HomeMy WebLinkAboutCAG2019-175 - Original - The Vitality Group, LLC - Wellness Program Master Service Agreement - 04/01/2019 40 000"4;
Records Management
KENT Document
W A S H I N G T O N
CONTRACT COVER SHEET
This is to be completed by the Contract Manager prior to submission
to the City Clerk's Office. All portions are to be completed.
If you have questions, please contact the City Clerk's Office at 253-856-5725.
Vendor Name: The Vitality Group, LLC
Vendor Number: 62CAg04 IV'7
JD Edwards Number
Contract Number: C1A-(-, 201 1- '5
This is assigned by City Clerk's Office
Project Name: VVkZ-(_^Je 5
Description: ❑ Interlocal Agreement ❑ Change Order ❑ Amendment ® Contract
❑ Other:
Contract Effective Date: 4/1/19 Termination Date: 3/31/2022
Contract Renewal Notice (Days): Automatic renewal for a successive period of 1 year
Number of days required notice for termination or renewal or amendment
Contract Manager: Laura Horea Department: HR
Contract Amount: 174 285
Approval Authority: ❑ Director ❑ Mayor ® City Council 02/19/19 Meeting Date
Detail: (i.e. address, location, parcel number, tax id, etc.):
ICI,
.M
F �N
4 u
i-
w:: .
VSKM
Im
Sr
AMr ,
_ � M
mil^,
a
TheVitalityGroup.com
TIM
VITALITY MASTER SERVICES AGREEMENT
Between
THE VITALITY GROUP, LLC
And
CITY OF KENT,A WASHINGTON MUNICIPAL CORPORATION
This Vitality Master Services Agreement(this"Agreement"),effective as of the date of the last signature
(the"Effective Date"), is made by and between The Vitality Group,LLC("TVG"),and aTYOF KENT,A WASHINGTON MUNICIPAL CORPORATION
("Customer"). Customer and TVG are jointly referred to as"Parties",or separately and non-specifically as"Party".Throughout
this Agreement,the term Party or Parties shall be deemed to include the Party's Affiliate(s).
NOW,THEREFORE,in consideration of the mutual agreements contained herein and other good and valuable
consideration,the receipt and sufficiency of which are hereby acknowledged,the Customer and TVG agree as follows:
1. DEFINITIONS. Certain defined terms used in this Agreement shall have the meanings specified in this Article 1. Certain
additional terms are defined elsewhere in this Agreement.
1.1. "Affiliate"means,when used with reference to a specified Person, any Person that directly or indirectly
controls or is controlled by or is under common control with the specified Person.
1.2. "Agreement"means this Vitality Master Services Agreement and all documents incorporated herein,
including but not limited to, Exhibits, Business Associate Agreement,and any Statement(s)of Work.
1.3. "Claims"means civil,administrative and criminal actions,claims, suits and legal proceedings of any kind that
are brought against an Indemnitee by a third party unaffiliated with such Indemnitee.
1.4. "Confidential Information"means all financial,business and other information, in whatever form or medium,
including,without limitation,any trade secrets, processes,financial data,technical data and documentation,
strategic planning, product/service specifications,prototypes,computer programs,drawings,models and
marketing data,that is furnished or disclosed by a disclosing Party or any of its Affiliates to the receiving
Party pursuant to the terms of this Agreement and which the disclosing Party has marked as"Confidential",
except that such term will not include(i)information already known by the receiving Party without an
obligation of confidentiality,(ii)information that is or becomes publicly known other than through a breach
by the receiving Party of any of its obligations under this Agreement, (III)information received by the
receiving Party from a third party who is not known by the receiving Party, acting in good faith,to be under
an obligation of confidence to the disclosing Party,and(iv)information that the disclosing Party has
disclosed to other parties without similar obligations of confidentiality.
1.5. "Costs"means damages,settlements,judgments,losses,expenses,interest,penalties,reasonable legal
fees and disbursements(including without limitation fees and costs for investigators,expert witnesses and
other litigation advisors)and other actual costs incurred by an Indemnitee to investigate,defend or settle a
Claim,except that no settlement payments shall be included in Costs unless the Indemnitor has given prior,
express written consent to the settlement.
1.6. "Data"means the information provided to TVG by Customer or any third party vendor, in order for TVG to
perform its responsibilities under this Agreement.
1.7. "Force Majeure"means an event that is a result of the elements of nature,as opposed to caused by human
behavior.
1.8. "Indemnitee"means a Person entitled to indemnification in accordance with Article 5.
1.9. "Indemnitor"means a Person who is required to indemnify an Indemnitee in accordance with Article 5.
Agency-Vitality Master Services Agreement, BAA and SOW 2
vi" TM
1.10. "Member"means those people which Customer deems eligible to receive access to the Vitality Program via
the eligibility file and which may be further defined in a Statement of Work.
1.11, "Person"means a natural person or a corporation, partnership,limited liability company,trust,association or
other entity,as the context requires or admits.
1.12. "Services"means all services provided by TVG.The specific Services to be provided by TVG will be outlined
in a(n)SOW(s)executed by the Parties.
1.13. "Statement of Work"("SOW")means a document executed between the Parties as part of this Agreement
that outlines the Services to be performed by TVG. SOW(s)may be executed at the time this Agreement is
executed or at any time during the term of this Agreement.
2. COMPENSATION.
2.1. As compensation in full for the successful performance of all work and Services to be performed by TVG
under this Agreement, Customer shall pay the fee(s)set forth in the SOW executed between the Parties.
2.2. TVG shall submit invoices electronically for any fees,charges or amounts payable hereunder once per
month.
2.3. Customer shall pay TVG via ACH or check the full amount due on all invoices within thirty(30)days of
submission.TVG reserves the right to institute an interest charge on all outstanding balances beyond
forty-five(45)days of one percent(1.0%)per month, accrued daily.
3. TAXES.Customer and TVG will each be responsible for their own taxes.Additionally,if it is determined that Vitality
Rewards Members receive are subject to taxes or fees,TVG is not responsible for the administration or collection for such
taxes or fees.
4. SURVEYS. Customer agrees TVG shall have the right to survey all Members regarding the Vitality Services. Such surveys
will be anonymous and be used by TVG for the purpose of evaluating product and service improvements. From time to
time,aggregate reports of our recent surveys may be provided to Customer.
5. INDEMNIFICATION and LIMITATION OF LIABILITY.
5.1. TVG shall indemnify,defend, protect and hold harmless Customer and its officers,directors, members,shareholders,
employees and agents(the"Customer Indemnitees"), upon written demand by Customer,from and against any and
all Costs and Claims,arising from or related to the performance by TVG of its obligations under this Agreement, if and
only to the extent that such Costs or Claims are attributable to the negligence,gross negligence or willful misconduct
of TVG or any of its directors,officers,employees or agents.
5.2. [RESERVED]
5.3. After receiving written notice of any Claim for which indemnification would be available under this Article,the
Indemnitee shall promptly give written notice thereof to the Indemnitor,except that the Indemnitee need not give such
notice if the Indemnitor has otherwise received written notice of the Claim. The Indemnitor may at any time, in its sole
discretion,assume the defense of the Claim(and be subrogated to the Indemnitee's position)by giving written notice
to the Indemnitee. Beginning at the point when the Indemnitor assumes the defense of the Claim,all future Costs
relating to the Claim shall be borne by the Indemnitor,provided that the Indemnitee cooperates with the Indemnitor in
the defense of the Claim. If the Indemnitor elects to assume the defense of the Claim,the Indemnitee shall be
represented by legal counsel chosen by the Indemnitor. This may be the same counsel representing the Indemnitor,
unless the Parties cannot appropriately be represented by the same counsel due to actual or potential conflict of
interest,in which case the Indemnitor shall choose separate counsel for the Indemnitee. Except to the extent the
Indemnitor elects to assume the defense of the Claim as provided in this Section,the Indemnitee shall defend the
Claim at its own expense,subject to reimbursement of reasonable expenses by the Indemnitor in accordance with
this Section. The Indemnitee shall be entitled to reimbursement of such reasonable expenses as incurred.
Agency-Vitality Master Services Agreement, BAA and SOW 3
vi" TM
Customer shall not withhold payment of any compensation due and payable to TVG hereunder for purpose of set-off
against any such reimbursement owed to Customer by TVG. Notwithstanding any other provision of this Section,no
indemnification shall be available hereunder(i)for any settlement to which the Indemnitor did not give prior,express
written consent,(ii)for any Claim of which Indemnitor did not receive notice as provided in this Section,or(iii)if the
Indemnitee failed to cooperate with the Indemnitor in the defense of the Claim.
5.4. LIMITATION OF LIABILITY. Except for third-party claims for which Indemnification is provided under section 5.3,in no
event shall either party be liable for indirect, incidental,consequential,special,exemplary,or punitive damages of
any kind or nature,including loss of profit,whether or not such damages were foreseeable or the other party was
advised of the possibility of such damages,whether based in contract,common law,warranty,tort,strict liability,
contribution, indemnity,or otherwise.
6. TERMINATION.
6.1. This Agreement shall commence on the Effective Date and shall continue until such time as there are no active SOWS
outstanding,at which time either Party may terminate this Agreement without cause with thirty(30)days advance
notice.Termination under this section shall be effective the last day of the month following the thirty(30)day
notice period.
6.2. Termination with cause. Either Party may terminate this Agreement,without any fees,
6.2.1. at any time, upon the mutual written agreement of the Parties,
6.2.2. by either Party, upon written notice to the other Party,if the other Party(the"Defaulting Party")shall materially
breach any obligation or covenant of the Defaulting Party hereunder and if such breach shall remain uncured for
thirty(30)days following notice of such breach given by the non-Defaulting Party to the Defaulting Party,
6.2.3. Termination of this Agreement shall not alter or impair any rights of either Party accrued under this Agreement
through the date of termination.
7. INTELLECTUAL PROPERTY. TVG is the owner of the Services offered,including without limitation, proprietary rights in
TVG methods, software,compilations of technical and non-technical information and records. The Parties agree that,
notwithstanding any other statement in this Agreement,(i)the data related to the use of the Services and(ii)the intellectual
property related to the Services is the sole and exclusive property of TVG. Customer and its Affiliates shall acquire no
intellectual property rights to the Services,the data related to the use of the Services,or to the marketing and enrollment
materials as a consequence of this Agreement, and shall maintain the confidentiality of such intellectual property. For the
purposes of clarity,TVG's intellectual property rights under this section do not attach to the raw data and personally
identifiable information of Customer and its employees,which shall at all times remain the Customer's sole Confidential
Information,and TVG shall have no rights to the use of such Confidential Information outside of the Services provided
under this Agreement.
8. DATA PRIVACY AND CONFIDENTIALITY.
8.1. The Parties shall agree and enter into a Business Associate Agreement("BAA"). Such BAA is attached hereto as
Exhibit A and shall govern all rights and obligations of the Parties as it pertains to protected health information.
8.2. The receiving Party agrees that the Confidential Information of the disclosing Party is and will remain the property,
and if applicable a valuable trade secret of the disclosing Party.
8.3. Either Party may receive and otherwise be exposed to Confidential Information of the other Party. Each Party
acknowledges the confidential and secret character of the Confidential Information and agrees that the Confidential
Information is the sole,exclusive and valuable property of the disclosing Party. Neither Party will reproduce any of the
other Party's Confidential Information except in the performance of this Agreement and will not divulge all or any part
of the Confidential Information in any form to any third party,either during or after the term of this Agreement except
as may be specifically set forth in this Agreement. Upon termination of this Agreement for any reason, including
.................................................................... __. ....................... ...............................
Agency-Vitality Master Services Agreement, BAA and SOW 4
s TM
expiration of its term,each Party will cease using and will destroy or return all whole and partial copies and derivatives
of the other Party's Confidential Information. This obligation to cease using and to return or destroy extends to all
Confidential Information that is in the receiving Party's possession,custody or control,except that the receiving Party
may retain one copy of such Confidential Information for archive purposes.
8.4. If a Party is requested or required(by law,court rule,or order,or subpoena to disclose any of the Confidential Information
of the other Party,it shall provide the other Party with reasonable notice of the request or requirement so that the
other Party may seek an appropriate protective order or selectively waive compliance with the provisions of this
Agreement.
8.5. The receiving Party will notify the disclosing Party promptly upon discovery of any unauthorized use or disclosure of
Confidential Information or any other breach of this Agreement, and will reasonably cooperate to regain possession of
the Confidential Information and prevent its further unauthorized use or disclosure. If a Party or any of its employees
or consultants attempt to use or disclose any of the Confidential Information in a manner contrary to the terms of this
Agreement,the other Party will have the right, in addition to such other remedies which may be available to it,to seek
injunctive relief enjoining such acts or attempts,it being acknowledged that legal remedies may be inadequate.
8.6. The terms of confidentiality under this Agreement shall not be construed to limit either party's right to independently
develop or acquire products or services of the same type as may be included within any Confidential Information or
to enter into any business transaction with any other vendor or customer which owns or has rights to any such similar
products or services, as long as such right is exercised without the use of any other party's Confidential Information
in violation of this Agreement.
9. COMPLIANCE WITH LAWS. Each Party shall,at its own expense,comply with all applicable laws,orders and regulations
of federal,state and municipal authorities regarding its performance under this Agreement.
10. ENTIRE AGREEMENT;AMENDMENT. This Agreement(including all attachments hereto)contains the entire agreement
of the Parties. This Agreement supersedes any prior written or oral agreements or understanding between the Parties with
respect to the subject matter hereof. In the event of conflicting terms between this Agreement and an executed SOW,the
terms of this Agreement shall control. TVG's only obligations in connection with this Agreement shall be as expressly set
forth herein and TVG makes no other representations or warranties,express or implied.
10.1. Any modifications,discharges,amendments or alterations to this Agreement shall not be effective unless evidenced
by an instrument in writing signed by both Parties.
10.2. Notwithstanding the foregoing, revision by TVG of its Vitality Program shall not constitute an amendment of this
Agreement if such revision maintains functionality that is similar to or with substantially the same or greater
functionality of the Vitality Program compared to the manner in which such program is operated on the date hereof
("Revision").
11. RELATIONSHIP BETWEEN THE PARTIES. None of the provisions of this Agreement are intended to create, nor shall any
provision be deemed or construed to create,any relationship between TVG and Customer other than that of independent
entities contracting with each other solely for the purpose of effecting the provisions of this Agreement. Neither of the
Parties,nor any of their employees,shall be construed to be the agent,employer or representative of the other.
12. SURVIVAL OF TERMS. Notwithstanding any termination,cancellation or expiration of this Agreement, provisions which are
intended to survive and continue shall so survive and continue, including, but not limited to the provisions specific to
Confidential Information, Indemnification and Intellectual Property.
13. SEVERABILITY. If any provision of this Agreement shall be held to be invalid or unenforceable for any reason,the
remaining provisions shall continue to be valid and enforceable. If a court finds that any provision of this Agreement is
invalid or unenforceable,but that by limiting such provision it would become valid and enforceable,then such provision shall
be deemed to be written,construed, and enforced as so limited.
14. MUTUAL DRAFTING. The Parties agree that the terms and conditions of this Agreement are the result of negotiations
between the Parties and that this Agreement shall not be construed in favor of or against any party by reason of the extent
to which any party or its professionals participated in the drafting of this Agreement.
................................... ....._,... ............,.,
Agency-Vitality Master Services Agreement, BAA and SOW 5
% 16
vi"
nVI
15. WAIVER. The failure of either Party to enforce any provision of this Agreement shall not be construed as a waiver or
limitation of that party's right to subsequently enforce and compel strict compliance with every provision of this Agreement.
16. DELEGATION AND ASSIGNMENT. Other than to an Affiliate,neither Party shall delegate its duties or assign its rights
under this Agreement,in whole or in part,without the prior written consent of the other party.
17. FORCE MAJEURE. Neither Party shall be liable nor deemed to be in default for any delay or failure in performance under
this Agreement nor other interruption of service resulting,directly or indirectly,from a Force Majeure. Nothing in this Section
shall excuse any obligations for payment of money owed hereunder.
18. COUNTERPARTS. This Agreement may be executed in counterparts,each of which shall be deemed an original and all of
which together shall constitute but one and the same instrument.
19. APPLICABLE LAW. This Agreement shall be governed by and construed in accordance with the laws of the State of
Washington without giving effect to principles respecting conflicts of laws. Any action pursuant to this Agreement shall be
brought and tried in a court of competent jurisdiction in the State of Washington and County of King,and each party hereby
irrevocably consents to the personal and subject matter jurisdiction of any such court.
20. NOTICES. Any notice, request,demand or communication required or permitted hereunder("Notices")shall be given in
writing by certified mail,return receipt requested,to the party to be notified. All Notices shall be deemed given and received
three(3)days after mailing to the address specified as follows:
TO:CUSTOMER To:The Vitality Group,LLC
CITY OF VENT,AWASH INGTON MUNICIPAL CORPORATION
Company: Vitality
Street Address:, - s- 200 West Monroe St.,Suite 1900
City, State Zip Cod WA qikS9' Chicago, IL 60606
Attn: A14A }�, Attn: Office of the General Counsel
INTENDING TO BE BOUND,this Agreement has been duly executed by the authorized representatives of the parties
set forth below.
CUSTOMER THE VITALITY GROUP,LLC
B : By:
Name: � �4✓ Name:
Title: Title:
Dated: l Dated:
...........................................................................................................................................................................
Agency-Vitality Master Services Agreement, BAA and SOW 6
EXHIBIT A
BUSINESS ASSOCIATE PRIVACY AND SECURITY AGREEMENT
THIS BUSINESS ASSOCIATE PRIVACY AND SECURITY AGREEMENT(the"BAA")effective as of the date of the
last signature by and between The Vitality Group,LLC("Business Associate")and the CITY OF KENT,A WASHINGTON MUNICIPAL CORPORATION HEALTH PLAN
(the"Covered Entity")sponsored by CITY OF KENT,A WASHINGTON MUNICIPAL CORPORATION ("Customer")which makes this BAA for and on
behalf of the Covered Entity. The purpose of this BAA is to set forth the mutual obligations of the parties regarding the
protection of the privacy of medical information subject to the Health Insurance Portability and Accountability Act of 1996 and
the associated regulations(45 C.F.R. parts 160-164,as may be amended,including the"Privacy Rule"and the"Security
Rule")("HIPAA")and the Health Information Technology for Economic and Clinical Health Act and the associated regulations,
as may be amended("HITECH"). "HIPAA"and"HITECH"are collectively referred to in this BAA as"HIPAA."
1. DEFINITIONS.Certain defined terms used in this Agreement shall have the meanings specified in this Article 1. Certain
additional terms are defined elsewhere in this BAA.All other terms used,but not otherwise defined,in this BAA shall have
the same meaning as those terms in 45 CFR 160.103.
1.1. "Data Aggregation"means the combining of Protected Health Information created or received by Business Associate
in its capacity as a business associate of the Covered Entity with the Protected Health Information received by
Business Associate in its capacity as a business associate of another covered entity to permit data analyses that
relate to the health care operations of the respective covered entities.
1.2. "Designated Record Set"means a group of records maintained for the Covered Entity that is(i)the medical records
and billing records about individuals maintained by or for a covered health care provider;(ii)the enrollment,payment,
claims adjudication,and case or medical management record systems maintained by or for a health plan;or(iii)Used,
in whole or in part,by or for the Covered Entity to make decisions about individuals. For the purposes of this
definition,"record"means any item,collection,or grouping of information that includes Protected Health Information
and is maintained,collected,Used,or disseminated by or for the Covered Entity.
1.3. "Disclose"or"Disclosure"means release,transfer,provision of access to,or divulging in another manner,of
information outside the entity holding the information.
1.4. "Electronic Media"means(i)electronic storage media including memory devices in computers(hard drives)and any
removable/transportable digital memory medium,such as magnetic tape or disk,optical disk,or digital memory card,
or(ii)transmission media Used to exchange information already in electronic storage media. For the purposes of this
definition,"transmission media"include,for example,the internet(wide-open),extranet(using internet technology to
link a business with information accessible only to collaborating parties),leased lines,dialup lines,private networks,
and the physical movement of removable/transportable electronic storage media. Certain transmissions,including of
paper,via facsimile,and of voice,via telephone,are not considered to be transmissions via electronic media,because
the information being exchanged did not exist in electronic form before the transmission.
1.5. "Electronic PHI'means individually identifiable Protected Health Information that is transmitted by or maintained in
Electronic Media.
1.6. "HITECH"means the Health Information Technology for Economic and Clinical Health Act,found in Title XIII of the
American Recovery and Reinvestment Act of 2009,Public Law 111-005.
1.7. "Individual'means the person who is the subject of Protected Health Information and shall include a person who
qualifies as a personal representative in accordance with 45 CFR 164.502(g).
1.8. `Protected Health Information"or"PHI"means information that is created or received by Business Associate from or
on behalf of the Covered Entity and is information about an Individual,whether oral or recorded in any form or
medium:(i)that relates to the past,present or future physical or mental condition of an Individual;the provision of
health care to an Individual;or the past,present or future payment for the provision of health care to an individual,and
(ii)that identifies the Individual or with respect to which there is a reasonable basis to believe the information can be
Used to identify the individual.PHI does not include individually identifiable health information in: (a)education
records covered by the Family Educational Right and Privacy Act,as amended,20 U.S.C. 1232g;and(b)records
.................................................................................................................. .............................................................
Agency-Vitality Master Services Agreement, BAA and SOW 7
V t
i TM
described at 20 U.S.C. 1232g(a)(4)(B)(iv). PHI also does not include individually identifiable health information
maintained by an entity in its role as an employer.
1.9. "Required By Law"means a mandate contained in law that compels a Covered Entity to make a Use or Disclosure of
Protected Health Information and that is enforceable in a court of law. Required By Law includes, but is not limited to,
court orders and court-ordered warrants;subpoenas or summons issued by a court,grand jury, a governmental or
tribal inspector general,or an administrative body authorized to require the production of information, a civil or an
authorized investigative demand; Medicare conditions of participation with respect to health care providers
participating in the program;and statutes or regulations that require the production of information,including statutes or
regulations that require such information if payment is sought under a government program providing public benefits.
1.10. "Secretary"means the Secretary of Health and Human Services(HHS)or any other officer or employee of HHS to
whom the authority involved has been delegated.
1.11. "Security Incident"means the attempted or successful unauthorized access, Use,disclosure, modification,or
destruction of information or interference with system operations in an information system. Inconsequential incidents
that occur on a daily basis,such as scans,pings or unsuccessful attempts to penetrate Business Associate's
networks or servers containing electronic PHI shall not be considered a Security Incident subject to reporting, unless
so required by the Privacy Rule.
1.12. "Use"means the sharing,employment, application,utilization,examination,or analysis of information.
2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE
2.1. Business Associate agrees to not Use or further Disclose Protected Health Information other than as permitted or
required by this BAA or as Required By Law. Business Associate will comply with the Privacy Rule requirements
applicable to Covered Entity if and to the extent Business Associate's performance of the services involves carrying
out Covered Entity's Privacy Rule obligations.
2.2. Business Associate shall develop, implement, maintain,and use appropriate safeguards to prevent any Use or
Disclosure of the PHI or Electronic PHI other than as provided by this BAA,and to implement administrative, physical,
and technical safeguards as required by section 164 of Title 45,Code of Federal Regulations and HITECH in order to
protect the confidentiality, integrity,and availability of Electronic PHI or PHI that Business Associate creates,receives,
maintains,or transmits,to the same extent as if Business Associate were a Covered Entity, See HITECH§ 13401.
Business Associate will comply with the applicable requirements of the Security Rule and Business Associate will
provide a description of such safeguards to Covered Entity,upon request. Business Associate further agrees to
monitor HIPAA privacy and security requirements imposed by future laws and regulations and to timely comply with
such requirements when acting for or on behalf of the Covered Entity in its capacity of Business Associate.
2.3. Business Associate will as soon as practicable report in writing to Covered Entity,upon discovery, any Security
Incident or Breach (as defined below)by it or any of its employees,directors,officers, agents,subcontractors or
representatives concerning the Use or Disclosure of PHI. For purposes of this BAA, "Breach"means any acquisition,
access,Use or Disclosure of PHI under this BAA that is(a)in violation of HIPAA or(b)not permitted under this BAA.
Business Associate will be deemed to have discovered a Breach as of the first day on which the Breach is,or should
reasonably have been, known to(a)Business Associate or(b)any employee,officer,or other agent of Business
Associate other than the individual committing the Breach. Business Associate further will investigate the Breach and
provide to Covered Entity, as soon as possible,all information Covered Entity may require to make notifications of the
Breach to Individuals and/or other persons or entities("Notifications"). Business Associate will cooperate with
Covered Entity in addressing the Breach. Business Associate will not notify Individuals or other persons or entities of
the Breach without the express written consent of Covered Entity. Covered Entity may elect, in its sole discretion,for
Business Associate to make the Notifications and implement other mitigation steps, in a form and manner and within
timeframes reasonably directed by Covered Entity,consistent with Covered Entity's legal obligations. Without
limitation as to any other remedies available to Covered Entity under this BAA or the law, Business Associate will pay,
or reimburse Covered Entity for all costs incurred in connection with provision of Notifications, including all costs
incurred to mitigate the harmful effects,or potentially harmful effects,of the Breach. Business Associate will establish
and implement procedures and other reasonable efforts for mitigating,to the greatest extent possible,any harmful
effects arising from any improper Use and/or Disclosure of PHI.
........................................................................._ _ ............................................
Agency-Vitality Master Services Agreement, BAA and SOW 8
V
s TM
2.4. Business Associate agrees to ensure that any agent, including a subcontractor,to whom it provides Protected Health
Information received from,or created or received by Business Associate on behalf of the Covered Entity agrees to the
same restrictions and conditions that apply through this BAA to Business Associate with respect to such information.
Moreover, Business Associate agrees to ensure that any such agent or subcontractor agrees to implement
reasonable and appropriate safeguards to protect the Covered Entity's PHI.
2.5. Business Associate agrees to provide access, at the request of the Covered Entity,and in a time and manner
mutually agreed upon by Business Associate and the Covered Entity,to Protected Health Information in a Designated
Record Set,to the Covered Entity or,as directed by the Covered Entity,to an Individual in order to meet the
requirements under HIPAA.
2.6. Business Associate agrees to make any amendment(s)to Protected Health Information in a Designated Record Set
that the Covered Entity directs or agrees to pursuant to 45 CFR 164.526 at the request of the Covered Entity or an
Individual,and in the time and manner mutually agreed upon by Business Associate and the Covered Entity.
2.7. Business Associate agrees to make internal practices, books,and records, including policies and procedures and
Protected Health Information, relating to the Use and Disclosure of Protected Health Information received from,or
created or received by Business Associate on behalf of,the Covered Entity available to the Secretary, in a time and
manner mutually agreed upon by Business Associate and the Covered Entity or as designated by the Secretary,for
purposes of the Secretary determining the Covered Entity's compliance with the Privacy Rule.
2.8. Business Associate agrees to document such Disclosures of Protected Health Information and information related to
such Disclosures as would be required for the Covered Entity to respond to a request by an Individual for an
accounting of Disclosures of Protected Health Information in accordance with 45 CFR 164.528.
2.9. Business Associate agrees to provide to the Covered Entity or an Individual, in the time and manner mutually agreed
upon by Business Associate and the Covered Entity,information collected in accordance with this BAA,to permit the
Covered Entity to respond to a request by an Individual for an accounting of Disclosures of Protected Health
Information in accordance with 45 CFR 164.528.
2.10, Business Associate agrees to satisfy all applicable provisions of HIPAA standards for electronic transactions and code
sets,also known at Electronic Data Interchange(EDI)Standards, at 45 CFR Part 162. Business Associate further
agrees to ensure that any agent,including a subcontractor,that conducts standard transactions on its behalf,will
comply with the EDI Standards. Notwithstanding the foregoing,the parties agree that any communications between
Business Associate and Covered Entity that are not required to meet the EDI standards shall be in such format as
Business Associate and Covered Entity shall jointly determine.
2.11. Business Associate and its agents or subcontractors, if any,shall only request, Use and Disclose the minimum
amount of PHI necessary to accomplish the purpose of the request, Use or Disclosure. Business Associate agrees to
comply with the Secretary's guidance on what constitutes minimum necessary. See HITECH§ 13405.
2.12. Business Associate agrees to restrict the Use or Disclosure of Protected Health Information, and document those
restrictions,at the request of the Covered Entity pursuant to 45 CFR 164.522(a), in a prompt and reasonable manner
consistent with the HIPAA regulations.
2.13. Business Associate agrees to accommodate alternative means or alternative locations to communicate Protected
Health Information, and document those alternative means or alternative locations,at the request of Covered Entity or
an Individual pursuant to 45 CFR 164.522(b), in a prompt and reasonable manner consistent with the HIPAA
regulations.
3. PERMITTED OR REQUIRED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
3.1. General Use and Disclosures
3.1.1. Except as otherwise limited in this BAA, Business Associate may Use or Disclose Protected Health Information
to perform functions, activities,or services for,or on behalf of,Covered Entity as specified in any related
contract with Covered Entity and in this BAA, provided that such Use or Disclosure of Protected Health
.................................... ._...,.. .,. .._... ,........
Agency-Vitality Master Services Agreement, BAA and SOW 9
V tA %
i"
TM
Information would not violate the Privacy Rule,including the minimum necessary requirement, if done by
Covered Entity.
3.1.2. Business Associate shall share Protected Health Information as reasonably requested by Covered Entity with
Covered Entity and the Centers for Medicare and Medicaid Services(CMS),and with their agents and any other
parties permitted by CMS guidance(including CMS's FAQ#5482),where the Covered Entity is submitting to
CMS the Protected Health Information required by 42 CFR 423.884 for Medicare's retiree drug subsidy
program.
3.1.3. Business Associate shall share Protected Health Information with authorized Customer employees as
reasonably requested by Customer to carry out Customer's responsibilities as plan administrator of the Plan(s),
including,without limitation,for purposes of auditing the performance of Business Associate.
3.2. Additional use and disclosure.
3.2.1. Except as otherwise limited in this BAA, Business Associate may use Protected Health Information for the
proper management and administration of the Business Associate or to carry out the legal responsibilities of the
Business Associate.
3.2.2. Except as otherwise limited in this BAA,Business Associate may Disclose Protected Health Information for the
proper management and administration of the Business Associate, provided that such Disclosures are Required
By Law, or Business Associate obtains reasonable assurances from the person to whom the information is
Disclosed that it will remain confidential and be used or further Disclosed only as Required By Law or for the
purpose for which it was Disclosed to the person,and the person notifies the Business Associate of any
instances of which it is aware in which the confidentiality of the information has been breached.
3.2.3. Except as otherwise limited in this BAA, Business Associate may Use Protected Health Information to provide
Data Aggregation services to Covered Entity as permitted by 45 CFR 164.504(e)(2)(i)(B).
3.2.4. Business Associate may Use Protected Health Information to report violations of law to appropriate Federal and
State authorities,consistent with 45 CFR 164.5020)(1).
4. OBLIGATIONS OF THE COVERED ENTITY
4.1. The Covered Entity shall provide Business Associate with a list of person(s)designated by the Covered Entity as the
persons(s)to whom it is permissible for Business Associate to Disclose Protected Health Information. The Covered
Entity shall immediately notify Business Associate of any changes in such list of designated persons(s).
4.2. The Covered Entity shall provide Business Associate with a copy of the plan document for the(any)health plan
covered under this BAA,as well as provide notification of any changes to such document.
4.3. The Covered Entity shall provide Business Associate with the notice of privacy practices that the Covered Entity
produces in accordance with 45 CFR 164.520,as well as any changes to such notice.
4.4. The Covered Entity shall provide Business Associate with any changes in,or revocation of, permission by an
Individual to Use or Disclose Protected Health Information, if such changes affect Business Associate's permitted or
required Uses and Disclosures.
4.5. The Covered Entity shall notify Business Associate of any restriction to the Use or Disclosure of Protected Health
Information that the Covered Entity has agreed to or must comply with in accordance with 45 CFR 164.522 and
HITECH§ 13405(a).
5. PERMISSIBLE REQUESTS BY THE COVERED ENTITY.The Covered Entity shall not request Business Associate to Use
or Disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by the
Covered Entity,except that Business Associate may Use PHI in its possession(i)for Business Associate's proper
management and administrative services,or(ii)to provide Data Aggregation services to the Covered Entity as permitted by
45 CFR 164.504(e)(2)(i)(B).
6. TERM AND TERMINATION OF THE BAA
6.1. Term. This BAA shall be effective as of the date of this BAA's execution. This BAA shall terminate when all of the
Protected Health Information provided by the Covered Entity to Business Associate,or created or received by
Business Associate on behalf of the Covered Entity, is destroyed or returned to the Covered Entity,or, if it is infeasible
_........ ,,_ ................................... ... ..... ...........
Agency-Vitality Master Services Agreement, BAA and SOW 10
TM
to return or destroy Protected Health Information, protections are extended to such information,in accordance with
the termination provisions of this Article.
6.2, Termination for Cause. Upon the Covered Entity's knowledge of a material breach by Business Associate,the
Covered Entity shall provide an opportunity for Business Associate to cure the breach or end the violation and
terminate this BAA if Business Associate does not cure the breach or end the violation within the time period mutually
agreed upon by Business Associate and the Covered Entity,or immediately terminate this BAA if Business Associate
has breached a material term of this BAA and Business Associate and the Covered Entity agree that cure is not
possible.
6.3. Effect of Termination.
6.3.1. In the event that Business Associate Uses or Discloses PHI for its own management and administration or to
carry out its legal responsibilities and Business Associate determines that it needs to retain such PHI for such
purposes following termination of this BAA,Business Associate shall retain only that PHI which is necessary for
Business Associate to continue its proper management and administration or to abide by its legal record
retention policies and needs for legal archival purposes and shall return to the Plan (or, if agreed to by the Plan,
destroy)the remaining PHI that Business Associate still maintains in any form. Business Associate shall
continue to use appropriate safeguards and comply with the Privacy Standards and Security Standards with
respect to PHI to prevent Use or Disclosure of such PHI,other than as provided for in this subparagraph,for as
long as Business Associate retains the PHI. Business Associate shall not Use or Disclose the PHI retained by
Business Associate other than for the purposes for which such PHI was retained and subject to the same
conditions set out in this BAA which applied prior to termination. Business Associate shall return to the Plan(or,
if agreed to by the Plan,destroy)the PHI retained by Business Associate when it is no longer needed by
Business Associate for its proper management and administration or to carry out its legal responsibilities.
6.3.2. In the event that Business Associate determines that returning(or, if applicable,destroying)PHI is not feasible,
Business Associate shall extend the protections of this BAA to the PHI and limit further Use and Disclosure to
those purposes that make the return(or destruction)infeasible for so long as Business Associate maintains
such PHI,but in no event less than six(6)years after the creation or last Use or Disclosure of such PHI.
Business Associate may charge a fee if it is required to maintain any such records following termination of this
BAA.
7. Regulatory Reference. A reference in this BAA to a section in the Privacy Rule or to a section of the Code of Federal
Regulations means the section as in effect or as amended,and for which compliance is required.
8. Amendment. The Covered Entity and Business Associate agree to take such action as is necessary to amend this BAA
from time to time as is necessary for the Covered Entity to comply with the requirements of the Privacy Rule and HIPAA,
including HITECH. This BAA may be amended by the Covered Entity and Business Associate by the express mutual
written agreement of both parties. This BAA contains the entire Business Associate Privacy and Security BAA between the
parties and supersedes all other understandings and agreements,oral or written,between the parties regarding privacy of
Protected Health Information.
9. Survival. The respective rights and obligations of Business Associate under Section 6.3 of this BAA shall survive the
termination of this BAK
10, Interpretation. Any ambiguity in this BAA shall be resolved in favor of a meaning that permits the Covered Entity to comply
with the Privacy Rule. When a section of the BAA calls for Business Associate to respond to a request from the Covered
Entity in conjunction with a regulation specifically cited in the section, Business Associate may rely on the Covered Entity's
request as verification by the Covered Entity that the request is made in compliance with the regulation. Business Associate
is not responsible for confirming that the Covered Entity's request is made in compliance with the specific regulation.
11. MISCELLANEOUS.
11.1. This BAA shall be governed by HIPAA and,where not covered by HIPAA or other federal law,the laws of the State of
Illinois. Where the context of the BAA requires,the singular shall include the plural and the masculine gender shall
include the feminine. Headings or titles of sections are for general information only and this BAA shall not be
construed by reference to such titles.
......................................................................................................
Agency-Vitality Master Services Agreement, BAA and SOW 11
V IA
i"* TM
11.2. This BAA shall be binding upon and inure to the benefit of the parties hereto and their respective successors and
permitted assigns. If any provision of this BAA is held invalid or unenforceable,such invalidity or unenforceability
shall not affect any other provision,and this BAA shall be construed and enforced as if such provision had not been
included.
11.3. Nothing express or implied in this BAA is intended to confer,nor shall anything herein confer,upon any person other
than Business Associate,or the Covered Entity and their respective successors or assigns,any rights,remedies,
obligations or liabilities whatsoever.
11.4. The parties hereto have executed this BAA as of the date set forth below,and understand that it is a binding,legal
contract.
INTENDING TO BE BOUND,this BAA has been duly executed by the authorized representatives of the parties set forth
below.
CUSTOMER(ON BEHALF OF COV ENTITY) THE VITALITY GROUP,LLC
s;Da ,r),a2=TQ11 By:
Name: ty6A_A Name:
Title: Title:
Dated: Dated:
.................................................................................................................................................................................
Agency-Vitality Master Services Agreement, BAA and SOW 12