Search

(ATTACHMENT B)

BUSINESS ASSOCIATE AGREEMENT

This BUSINESS ASSOCIATE AGREEMENT (this “Agreement”) is entered into by and between Part D

Advisors, Inc., a Michigan corporation (“PDA”) and the City of Nashua Health Plan (the “Health Plan”)
(together, the “Parties”), effective as provided below.
RECITALS

WHEREAS, the Health Plan is a “covered entity” within the meaning of the Health Insurance Portability
and Accountability Act of 1996 (“HIPAA”) and its implementing regulations concerning privacy of
individually identifiable health information as set forth in 45 CFR Parts 160-164, as amended from time
to time (the “Privacy Rule”); and

WHEREAS, PDA has heretofore entered into an agreement with the City of Nashua (“Plan Sponsor”)
to provide certain administrative services in connection with the Health Plan (the “Service Agreement”); and

WHEREAS, the Privacy Rule requires covered entities such as the Health Plan to obtain and document
satisfactory assurances from “business associates” (as defined therein) regarding appropriate safeguarding
of certain “protected health information” (as defined therein) received or created by the business associate

(a “BA Agreement’); and

WHEREAS, PDA, in the performance of its services in connection with the Health Plan, may be deemed
a “business associate” within the meaning of the Privacy Rule; and

WHEREAS, the Parties desire to enter into an agreement intended to satisfy the BA Agreement
requirement and related requirements under the Part D Program (as defined in the Service Agreement) as
and to the extent such requirement may be applicable.

NOW, THEREFORE, in consideration of the premises and the respective covenants and agreements
herein contained, the Parties agree as follows:

AGREEMENT
i. Definitions
Capitalized terms not expressly defined in this Agreement shall have the meanings as
defined in the Privacy Rule and the Security Standards (as defined below). For purposes of

this Agreement:

(a) “Designated Record Set” shall have the same meaning as the term “designated record
set” in 45 CFR 164.501 in respect of the Health Plan.

(b) “Effective Date” shall have the meaning as set forth in Section 7(a) of this Agreement.

(c) “ERISA” shall mean Employee Retirement Income Security Act of 1974, as amended,
and the regulations hereunder.

City of Nashua 1 BAA Revised October 2013

(d)

(e)

(f)

(g)

(h)

(i)

@)

(k)

(I)

(m)

“Individual” shall have the same meaning as the term “individual” in 45 CFR 160.103
and shall include a person who qualifies as a personal representative in accordance with
45 CFR 164.502(g).

“Health Plan Administrator” or “Plan Administrator” shall have the same meaning as
set forth in the Health Plan’s Plan Document or in the absence of such designation shall be
the Plan Sponsor.

“Privacy Rule” shall have the meaning as set forth in the RECITALS portion of this
Agreement.

“Protected Health Information” shall have the same meaning as the term “protected
health information” in 45 CFR 160.103, but limited to the information created, received,
transmitted or maintained by PDA from or on behalf of the Health Plan. “Protected Health
Information” includes electronic protected health information (as defined in 45 CFR
160.103) (“ePHY”) that PDA creates, receives, maintains or transmits on behalf of the
Health Plan.

“Required by Law” shall have the same meaning as the term “required by law” in 45
CFR 164.103 (and as further described in 70 Federal Register 4405 with regard to
compliance with the Center for Medicare and Medicaid Services’ requirement of
disclosure of Protected Health Information pursuant to 42 CFR 423.884(b)).

“Secretary” shall mean the Secretary of the Department of Health and Human Services
or his designee.

“Security Incident” shall have the same meaning as set forth in 45 CFR 164.304, and
which includes the attempted or successful unauthorized access, use, disclosure,
modification, or destruction of information or interference with system operations in an
Information System (as defined at 45 CFR 164.304).

“Security Standards” shall mean the Security Standards for the Protection of Electronic
Protected Health Information at 45 CFR Parts 160, 162, and 164, as amended from time to

time.

“Service Agreement” shall have the meaning as set forth in the RECITALS portion of
this Agreement.

“Significant Breach” shall mean a pattern of activity or practice that constitutes a
material breach or violation of this Agreement in the written opinion of legal counsel for
the Health Plan. For purposes hereof, a “pattern of activity or practice” shall consist of at
least three (3) discrete acts and/or omissions within a period of not more than 180
consecutive days.

2 Obligations of PDA

PDA agrees to:

(a)

City of Nashua

Not use or disclose Protected Health Information other than as permitted or required by
this Agreement, the Privacy Rule, the Security Standards, or as Required By Law;

2 BAA Revised October 2013

(b)

(c)

(d)

City of Nashua

Use appropriate safeguards to prevent use or disclosure of the Protected Health
Information other than as provided for by this Agreement and mitigate to the extent
practicable, any harmful effect known to PDA of use or disclosure of Protected Health
Information in violation of this Agreement;

Report to the Health Plan Administrator, for the benefit of the Health Plan, any use or
disclosure of the Protected Health Information not provided for by this Agreement of
which it becomes aware, including any potential “breach” of Protected Health Information
that may require notification to Individuals, the media, and/or the Secretary pursuant to 45
CFR 164.400 et. seqg., and any Security Incident of which it becomes aware.

PDA agrees to assist Health Plan, or Health Plan Administrator on behalf of the Health
Plan, as it determines, in its sole discretion, whether any impermissible use or disclosure of
Protected Health Information constitutes a breach of Protected Health Information for
purposes of Subtitle D of the Health Information Technology for Economic and Clinical
Health Act of 2009 (42 U.S.C. 17921-53) and its implementing regulations (““HITECH”)
and the Privacy Rule, and whether such breach requires notification by the Health Plan to
Individuals, the media, and/or the Secretary.

In furtherance of the foregoing, in the event PDA discovers a breach of Protected Health
Information, PDA agrees:

(i) To provide the Health Plan with relevant information, including without
limitation, a brief description of the incident, the date of the incident, the
Individuals potentially affected, the date of discovery, the type of Protected
Health Information involved, any recommendations that should be made to
Individuals for their protection, a description of how PDA is and proposes to
mitigate any harm to Individuals, a description of how PDA is and will prevent
future incidents, and any other information reasonably requested by the Health
Plan so that it may comply with its obligations under HITECH and its
implementing regulations, and the Privacy Rule.

(ii) To assist the Health Plan to further investigate any breach incident, to assist in
making notifications to Individuals as necessary, to mitigate any harm resulting
or that may reasonably result from a breach incident, and to assist in taking any
other actions that the Health Plan deems reasonably necessary to comply with
HITECH and its implementing regulations, and the Privacy Rule.

Ensure that any agent, including a subcontractor, to whom it provides Protected Health
Information received from the Health Plan, or that creates, receives, maintains, or
transmits Protected Health Information on behalf of PDA, enters into an agreement that
contains the same or more stringent restrictions and conditions that apply through this
Agreement to PDA with respect to such information, including without limitation,
ensuring that any such agent or subcontractor agrees to implement administrative, physical
and technical safeguards as required by the Security Standards that reasonably and
appropriately protect the security, confidentiality, integrity, and availability of any ePHI
that PDA creates, receives, maintains, or transmits on behalf of the Health Plan; provided
that the Health Plan shall not have any right to disapprove any subcontractors of PDA or to
review any agreements with such subcontractors, except to the extent specifically provided
herein;

3 BAA Revised October 2013

(e)

(f)

(g)

(h)

(i)

(a)

(b)

City of Nashua

Provide, in a commercially reasonable time and manner, access to Protected Health
Information to the Health Plan Administrator, for the benefit of the Health Plan, to the
extent necessary to meet the requirements under 45 CFR 164.524, provided that such
access shall be provided only to the extent such Protected Health Information is in the
possession of PDA and is a part of the Designated Record Set.

Make, in a commercially reasonable time and manner, any amendment(s) to Protected
Health Information that the Health Plan Administrator, for the benefit of the Health Plan,
directs or agrees to pursuant to 45 CFR 164.526, provided that such amendment(s) shall
be made only to the extent such Protected Health Information is in the possession of PDA
and is a part of the Designated Record Set;

Make available to the Health Plan, in a commercially reasonable time and manner,
information in the possession of PDA as and to the extent required for the Health Plan to
respond to a request by an Individual for an accounting of disclosures of Protected Health
Information in accordance with 45 CFR 164.528;

To the extent PDA has agreed to carry out any of the Health Plan’s obligations under the
Privacy Rule, PDA shall comply with the requirements of the Privacy Rule that apply to
the Health Plan in the performance of its obligations; and

Make internal practices, books, and records relating to the use and disclosure of Protected
Health Information received from the Health Plan, or created or received by PDA on
behalf of the Health Plan, available to the Secretary for purposes of the Secretary
determining the Health Plan's and PDA’s compliance with the Privacy Rule and Security
Standards.

Permitted Uses and Disclosures by PDA

General Use_and Disclosure Provisions. Except as otherwise limited in this Agreement,
PDA may use or disclose Protected Health Information to perform its duties, functions,
activities, or services for, or on behalf of, the Health Plan or its Plan Sponsor, provided
that such use or disclosure would not violate the Privacy Rule if done by the Health Plan.

To the extent practicable, PDA shall use a Limited Data Set (as defined in the Privacy
Rule) with respect to Protected Health Information of the Health Plan. If not practicable,
PDA shall use the least amount of Protected Health Information necessary to achieve the
intended purpose, and shall document why such amount of Protected Health Information
is necessary. PDA shall use and/or disclose the minimally necessary Protected Health
Information to perform its obligations under the Service Agreement, and shall comply
with any guidance issued by the Secretary regarding the minimal necessary use and
disclosure of Protected Health Information.

Specific Use and Disclosure Provisions.

(i) PDA may use Protected Health Information for the proper management and
administration of PDA or to carry out the legal responsibilities of PDA.

(ii) Except as otherwise limited in this Agreement, PDA may disclose Protected

Health Information for the proper management and administration of PDA or to
carry out the legal responsibilities of PDA, provided _ that:

4 BAA Revised October 2013

(iii)

(iv)

(v)

(vi)

(A) Disclosures are Required By Law, or

(B) PDA obtains reasonable assurances from the person to whom the
information is disclosed that it will be held confidentially and used or
further disclosed only as Required By Law or for the purpose for which
it was disclosed to the person, and the person notifies PDA of any
instances of which it is aware in which the confidentiality of the
information has been breached.

Except as otherwise limited in this Agreement, PDA may use Protected Health
Information to provide Data Aggregation services as permitted by 45 CFR
164.504(e)(2)(i)(B).

PDA may use or disclose Protected Health Information to report violations of law
to appropriate Federal and/or State authorities to the extent consistent with 45
CFR 164.502().

Except as otherwise limited in this Agreement, PDA may disclose Protected
Health Information to other “business associates” (within the meaning of the
Privacy Rule) of the Health Plan to perform its duties under the Service
Agreement. Notwithstanding any provision hereof or any other prior agreement
by the Parties, it shall be the Health Plan’s sole responsibility (and not PDA’s
responsibility) to ensure that the Health Plan has entered into appropriate
business associate agreements with its business associates.

Except as otherwise limited in this Agreement, PDA may disclose Protected
Health Information to the persons to whom the Health Plan Administrator, on
behalf of the Health Plan, directs PDA to provide Protected Health Information.
Notwithstanding any provision hereof or any other prior agreement by the Parties,
it shall be the Health Plan’s sole responsibility (and not PDA’s responsibility) to
ensure that the Health Plan has, in its official plan document, appropriate
provisions regarding disclosures of Protected Health Information.

4. Obligations of the Health Plan and Health Plan Administrator

(a)

(b)

City of Nashua

General. Except as otherwise specifically provided under this Agreement, the Health Plan
shall not request or permit PDA to (and shall not cause the Health Plan Administrator to
request or permit PDA to) use or disclose Protected Health Information in any manner
that may not be permissible under the Privacy Rule if done by the Health Plan.

Notification of Privacy Practices and Restrictions. The Health Plan shall cause the Health
Plan Administrator to promptly notify PDA of:

(i)

(ii)

Any limitation(s) in the Health Plan’s notice of privacy practices in accordance
with 45 CFR 164.520, to the extent that such limitation may affect PDA's use or
disclosure of Protected Health Information;

Any changes in, or revocation of, permission by Individual to use or disclosure of

Protected Health Information, to the extent that such changes may affect PDA's
use or disclosure of Protected Health Information; and

5 BAA Revised October 2013

(iii) Any restriction to the use or disclosure of Protected Health Information that the
Health Plan has agreed to in accordance with 45 CFR 164.522, to the extent that
such restriction may affect PDA's use or disclosure of Protected Health
Information.

J. Disclosure to CMS for Part D Program

Pursuant to 42 CFR 423.884(b) and notwithstanding any provision herein to the contrary, the
Health Plan agrees that the Health Plan, the Health Plan Administrator or PDA (on behalf of the
Health Plan) may disclose Protected Health Information to the Center for Medicare and Medicaid
Services (CMS) to the extent necessary to comply with Subpart R of 42 CFR Part 423 (relating to
Notices of Creditable and Non-Creditable Coverage and applications for drug subsidy payment to
the Plan Sponsor in connection with the prescription drug benefit under the Health Plan).

6. Security of Electronic Protected Health Information

(a) PDA has implemented administrative, physical, and technical safeguards that reasonably
and appropriately protect the security, confidentiality, integrity and availability of ePHI
that it creates, receives, maintains or transmits on behalf of the Health Plan as required
under the Security Standards.

(b) PDA agrees that it will ensure that agents or subcontractors to whom it provides ePHI
agree to implement the administrative, physical, and technical safeguards that reasonably
and appropriately protect its confidentiality, integrity and availability.

(c) PDA agrees to report to the Health Plan, as soon as reasonably practicable, any Security
Incident (as defined in 45 C.F.R. Part 164.304) of which it becomes aware.

(d) The Health Plan agrees and understands that the Health Plan is independently responsible
for the security of ePHI in its possession, whether it was created by the Health Plan or
received from outside sources (including PDA).

7. Term and Termination

(a) Term. The term of this Agreement shall be for a period commencing as of the effective
date of the Service Agreement and ending when all of the Protected Health Information
provided by the Health Plan to PDA, or created or received by PDA on behalf of the
Health Plan, is destroyed, returned to the Health Plan or further protected in accordance
with the termination provisions in this Section 7.

(b) Termination for Cause. Upon the Health Plan Administrator’s knowledge of a Significant
Breach of PDA’s obligation under this Agreement and subject to Section 7(c) hereof, the
Health Plan Administrator may commence termination of this Agreement by providing a
notice of termination to PDA. Notwithstanding the foregoing, this Agreement shall be
considered to have been terminated pursuant to this Section 7(b) only if, prior to such
notice of termination:

(i) The Health Plan Administrator shall have given to PDA written notice
describing with specificity the Significant Breach;

City of Nashua 6 BAA Revised October 2013

(c)

(d)

(ii) A period of 60 days from and after the giving of such notice shall have elapsed
without PDA’s having substantially cured or remedied such reason for
termination during such 60-day period, unless such reason for termination cannot
be substantially cured or remedied within 60 days, in which case the period for
remedy or cure shall be extended for a reasonable time (not to exceed 60 days),
provided that PDA has made and continues to make a diligent effort to effect
such remedy or cure; and

(iii) A final determination shall have been made by the Health Plan
Administrator that Significant Breach persists, following a meeting at which PDA
shall be entitled to appear and contest the determination.

In the event PDA learns of a pattern of activity or practice by the Health Plan, or the
Health Plan Administrator, of material breach or violations of the terms and conditions
set forth herein, if the Health Plan or Health Plan Administrator fails to cure or end such
breach or violations, PDA shall have the right to terminate this Agreement, or if
termination is not feasible, report the material breach or violations to the Secretary.

Condition Precedent. Upon receipt of a notice of termination pursuant to Section 7(b)
hereof, or for termination of this Agreement for any other reason, PDA shall return or
destroy all Protected Health Information received from the Health Plan, or created or
received by PDA on behalf of the Health Plan, that PDA still maintains in any form, and
may retain one archival copy of such information. If PDA maintains an archival copy or
determines that such return or destruction is not feasible, PDA shall extend the
protections of this Agreement to such Protected Health Information and limit further
uses and disclosures of such Protected Health Information.

Report to Secretary of HHS. If, in the reasonable determination of the Health Plan
Administrator, termination of the Agreement pursuant to Section 7(b) hereof is not
feasible, the Health Plan Administrator shall report the Significant Breach to the
Secretary, if required under HIPAA.

8. Other Provisions

(a)

(b)

(c)

City of Nashua

Separate from Service Agreement. Except to the extent specifically provided herein, this
Agreement shall not be construed, and is not intended, to be a part of the Service
Agreement or to otherwise impose on PDA any duties, responsibilities, obligation
whatsoever in respect of the administration of the Health Plan, including any duties,
responsibilities or obligation of the Health Plan pursuant to the Privacy Rule.

No Liability. To the fullest extent permitted by law, PDA shall be under no liability for
any use or disclosure of Protected Health Information made in accordance with the
directions of the Health Plan.

No Duty to Question. Notwithstanding anything herein to the contrary, PDA shall not be
under any duty to question any directions received from the Health Plan Administrator,
nor to review in any respect the manner in which any fiduciary of the Health Plan
exercises its authority and discharges its duties with respect to the Health Plan.

7 BAA Revised October 2013

(d)

(e)

(f)

(g)

(h)

(i)

@)

(k)

()

(in)

City of Nashua

Amendment. The Parties agree to take such action to amend this Agreement from time to
time as is necessary for the Health Plan to comply with applicable law, including the
requirements of HIPAA, HITECH, the Privacy Rule, and the Security Standards.

Ambiguities. Any ambiguity in this Agreement shall be resolved in a manner that is
consistent with the applicable requirements under the Privacy Rule.

Notice. Any notice required to be given hereunder shall be in writing and delivered by
hand or sent by facsimile, registered or certified mail, return receipt requested, or by air
courier, to the address (or fax number) cited in the signature block of this Agreement or
to such other address (or fax number) as shall be specified by like to notice by either
Party, and shall be deemed given only when received.

Headings. The title, headings, and subheadings of this Agreement are solely for the
convenience of the Parties and do not affect the meaning or interpretation of any
provision of this Agreement.

Governing Law. Except to the extent preempted by ERISA, this Agreement shall be
governed by and enforceable in accordance with the laws of the State of New
Hampshire without giving effect to the principles of conflict of laws thereof.

Entire Agreement. This Agreement and the Service Agreement contain the entire
understanding between the Health Plan and PDA with respect to the subject matter hereof
and, except as specifically provided herein, cancels and supersedes any and all other
agreements between the Health Plan and PDA with respect to the subject matter hereof.
Any amendment or modification of this Agreement shall not be binding unless in writing
and signed by both the Health Plan and PDA.

Severability. In the event that any provision of this Agreement is determined to be invalid
or unenforceable, the remaining terms and conditions of this Agreement shall be
unaffected and shall remain in full force and effect, and any such determination of
invalidity or unenforceability shall not affect the validity or enforceability of any other
provision of this Agreement.

No Benefit to Others. The representations, covenants and agreements contained in this
Agreement are for the sole benefit of the Parties, and they shall not be construed as
conferring, and are not intended to confer, any rights on any other persons.

Counterparts. This Agreement may be signed in counterparts, each of which shall be an

original, with the same effect as if the signatures thereto and hereto were upon the same
instrument.

8 BAA Revised October 2013

IN WITNESS WHEREOF, the Parties have entered into this Business Associate Agreement, effective
as of the Effective Date.

PART D ADVISORS, INC. City of Nashua, on behalf of itself and the City of
Nashua Health Plan
By: By:
Name: Name:
Title: Title:
Address: 17199 N. Laurel Park Drive Address:
Suite 400

Livonia, MI 48152

Date: Date:

City of Nashua 9 BAA Revised October 2013

REPORT OF THE FINANCE COMMITTEE
SEPTEMBER 20, 2017

A meeting of the Finance Committee was held on Wednesday, September 20, 2017, at 7:04 p.m. in the
Aldermanic Chamber.

Mayor Jim Donchess, Chairman, presided.

Members of the Committee present: Alderman-at-Large Mark S. Cookson, Vice Chair
Alderman-at-Large Lori Wilshire
Alderman-at-Large Michael B. O’Brien
Alderman Benjamin M. Clemons
Alderman June M. Caron

Members not in Attendance: Alderman Ken Siegel

Also in Attendance: Alderman-at-Large Brian S. McCarthy
Alderman Richard A. Dowd
Alderman David Schoneman
John Griffin, CFO/Comptroller
Dan Kooken, Purchasing Manager

PUBLIC COMMENT — None
COMMUNICATIONS

From: Dan Kooken, Purchasing Manager
Re: Purchase Of Vehicles Per Fleet Assessment FY18 (Value: $128,986)

MOTION BY ALDERMAN O’BRIEN TO ACCEPT, PLACE ON FILE AND AUTHORIZE THE PURCHASE
FROM MHQ, INC. IN THE AMOUNT OF $128,986. FUNDS ARE AVAILABLE IN DEPARTMENT 152, FIRE;
CERF

MOTION CARRIED

From: Karl Gerhard, Deputy Fire Chief, Nashua Fire Rescue
Re: Household Hazardous Waste Collection Program Support
e Referred to Cmte — 9/12/2017

MOTION BY ALDERMAN O’BRIEN TO ACCEPT AND PLACE ON FILE
MOTION CARRIED

UNFINISHED BUSINESS — None
NEW BUSINESS — RESOLUTIONS

R-17-128
Endorsers: Alderwoman Mary Ann Melizzi-Golja
Alderman Richard A. Dowd
Alderman-at-Large Michael B. O’Brien, Sr.
AUTHORIZING THE MAYOR TO ENTER INTO THE COOPERATIVE AGREEMENT FOR
HOUSEHOLD HAZARDOUS WASTE COLLECTION WITHIN THE NASHUA, NEW HAMPSHIRE
REGION
e Also assigned to the Board of Public Works; to appear on its 9/28/2017 agenda