as set forth below for the purpose of addressing
the "Standards for Pnvacy of Individually Identifiable Health Information,° 45 CFR Part 160 and Part 164, Subparts A
and E(the "Privacy Rule°), the "Standards for Electronic Transactions,° 45 CFR Part 160, Subpart A, and Part 162,
5ubpart A and Subparts I through R(the "Electrornc Transaction Rule"), the "Security Standards for the Protection of
Electronic Protected Health Information," 45 CFR Part 160, Subpart A, and Part 164, Subparts A and C(the "Secunty
Rule"), and the "Standards for Breach Notification for Unsecured Protected Health Information," 45 CFR Part 164,
Subpart D(the "Breach Notification Rule"), as amended and clarified by the HIPAA Omrnbus Rule or any regulations,
rules or gwdance that may be issued after the effective date of this Agreement
NOW, THEREFORE, in consideration of the premises and other good and valuable consideration, the
receipt and suffiGency of which is hereby acknowledged, the Pian and DBI agree as follows
Article I — Definitions
1 1 "Agent" shall have the meaning given to it m Section 2 5 As provided by HIPAA, an Agent and a
Subcontractor are two separate types of arrangements
1 2 "Breach" shall have the meanmg given to it by 45 CFR § 164 402
1 3 "Busmess AssoGate" shall have the meaning given to it by 45 CFR § 160 103
1 4 "Designated Record SeY' shall have the meanmg given to it by 45 CFR § 164 501
1 5 "Health Care Operations" shall have the same mearnng given to it m 45 CFR § 164 501
1 6 "HIPAA° shall mean, collectively, the Pnvacy Rule, the Electrornc Transaction Rule, the Security
Rule, and/or the Breach Notification Rule, each as amended and clanfied by the HIPAA Omrnbus Rule
1 7 "HIPAA Omnibus Rule° shall mean the "Modifications to the HIPAA Pnvacy, Secunty, Enforcement
and Breach Notification Rules under the Health Information Technology for Economic and Ciinical Health Act and the
Genetic Information Nondiscnmination Act," 78 Federal Register 5566 (January 25, 2013)
1 8 "Indiwdual" shall mean the person who is the sub�ect of PHI and shail include a person who
qualifies as a personal representative m accordance with 45 CFR § 164 502(g)
1 9 "Individual Rights Requests" shall mean Access Requests, Amendment Requests, Accountmg
Requests, and requests under Section 3 3
1 10 "Payment" shall have the same meaning given to it m 45 CFR § 164 501
1 11 "PHI" shall mean any mformation, whether oral or recorded m any form or medium, that —(i) retates
to the past, present or future physical or mental condition of an Individual, the provision of health care to an
Individual, or the past, present or future payment for the provision of health care to an Indiv�dual, and (u) identifies the
Indiwdual or v�nth respect to which there is a reasonable basis to believe the information can be used to identify the
Individual
1 12 "Plan" shall have the mearnng provided as first wntten above In all cases, the Plan shall mean the
group health plan or plans of the Sponsor as set forth in 45 CFR § 160 103
1 13 "Plan Admmistration Funckions" shall have the same meaning given to it m 45 CFR § 164 504
1 14 "Plan Admmistrator" shall mean the entity, mdividual, group or committee appomted by the
Sponsor, or its su�essor or successors, who have authonty to administer the Plan
1 15 "Pnvacy OfficiaP shall mean the person designated by the Plan to serve as its pnvacy official withm
the mearnng of 45 CFR § 164 530(a), and any person to whom the Pnvacy OffiGal has delegated any of his or her
duties or responsibdities
1 16 "Protected Information" shall mean PHI received from the Plan or created, received, maintained or
transmitted by DBI on behalf of the Plan
1 17 "Reqwred by Law" shall have the same meaning gwen to it in 45 CFR § 164 103
Services
1 18 "Secretary" shall mean the Secretary of the United States Department of Health and Human
1 19 "Services" shall mean the activities, functions and/or services that DBI from t�me to time renders to
or on behalf of the Plan to the extent that those activities, functions and/or services are covered by HIPAA
1 20 "Subcontracto�' shall have the same meaning giwng to it in 45 CFR § 160 103
1 21 "Unsecured PHI° shall mean Protected Information that is not secured through the use of a
technology or methodology that renders such Protected Information unusable, unreadable or indecipherable to
unauthorized indiwduals as specified m 45 CFR § 164 402
Article II — Obliqations and Actrvities of DBI
2 1 Status of DBI DBI acknowledges and agrees that it is a Business Associate of the Plan for
purposes of the Pnvacy Rule
2 2 Permitted Uses and Disclosures of Protected Information
(a) Permitted Uses DBI shall not use Protected Information other than as permitted by this
Agreement DBI may use Protected Information —(i) m connection with the pertormance, management and
admmistration of the Services, (u) for the proper busmess management and admirnstrat�on of DBI, (ui) to carry out
DBI's legal responsibdities, (iv) to report violations of law consistent �nnth 45 CFR § 164 502�), (v) to the extent and for
any purpose authorized by an Indiwdual under 45 CFR §164 508, and (vi) for any purpose prowded that no data is
identifiable and has been de-identified pursuant to 45 CFR §164 514(b) (includmg the separate de-identification
guidance issued by the Secretary on November 26, 2012) Nofinnthstandmg the foregoing sentence, DBI shall not
use Proteded InformaUon in any manner that violates the Pnvacy Rule, or that would violate the Privacy Rule if so
used by the Plan (except for the purposes speGfied under 45 CFR § 164 504(e)(2)(i)(A) and (B))
(b) Permitted Disclosures DBI shall not disclose Protected Information other than as
permitted by this Agreement DBI may disclose Protected information —(i) in connection v�nth the pertormance,
management and admirnstration of the Services, (u) to report violations of law consistent with 45 CFR § 164 502�),
(ni) to the extent and for any purpose authonzed by an Individual under 45 CFR §164 508, and (iv) for any purpose
provided that no data is identifiable and has been de-identified pursuant to 45 CFR §164 514(b) (including the
separate de-identification gwdance issued by the Secretary on November 26, 2012) In addition, DBI may also
disclose Protected Information to a third party for the proper busmess management and administration of DBI and to
carry out DBI's legal responsibdities, provided, that the disclosure is Required by Law, or DBI obtains, pnor to the
disdosure —(1) reasonable assurances from the third party that the Protected Information wdl be held confidentially
and used or further disclosed only as Required by Law or for the purpose for which it was disdosed to the third party,
and (2) an agreement from the third party that the third party wdl notify DBI immediately of any mstances m which it
knows the wnfident�ality of the information has been breached Further, DBI shall disdose, upon request, Protected
Information to the Sponsor for Plan Admirnstration Functions and to designated Sponsor employees (or designated
Business Associates of the Plan) who are working for or on behalf of the Plan for purposes of Payment and Health
Care Operat�ons (includmg claims assistance activities) consistent with 45 CFR § 164 506(c)(1) Notwithstanding the
foregomg, DBI shall not disclose Protected Information in any manner that violates the Pnvacy Rule, or that wouid
violate the Pnvacy Rule if so disGosed by the Plan (except for the purposes specified under 45 CFR §
164 504(e)(2)(i)(A) and (B))
(c) Mirnmum Necessarv To the extent required by the Pnvacy Rule, DBI shall only request,
use and/or disdose the mirnmum amount of Protected Information nec�ssary to accomplish the purpose of the
request, use and/or disclosure For this purpose, the determination of what constitutes the mirnmum necessary
amount of Protected Information shall be determined in accordance with Section 164 502(b) of the Pnvacy Rule
(d) Direct Application of Pnvacy Rules DBI shall not use and/or disclose Protected
Information or provide any Services that require the use and/or disGosure of Protected Information unless such use
and/or disdosure directly complies with this Section 2 2 and Sections 164 502(a)(3) and 164 504(e) of the Pnvacy
Rule
(e) GINA Provisions Notwithstanding subsections (a) through (c) above, DBI shall not use
and/or d�sclose Protected InformaUon that is genetic information for underwnting purposes, as set forth m 45 CFR §
164 502(a)(5)
2 3 Safeguards DBI shall maintam and use appropnate and commeraally reasonable safeguards to
prevent use and/or disclosure of Protected Informat�on other than as permitted or required m this Agreement
2 4 Reports of Prohibited DisGosures If DBI becomes aware of a disGosure of an Individual's
Protected Information by DBI and the disclosure violated the provisions of this Agreement, DBI must inform the
Pnvacy Offiaal regardmg the prohibited disclosure of the Indrvidual's Protected Information To the extent that a
disclosure described in this Section 2 4 also const�tutes a Breach of Unsecured PHI, the prowsions of this Section 2 4
shall not apply, but rather the prowsions of Section 2 8 shall apply
2 5 Agents and Subcontractors DBI shall reqwre each of its representatives, agents, and entities
(collecUvely, "Agents") to whom DBI prowdes Protected Information on behalf of the Plan to agree to observe the
restnctions on use and d�sclosure of the Protected Information imposed upon DBI by this Agreement and the Privacy
Rule In addition, DBI shall enter mto a Busmess Assoaate Agreement with each of its Subcontractors which meets
the reqwrements of the Pnvacy Rule, including the reqwrements set forth m 45 CFR § 164 504(e)
2 6 Access by Secretary DBI shall make available to the Secretary DBI's mternal practices, books and
records (inGuding its poliGes and procedures) relating to DBI's use and disclosure of Protected Information for the
purpose of enabling the Secretary to assess the Plan's and/or DBI's compliance mnth HIPAA DBI shall mform the
Privacy OffiGal of any request sent by the Secretary on behalf of the Plan that is received by DBI, unless it is
prohibited by applicable law from doing so
2 7 Mitigation DBI agrees to mitigate, to the extent practicable, any harmful effect that is known to DBI
of a use or disclosure of Protected Information by DBI in violation of the reqwrements of this Agreement
2 8 Notice of Breach of Unsecured PHI
(a) DBI Regwrements Upon DBI's discovery of a Breach of Unsecured PHI by DBI, DBI shall
(1) Pursuant to the reqwrements set forth m subsection (b) below, provide wntten
notice of the Breach, on behalf of the Plan, without unreasonable delay but no later than sixty (60) calendar
days following the date the Breach is discovered or such later date as is authonzed under 45 CFR §
164 412, to
(i) each Individual whose Unsecured PHI has been, or is reasonably
believed by DBI to have been, accessed, acquired, used or disclosed as a result of the Breach,
(n) the media to the extent required under 45 CFR § 164 406, and
(ui) the Secretary to the extent required under 45 CFR § 164 408 (unless
the Plan has elected to prowde this notification and has informed DBI),
(2) Pursuant to the reqwrements set forth m subsection (c� below, prowde wntten
notice of the Breach to the Privacy Offiaal, as soon as administratively practicable, but no later than three
(3) busmess days after the Breach is discovered, and
(3) If the Breach involves less than 500 individuals, maintam a log or other
documentation of the Breach which contains such mformation as would be reqwred to be mGuded if the log
were maintained by the Plan pursuant to 45 CFR § 164 408, and provide such log to the Plan within five (5)
business days of the Plan's wntten request
(b) Notice Reqwrements This subsection (b) provides the followmg special rules that shall
each be applicable to the provisions of Section 2 8(a)(1) —
(1) The date that a Breach is discovered shall be determined by DBI, m its sole
discretion, in accordance with the Breach NoUfication Rule
(2) The content, form and delivery of each of the notices reqwred by Section
2 8(a)(1) shall comply in all respects with the breach notification provisions applicable to the Plan, as set
forth in the Breach Notification Rule
(3) DBI shall send the notices described in Section 2 8(a)(1)(i) to each Indiwdual
using the address on file v�nth DBI (or as may be otherwise prowded by the Plan) If the notice to any
Individual is returned as undeliverable, DBI shall make one additional attempt to deliver the notice to the
Indiwdual using such information as is reasonably avadable to it, or shall take other action required by the
Breach Notification Rule
(4) With respect to notices required under Section 2 8(a)(1)(i) and (u), DBI and the
Pnvacy Official shall cooperate in all respects regardmg the draftmg and the content of the notices To that
end, before sending any notice to any Individual or the media under Section 2 8(a)(1)(i) or (u), DBI shall first
provide a draft of the notice to the Pnvacy OffiGal The Pnvacy Offiaal shall have flve busmess days (plus
any reasonabte extensions) to either approve DBI's draft of the notice or revise the language of the not�ce
Alternatively, the Privacy Official may elect to draft the notice for review by DBI Once DBI and the Privacy
Official agree on the final content of the notice, DBI shall send the notice to the Individuals and/or the media
based on the reqwrements of the Breach Notification Rule
(c) Privacy Offic�al Notice The notice to the Privacy Official pursuant to Section 2 8(a)(2)
shall inGude the identiry of each Individual whose Unsecured PHI was mvolved m the Breach and a bnef descnption
of the Breach To the extent that DBI does not know the identities of all affected Individuals when it is required to
notify the Pnvacy O�GaI, DBI shall provide such informaUon as soon as admmistratively practicable after such
information becomes avadable Upon the Plan's wntten request, DBI shall provide such additional information
regarding the Breach as may be reasonably requested from time to time by the Plan
(d) Services Agreement DBI reserves the nght to charge reasonable, cost based fees for
sendmg the notices required by this Section 2 8 should a Breach be due to actions on the part of the Sponsor, the
Plan or any other entity other than DBI, its Agents or Subcontractors
Article III — Indiv�dual R�qhts Reawrements
3 1 Desi�nated Record Sets
(a) General DBI agrees to maintain a Designated Record Set for the Plan in a manner and
form that wdl allow the Plan to provide access and amendment nghts to an Individual �nnth respect to the Individual's
Protected Information in conformance with 45 CFR §§ 164 524 and 164 526
(b) Access Reauests Upon request from the Plan, DBI shall process and respond to a
request by an Individual for access to an Individual's Protected Information that is maintained by DBI in a Designated
Record Set pursuant to 45 CFR § 164 524 (an "Access Request°) DBI shall respond to such Access Request within
the timeframes reqwred by 45 CFR § 164 524 by fumishing such Protected Information to the Plan If the Protected
Information that is requested is maintamed electronically and the Individual requests an electroroc copy of such
information, DBI wdl provide access to the mformation in an electronic format that complies with 45 CFR §
164 524(c)(2)(u) Thereafter, the Plan wdl be responsible for sending such information to the Individual
(c) Amendment Reauests Upon request from the Plan, DBI shall process a request by an
Indi�ndual for amendments to an Individual's Protected Information that is maintained by DBI m a Designated Record
Set pursuant to 45 CFR § 164 526 (an "Amendment RequesY') DBI shall process such Amendment Request within
the timeframes required by 45 CFR § 164 526
(d) Coordination with Pnvacy Official DBI shall coordmate and cooperate with the Pnvacy
OffiGal (or any other person designated by the Plan Admirnstrator for this purpose) regardmg all processing,
recordkeeping and documentation issues relating to Access Requests and Amendment Requests Notwithstanding
the foregoing, DBI shall not be obligated to coordmate with the Pnvacy OffiGal if an Individual files an Access
Request or Amendment Request �nnth DBI and such request is directed solely to DBI
3 2 Accountmas
(a) Documentation of Disclosures DBI agrees to document and maintam a Iog of any and all
disdosures from and after the date or dates reqwred by 45 CFR § 164 528 made by DBI of Protected Information in a
manner and form that wdl allow the Plan to provide to an Indiwdual an accounUng of disclosures or other applicable
report of the Indiwdual's Protected Information in compliance with and based on the requirements of 45 CFR §
164 528
(b) Accounting Requests Upon request from the Plan, DBI shall process and respond to a
request by an Individual for an accountmg of disclosures or other applicable report of an Individual's Protected
Information pursuant to the reqwrements of 45 CFR § 164 528 (an "Accounting Request") DBI shall respond to such
Accounting Request within the timeframes reqwred by 45 CFR § 164 528 by furrnshmg such accounting to the Plan
Thereafter, the Plan wdl be responsible for sending such information to the Individuai
4
(c) Coordmation with Pnvacy Official DBI shall coordmate and cooperate mnth the Privacy
OffiGal (or any other person designated by the Plan Administrator for this purpose) regarding all processmg,
recordkeeping and documentation issues relatmg to Accounting Requests Notwithstandmg the foregoing, DBI shall
not be obligated to coordinate �nnth the Pnvacy Official �f an Individual files an Accountmg Request with DBI and such
request is directed solely to DBI
3 3 Privacy Protection Requests
(a) Restnction Requssts on Uses and Disclosures The Plan and DBI on behalf of the Plan
shall not agree to a restnction on the use or disclosure of Protected Informat�on pursuant to 45 CFR § 164 522(a)
without first consultmg with the other party DBI is not obligated to implement any restnction, if such restriction would
hmder Health Care Operations or the Services DBI prowdes to the Plan, unless such restnetion would otherwise be
required by 45 CFR § 164 522(a)
(b) Confidential Communication Reauests DBI shall implement any reasonable requests by
Individuals relating to a request to receive commurncations of Protected Information by alternative means or at
altemative locations to the extent required by 45 CFR § 164 522(b)
(c) Coordmation with Pnvacy Official DBI shall coordinate and cooperate with the Pr�vacy
Official (or any other person designated by the Plan Administrator for this purpose) regarding all processing,
recordkeeping and documentation issues relating to requests under this Section 3 3
Article IV — Electronic Trensact�on Rule
4 1 Business Associate Reawrements DBI acknowledges that it is a Busmess AssoGate of the Plan
for purposes of the Electrornc Transaction Rule DBI agrees that it shall comply with all Electrornc Transaction Rule
reqwrements that may be applicable to DBI with respect to the Services it provides to and on behalf of the Plan DBI
shall also reqwre each of its Agents and Subcontractors to whom DBI provides Protected Information that is received
from, or created or received by DBI on behalf of the Plan to comply �nnth the applicable reqwrements of the Electronic
Transaction Rule
4 2 Sponsor Transmissions Electronic transmissions between DBI and the Sponsor are not reqwred
to comply �nnth the Electrornc Transaction Rule Accordingly, the Sponsor hereby represents and warrants that all
electrornc transmissions with respect to the Plan between the Sponsor (either directly or through its designated
agent) and DBI, relating to —(i) enrollment and disenroliment information and (n) premium payment information, as
each are covered by the Electrornc Transaction Rule, are sent or received by the Sponsor (either directly or through
its designated agent) m the Sponsor's capaaty as an employer and are not sent or received by the Plan
Art�cle V— Oblis�at�ons of Plan
5 1 PnvacX Notice Upon request, the Plan wdl provide DBI with a copy of its notice of privacy
practices pursuant to 45 CFR § 164 520
5 2 Authonzations The Plan �nnll notify DBI of any changes m or revocations of Indiwdual
authonzations for use or disGosure of Protected Information to the extent that such changes or revocaUons may
affect DBI's use or disclosure of Protected Information
5 3 Offiaals The Plan wdl notify DBI of the current name and contact mformation of the Plan
Admirnstrator, the Pnvacy Official and any other person that has the authority to act on behalf of the Plan Hnth respect
to the prowsions contained m this Agreement
5 4 Plan Amendments Sponsor represents that it has amended its Plan documents to include specafic
provisions to restnct the use or disGosure of PHI and to ensure adequate procedural safeguards and accounting
mechanisms for such uses or disGosures, in accordance with the Pnvacy Rule
5 5 Additional Certification The Plan represents and warrants that (a) it has amended its plan
documents, in accordance with 45 CFR § 164 504(�, so as to allow the Plan to receive Protected Information, (b) it
has received a cerhfication from the Sponsor m accordance with 45 CFR § 164 504(�(2)(u), and wdl provide a copy of
such certification to DBI upon request, (c} the plan document amendments permit the Plan to receive Protected
Information (including detaded invoices, reports and statements from DBI), and (d) the Plan has determined, through
its own policaes and procedures and m compliance with 45 CFR § 164 502(b), that the Protected Information that it
receives from DBI (including the detaded mvoices, reports and statements) contam the mirnmum mformation
necessary for the Plan to carry out its Payment and Health Care Operations actroities
Article VI — Amendment and Termination
6 1 Amendment No change, modification, or attempted waiver of any of the provisions of this
Agreement shall be bindmg upon any party hereto unless reduced to writ�ng and signed by the parry against whom
enforcement is sought DBI agrees to take such action as is necessary to amend this Agreement from time to time as
the Plan reasonably determmes necessary to comply with HIPAA, or any other applicable taw, rule or regutation
6 2 Term The Term of this Agreement shall be effective on the date first wntten above (except as
otherwise noted herein) and shall termmate when all of the Protected Information received from the Plan, or created
or received by DBI on behalf of the Plan, is destroyed m accordance �nnth the Plan's authonzation or is retumed to the
Plan (or its designated agents) pursuant to Section 6 4
6 3 Termmation If one party to this Agreement (the "Non-Breaching Party") has knowtedge of a
material violaUon of this Agreement by the other party to this Agreement (the "Breaching Party"), as determined in
good faith by the Non-Breachmg Party, the Non-Breaching Party must promptly
(a) Provide an opporturnry for the Breaching Party to end and to cure the matenal wolation
�nnthm a reasonable time specified by the Non-Breaching Party, and if the Breachmg Party does not end and cure the
matenal violation withm such time (mcludmg reasonable extensions that the Non-Breaching Party determines are
necessary) to the satisfaction of the Non-Breaching Party, the Non-Breaching Party shall immediately terminate the
Services rendered by DBI and any agreement or contract related thereto, or
(b) If a cure is not possible as determined by the Non-Breachmg Party in its sole discretion,
the Non-Breaching Party shall immediately termmate the Services rendered by DBI and any agreement or contract
related thereto
6 4 Effect of Termmation Upon termmation pursuant to Section 6 3, the Plan withm a reasonable time
thereafter must mform DBI to either destroy or return to the Plan (or any agents designated by the Plan) the Protected
Informat�on that DBI and its Agents and Subcontractors maintam m any form, and DBI and its Agents and
Subcontractors shall retain no copies of the Protected Informat�on However, in many situations DBI maintams one or
more backup copies of Protected Information for auditmg, data management and other related purposes and DBI has
determined that destruction of all copies of Protected Information that it mamtams is infeasible Therefore, after
termmation of the Services and pursuant to 45 CFR § 164 504(e)(2)(u)(J), this Agreement shall remain m effect and
DBI shall continue to observe and shall ensure that its Agents and Subcontractors continue to observe its obligations
under this Agreement to the extent copies of the Protected Information are retained by DBI and shall limit further uses
and disclosures of Protected Information to the purposes that make its retum or destruction mfeasible and that are
consistent v�nth the Pnvacy Rule
Article VII — Electromc Securitv Standards
7 1 Defirntions When used m this Article, the follo�nnng terms shall have the mearnngs set forth as
follows
(a) "Electronic Media° shall have the mearnng given to it m 45 CFR § 160 103
(b) "Electronic Protected Information° shall mean Protected Information received from the
Plan or created, received, maintained or transmitted by DBI on behalf of the Plan that is transmitted by Electronic
Media or maintained in Electronic Media
(c) "Secunty Incident" shall have the meaning given to it in 45 CFR § 164 304
7 2 Requirements Pursuant to 45 CFR § 164 314(a)(2)(i), DBI shall
(a) Comply with the applicable reqwrements of the Secunty Rule, including the requirement
that DBI implement, maintain and document admirnstrative, physical and techrncal safeguards that reasonably and
appropnately protect the confidentiality, mtegrity, and avadabdity of Electronic Protected Information to the extent
reqwred by the Secunty Rule,
(b) Report (pursuant to ,the terms and conditions of Section 7 3) to the Pnvacy Official (or
such other person designated for this purpose) any Secunty InGdent of which DBI becomes aware and which
occurred during the applicable reportmg penod,
(c) Reqwre each of its Agents to whom DBI prowdes Electronic Protected Information to
agree to implement admmistrative, physical and technical safeguards that reasonably and appropnately protect the
confidentiality, integnty, and avadability of the Electrornc Protected Information that is provided to the agent to the
extent required by the Secunty Rule, and
6
(d) Enter into a contract or other arrangement with each of its Subcontractors that create,
receroe, maintain or transmit Electrornc Protected Information on behalf of DBI pursuant to which the Subcontractor
agrees to comply with the applicable requirements of the Secunty Rule
7 3 Reportmg Protocols All reports required by Section 7 2(b) shall be provided pursuant to the terms
and condit�ons speGfied in this Section
(a) Attempted Security Incidents Reportmg for any Secunry InGdent involvmg the attempted
unauthorized access, use, disclosure, modification or destruction of Electronic Protected Information (collectively, an
"Attempted Secunry IncidenY') shall be prowded pursuant to the standard reporting protocols of DBI (as determined
by DBI)
(b) Successful Secunty Incident Reporting for any Secunty Inadent mvolvmg the successful
unauthonzed access, use, disclosure, modification or destruction of Electronic Protected Information (collectively, a
"Successful Secunty IncidenY') shall be provided to the Plan pursuant to the standard reportmg protocols of DBI (as
determined by DBI), provided, that (i) the reports shall at a mmimum include the date of the �nGdent, the parties
involved (if known, mcluding the names of Individuals affeded), a description of the Successful Security Incadent, a
descnption of the Electrornc Protected Information involved m the madent and any action taken to mitigate the impact
of the S4ccessful Security InGdent andlor prevent its future recurrence and (n) the reports shall satisfy the minimum
requirements for Security Inc�dent reportmg that may be required from time to time by the Secretary In addition,
Successful Secunty Inadents shall be reported to the Ptan as soon as administraUvely practicabie after the
occurrence of the incident takmg into account the seventy and nature of the incident Notwithstanding the foregoing,
the Plan may request detads about one or more Successful Secunty InGdents, and DBI shall have 30 days thereafter
to fumish the requested information
(c) Breach of Unsecured PHI To the extent that a Secunty Incident descnbed m this Section
7 3 also constitutes a Breach of Unsecured PHI, the provisions of this Section 7 3 shall not apply, but rather the
provisions of Section 2 8 shall apply
7 4 Mitigation DBI agrees to mitigate, to the extent practicable, any harmful effect that is known to DBI
relating to any Secunty InGdent
7 5 Access by Secretarv DBI shall make avadable to the Secretary DBI's mtemal practices, books and
records (includmg its policies and procedures) relating to the safeguards established by DBI with respect to Electronic
Protected Information for the purpose of enabling the Secretary to assess DBI and/or the Plan's compliance with the
Security Rule DBI shall inform the Pnvacy Official of any request sent by the Secretary on behalf of the Plan that is
received by DBI, unless DBI is prevented by applicable law from doing so
Article VIII — General
8 1 Other Agreements The Plan and DBI acknowledge and affirm that this Agreement is in no way
intended to address or cover all aspects of the relationship of the Plan and DBI and of the Services that are rendered
by DBI to and on behalf of the Plan Rather, this Agreement deals only w�th those matters that are specifically
addressed herein Further, this Agreement supersedes any pnor business associate agreements entered mto by DBI
and the Plan (or any predecessor to the Plan), and shall apply to all Protected Information exist�ng as of the effective
date of this Agreement or created or received thereaRer whde this Agreement is in effect
8 2 indemnification My indemrnfication relating to wolations of this Agreement by DBI or the Plan (or
the Sponsor on behalf of the Plan) shall be addressed to the extent applicable by the Serwces Agreement of the
parties
8 3 Severabditv The provisions of this Agreement shall be severable, and the mvalidity or
unenforceabdity of any provision (or part thereo� of this Agreement shall in no way affect the va►idity or enforceabd�ty
of any other provisions (or remaining part thereo� If any part of any provision contained m this Agreement is
determined by a court of competent �unsdiction, or by any admmistrative tnbunal, to be invalid, dlegal or incapable of
being enforced, then the court or tnbunal shall interpret such provisions m a manner so as to enforce them to the
futlest extent of the law
8 4 Interpretation The provisions of this Agreement shall be mterpreted m a manner mtended to
achieve compliance wnth HIPAA Whenever the Agreement uses the term "including" followed by a speafic item or
items, or there is a passage havmg a simdar effect, such passages of the Agreement shatl be construed as if the
phrase "without lim�tation" foilowed such term (or otherwise applied to such passage in a manner that avoids
limitations on �ts breadth of application) Where the term "and/o�' is used in this Agreement, the provision that
includes the term shall have the mearnng the provision would have if °and" replaced "and/or," but it shall also have
the meanmg the provision would have if "or' replaced "and/or " Any reference to a secbon or provision of HIPAA shall
include any amendment or clanfication of such section or provision contamed in the HIPAA Omrnbus Rule and any
regulation, rule or gwdance issued by the Secretary following the effectwe date of this Agreement
8 5 Counterparts Any number of counterparts of this Agreement may be signed and delivered, each of
which shall be considered an original and all of which, together, shali consUtute one and the same mstrument
8 6 Bindm�Effect The provisions of this Agreement shall be binding upon and sha�l inure to the
benefit of the parties hereto and their heirs, assigns and successors in interest The Plan shall have the nght to
assign this Agreement to any successor or surwving health plan, and all covenants and agreements hereunder shall
inure to the benefit of and be enforceable by any such assignee
S 7 No Third-Party BenefiGanes Nothing express or implied m this Agreement is intended to confer,
and nothing herein shall confer, upon any person other than the parties hereto any nghts, remedies, obligations or
liabdities whatsoever
8 8 Ap�licable Law The provisions of this Agreement shall be construed and admirnstered to, and its
validity and enforceability determined under HIPAA To the extent that HIPAA is not applicable m a particular
circumstance, the provisions of this Agreement shall be construed and admmistered to, and its validity and
enforceabdity determined under the Employee Retirement Income Secunry Act of 1974, as amended ("ERISA") In
the event that HIPAA and ERISA do not preempt state law in a particular circumstance, the laws of the State of North
Dakota shall govern
8 9 State Privacy and Security Laws
(a) General Pursuant to 45 CFR § 160 203, DBI and the Plan acknowledge that HIPAA only
preempts state laws which are contrary to a HIPAA standard, requirement or implementation speafication, prowded
that state laws which relate to the privacy of Protected Information and are more stnngent than the Privacy Rule are
not preempted Accordingly, the parties acknowledge that certain State Pnvacy Laws affectmg the privacy and/or
security of personally identifiable information (e g, name, address, age, and social secunty number) relating to a Plan
partiGpant or beneficiary ("Privacy Restricted Data") may apply to the Services prowded by DBI to the extent such
State Privacy Laws are not preempted by HIPAA. For purposes of this Section 8 9, "State Privacy Laws" shall mean
any applicable state and local pnvacy laws governing the creation, collection, storage, mamtenance, access,
modification, transmission, use or disdosure of Pnvacy Restncted Data
(b) State Pnvacy Laws All Privacy Restncted Data created, collected, received or obtamed
by or on behalf of DBI m the course of performmg its Services shall be created, collected, received, obtained, stored,
maintained, accessed, modified, transmitted, used and disGosed in accordance with any and all applicable State
Privacy Laws DBI shall at all times perForm the Services m accordance with the State Pnvacy Laws and as not to
cause the Sponsor or the Plan to be in violation of the State Pnvacy Laws DBI shall be fully responsible for any
creation, collection, receipt, access, storage, mamtenance, modification, transmission, use and disclosure of Privacy
Restncted Data pertormed by or on behalf of DBI that is in violation of any State Pnvacy Laws DBI shall remedy and
mitigate the damages of any breach of pnvacy, security, integnty or confidentiality with respect to the unauthonzed
creation, collection, receipt, storage, maintenance, access, modification, transmission, use or disclosure (a "State
Breach") of Privacy Restricted Data that is or may be in violation of any State Pnvacy Laws
(c) Notification DBI shall notify the Privacy Officer (usmg the procedures that apply to
Breaches of Unsecured PHI under Section 2 S(c)) of any State Breaches by or on behalf of DBI of Pnvacy Restricted
Data that is or may be in violaUon of any State Pnvacy Laws In addition, D61 shall also notify the affected Plan
participants and benefiGanes (usmg the procedures that apply to Breaches of Unsecured PHI under Section 2 8(b))
of any State Breaches by or on behalf of DBI of Pnvacy Restncted Data that is in violat�on of any State Pnvacy Laws
and any state or local governmental agencies, authonties or other entities, but only to the e�ent reqwred by such
State Pnvacy Laws
(d) HIPAA Coordination The parties acknowledge that in certam situations the provisions of
both Section 2 8 and this Section 8 9 shall apply If both Sections 2 8 and 8 9 apply in a given situation, DBI shall
comply with both Sections 2 8 and 8 9 to the extent applicable
8 10 Obliqation of Plan and DBI To the extent that DBI cames out the HIPAA obligations of the Plan
(includmg the obtigations set forth in Section 2 8 and Articie III), DBI shall comply with the applicable requirements of
HIPAA as they apply to the Plan in the performance of such obligations on behalf of the Plan
IN WITNESS WHEREOF, the parties hereto have executed this Agreement by their duly authonzed offiaals
on the date set forth above
Signed for by the Sponsor on behalf of and as a Discovery Benefits, Inc.
representative of the Plan
B G������ � �
/� �(�� By
Name ( '. �/l.C�l(' ((�'�2 U.aZ-�VYdO(�'�
�/��� Name Suzanne Rehr
Title �U VVI.Ce(/1 Ycs�OI�IrCQS {�Cet�l'i�P�V'
� I � g 1 �� (�- Title Chief Compliance Officer/EVP
Date ,�_ Date Mav 1, 2013