HomeMy WebLinkAboutContract CAG-18-039
Claims Audit Service Agreement
This Claims Audit Service Agreement (the "Agreement") is entered into by and between J.
Graham Inc., a Tennessee corporation (hereinafter "JGI") and City of Renton, (hereinafter
"Client"), on the following terms and conditions:
1. Definitions
As used in this Agreement, the following defined terms have the following meaning:
(a) TPA is the Third Party Administrator or other Healthcare Claims payment
organization processing claims on behalf of the Client.
(b) Healthcare Claim(s) are the claims and the supporting information submitted by
subscribers, dependents, or providers to the TPA seeking reimbursement for
services covered by Client's health and welfare benefit plan, including information
created by the TPA related to the payment or disposition of the submission.
(c) Identified Amounts are any overpayments of Healthcare Claims identified by JGI
during the Claims Audit which are an error or recovery item regardless of
assignment of fault for the error or the ability of the TPA to recover the
overpayment. Identified Amounts also include all out-of-sample claims associated
with those error categories from sample claims.
(d) Recovered Amounts are any Identified Amounts resulting in a cash refund or
credit to the Client's healthcare plan,including but not limited to,those Recovered
Amounts described in Section 7(b) of this Agreement.
(e) Claims Audit is the service provided by JGI which normally includes reviewing the
Claims Data Set electronically for likely overpayments, confirming any
overpayments with the TPA, and recommending a course of action to be
implemented by the TPA and Client for correcting underlying problems and
recovering any Healthcare Claims overpayments.
(f) Claims Data Set is the electronic file provided by the TPA that provides the
historical record and data of Healthcare Claims paid on Client's behalf that will be
used to conduct the Claims Audit.
(g) Party or Parties refers to Client and JGI.
2. Duties of JGI
JGI shall:
(a) Meet with Client personnel, either by phone or in person, to outline the Claims
Audit process,submit an information request to Client,and establish a process for
resolving questions JGI may have during the Claims Audit with the appropriate
Client personnel.
(
is
(b) Provide a Claims Audit scope and/or data request to the TPA, review Claims Data
Set for completeness and compare total amount paid by TPA to healthcare
providers as set forth in the Claims Data Set versus the amount funded by Client
for Healthcare Claims.
(c) Perform an analysis of the Claims Data Set to detect potential overpayments in
some or all of the following areas: duplicate payments, payments outside valid
eligibility, benefits application, procedure bundling/unbundling, accuracy of
pricing and provider contract application, timely filing, coordination of benefits,
multiple surgery discounts, and assistant surgeon discounts. The scope of the
claims audit will include review of claims administration procedures including
claims filing procedures and internal financial control mechanisms. Client agrees
that the scope of the Claims Audit,the analysis performed during the Claims Audit
and the decision to analyze any particular area for potential overpayments during
the Claims Audit, shall be determined solely by, and at the discretion of, JGI. JGI
does not warrant or represent that it will discover any or all errors or
overpayments,or any particular number or percentage of errors or overpayments
made by the TPA.
(d) Review a sample of claims on a site visit at the TPA with the total number of site
visit claims to be negotiated with the TPA consistent with any limitations in the
audit rights between Client and TPA.
(e) Deliver reports to TPA and Client identifying specific Healthcare Claims that Client
may be entitled to recover, and review such reports with Client and/or TPA at
Client's discretion.
(f) Monitor TPA's efforts, to the extent possible, in recovering overpayments of
Healthcare Claims. Actual collection of, and any related efforts to collect
Healthcare Claims overpayments, is solely the responsibility of the TPA and Client.
(g) Provide Client, as appropriate, with updates showing progress throughout the
project, as well as a final report identifying Identified Amounts and Recovered
Amounts as reported by the Client or the TPA to JGI.
(h) Maintain accounts and records,which properly reflect all direct and indirect costs
expended and work provided in the performance of this Agreement and retain
such records for as long as may be required by applicable Washington State
records retention laws, but in any event no less than six years after the
termination of this Agreement.JGI agrees to provide access to and copies of any
records related to this Agreement as required by Client to audit expenditures and
charges and/or to comply with the Washington State Public Records Act (Chapter
42.56 RCW).
(i) To the full extent Client determines necessary to comply with the Washington
State Public Records Act, chapter 42.56 RCW (the "Public Records Act"), make a
due diligent search of all records in JGI's possession or control relating to this
Agreement and the work, including, but not limited to, e-mail, correspondence,
2
. 2
notes, saved telephone messages, recordings, photos, or drawings and provide
them to Client. In the event JGI believes said records need to be protected from
disclosure, it may, at JGI's own expense, seek judicial protection as described in
paragraph 9. JGI shall indemnify, defend, and hold harmless Client for all costs,
including attorneys' fees, attendant to any claim or litigation related to a Public
Records Act request for which JGI has responsive records and for which JGI has
withheld records or information contained therein,or not provided them to Client
in a timely manner. JGI shall produce for distribution any and all records
responsive to the Public Records Act request in a timely manner, unless those
records are protected by court order.
(j) Not give a gift of any kind to Client's employees or officials.JGI also confirms that
it does not have a business interest or a close family relationship with any officer
or employee of Client who was, is, or will be involved in selecting JGI, negotiating
or administering this Agreement, or evaluating JGI's performance of the work.
(k) Obtain a City of Renton Business License prior to performing any work and
maintain the business license in good standing throughout the term of this
Agreement.
Information regarding acquiring a city business license can be found at:
http://rentonwa.gov/business/default.aspx?id=548&mid=328.
Information regarding State business licensing requirements can be found at:
http://dor.wa.gov/content/doingbusiness/registermybusiness/
(I) Secure and maintain insurance, as follows:
1. Commercial general liability insurance in the minimum amounts of$1,000,000
for each occurrence/$2,000,000 aggregate for the Term of this Agreement.
2. In the event that work delivered pursuant to this Agreement either directly or
indirectly involve or require Professional Services, Professional Liability, Errors
and Omissions coverage shall be provided with minimum limits of$1,000,000
per occurrence. "Professional Services", for the purpose of this section, shall
mean any work provided by a licensed professional or work that requires a
professional standard of care.
3. Workers'compensation coverage,as required by the Industrial Insurance laws
of the State of Washington, shall also be secured.
4. Commercial Automobile Liability for owned, leased, hired or non-owned,
leased, hired or non-owned, with minimum limits of $1,000,000 per
occurrence combined single limit, if there will be any use of JGI's vehicles on
Client's premises by or on behalf of Client, beyond normal commutes.
3
5. JGI shall name the City of Renton as an Additional Insured on its commercial
general liability policy on a non-contributory primary basis. Client's insurance
policies shall not be a source for payment of any JGI liability, nor shall the
maintenance of any insurance required by this Agreement be construed to
limit the liability of JGI to the coverage provided by such insurance or
otherwise limit Client's recourse to any remedy available at law or in equity. '
6. Subject to Client's review and acceptance, a certificate of insurance showing
the proper endorsements, shall be delivered to Client before performing the
work.
7. JGI shall provide Client with written notice of any policy cancellation, within
two (2) business days of its receipt of such notice.
(m) Comply with laws prohibiting discrimination as follows, except to the extent
permitted by a bona fide occupational qualification:
1. JGI, and its agents, employees, representatives, and volunteers with regard to
the work performed or to be performed under this Agreement, shall not
discriminate on the basis of race,color,sex,religion,nationality,creed,marital
status, sexual orientation or preference, age (except minimum age and
retirement provisions),honorably discharged veteran or military status,or the
presence of any sensory, mental or physical handicap, unless based upon a
bona fide occupational qualification in relationship to hiring and employment,
in employment or application for employment, the administration of the
delivery of work or any other benefits under this Agreement, or procurement
of materials or supplies.
2. JGI will take affirmative action to insure that applicants are employed and that
employees are treated during employment without regard to their race,
creed, color, national origin, sex, age, sexual orientation, physical, sensory or
mental handicaps, or marital status. Such action shall include, but not be
limited to the following employment, upgrading, demotion or transfer,
recruitment or recruitment advertising, layoff or termination, rates of pay or
other forms of compensation and selection for training.
3. If JGI fails to comply with any of this Agreement's non-discrimination
provisions, Client shall have the right, at its option, to cancel the Agreement
in whole or in part.
4. JGI is responsible to be aware of and in compliance with all federal, state and
local laws and regulations that may affect the satisfactory completion of the
project, which includes but is not limited to fair labor laws, worker's
4
(
compensation, and Title VI of the Federal Civil Rights Act of 1964, and will
comply with City of Renton Council Resolution Number 4085.
3. Duties of Client
Client shall:
(a) Notify TPA of the Claims Audit and authorize release of all information and data
to JGI necessary to complete the Claims Audit, including but not limited to, the
Claims Data Set.
(b) Prior to the delivery of the Claims Data Set to JGI, provide written notice to JGI of
any Healthcare Claim overpayments already identified by Client or TPA.
(c) Provide JGI with the following documentation to support the Claims Audit:
Summary Plan Descriptions for all options and time periods covered by the Claims
Audit, banking files showing amount paid by claim or summary check run data of
funding by Client for the time periods audited if banking file is not available, any
electronic eligibility or other eligibility records maintained by Client, and copies of
contracts between the Client and TPA.
(d) Verify Recovered Amounts and provide JGI access to monthly reports, bill
summaries, and other documentation provided by TPA which may reasonably be
expected to contain information regarding Recovered Amounts.
(e) Provide all documentation from TPA showing collection of Identified Amounts
within 5 days of Client's receipt of this information from TPA.
(f) Direct TPA to recover any Identified Amounts unless Client has a reason not to
pursue the collections. Client on its own initiative shall make a reasonable, good
faith attempt to require TPA to recover Identified Amounts.
4. Relevant Time Frame for Claims Audit
This Agreement shall apply to all Healthcare Claims paid under Client's medical plans
during the following time periods:
January 1, 2016 to January 31, 2018
This time period can be modified upon written agreement(including email) between the
Parties to include additional time periods due to delays in beginning the Claims Audit or
to account for other restrictions imposed by the TPA.
5. Term
This Agreement shall be effective beginning on February X,,2018,(the"Effective Date"),
and shall continue thereafter for a period of 18 months.
6. Termination
Either Party may terminate this Agreement, for any reason, upon thirty (30) days
advanced written notice to the other Party.The Agreement shall terminate at the end of
5
such thirty(30) day period. Termination or expiration of this Agreement shall not relieve
Client or JGI of their respective obligations pursuant to paragraphs 2(h), 2(i), 3(d), 3(e),
3(f), 7, 8, 9, 12, 14, 15, 18 and 19, all of which shall survive termination or expiration of
the Agreement and be continuing obligations.
7. Compensation
(a) Client shall pay JGI $10,800 for the Claims Audit Fees will be paid as follows -
$5,400 will be due upon signature of this Service Agreement and $5,400 upon
release of the Final Claims Audit Report.
(b) Unless Client provides written notice to JGI specifically identifying any Healthcare
Claims overpayments before JGI receives the Claims Data Set from the TPA, any
Healthcare Claims overpayments identified by JGI at the time of or after receipt of
the Claims Data Set which are identified by JGI shall be Identified Amounts
attributable solely to the efforts of JGI for which JGI is entitled to receive the entire
fee provided for in paragraph 7(a) regardless of whether the TPA or Client became
aware of, or knew of, the Healthcare Claims overpayments before or after the
delivery of the Claims Data Set to JGI.
(c) In the event this Agreement is terminated by Client in accordance with paragraph
6 of this Agreement after JGI has received the Claims Data Set but prior to JGI's
identification of any Healthcare Claims overpayments,JGI shall be reimbursed for
any expenditures incurred by it during the engagement and be paid compensation
at the rate of $150 per hour for each hour that a partner or associate spent
working on the engagement prior to termination.
(d) Except as set forth in paragraph 7(a) of this Agreement, JGI shall be responsible
for any costs and expenses incurred by it while providing services during the
engagement.
(e) Client shall remit to JGI the appropriate fee determined in accordance with
paragraph 7(a) within thirty(30) business days of Client's receipt of invoice.
(f) Payment for any part of the work shall not constitute a waiver by Client of any
remedies it may have against JGI for failure of JGI to perform the work or for any
breach of this Agreement by JGI.
8. Impact on Members
JGI will provide Client an opportunity to review reports that could impact its members
and make decisions regarding whether the recovery should proceed related to the
member portion of these claims. JGI will follow all Client decisions regarding recovery
that will impact members. Client will take all reasonable efforts to pursue recovery in
accordance with Client's obligations under paragraph 3 of this Agreement.
9. Confidentiality,Subject to the Public Records Act
(a) The Claims Audit process requires access to member records and other highly
personal information. JGI understands that Client's claims data is highly
6
confidential, and JGI agrees to use and disclose such information only in
compliance with the Business Associate Agreement attached hereto and
incorporated by reference as Attachment A.
(b) JGI acknowledges that Client is subject to the Public Records Act which compels
the disclosure of non-exempt public records when requested. JGI represents that
its Healthcare Claims Audits are conducted by applying proprietary, confidential
audit processes and logic, the employment of trade secrets and proprietary
technology and software, all of which are confidential proprietary business
information, trade secrets and the intellectual property of JGI which shall not be
used, disclosed or otherwise disseminated to third parties. The Public Records
Act exempts certain proprietary information and records from disclosure. Thus,
the Parties agree that if Client receives a request under the Public Records Act for
i
JGI's information or records, and if Client believes that such information or
records, or both, is subject to disclosure under the Public Records Act, Client will
provide JGI with 14 days'advanced notice prior to disclosure so that JGI may elect
to seek a court order protecting against the disclosure of its information or
records, or both. Absent a timely court order restraining disclosure, Client shall
incur no liability for any disclosure made in response to a request to public
records. Client further agrees that any disclosure in violation of a valid court
order restraining disclosure will result in immediate irreparable injury to JGI that
cannot be compensated adequately by money alone. The rights and remedies
provided in this paragraph 9(b) are not exclusive but are in addition to any other
rights and remedies otherwise available under this Agreement or applicable law.
10. Release for Use as Reference
Client hereby authorizes JGI to use its name in verbal and written communications as a
current or previous Client. No additional information about the findings, benefits design,
or that beyond a simple reference to Client is permitted without the consent of an
authorized representative from Client.
11. Relationship of Parties and No Third Party Beneficiaries
In performing services under this Agreement,JGI is acting as an independent contractor.
Nothing contained herein shall be construed as creating a partnership, joint venture,
agency or employment relationship between JGI and Client or any of its subsidiaries or
related entities. The parties agree that there are no intended third party beneficiaries to
this Agreement and nothing in this Agreement shall be construed to create any third party
beneficiary rights in any person or entity. Client shall not exercise control or direction
over the manner or method by which JGI performs the services which are the subject
matter of this Agreement. Client agrees and understands that JGI is merely identifying
overpayment of Healthcare Claims and Client and its TPA are solely responsible for the
actual collections of, or efforts to collect, any Identified Amounts. Client agrees and
understands that JGI is not a guarantor of, nor guaranteeing, the receipt by Client of any
Healthcare Claims overpayments.
7
12. Indemnity
(a) Client shall indemnify and hold JGI and its successors, assigns, shareholders,
directors, officers, employees, agents, affiliates, subsidiaries, parents and
representatives harmless from and against any and all liabilities,demands, causes
of action, lawsuits, governmental actions, losses, damages,fines, penalties, costs
and expenses, as well as all of JGI's costs to defend any claims, including but not
limited to actual attorney's fees(as defined in paragraph 18(b)of this Agreement)
relating to Client's conduct or any act or omission of Client and/or its directors,
officers, employees, agents or subcontractors.
(b) JGI shall indemnify and hold Client and its successors, assigns, shareholders,
directors, officers, employees, agents, affiliates, subsidiaries, parents and
representatives harmless from and against any and all liabilities, demands, causes
of action, lawsuits, governmental actions, losses, damages, fines, penalties, costs
and expenses, as well as Client's costs to defend any claims, including but not
limited to actual attorney's fees(as defined in paragraph 18(b)of this Agreement)
relating to JGI's conduct or any act or omission ofJGI and/or its directors, officers,
employees, agents or subcontractors. THIS INDEMNIFICATION SHALL NOT BE
LIMITED IN ANY WAY BY THE LIMITATION OF LIABILITY AND DAMAGES AND
WAIVER OF JURY PROVISIONS SET FORTH IN PARAGRAPH 15.
(c) It is further specifically and expressly understood that JGI's indemnification
provided in this Agreement constitute its waiver of immunity under the Industrial
Insurance Act, RCW Title 51, solely for the purposes of this indemnification. The
Parties have mutually negotiated and agreed to this waiver.
13. Assignment
JGI may use subcontractors to conduct any portion of services offered to Client in its own
discretion, without the acknowledgement or permission of Client. JGI will hold all
subcontractors to the terms and conditions of this contract, including the obligations as a
Business Associate of Client as described in Attachment A. Client may not assign its rights
or delegate its responsibilities under this Agreement without the prior written consent of
JGI.
14. Notices
Any payment,demand, invoice, notice or declaration of any kind which must be delivered
to the other Party shall be in writing and served either personally, by facsimile with proof
of receipt, by overnight carrier with written confirmation of delivery, or by United States
first-class mail, postage prepaid, to the attention of the individual designated below by
each party at the following addresses or facsimile numbers:
To Client at: City of Renton
1055 South Grady Way
Renton,Washington 98057
Attention: Wendy Rittereiser
8
To JGI at: J. Graham, Inc.
8011 Brooks Chapel Road #4035
Brentwood,Tennessee 37027
Attention: John M. Graham
15. Limitation of Liability and Damages and Waiver of Jury
(a) Limitation of Damages. IN NO EVENT SHALL JGI HAVE ANY LIABILITY TO CLIENT
FOR ANY LOST PROFITS OR FOR ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE,
EXEMPLARY, OR CONSEQUENTIAL DAMAGES HOWEVER CAUSED AND, WHETHER
IN CONTRACT,TORT OR UNDER ANY OTHER THEORY OF LIABILITY.
(b) Limitation of Liability and Waiver of Jury. IN NO EVENT SHALL JGI's TOTAL
AGGREGATE LIABILITY TO CLIENT ARISING OUT OF OR RELATED TO THIS
AGREEMENT, WHETHER INCURRED WITH RESPECT TO ONE CLAIM, OR MULTIPLE
RELATED OR UNRELATED CLAIMS,AND WHETHER IN CONTRACT,TORT OR UNDER
ANY OTHER THEORY OF LIABILITY, EXCEED AN AMOUNT EQUAL TO THE LESSER OF
(i) THE DIRECT DAMAGES TO CLIENT OR (ii) THE TOTAL FEES PAID BY CLIENT TO
JGI IN THE TWELVE(12) MONTH PERIOD PRIOR TO THE EVENT GIVING RISE TO THE
CLAIMS. THE PARTIES AGREE TO WAIVE ANY RIGHT TO, OR TRIAL BY,A JURY AND
AGREE THAT ANY LEGAL PROCEEDING SHALL BE CONDUCTED ONLY AS A BENCH
TRIAL IN FRONT OF A JUDGE.
(c) Essential Term of the Agreement. Client acknowledges and agrees that the
disclaimers, exclusions and limitations of liability and damages set forth in Section
15 of this Agreement form an essential term of the Agreement between the
Parties, and, absent the foregoing disclaimers, exclusions or limitations of liability
and damages,JGI would not enter into this Agreement.
16. Severability
If one or more of the provisions contained in this Agreement, or any portion of any
provision contained in this Agreement, shall for any reason be held unenforceable in any
respect, the unenforceable provision or portion thereof, shall not affect the remaining
portion of such provision or any other provision of this Agreement, all of which shall
remain in full force and effect.
17. Waiver
A waiver or indulgence of any breach of any provision of this Agreement shall not be
deemed or construed as a waiver of any other provision, affect the validity of the
remainder of this Agreement or constitute a waiver of any preceding or subsequent
breach of the same or any other provision of this Agreement.
9
18. Disputes
(a) If a dispute arises pursuant to or in connection with this Agreement, the
complaining party shall reduce the dispute to writing and submit it to the Client's
CEO or President, or John M. Graham of JGI, as the case may be, followed by a
meeting between these individuals within thirty(30)days of receipt of the written
dispute. If the matter is not resolved to the mutual satisfaction of the parties after
the required meeting, either party may then institute legal action.
Notwithstanding the foregoing,this paragraph shall not apply to any breach of the
confidentiality provisions set forth in paragraph 9 of this Agreement.
(b) If Client or JGI institutes legal action to enforce the terms of this Agreement,then
the prevailing Party in any such litigation shall be entitled to recover its reasonable
attorneys' fees and expenses incurred in the litigation. For purposes of this
paragraph, and paragraph 12 of this Agreement, an attorney's fee shall be limited
to such attorney's actual hours expended on the matter multiplied by the
attorney's customary hourly rates for such work without regard to, and with no
increase or multiplier due to, for example, the attorney having accepted the
matter on a contingency fee basis.
19. Governing Law,Venue and Jurisdiction
This Agreement is made and entered into in the state of Washington and will be governed
by the laws of the state of Washington, without regard to choice or conflicts of law
principles. Any legal proceedings brought to enforce this Agreement, or any claims
relating to, associated with or arising out of this Agreement, shall be brought in the King
County Superior Court for the State of Washington at the Maleng Regional Justice Center
in Kent, King County, Washington, or its replacement or successor.
20. Authority to Contract
Each party to this Agreement hereby represents and warrants that it has the full right,
power and authority to enter into this Agreement. Each person signing this Agreement
on behalf of an entity represents and warrants that he or she has the full right, power,
authority and capacity to sign this Agreement on behalf of the entity for which he or she
has signed this Agreement.
21. No Strict Construction Against a Party
Each party acknowledges that they have had the opportunity through legal counsel or
otherwise to participate and have participated in the negotiation of the terms of this
Agreement and the language incorporating those terms into the Agreement. In the event
that an ambiguity,or question of intent, construction or interpretation of this Agreement
arises, this Agreement shall be construed as if drafted jointly by the parties and no
presumption or burden of proof shall arise favoring or disfavoring any party by virtue of
its role or participation, or lack thereof, in negotiating the terms of this Agreement or its
authorship, role or participation, or lack thereof, in drafting any provision of this
Agreement.
10
22. Execution of Agreement
This Agreement may be executed in counterparts and each such fully executed
counterpart shall constitute an original,all of which together shall constitute one and the
same agreement. A facsimile or PDF signature shall be deemed an original signature.
23. Headings
This section and the paragraph headings contained in this Agreement are for reference
purposes only and shall not affect in any way the meaning or interpretation of this
Agreement.
24. Entire Agreement
This Agreement contains the entire agreement and understanding between the parties
pertaining to the subject matter herein and supersedes any and all prior and/or
contemporaneous oral or written agreements and understandings if any, of the parties
pertaining to the subject matter herein. No change, alteration, modification or
amendment of this Agreement, whether oral, through course of dealings, or otherwise
shall be effective or binding unless set forth in a written agreement signed by all the
parties.
25. No Inducement
Client acknowledges and agrees that its execution of this Agreement was not induced by,
and is not contingent upon, any particular result or outcome of the Claims Audit, any
specific identification or recovery of any overpayments or any representations regarding
any dollar amount, percentage or probability of the identification or recovery of
overpayments unless set forth specifically in this Agreement. Client further agrees that
the only representations made by JGI, its employees, officers, directors or agents that is
relying on in entering into this Agreement are those specific representations set forth in
this Agreement.
11
IN WITNESS WHEREOF,the Parties have voluntarily entered into this Agreement as of the
date last signed by the Parties below.
CITY OF RENTON J.Graham,Inc.
By: By:
Ellen Bradley-Mak,Administrator John M. raham
Human Resources & Risk President
Management
a - �- te7 -115tic/
Date Date
Approved as to Legal Form
.oka % •ane !a
Shane Moloney
Renton City Attorney
Contract Template Updated 12/29/2017
(Non-Standard;LCC 2/9/2018)
12
}
ATTACHMENT A:BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement("Agreement") between J.Graham Inc.("Business Associate")
and City of Renton ("Covered Entity") is effective as of the effective date of the Claims Audit
Service Agreement between the parties ("Service Agreement"). For purposes of complying with
the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health
Information Technology for Economic and Clinical Health Act of the American Recovery and
Reinvestment Act of 2009 ("HITECH") and regulations issued under HIPAA and HITECH, Business
Associate and the Covered Entity agree as follows. To the extent Business Associate is acting as
a business associate of Covered Entity pursuant to the Service Agreement, the provisions of this
Agreement shall apply, and Business Associate shall be subject to the penalty provisions of the
HIPAA Rules as specified in 45 CFR Part 160.
1. Definitions. Terms used, but not otherwise defined, in this Agreement shall have the
same meaning as those terms in the HIPAA Rules.
(a) "HIPAA Rules" shall mean privacy, security and breach reporting regulations set
forth at 45 CFR Part 160 and Part 164,Subparts A, C, D and E.
(b) "PHI" means Protected Health Information, as defined in the HIPAA Rules, limited
to the information created or received by Business Associate from or on behalf of the
Covered Entity.
2. Uses and Disclosures. Business Associate agrees not to use or disclose PHI other than as
authorized by this Agreement or as Required By Law.
(a) Business Associate may use and disclose PHI to provide the services set forth in
the Service Agreement,to the extent that such uses and disclosures would not violate the
HIPAA Rules. Business Associate may also use PHI to create information that is de-
identified in compliance with the HIPAA Rules as necessary to provide such services and
to comply with the minimum necessary standard. To the extent Business Associate is to
carry out an obligation of Covered Entity under the HIPAA Rules, Business Associate shall
comply with the requirements of the HIPAA Rules that apply to Covered Entity in the
performance of such obligation.
(b) Business Associate may use PHI for the proper management and administration
of Business Associate or to carry out its legal responsibilities. Business Associate may
disclose PHI for the proper management and administration of Business Associate or to
carry out its legal responsibilities if the disclosure is Required By Law or if Business
Associate obtains reasonable assurance from any person or organization to which
Business Associate will disclose such PHI that the person or organization will: (1) hold
such PHI in confidence and use or further disclose it only for the purpose for which
Business Associate disclosed it to the person or organization or as Required By Law; and
13
(2) notify Business Associate of any instance of which the person or organization becomes
aware in which the confidentiality of such PHI was breached.
(c) Without limiting any uses or disclosures expressly permitted in this Agreement,
Business Associate will not sell PHI or use or disclose PHI for purposes of marketing or
fundraising, as defined and proscribed in the HIPAA Rules and HITECH.
(d) To the extent covered by the requirements of 45 CFR § 164.502(b), Business
Associate shall limit its uses and disclosures of, and requests for, PHI (1) when practical,
to the information making up a Limited Data Set, and (2) in all other cases, to the
minimum amount of PHI necessary to accomplish the intended purpose of the use,
disclosure or request.
3. Safeguards. Business Associate will use appropriate administrative,technical and physical
safeguards to prevent the use or disclosure of PHI other than as permitted by this
Agreement. Business Associate will also comply with the applicable provisions of 45 CFR
Part 164, Subpart C of the HIPAA Rules with respect to electronic PHI to prevent any use
or disclosure of such information other than as provided by this Agreement.
4. Reporting. To the extent known to or discovered by Business Associate, Business
Associate will report to Covered Entity, promptly and within the time periods required by
applicable law, (a) any use or disclosure of PHI not permitted by this Agreement; (b) any
Breach of Unsecured Protected Health Information; and (c) any Security Incidents
involving electronic PHI. The parties acknowledge and agree that this section constitutes
notice by Business Associate to the Covered Entity of the ongoing existence and
occurrence of attempted but Unsuccessful Security Incidents(as defined below)for which
no additional notice to the Covered Entity shall be required. "Unsuccessful Security
Incidents" shall include, but not be limited to, pings and other broadcast attacks on
Business Associate's firewall, port scans, unsuccessful log-on attempts, denials of service
and any combination of the above, so long as no such incident results in unauthorized
access, use or disclosure of electronic PHI. All reports of Breaches shall be made in
compliance with 45 CFR§ 164.410.
5. Subcontractors. In accordance with 45 CFR §§ 164.308(b)(2) and 164.502(e)(1)(ii),
Business Associate shall require that its Subcontractors to whom it provides PHI, agree to
the same restrictions and conditions that apply to Business Associate with respect to such
information.
6. Mitigation. Business Associate agrees to attempt to mitigate, to the extent practicable,
any harmful effect that is known to Business Associate of a use or disclosure of PHI by
Business Associate in violation of the requirements of this Agreement.
7. Access. Business Associate agrees to comply with the Covered Entity's written request to
accommodate an Individual's access to his/her PHI in a Designated Record Set maintained
14
{
by Business Associate as set forth in the HIPAA Rules. In the event an Individual contacts
Business Associate for access to his/her PHI, Business Associate agrees to forward
promptly the written request to Covered Entity. If the requested PHI is maintained
electronically, Business Associate must provide a copy of the PHI in the electronic form
and format requested by the individual, if it is readily producible, or, if not, in a readable
electronic form and format as agreed to by Covered Entity and the individual.
8. Amendments. Business Associate shall make any amendment(s) to PHI in a Designated
Record Set that the Covered Entity directs. Such amendments shall be made in the time
and manner required by 45 CFR§164.526.
9. Accounting. Except for disclosures excluded from the accounting obligation by the HIPAA
Rules and regulations issued pursuant to HITECH, Business Associate shall document such
disclosures of PHI by Business Associate and information related to such disclosures as
would be required for the Covered Entity to respond to a request by an Individual for an
accounting of disclosures of PHI in accordance with 45 CFR §164.528 and HITECH.
Business Associate shall provide to the Covered Entity information collected in
accordance with this paragraph to permit the Covered Entity to respond to a request by
an Individual for an accounting of disclosures of PHI in accordance with 45 CFR§164.528.
In the event the Secretary finalizes regulations requiring Covered Entities to provide
access reports, Business Associate shall also record such information with respect to
electronic PHI held by Business Associate as would be required under the regulations for
Covered Entities beginning on the effective date of such regulations.
10. Books and Records. Business Associate shall make its internal practices, books and
records relating to uses and disclosures of PHI available to the Secretary for purposes of
determining the Covered Entity's compliance with the HIPAA Rules.
11. Return/Destruction. Upon the termination of this Agreement, Business Associate shall
return or destroy all PHI and will retain no copies of such information, unless return or
destruction is infeasible. If such return or destruction of PHI is infeasible, Business
Associate may continue to maintain such PHI but shall continue to abide by the terms and
conditions of this Agreement with respect to such information and shall limit its further
use or disclosure of such information to those purposes that make return or destruction
of the information infeasible.
12. Covered Entity's Obligations. The Covered Entity shall (a) only transmit PHI to Business
Associate for which it has all consents and authorizations necessary to permit such
disclosure and to permit Business Associate to perform the services described in the
Service Agreement; (b) ensure that any Covered Entity policies or notices of privacy
practices do not conflict with or limit the ability of Business Associate to perform the
services described in the Service Agreement; (c) in the event that Covered Entity agrees
to provide additional privacy protections to PHI relating to an Individual, notify Business
Associate of such limitations promptly; and (d) in the event that an Individual revokes an
15
authorization or consent given to the Covered Entity that pertains to the use or disclosure
of PHI previously transmitted to Business Associate, promptly notify Business Associate
of such revocation.
13. Interpretation/Amendment. To the extent that any provision of this Agreement is in
conflict with any law,regulation,rule or administrative policy of any governmental entity,
the parties will take such actions as are reasonably necessary to amend this Agreement
to bring it into conformity with these provisions.In the event of any conflict between this
Agreement and the Service Agreement, the terms of this Agreement shall control. This
Agreement shall be interpreted in such a manner as to permit the Covered Entity and
Business Associate to comply with the HIPAA Rules. Nothing in this Agreement shall be
construed to create any rights or remedies in any third parties.
14. Termination.In the event either party breaches the Agreement,the non-breaching party
may terminate this Agreement and the Service Agreement immediately if cure is not
possible or if the breaching party fails to cure the breach within thirty(30) days of being 4'
notified in writing of the breach by the other party. In addition, this Agreement shall
automatically terminate upon termination of all of the Service Agreements between the
parties. The obligations set forth in Section 11 shall survive any termination or expiration
of this Agreement.
WITNESS WHEREOF,each of the undersigned has caused this Agreement to be duly executed
on the dates set forth below.
COVERED ENTITY J.GRAHAM INC.
By: By:
t1llY1 1*
Name: Ellen Srua►ty—MQ \ Name: . 1rGiYutrn
PrGS1 d.�XI
Title: /��� awl S b�to Title:
Date: Fej Z(P a0 t 4 Date: 1111C1(6/
fi
16