1. Term. The term of this Amendment shall be effective as of the Effective Date of this Amendment and shall terminate when all of the PHI provided by Plan to Business Associate, or created or received by Business Associate on behalf of Plan, is destroyed or returned to Plan, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions of this section.
2. Termination for Cause. Upon Plans’ knowledge of a material breach by Business Associate, Plan shall:
a) Provide an opportunity for Business Associate to cure the breach or end the violation, and terminate the Agreement(s) if Business Associate does not cure the breach or end the violation within the time specified by Plan; or
b) Immediately terminate the Agreement(s) if Business Associate has breached a material term of this Amendment and cure is not possible; or
c) If neither termination nor cure are feasible, report the violation to the Secretary.
Business Associate shall have the same obligations as the Plan with respect to a material breach by Plan as provided in this Section C (.2).
Appendix D
Business Associate Agreement and Certification
© Towers Watson 2010
3. Effect of Termination. (a) Except as provided in paragraph (b) of this Section, upon termination of the Agreement(s) for any reason, Business Associate shall return or destroy all PHI received from Plan, or created or received by Business Associate on behalf of Plan. This provision also shall apply to PHI that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the PHI. (b) In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to Plan notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction is infeasible, Business Associate shall extend the
Appendix D
protections of this Amendment to such PHI and limit further Uses and Disclosures of such PHI to those purposes that make return or destruction infeasible, for so long as Business Associate maintains such PHI.
D. MISCELLANEOUS
1. Regulatory References. A reference in this Amendment to a section in the Privacy Rules means the section as in effect, including any amendment that has become effective.
2. Amendment. This Amendment may be amended at any time and for any reason by a written instrument executed by both Parties. The Parties agree to take such action as is necessary to amend this Amendment and/or the Agreement(s) from time to time as is necessary for Plan to comply with the requirements of the Privacy Rules and the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191.
3. Survival. The obligations of Business Associate under the Disclosure accounting provision in Section A (12) and the indemnity provision in Section A (18) of this
Amendment, and the respective rights and obligations of Business Associate under the termination provision in Section C (3) of this Amendment, shall survive the termination of this Amendment and/or the Agreement(s).
4. Interpretation. Any ambiguity in this Amendment shall be resolved in favor of a meaning that permits Plan to comply with the Privacy Rules. The terms and conditions of this Amendment shall override and control any conflicting terms and conditions in any agreement between Plan and Business Associate related to the privacy and Security of PHI.
5. Effect on Agreement(s). The terms and conditions of this Amendment shall override and control any conflicting terms and conditions in any Agreement(s) concerning the privacy and Security of PHI. Except as amended herein, all terms and conditions of the
Agreement(s) between the Parties shall remain in full force and effect in accordance with such Agreement(s).
Agreed to and Accepted by:
Visa Inc. DATE
__________________________ _____________________________
On Behalf of the Plan
NAME DATE
__________________________ _____________________________
Appendix D
Business Associate Agreement and Certification
© Towers Watson 2010 Business Associate
Visa Certification to <<Business Associate>>
Visa Group Health Plan (“Plan”) acknowledges and agrees that the federal Privacy Rules (promulgated at 45 CFR Parts 160 and 164) allow the Plan to permit <<Business Associate>>
to disclose or provide access to Protected Health Information (“PHI”), as therein defined), other than Summary Health Information (also as therein defined), to [Employer Name] (the “Plan Sponsor”) only after the Plan Sponsor has amended its Plan documents to provide for the permitted and required Uses and Disclosures of PHI, and that the federal Privacy Rules require the Plan Sponsor to provide a certification to the Plan that certain required provisions have been incorporated into the Plan documents before the Plan may disclose, either directly or through a Business Associate, such as <<Business Associate>> any PHI to the Plan Sponsor.
The Plan hereby represents that Plan documents have been so amended and that the Plans have received such certification from the Plan Sponsor.
The Plan acknowledges and agrees that the federal Privacy Rules allow the Plan to permit
<<Business Associate>> to disclose or provide access to PHI, other than Summary Health Information, to only those employees or other persons (including third parties) under the control of the Plan Sponsor who are described by position in the Plan documents as the persons who are given access to PHI solely to carry out the Plan Administration Functions that the Plan Sponsor performs for the Plan.
Accordingly, to the extent <<Business Associate>> is needs to disclose or provide access to PHI to the Plan Sponsor or any employee or other person under the control of the Plan
Sponsor, <<Business Associate>> shall make such Disclosure of or provide such access to PHI only as follows:
To any employee or other person under the control of the Plan Sponsor upon such person's written request on behalf of the Plan Sponsor for the purpose of obtaining premium bids for the provision of health insurance, HMO or stop-loss coverage for the Plan or modifying, amending or terminating the Plan;
To only the following employees or other persons (including third parties) identified in the Plan documents and under the control of the Plan Sponsor solely for the purpose of carrying out the Plan Administration Functions that the Plan Sponsor performs for the Plan:
[List such persons(s) by name and position, currently:
Add Name, Title, Location
Business Associate Agreement and Certification
© Towers Watson 2010
Notwithstanding anything herein to the contrary, effective as of the date determined by the Secretary, the <<Business Associate>> shall not disclose to the Plan Sponsor PHI that is Genetic Information for Underwriting Purposes.
Appendix D
Appendix D
Business Associate Agreement and Certification
© Towers Watson 2010
It is acknowledged and agreed that the federal Privacy Rules require the Plan to maintain policies and procedures to ensure that any PHI that it uses, requests or discloses be no more than the Minimum Necessary to accomplish the intended purpose. Accordingly, the Plan hereby agrees and represents that any requests that it makes for PHI to be disclosed to it or to the Plan Sponsor will be for no more than the minimum amount necessary for their intended purpose.
Acknowledged and greed to by:
NAME DATE
_______________________________________________ _________________________
On behalf of the Visa Group Health Plan