Documents

resolution 7 pages

Also attached to this agenda item: Resolution 137-2025 BAA for MSEB

Rev 3/21 pg. 1 Village of Croton-on-Hudson Business Associate Agreement This Agreement is made and entered into this 22nd day of April 2025, by and between Village of Croton- on-Hudson (VCOH) and Marshall+Sterling Employee Benefits, Inc (“MSEB”) (collectively, the “Parties”). VCOH has entered into an agreement with MSEB for broker, agent and consulting services; and MSEB acknowledges that it is a “Business Associate” of VCOH as those terms are defined by the Health Insurance Portability and Accountability Act and its implementing regulations (45 C.F.R. Parts 160-164) (“HIPAA”). In Consideration of the mutual covenants and conditions contained in this Agreement, the parties agree as follows: 1. Definitions. Capitalized terms in this Agreement and not otherwise defined herein shall have the meanings set forth in HIPAA and the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH Act”), which definitions are hereby incorporated by reference. 2. Obligations and Activities of Marshall+Sterling Employee Benefits. 2.1 MSEB agree to use or disclose Protected Health Information (“PHI”) received from or on behalf of VCOH or created for VCOH only as permitted or required by this Agreement, as required by law, or for MSEB internal management and compliance purposes. 2.2 MSEB agrees to develop, implement, maintain and use appropriate administrative, technical, and physical safeguards to protect the privacy of the PHI other than as provided for by this Agreement. The safeguards must reasonably protect PHI from any intentional or unintentional use or disclosure in violation of the Security and Privacy Rules and limit incidental uses or disclosures made pursuant to a use or disclosure otherwise permitted by this Agreement. 2.3 MSEB agree to comply with the Security and Privacy Rules and will use appropriate administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI that MSEB creates, receives, maintains, or transmits on VCOH’s behalf. MSEB will also implement the technologies and methodologies used to render the electronic PHI that it creates, receives, maintains, or transmits on behalf of VCOH unusable, unreadable, or indecipherable to unauthorized individuals as required by the HITECH Act and the Department of Health and Human Services (“HHS”). 2.4 MSEB agrees to mitigate, to the extent practicable, any harmful effect that is known to MSEB of a use or disclosure of PHI by MSEB in violation of the requirements of this Agreement. Rev 3/21 pg. 2 2.5 MSEB agrees to report to VCOH, any use or disclosure of PHI not provided for by this Agreement of which it becomes aware not more than thirty (30) calendar days after MSEB discovers such non-permitted use or disclosure. 2.6 MSEB agrees to report to VCOH the aggregate number of unsuccessful, unauthorized attempts to access, use, disclose, modify, or destroy electronic PHI or to interfere with system operations in an information system containing electronic PHI, including pings. Such reports will be provided once per month, on or before the 10th calendar day of such month. MSEB will report to VCOH any successful unauthorized access, use, disclosure, modification, or destruction of electronic PHI or any successful interference with system operations in an information system containing electronic PHI, in writing, as soon as feasible. 2.7 MSEB agrees to provide notification to VCOH of any potential Breach of Unsecured PHI no later than thirty (30) days after the discovery of such potential Breach by Marshall+Sterling Employee Benefits, unless a delay is allowed under applicable law. Breach is defined as the unauthorized acquisition, access, use or disclosure of PHI which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information. MSEB shall treat a potential Breach as being discovered in accordance with 45 CFR §164.410. The notification shall consist of the following: (i) A brief description of the breach, including the date of the breach and the date of discovery; (ii) Identify the types of PHI that were involved in the breach; (iii) Identify who made the non-permitted use or disclosure and who received it; (iv) Identify what corrective action has been taken; and (v) Provide such other information, including a written report and risk assessment under 45 CFR §164.402, as VCOH may request. 2.8 MSEB agrees to ensure that any agent, including a subcontractor, to whom it provides PHI, received from, or created or received by MSEB on behalf of VCOH, agrees to the same restrictions and conditions that apply through this Agreement to MSEB with respect to such information. Moreover, MSEB shall ensure that any such agency or subcontractor agrees to implement reasonable and appropriate safeguards to protect the member’s PHI. 2.9 MSEB Inc agrees to provide access, at the written request of VCOH, and in the time and manner mutually agreed by the parties or designated by the Secretary, to PHI in a Designated Record Set in MSEB ’s custody or control, to VCOH or, as directed by VCOH, to an Individual or the Individual’s designee, in order to meet the requirements under 45 C.F.R. § 164.524. Effective September 23, 2013, if VCOH requests an electronic copy of PHI that is maintained electronically in a Designated Record Set in MSEB ’s custody or control, MSEB will provide an electronic copy in the form and format specified by VCOH if it is readily producible in such format; if it is not readily producible, MSEB will work with VCOH to determine an alternative form and format that enable VCOH to meet its electronic access obligations under 45 C.F.R. § 164.524. 2.10 MSEB agrees to make any amendment(s) to PHI in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 C.F.R. § 162.526 at the request of VCOH Rev 3/21 pg. 3 or an Individual, and in the time and manner mutually agreed by the parties or designated by the Secretary. 2.11 MSEB agrees not to receive, directly or indirectly, remuneration in exchange for any PHI of an Individual unless VCOH received valid authorization from the Individual or unless an exception under HIPAA or the HITECH Act applies. 2.12 MSEB agrees to make internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI received from, or created or received by MSEB on behalf of VCOH, available to VCOH, or to the Secretary, in a time and manner mutually agreed by the parties or designated by the Secretary, for purposes of the Secretary determining VCOH’s compliance with the Security and Privacy Rules. 2.13 MSEB agrees to document such disclosures of PHI and information related to such disclosures as would be required for VCOH to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R § 164.528. 2.14 MSEB agrees to provide to VCOH or an Individual member, in a time and manner mutually acceptable to the parties, information collected in accordance with this Agreement, to permit VCOH to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. 2.15 In the event that MSEB transmits or receives any Covered Electronic Transactions on behalf of VCOH, it shall comply with all applicable provisions of the Standards for Electronic Transactions Rule to the extent required by law, and shall ensure that any agents that assist MSEB in conducting Covered Electronic Transactions on behalf of VCOH agree in writing to comply with the Standards for Electronic Transactions Rule to the extent required by law. 3. Permitted Uses and Disclosures by MSEB. Except as otherwise limited in this Agreement, MSEB may use or disclose PHI to perform functions, activities, or services for, or on behalf of VCOH, provided that such use or disclosure would not violate the Security and Privacy Rules if done by VCOH including the minimum necessary requirements thereto. 3.1 Except as otherwise limited in this Agreement, MSEB may use PHI for the proper management and administration of MSEB or to carry out the legal responsibilities of MSEB. 3.2 Except as otherwise limited in this Agreement, MSEB may use or disclose PHI to perform functions, activities or securities for, or on behalf of VCOH provided that such use or disclosure would not violate the Security and Privacy Rules if done by VCOH, or the minimum necessary policies and procedures of the Covered Entity. 3.3 Except as otherwise limited in this Agreement, MSEB may use PHI to provide administrative services to VCOH as permitted by 45 C.F.R § 164.504(e)(2)(i)(A). Rev 3/21 pg. 4 3.4 Except as otherwise limited in this Agreement, MSEB may disclose PHI for the proper management and administration of MSEB , provided that disclosures are Required by Law, or MSEB obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies MSEB of any instances of which it is aware in which the confidentiality of the information has been breached. 3.5 Except as otherwise limited in this Agreement, MSEB may use PHI to provide Data Aggregation services to VCOH as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B). 3.6 MSEB may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 C.F.R. § 164.502(j)(1). 4. Obligations of VCOH. Upon request, VCOH shall provide MSEB with a copy of its Notice of Privacy Practices and Restrictions: 4.1 VCOH shall notify MSEB of any limitations in the Notice of Privacy Practices of VCOH in accordance with 45 C.F.R. § 164.520, to the extent that such limitation may affect MSEB ’s use or disclosure of PHI. 4.2 VCOH shall notify MSEB of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such changes may affect MSEB ’s use or disclosure of PHI. 4.3 VCOH shall notify MSEB of any restriction to the use or disclosure of PHI that VCOH has agreed to in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect MSEB use or disclosure of PHI. 5. Permissible Requests by VCOH. Except as otherwise permitted by this Agreement, VCOH shall not request MSEB to use or disclosure PHI in any manner that would not be permissible under the Security and Privacy Rules if done by VCOH, except that MSEB may use or disclose PHI for Data Aggregation, or management and administrative activities of MSEB as further specified herein this Business Associate Agreement. 6. Terms and Termination. 6.1 Term. The Term of this Agreement shall be effective upon execution of this Agreement by both parties, and shall terminate when all of the PHI provided by VCOH to MSEB , or created or received by MSEB on behalf of VCOH, is destroyed or returned to VCOH or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions in this Section. Rev 3/21 pg. 5 6.2 Termination for Cause. Upon VCOH’s knowledge of a material breach of any provision of this Agreement by MSEB , VCOH shall either: 6.2.1. Provide an opportunity for MSEB to cure the breach or end the violation and terminate this Agreement if MSEB does not cure the breach or end the violation within the time specified by VCOH; 6.2.2. Immediately terminate this Agreement if MSEB has breached a material term of this Agreement and cure is not possible; or 6.2.3. If neither termination nor cure is feasible, VCOH shall report the violation to the Secretary. 6.3. Effect of Termination. 6.3.1. Except as provided in the following paragraph, upon termination of this Agreement, for any reason, MSEB shall return or destroy all PHI received from VCOH, or created or received by MSEB on behalf of VCOH. This provision shall apply to PHI that is in the possession of subcontractors or agents of MSEB . MSEB shall retain no copies of the PHI. 6.3.2. In the event that MSEB determines that returning or destroying the PHI is infeasible, MSEB shall provide to VCOH notification of the conditions that make return or destruction infeasible. MSEB shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as MSEB maintains such PHI. 7. Legal Actions. 7.1 Response to Subpoenas. In the event that MSEB receives a subpoena (or similar notice or request) from any judicial, administrative or other party arising out of or in connection with this Agreement, including, but not limited to, any unauthorized use or disclosure of PHI or any failure in MSEB shall promptly forward a copy of such subpoena to VCOH and afford VCOH the opportunity to be a part of the decision making with regard to the subpoena including but not limited to responding to the subpoena. 7.2 Indemnity. 7.2.1 MSEB will indemnify and hold harmless VCOH and any member affiliate, trustee, officer, director, employee, volunteer or agent from and against any claim, cause of action, liability, damage, cost or expense, including attorneys’ fees and court or proceeding costs, arising out of or in connection with any unauthorized use or disclosure of PHI or any failure in security measures affecting PHI or any other Rev 3/21 pg. 6 breach of the terms of this Agreement by MSEB or any person or entity under MSEB ’s control. 7.2.2 VCOH will indemnify and hold harmless MSEB and any MSEB affiliate, trustee, officer, director, employee, volunteer or agent from and against any claim, cause of action, liability, damage, cost or expense, including attorneys’ fees and court or proceeding costs, arising out of or in connection with any unauthorized use or disclosure of PHI or any failure in security measures affecting PHI or any other breach of the terms of this Agreement by VCOH or any person or entity under VCOH’s control. 7.3 Right to Tender or Undertake Defense. 7.3.1 If VCOH is named a party in any judicial, administrative or other proceeding arising out of or in connection with any unauthorized use or disclosure of PHI or any failure in MSEB ’s security or privacy measures affecting PHI, electronic PHI, or any other breach of the terms of this Agreement by (1) MSEB , (2) any person or entity under MSEB ‘s control, or (3) its subcontractors or agents, VCOH will have the option at any time either (1) to tender their defense to MSEB , in which case MSEB will provide qualified attorneys to represent VCOH’s interests at MSEB ’s expense, or (2) undertake their own defense, choosing the attorneys, consultants and other appropriate professionals to represent their interests, in which case MSEB will be responsible for and pay the reasonable fees and expenses of such attorneys, consultants and other professionals. 7.3.2 If MSEB is named a party in any judicial, administrative or other proceeding arising out of or in connection with any unauthorized use or disclosure of PHI or any failure in VCOH’s security or privacy measures affecting PHI, electronic PHI, or any other breach of the terms of this Agreement by (1) VCOH, (2) any person or entity under VCOH’s control, or (3) VCOH’s subcontractors or agents, MSEB will have the option at any time either (1) to tender its defense to VCOH, in which case VCOH will provide qualified attorneys to represent MSEB ’s interests at VCOH’s expense, or (2) undertake its own defense, choosing the attorneys, consultants and other appropriate professionals to represent its interests, in which case VCOH will be responsible for and pay the reasonable fees and expenses of such attorneys, consultants and other professionals. 7.4 Right to Control Resolution. VCOH will have the sole right and discretion to settle, compromise or otherwise resolve any and all claims, causes of actions, liabilities or damages against them, notwithstanding that VCOH may have tendered their defense to MSEB . Any such resolution shall not relieve MSEB of its obligation to indemnify VCOH. General Provisions. Rev 3/21 pg. 7 8.1 Regulatory References. A reference in this Agreement to a section in the Security and Privacy Rules means the section as in effect or as amended. 8.2 Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for VCOH to comply with the requirements of the Security and Privacy, HIPAA and the HITECH Act. 8.3 Survival. The respective rights and obligations of MSEB under this Agreement shall survive the termination of this Agreement. 8.4 Interpretation. Any ambiguity in this Agreement shall be resolved to permit VCOH to comply with the Security and Privacy Rules. 8.5 No Third-Parties. Nothing express or implied in this Agreement is intended to confer, nor shall anything n this Agreement confer, upon any person or entity other than the parties and their respective successors or assigns any rights, remedies, obligations, or liabilities whatsoever. 8.6 Conflicts. To the extent that the law of the state in which VCOH does business is more stringent than Federal law regarding privacy issues, the law of such state shall control, unless such state law is preempted by the Federal law. 8.7 Counterparts. This Agreement may be executed in counterparts, each of which shall be deemed an original, and all of which shall constitute one binding agreement. The Parties hereto execute this Agreement the date indicated above. MSEB By: ________________________________ By: Title: _______________________________ Title: President, MSEB .