Loading...
HomeMy WebLinkAboutA6334 - TRANSCENT TECHNOLOGIES GROUP INC - BENEFIT SERVICES SOFTWARE P,6V) Transcend Technologies Group,Inc.Technology and Services Agreement This Technology and Services Agreement entered Into between Transcend Technologies Group,Inc.Idba benefitscoenml,a California Corporation with its principal offices located at 31012infandel Drive,Suite 200,Rancho Cordova,CA 95670(hereafter TTG)and Employer,whose name and principal business address are set forth below,collectively"the Parties',determines the rights and obligations of TTG and Employer with respect to the subject matter of this Agreement. All capitalized terms are defined in section 3.0 below unless specifically stated otherwise. Effective Date: The first day ofAprlf 2013 Employer Name: City of Palm Springs Address: 3200 East Tahquitz Canyon Way City,State,Postal Code: Palm Springs,California 92262 1.0 Agreement and Term trademarks, sales marks, service marks, trade names, marketing 1.1 During the Term and in accordance with this Agreement: (i) TTG materials, distinguishing images or computer graphics, words, grants Employer a nonexclusive, nontransferable right to use the combination of words,audio recordings,computerized icons,Internet Software for the sole purpose of agency management and/or the domain names or sub-names,or other TTG-related items used by TTG administration of employee benefits for the employees of Employer In promotion or providing the Software Services or any services and Employer Customers, (if)TTG shall render and Employer shall relating thereto at any time prior to, during,or subsequent to the license the Software,Training and Maintenance&Support, termination of this Agreement. 1.2 Employer has the option to purchase Services, Outsourcing, 3,10 "Maintenance"means the TTG services that shall Include:(i)providing Fulfillment and other Professional Services. and Installing on TTG equipment any Enhancements to the Software, 1.3 This Agreement shall commence on the Effective Date and, unless (ii) providing and installing on TTG equipment any Maintenance sooner terminated under Section 8.0 herein,shall continue for three Modifications to the Software. (3) years ("Initial Period'). Thereafter, this Agreement shall 3.11 "Maintenance Modifications" means modifications, updates or automatically renew for successive periods of one (1) year each revisions made by TTG at Its sole discretion to the Object Code of the ("Renewal Period")unless a Party gives the other Party written notice Software or to the User Manual relating thereto that correct effors or of non-renewal at least sixty(60) days before the expiration date of support a new release of the operating system. the then current Renewal Period. 3.12 "Module"means a unit of Software that adds additional functionality to the base Software. 2.0 Commencement of Service 313 "Object Code" means computer code In machine-readable, 2.1 Commenting on the Effective Date, TTG shall provide Software, executable form, generated by compilation of source code and Training, Maintenance and Support, Billing, Outsourcing and contained in a medium that permits Rio be loaded into and operated Fulfillment services according to the availability of TTG's Service on computers, and including any runtime modules or programming Schedules. Employer may also contract for Professional Services as object libraries,text or graphic files or other data structures or code more specifically set forth in section 3.15. components necessary for the operational use of the Software. 2.2 Employer understands that TTG's availability to perform these 3,14 "Outsourcing" means the initial setup by TTG of Employer and Its Services shall be provided on a"first-come,first-served"basis. employees within the Software, including, but not limited to, the configuration of the Employer's company,divisions(business units or 3.0 Definitions locations),employment categories,payroll schedules,employee and 3.1 "Administrator Account"means any user profile with access to more dependent census,current enrollment elections,vendors,outline of than one Employee Record, benefits,plan designs,qualifying events and enrollment waivers. 3.2 "Agreement"means this Technology and Services Agreement and any 3.15 "Professional Services"means the TTG services that are specified in a exhibits, attached hereto, or otherwise Incorporated herein by Project Authorization Form. The Professional Services may Include, reference. without limitation, the following types of services: data collection, 3.3 "Project Authorization Form"means the TTG standard form that sets consulting, design, coding, testing, installation, configuration and forth a description of the Services and/or the Professional Services to training. be provided by TTG to Employer and requires Employers signature to 3.16 "Services"shall mean the Software,Training,Billing,Maintenance and authorize the work to be performed.The Project Authorization Form Support,Employer setup,and outsourced carrier fulfillment provided may also reference a Statement of Work document when the by TTG to Employer. Employer has requested Services and/or Professional Services that are 3.17 "Service Schedules" means the queue of TTG's current Training, to be Invoiced at the hourly rate. Each Project Authorization form Outsourcing and fulfillment availability maintained on a first-come, Will be governed by the terms of this Agreement and,if there Is a first-serve basis. conflict between a Project Authorization Form and this Agreement, 3.18 "Software" means the benefitRONNECT' and/or agencystatucra the terms of this Agreement shall prevail. application program installed in Object Code format, any updates, 3.4 "Employer"means the business entity Identified above,which entity's revisions, new versions, supplements, all permitted copies of the employees have authorized the Employer to access and enter foregoing supplied by TTG to Employer,related documentation,and employee Information Into the Software. media,whether in machine readable or printed form;for the purpose 3.5 "Effective Date"means the date entered in the outlined boxabove. of Employer's enrollment and administration of employee benefits 3.6 "EnhancemenW means modifications, additions or substitutions, and/or agency management. other than Maintenance Modifications,made by TTG to the Software 3.19 "Statement of Work" means the TTG standard document that sets at its sole discretion that accomplish Incidental, performance, forth a description of the Professional Services to be provided on an structural or functional Improvements to the Software,to the extent hourly basis by TTG to Employer. that TTG elects to develop such Enhancements. Provided,however, 3.20 "Support" means the TTG services that Include providing Employer and notwithstanding the foregoing, new application Modules which telephone and e-mail support during TTG's normal business hours for TTG markets separately from the Software shall not be included in the the purpose of enabling Employer to obtain information or resolve definition of Enhancements, questions pertaining to the use of the Software. 3.7 "Employee Record" means the collection of related items of 3.21 'Term"means the Initial Period and any successive Renewal Periods. Information about an Individual,treated as a unit,and stored in the 3.22 "Training" means the phone or classroom training sessions made Software database. available to Employer by TTG,which are designed to educate and 3.8 "Fulfillment'means TTG's process of developing,testing,extracting, train on the step-by-step processes of configuring,administering and delivering,supporting and monitoring data from the Software in an selling the Software and its different modules. electronic and secure format, Including but not limited to portable 3.23 "User Manual" means the user documentation for the Software document format (PDF), Microsoft Excel (XLS), delimited or fixed provided by TTG to Employer In printed or in electronic format and length text (TXT) or Extensible Markup Language fXML) formatted which may be amended from time to time by TTG, files. 3.24 The singular and plural shall each Include the other, and this 3.9 "Intellectual Property Rights" means all copyrights, confidentiality Agreement shall be read accordingly when required by the facts. rights, trade secret rights, patent rights and other intellectual property rights which shall include, but not be limited to TTG's ownership of the Software and the TTG trademark and any other IN'WTTG Technology and Services Agreement 2013,Employer Direct.Updated 02/04/13. b e 1't e f 1455 CO N N E C T'^A 1 4.0 Obligations 6.0 Fees 4.2 All of the obligations of TTG or its designee to provide Services and/or 6.1 All amounts due under this Agreement shall be paid in United States Professional Services under this Agreement are conditioned upon Dollars IUSD). Employer's provision and maintenance,at Employers sole expense, 6.2 Per-Employee-Per-Month("PEPM")Fees-In consideration for any of Employer's hardware, third party software products, operating Software and Services provided hereunder that are specified in systems,database systems and communications equipment required Exhibit D as being provided on a PEPM basis,Employer agrees to pay to connect to,access and use the Software. TTG,commencing with the Effective Date of this Agreement,a PEPM 4.2 Employer shall not copy,transfer,modify,translate,reverse engineer, fee, computed by multiplying the number of Employee Records decompile or disassemble the Software and shall take all measures (classified as Active,COBRA,FMtA or Retired)by the PEPM rate listed necessary to prevent others within Its control from doing or in Exhibit D, according to the terms of TTG's standard monthly attempting the same, invoice, net fifteen (15) days. Employer further agrees that the 4.3 Employer shall not remove, attempt to remove, modify or obscure number and classification of Employee Records stored In the Software any copyright, trademark, patent or other proprietary notices from database one week prior to the end of each calendar month shall be a the Software,User Manual or any portion thereof,Including without bona fide and accurate representation of the number and limitation,any component of the Software code of any kind or form classification of Employee Records stored in the Software database which may be provided to Employer to enable Employer to access over the course of the month. and/or use the Software. 6.3 Minimum Fees - In the event that the monthly charge for PEPM 4.4 If TTG determines that a service issue reported by Employer Is(I)due services does not meet or exceed the monthly"Minimum" amount to modification of the Software by Employeror an unauthorized third specified in Exhibit D, Employer agrees to pay TTG the monthly party,(il)a result of Employers failure to comply with the operating Minimum amount,according to the terms of TTG's standard invoice, instructions set forth in the current version of the User Manuals,(fii) 6.4 Non-PEPM Fees - In consideration for any Software and Services due to Employer's failure to comply with the terms of this Agreement, provided hereunder that are not included as PEPM services(including, then all of TTG's time and expenses associated with providing support but not limited to one-time EDI setup fees,one-time account setup relating to or correcting such problem,shall be Involced to Employer fees, per-occurrence training fees, monthly data management fees, by TTG at the current Professional Services hourly rate and such etc.), Employer agrees to pay TTG the rates listed in Exhibit D, Invoice shall be paid by Employer subject to the provisions of this according to the terms of TTG's standard invoice. Agreement. 6.5 Travel Fees-TTG shall provide Employer and Employers designated 4.5 TTG does not guarantee Its ability to exchange data electronically with employees with two(2)days of training In the use of the Software at benefit providers or other third party systems.TTG Is not responsible no additional cost to the Employer; including without limitation all for the integrity of the data transmitted electronically between travel expenses Employer, benefit providers and third party systems. TTG reserves 6.6 Other Fees-If TTG is to incur any additional fees or expenses that are the right,in Its sole discretion,to charge Fulfillment service fees to not within the scope of the Services, TTG shall notify Employer in Employer for providing electronic data exchange capabilities between advance for approval,and Employer shall pay the approved additional Employer,benefit providers and other third party systems, fees or expenses within the terms of the Invoice. Upon completion of Implementation. 5.0 Ownership and Confidentiality 6.7 Employer shall pay or reimburse TTG and shall be responsible for and 5.1 Employer understands and agrees It has no right, title, interest or shall Indemnify,defend and hold TTG harmless from any applicable ownership in, or to, the Software, User Manuals, or any of its sales,use,excise,value added,utility or similar or other taxes related components, programming code or data structures, or any other to the fees and services provided under this Agreement. materials provided to Employer related to the use of the Software,or 6.8 Unless specified otherwise in Exhibit D,the Fees shown in Exhibit D any copies or modifications of the Software, User Manuals, or any shall remain In effect for the duration of the contract, subject to components, code or data structures thereof or in the Software or change annually on April 1,2016.TTG reserves the right to increase any other materials provided to Employer related to the use of the Its Fees for any Initial or Renewal Period of this Agreement to current Software,except to the extent that TTG grants Employer the right to prevailing rates. use the Software,User Manual and related materials. 6.9 Any late payment shall accrue interest at the lesser of eighteen(18) 5.2 Employer understands and agrees that the Software, User Manuals, percent per annum of the late amount or the maximum amount related materials and all security information and passwords Issued allowed bylaw. for access to the Software (collectively "TTG Confidential Information") constitutes confidential and proprietary information 7.0 Discounts/Commission Splits and trade secrets of TTG or Its suppliers.Employer shall maintain all 7.1 Broker an Record has discounts available when using a TTG carrier TTG Confidential Information in strict confidence and shall not partner. publish, communicate, disclose or permit to be disclosed such 7.2 Discount is not available if Business Associate's contract Is in Information in any way to third parties. Employer agrees to take all conflict with TTG's contract with the same carrier where discount appropriate steps to ensure that all persons having access to the is being provided. Software or User Manuals shall refrain from any unauthorized 7.3 To receive discount, initial enrollment period needs to have a reproduction or disclosure of TTG's Confidential Information, minimum of 20%participation in the product offering that triggers Notwithstanding anything to the contrary herein,TTG's Confidential the discount to be In place. For every 1%below the minimum Information shall not Include information that; (I) is known or participation,10%will be reduced from the discount provided. available through other lawful sources not bound by a confidentiality 7.4 All discounts to be applied after the initial open enrollment closes obligation to TTG,(If)is or becomes publicly known through no fault and verification that participation numbers have been met. of the receiving party at Its agents, {IS) is required to be disclosed 7.5 Discounts are able to continue In 0 new products are offered In pursuant to law or court order,provided that the discloser provides subsequent years along with the same participation requirements TTG with reasonable prior notice of any such compulsory disclosure as In section 7.3. and permits TTG to object,Intervene or appeal such order. 7.6 Review of Discounts,commission splits,overrides and PEPM fees 5.3 TTG understands and agrees that any Employer and/or employee data received will take place annually. TTG reserves the right to remove generated and stored by the Software on behalf of Employer by or any discounts or offerings at the sole discretion of TTG. through Employer's use of the Software constitutes confidential and proprietary information and trade secrets of Employer and shall 9.0 Termination remain Employers sole and exclusive property. TTG shall maintain 8.1 TTG may terminate this Agreement upon any of the following events; Employer and/or Employee data In strict confidence and shall not 8.1.1 If Employer falls to pay any amounts due to TTG within thirty(30) publish, communicate, disclose, or permit to be disclosed such business days after Employers receipt of written notice of such Information In any way to third parties. TTG agrees to take all nonpayment from TTG; appropriate steps to ensure that all persons having access to any 8.1.2 If Employer breaches any Intellectual Property Rights ofTTG or Its Employer and/or employee data shall refrain from any unauthorized suppliers in the Software; reproduction or disclosure of Employer and/or employee data. 8.1.3 If Employer attempts to manipulate the number of Employee Records on the last day of the month. 8.1.4 If Employer breaches its confidentiality obligations under this Agreement; TTG Technology and Services Agreement 2013.Employer Direct.Updated 01/04/13. 1)1!IEI?f1't S C 0 N N EC T`^,r 2 8.1.5 If Employer breaches any of the other terms, covenants, 10.0 Indemnification restrictions or conditions of this Agreement or Its License to the 10.1 In the event any suit or claim Is brought against Employer based on a Software and fails to cure the breach within thirty (30) days claim that the authorized use of the software under this Agreement after Employer's receipt of written notice of such breach from infringes any existing Intellectual Property Rights of a third party,TTG TTG; agrees that: 8.1.6 If Employer becomes insolvent or admits a general inability to pay 10.1.1 To the extent that the claims or proof of the suit Involve claims or its debts as they become due; factual allegations that the Software infringes any existing 8A.7 If Employer makes a general assignment for the benefit of Intellectual Property Rights of a third party,TTG shall defend the creditors;or suit at Its expense and hold Employer harmless thereof, 8.1.8 If Employer files a petition in bankruptcy or is the subject of an provided however that Employer promptly notifies TTG In Involuntary petition in bankruptcy that is not dismissed within writing and gives TTG complete authority and the Information sixty(601 days after the filing date. required to defend or settle the suit; 8.2 Employer may terminate this Agreement and the rights and licenses 10.1.2 TTG shall pay any settlement of the suit or claim agreed to by TTG granted upon any of the following events: and to the extent that any judgment In any such suit is based on 8.2.1 If TTG breaches any of Its obligations under this Agreement and proof that the Software Infringes any existing intellectual fails to cure the breach within thirty(30)days after receipt of Property rights of a third party,TTG shall pay all damages and written notice of such breach from Employer; costs awarded against Employer related thereto; provided 8.2.2 If TTG becomes insolvent or admits a general Inability to pay Its however that TTG shall not be responsible for any cost,expense debts as they become due; or compromise made or incurred by Employer without TTG's 8.2.3 If TTG makes a general assignment for the benefit of creditors;or prior written consent; 8.2.4 If TTG files a petition In bankruptcy or is the subject of an 10.1.3 TTG shall allow Employer to participate In the defense of the suit Involuntary petition in bankruptcy that B not dismissed within at Employer's own expense,if Employer so elects,and sixty(60)days after the filing date. 10A.4 Notwithstanding anything to the contrary in this Agreement,TTG 8.2.5 Notwithstanding any other provision to the contract, City may shall have no obligation of indemnity with regard to any terminate this Agreement at any time,with or without cause, modifications of any kind by Employer, regardless of whether upon thirty (30) days written notice to TTG. TTG shall be such changes were authorized. entitled to all compensation for all services rendered prior to 10.2 In the event any suit or claim is brought against TTG based on a claim the effective date of the notice of termination that Employer Improperly collected, used or disseminated any 8.3 In the event of the expiration or termination of this Agreement,under Information or other data using the Software,Employer agrees that: Sections 8.1 or 8.2 herein, TTG may discontinue the Services and 10.2.1 Employer shall defend the suit at Its expense and hold TTG Employer's access to,and use of the Software,provided however,at harmless therefrom, provided however that TTG promptly the expense of the party causing the breach and upon request from notifies Employer In writing and gives Employer complete Employer, within thirty (30) days following said termination or authority and the information required to defend or settle the expiration,TTG will deliver to Employer all Employer and Employer suit; Customer data stored by the Software on TTG's or third party 10.2.2 Employer shall pay any settlements of the suit or claim agreed to equipment,as of the date of termination or expiration. by Employer and to the extent that any judgment in any such suit is based on proof that Employer improperly collected,used 9.0 Warranties and Limitations of Liability or disseminated any Information or other data using the 9.1 TTG WARRANTS THAT DURING THE TERM IT SHALL PERFORM THE Software, Employer shall pay all damages and costs awarded SERVICES UNDER THIS AGREEMENT USING COMMERCIALLY against TTG related thereto, provided however that Employer REASONABLE EFFORT. TFG SPECIFICALLY DISCLAIMS ALL OTHER shall not be responsible for any cost,expense, or compromise WARRANTIES, EXPRESS OR IMPLIED, INCLUDING,BUT NOT LIMITED made or Incurred by TTG without Employer's prior written TO,THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS consent;and FOR A PARTICULAR PURPOSE, 10.2.3 Employer shall allow TTG to participate in the defense of the suit at TTG's own expense,if TTG so elects. 9.2 EMPLOYER UNDERSTANDS AND AGREES THAT TTG'S LIABILITY FOR ANY DAMAGES SUFFERED BY EMPLOYER,WHETHER IN CONTRACT,IN 11.0 Protected Neahh Information TORT, UNDER ANY WARRANTY THEORY, IN NEGLIGENCE, OR 11.1 Employer and TTG agree to comply and modify the Agreement as OTHERWISE, SHALL NOT EXCEED THE AMOUNT PAID TO TTG BY necessary to comply with the Administrative Simplification EMPLOYER PURSUANT TO THIS AGREEMENT DURING THE ONE (1) requirements of the Health Insurance Portability and Accountability MONTH IMMEDIATELY PRIOR TO THE DATE UPON WHICH Act of 2996("HIPAA"),as set forth in Title 45, Parts 160 and 164 of EMPLOYER'S CLAIM OR CAUSE OF ACTION AROSE. the Code of Federal Regulations(the"CFR"). NOTWITHSTANDING ANYTHING TO THE CONTRARY HEREIN, TTG 11.2 Capitalized terms not otherwise defined In the Agreement shall have SHALL NOT BE LIABLE TO EMPLOYER OR OTHERS FOR PUNITIVE OR the meanings given to them In Title 45,Parts 160 and 164 of the CFR EXEMPLARY DAMAGES OR ANY SPECIAL, INDIRECT OR and are Incorporate herein by reference. CONSEQUENTIAL DAMAGES (INCLUDING LOST PROFITS) OF 11.3 Protected Health Information ("PHr) means any Information, EMPLOYER, EVEN IF TTG HAS BEEN PREVIOUSLY ADVISED OF THE whether oral or recorded in any form or medium that:(i)relates to POSSIBILITY OF SUCH DAMAGES. the past, present, or future physical or mental condition of an Individual;the provision of health care to an Individual or the past, 9.3 FURTHER,EMPLOYER UNDERSTANDS AND AGREES THAT THE USE OF present or future payment for the provision of health care to an THE SOFTWARE MAY FROM TIME TO TIME BE INTERRUPTED, AND Individual;and (il) Identifies the Individual or with respect to which TTG MAKES NO WARRANTY OR REPRESENTATION TO EMPLOYER there is a reasonable basis to believe the information can be used to THAT THE SOFTWARE WILL BE FUNCTIONAL AND AVAILABLE AT ALL identify the Individual and shall have the meaning given to such term TIMES. EMPLOYER SHALL NOT BE ENTITLED TO RECOVER FOR ANY under HIPAA and the HIPAA Privacy and Security Regulations, LOSSES, INCLUDING, WITHOUT LIMITATION, ANY LOSS OF DATA, including,but not limited to Title 45,Parts 160 and 164 of the CFR. WHICH MAY RESULT FROM SUCH INTERRUPTION OF AVAILABILITY OF The Term"PHI"includes electronic PHI as that term is defined under THE SOFTWARE. NOTWITHSTANDING ANY OTHER LIMITATION OF the Security Regulations. LIABILITY IN THIS AGREEMENT, IN THE EVENT THAT USE OF THE 11.4 Employer shall use and/or disclose PHI only to the extent necessary to SOFTWARE IS INTERRUPTED FOR MORE THAN A 24 HOUR PERIOD, satisfy Employer's obligation under the Agreement. TTG shall use TTG AGREES TO CREDIT EMPLOYER IN AN AMOUNT EQUAL TO THE and/or disclose PHI only to the extent necessary to satisfy TTG's PRORATED PEPM FEES(AS SET FORTH IN EXHIBIT D)OTHERWISE DUE obligations under the Agreement. To the extent that the parties can FROM THE EMPLOYER FOR EACH DAY THAT THE SOFTWARE IS NOT limit uses and/or disclosures of PHI to a Limited Data Set las defined FUNCTIONAL OR OTHERWISE UNAVAILABLE. in the HIPAA Regulations),each party agrees to do so. If use of a Limited Data Set is Impracticable, the party using and/or disclosing 9.4 Internet Delays. TTG's services may be subject to limitations,delays PHI will document the necessity for use of additional PHI. and other problems inherent In the use of the Internet and electronic 11.5 Neither party shall use or disclose any PHI received from or on behalf communications. TTG Is not responsible for any delays, delivery of a Covered Entity or Individual,except as permitted or required by failures or other damage resulting from such problems. the Agreement, as required by law or as otherwise authorized in writing by the respective party,a Covered Entity or an Individual. TTG Technology and Services Agreement 2013.Employer Direct.Updated 01/04/13. ben f?f I CON N ECT' �lr 3 11.6 Employer and TTG shall develop, Implement, maintain and use and effect. If any ambiguity or question of intent arises, this appropriate administrative, technical and physical safeguards to Agreement shall be construed as if drafted jointly by the Parties and prevent the improper use or disclosure of any PHI. no presumption or burden of proof shall arise favoring or disfavoring 11.7 Employer and TTG shall develop, Implement, maintain and use either Party by virtue of authorship of any of the provisions of this appropriate administrative,technical and physical security measures Agreement. in compliance with Section 1173(d)of the Social Security Act,Title 42, 12.8 Time Limitation. Except for actions for non-payment or for breach of Section 1320d-2(d)of the United States Code and Title 45,Part 160 TTG's or Its third parties Intellectual Property Rights,no action arising and Part 164 of the CFR to preserve the Integrity and confidentiality out of or relating to this Agreement may be brought later than two(2) of all electronically maintained or transmitted Health Information years after the cause of action became known to the Injured Party. received from or on behalf of a Covered Entity or Individual. 12.9 Notices. All notices required or permitted under this Agreement and Employer and TTG shall document and keep these security measures all requests for approvals,consents,and waivers must be delivered by current. a method providing for proof of delivery. A confirmed facsimile 11.8 TTG and Employer shall ensure that any employee or subcontractor to transmission shall be deemed to provide proof of delivery.Any notice whom it provides PHI agrees to the same restrictions and conditions or request will be deemed to have been given on the date of delivery. that apply through this Agreement with respect to PHI. Notices and requests must be delivered to the Parties at the 11.9 Employer shall document disclosures of PHI and Information related addresses on the first page of this Agreement until a different address to such disclosures as would be required for TTG to respond to a has been designated by notice to the other Party. request by an Individual for an accounting of disclosures of PHI In 12.10 Non-Solicitation of Employees. Neither Party shall directly solicit the accordance with Title 45,Part 164,Subpart E,Section 164.528 of the services or employment of any employee of the other Party during CFR. the Term.The soliciting Party,who violates this section 11.10,shall 11.10 Employer agrees to provide TTG or an Individual,within thirty(30) pay to the other Parry an amount equal to one(1)year's salary for days written notice,information collected in accordance with Section any solicited employee of the other Parry,as liquidated damages and 10.9 above,to permit TTG to respond to a request by an Individual for not as a penalty.The amount of annual salary shall be the annual an accounting of disclosures of PHI in accordance with Title 45,Part salary in effect at the date the employee was solicited.For purposes 164,Subpart E,Section 164.529 of the CFR. of this section 11.10,the term"employee"means current or former 11.21 TTG and Employer shall Implement a procedure for notifying each employees of the other Party who were employed by the other Party other of any breach of unsecured PHI for which notification by the within three(3)months before solicitation occurred. Employer to the affected Individuals Is required pursuant to the 12.11 Publicity. Either Party may(in any press release,advertising or other Notice Regulations published by the Secretary of Health and Human publicly-disseminated materials) refer to the other Parry, to the Services pursuant to Section 13402 of the Health Information Services provided under this Agreement, and to background Technology for Economic and Clinical Health Act (-HITECH Act"). Information leading to this Agreement, including, for example:TTG Notification of a breach of unsecured PHI will be provided to the competitors and competing products considered by Employer, net appropriate parties as soon as practicable upon discovery, but in no value of the Agreement,and Employer business needs and reasons event later than 10 calendar days after discovery. Such notice shall for selecting TTG. Before disclosing this Information publicly, the Include all Information needed for the Employer to fulfill its disclosing party shall review the factual content of the disclosures obligations under the Notice Regulations. with the other Party and obtain the other Party's consent prior to 12.0 Miscellaneous disclosure. In any event, neither Employer nor TTG shall publicly 12.1 Assignment.Employer shall not assign this Agreement or transfer,by disclose special pricing, discounts, payment terms or addenda operation of law or otherwise, any of its respective rights or contained In,or attached to,this Agreement. obligations under this Agreement(including,without limitation,by a 12.12 Entire Agreement. This Agreement and the Exhibits listed below and change in the majority ownership or control of Employer)without the referred to herein,together with any addenda signed by the Parties prior written consent of TTG,such consent shall not be unreasonably (collectively, the "Agreement"), constitute the entire agreement withheld. Any assignment or transfer in violation of this section 11.1 between TTG and Employer with respect to the License, Services, shall be void. Software and other subject matter of this Agreement,and may only 12.2 Waiver. No term or provision of this Agreement shall be deemed be modified by a written amendment or addendum signed by both waived and no breach shall be deemed excused,unless such waiver is TTG and Employer. No employee, agent or other representative of in writing and signed by the Party who is alleged to have waived the either TTG or Employer has authority to bind the other with regard to term or provision. any statement,representation,warranty,or other expression unless It 12.3 Excusable Delay, Neither TTG nor Employer shall be deemed to be in is specifically Included within the express terms of this Agreement or default of any provision of this Agreement or for any failure in a written addendum signed by both TTG and Employer.All purchase performance, resulting from acts or events beyond the reasonable orders, prior agreements, representations, statements, proposals, control of TTG or Employer,as the use may be.For purposes of this negotiations, understandings, and undertakings with respect to the Agreement,such acts shall include,but not be limited to,acts of God, subject matter of this Agreement are superseded by this Agreement. civil or military authority, civil disturbance, war,strikes,fires, other catastrophes or other such major events beyond TTG's or Employer's reasonable control. This section 11.3 shall not excuse Employer's payment obligations. 12.4 Governing Law and Dispute Resolution. This Agreement is governed by and construed in accordance with the laws of the State of California, without giving effect to any choice or conflict of law provisions,principles or rules (whether of the State of California or any other jurisdiction)that would cause the application of any laws of any jurisdiction other than the State of California. The parties agree that all claims,actions,suits and proceedings between them relating to this Agreement will be filed,tried and litigated only in the Circuit or District Courts of Sacramento County,California. In connection with the foregoing, the parties consent to the jurisdiction and venue of those courts and expressly waive any claims or defenses of lack of jurisdiction of or proper venue by those courts. 12.5 Lexal Fees and Costs. The prevailing Party shall be entitled to collect from the other Parry the prevailing Party's reasonable legal fees and costs in connection with the enforcement of this Agreement. 12.6 Independent Contractor. TTG Is providing the Services under this Agreement as an Independent contractor,and its personnel shall not be considered employees or agents of Employer. 12.7 Severance and Interpretation. If any provision of this Agreement is fpund to be unenforceable, such provision shall be deemed to be deleted or narrowly construed to such extent as Is necessary to make it enforceable and this Agreement shall otherwise remain In full force TTG Technology and Services Agreement 2013.Employer Direct.Updated 01/04113. be j'j 2 f it S CONN ECT'r`V 4 IN WITNESS WHEREOF, the parties hereto have executed this Agreement by their duly authorized officers or representatives as of the day and year set forth above. For Transcend Technologies Group,Inc.: For The City of Palm Springs: 01,,ii i k, (Signed) (Signed) Jo,f e'w, Van (Printed) (Printed) �lpSt �2H-�- I Coo (Title) —� (Title) 31z.1 Zotl X (Date) (Date/Q ORIGINAL o° TTG Technology and Services Agreement 2013.Employer Direct.Updated 01/04/13. benefltSCONNEM!QpP 5 IN WITNESS WHEREOF, the parties hereto have executed this Agreement by their duly authorized officers or representatives as of the day and year set forth above. For Transcend Technologies roup,Inc.: or The City of Palm Springs: (Signed) (Signed) Ja ere, KQ -f,6- l+ 12s e,.J (Printed) (Printed) I C00 (_i1-c{ /T�rt.r4 (Title) IZOI� March 31 3n , 3 (Date) (Date) AS TO FORM APPROVED BY CffY MANAGER ll��f25000°% Ab3311. City Attome, ATTEST: ity Clerk�� TTG Technology and Services Agreement 2013.Employer Direct.Updated 01/04/13. h G i i, j i i,CONNECT' OVJ S 1l Exhibit A Notices and Contact Information 1.0 Notices from Employer shall be sent to: Transcend Technologies Group,Inc. 31012infandel Drive,Suite 200 Rancho Cordova,CA 95670 2.0 Notices from Transcend Technologies Group shall be sent to: (Please provide Employer Contact Information) Company Name Company Street Address Company Street City Company Street State Company Street Postal Code Primary Contact Name Primary Contact Phone Number Primary Contact Fax Number Primary Contact Email Address Company Billing Address Company Billing City Company Billing State Company Billing Postal Code Billing Contact Name Billing Contact Phone Number Billing Contact Fax Number Billing Contact Email Address TTG Technology and Services Agreement 2013.Employer Direct.Updated 01/04113. (-12!i B f 1 f S CONN ECT`�`y 6 Exhibit C Optional Payment Authorization—Monthly Fees Please complete the appropriate section for your preferred method of payment.Please provide a photocopy of the credit card or voided bank check in lieu of the bank Information below along with the signed copy of this form. I authorize Transcend Technologies Group to initiate monthly deduction from my account shown below, for the amount and period specified,for payment of monthly fees. Credit Card Information Client Name: Name on Card: ❑Visa ❑MasterCard ❑American Express Card Number: Security Code: Expiration Date: Billing Address: City: State,Postal Code EFT Information Name on Account: Account Number: Bank Name: Bank Routing Number(9 digits): Invoicing Information ❑ Same as previous page Company Billing Address: Company Billing City: Company Billing State: Company Billing Postal Code: Billing Contact Name: Billing Contact Phone Number: Billing Contact Fax Number: Billing Contact Email Address: Deduct monthly payment of$ S00 once a month beginning the first day of Aril 2013. 1 understand this authority is to remain in full force and effective until Transcend Technologies Group has received written notification from me of its termination in such time and manner as to afford Transcend Technologies Group and depositor a reasonable opportunity to act upon it.I have the right to stop payment of deduction to my credit card or bank account by notification to Transcend Technologies Group thirty(30)business days or more before this payment is scheduled to be made. Signature: Date: TTG Technologyand services Agreement 2013.Employer Direct.Updated 01/04/13. ben of it SCONNECT`�`r 8 b en ef it • Exhibit D benefitSCONNECT® Pricing — The City of Palm Springs Enrollment & Administration Pricing-Enrollment services include software access for the broker, employer, and employee, implementation and support, and unlimited carrier connectivity. 1 2 Pricing is calculated on a Per Employee Per Month (PEPM) basis as shown below. At the end of each month, the number of Active, COBRA, FIALA and Retired employees in your system are tallied and you are billed accordingly. There is no charge for Inactive,Terminated,or Deceased employee records. Dependent Data/Existing Election Set-up Fee - $1.00 per employee per plan type (calculated as total number of employees multiplied by total number of plans, $3,000 minimum).; Waived if group comes on within 6 months of plan renewal. Set-up Fee-25,000 set-up includes implementation;all EDI connections and on-site training. Monthly Minimum-$500 per month Enrollment&Administration 4 $1.95 Per Employee Per Month HR Support $1.00 Per Employee Per Month Software Access fee includes full access to the core enrollment & eligibility software platform, and all add-on modules (Billing/Invoicing, COBRA, Commission Tracking, and Sales Management).Software Access fee also includes agency training,maintenance and support: Software Training includes two(2)days of agency CORE training in a group classroom setting. Software Maintenance includes secure software/data hosting and maintenance at benefitSCONNECT"s data centers,bug fixes and product releases. Software Support includes online and LIVE product support for the agency. Product support specialists are available by phone or email from 6:00am-5:00pm(PT),Monday-Friday. 'benefitscoama•'s current EDI Ubrary is available online at www.benefitscoeeta.net 2 benef tsceeeca•guarantees that we will provide each payroll vendor-or the company Human Resource staff-with the data they require to process payroll successfully;however,benefitscoaesa•does not guarantee payroll connectivity with every provider. 1 This set-up fee applies for implementations beginning within 6 months of the renewal date.The fee will be waived for projects that begin more than 6 months In advance of renewal. 4 Agency Minimum-SSW/month.Services are Included in this pricing model(available to groups over 100 EEs,free paper-based enrollment for groups under 100).Unlimited usage of benefhemaraa•agency u om is also Included at no additional charge. Volume is based on Wells Fargo Insurance Services USA,Inc.offices in aggregate. Pricing exclusive to Wells Fargo Insurance Services USA,Inc.confidential-for internal use only. Copyright 2013 Transcend Technologles Group.All Rights Reserved. Revised 11/5/2012 9.41 AM benefitSCONNECT Services Electronic Data Interchange(EDI): EDI Programming—Includes the following for each Export/Connection: • Discovery/Analysis • Programming • Testing • Documentation • Promotion to Production EDI Maintenance/Monitoring/Support—Includes the following for each Export/Connection: • Project Meetings • Unlimited Data Transactions • Ongoing File Export Monitoring • Support for Updates to Export File Format Changes-Mandatory updates from carrier included • Support for Bug Fixes Employer Group Implementation: Implementation—Includes the following The City of Palm Springs: • Initial planning meeting(s)(via phone) • Weekly progress meetings(via phone) • Custom employee enrollment configuration in benefitscoNNECTO • Data fulfillment analysis(via phone,up to 1 hour) • Initial employee data import(file type bCS00) • Full execution of Standard Test Plan Pricing exclusive to Wells Fargo Insurance Services USA,Inc.Confidential-for Internal use only. Copyright 2013 Transcend Technologies Group.All Rights Reserved. Revised 111S/2012 9:41 AM . . Optional Services Pricing HR Support $1.00 Per Employee Per Month benefitsmNNECTO management of all ongoing data imports,updates&testing for the employer group HRIS/Payroll EDI — Programming fee for HRIS $3 995 Per Employer/ One Time export or payroll vendor export. Per Connection HRIS/Payroll Maintenance/f%4onitoring/Support $55 Per Active EDI Per Month (Mandatory)— Required monthly maintenance fee for each active feed. New Data Mapped Forms — Programming fee for $495 Per Form One Time Forms Developed compliancecoNNecT—includes Ask the HR Pro, $15 Per Broker User Per Month Glossary of HR Terms,HR Forms,Job Descriptions, QA Database,Employee Handbook, Employment $25 Per ER User Per Month Laws,HR Articles, HR News&Updates,Glossary of HR Terms, HR Resources. Additional EDI Feeds—Unlimited carrier $0 Per Connection Per Month connections. Billing Reconcilliation—ConsolidatedBilling $1.00 Per Employee Per Month Services Optional Services Pricing HR Support—Includes the following,plus additional services upon request • A dedicated support specialist that the broker or group can email or call directly for assistance year-round. • Assistance with resolution of carrier data discrepancies • Employee census updates • System,plan,and employee updates(as necessary) • Ad hoc report services(creating, running,scheduling custom reports) • Data import and export services • Employer group training • Monthly carrier enrollment updates(when EDI feeds are unavailable) Pricing exclusive to Wells Fargo Insurance Services USA,Inc.Confidential-for internal use only. Copyright 2013 Transcend Technologies Group.All Rights Reserved. Revised 11/5/2012 9:41 AM , s benefitSCONNECT Project Authorization Wells Fargo Ins.Srvcs,Torrance City of Palm Springs _553 ; R u m m Arlene Farfan 60 days upon receipt of executed project auth; TBD in completed implementation packet and all Oct`13 carrier contact information. Projects and Services Requested Important-Project will begin once the signed project authorization is returned. Billing will begin the day benefitSCONNECTe receives the project authorization. ® Traditional Implementation+HR Support Included in$25,000 Set-Up ® Carrier Connection—CalPers Included in$25,000 Set-Up ® Carrier Connection—Standard included in$25,000 Set-Up ® Carrier Connection—MHN Included in$25,000 Set-Up ® Carrier Connection—Safeguard Included in$25,000 Set-Up ® Carrier Connection—MetLife Included in$25,000 Set-Up ® Carrier Connection—Aetna Included in$25,000 Set-Up ® Carrier Connection—VSP included in$25,000 Set-Up ® Carrier Connection—Blue Shield of CA Included in$25,000 Set-Up ® Carrier Connection—Cigna Included in$25,000 Set-Up ® Carrier Connection—IGOE Included in$25,000 Set-Up ® Dependent and current election upload Included in$25,000 Set-Up ® Offsite Training—Two Days. Included In$25,GW Set-Up p � ` d ���)rr � �4Ai ��� �✓ iI'I vf�' "Pl 4�"" -- ' � ..��". >tx✓.ka � � `iJ�Nta �� ls! S likes �>i a Billed at 100 employee life minimum. z The estimated completion date is based on the date that this project authorization Is returned signed along with carrier contacts and a completed Implementation packet(if Implementation Is Included on this form).Your project will not begin until all of these Items are received. a$500 monthly minimum due for March and April,2013.$2.95 PEPM kicks in May,2013. °One-Time Implementation/Set-up fee of$25,000 will be paid by CIGNA;City of Palm Springs will not be responsible for set-up fee due to prior agreement made with Cigna. If Cigna fails to remit set-up payment by May 31n,2013,the City of Palm Springs agrees to assume responsibility for set-up and monthly on-going costs. Copyright 2013 Transcend Technologies Group.All Rights Reserved. . - Carrier / Vendor Contacts WFIS,Torrance City of Palm Springs Carrier Connection(s) CalPers Aetna Standard Safeguard Metlife MHN VSP IGOE Cigna Blue Shield of CA By signing below,you agree to authorize benefltscoNNECr•to complete the work designated on this form,and understand the process and obligations to fulfill these projects. Fo benefitscoNNecT• For:City of Palm Springs � s Si ure JatJtn� `Canes ',✓� Printed ame Printed Name C/mot /��1.✓//�tsC"`, 3 12t 2 d l 3 gwi0 cs�® Date r Date For:Cigna F AS T® ® LEH Signature tC A`s:SRive¢ Printed Name APPROVED BY CITY MANAGER Date Copyright 2013 Transcend Technologies Group.All Rights Reserved. ATTEST: City Clerk ERRORS & OMISSIONS RENEWAL SUMMARY TRANSCEND TECHNOLOGIES GROUP, INC. SUMMARY OF COVERAGES ERRORS & OMISSIONS LIABILITY Underwriting Carrier:HISCOX Inc (Lloyd's of London) Best Rating:A/XI Limit of Liability— Claims Made Form Policy Aggregate Limit, Including of costs and expenses: $ 3,000,000 Retroactive Dates: January 1, 2008 for first$2,000,000 in Policy Limit November 7, 2009 for$1,000,000 in Policy Limit excess of$2,000,000 - Definition of`Business Activities": Application Services provider services, software programming services, including customization, development, and maintenance services, technology consulting services, and technology training services, for others for a fee. - Notable Coverage Extensions,including but not limited to: Rogue Employees Unauthorized Access Data Base Management Services - Notable Endorsements, Including but not limited to: 25% Minimum Earned Premium upon binding Service of Suit Retroactive Date (Split) Amendatory Endorsement Cancellation Clause Bi-Lateral Extended Reporting Period Extended Reporting Period - Notable Exclusions, Including but not limited to: Medical Malpractice November 1,2011 John O.Bronson Co. Page 4 Wesley Carson ERRORS & OMISSIONS RENEWAL SUMMARY TRANSCEND TECHNOLOGIES GROUP, INC. Policy Coverage Modules: A. Technology Protection Module: Sub Limit* $ 3,000,000 Retention Each and Every Claim* $ 10,000 *Single Aggregate Limit, inclusive of costs and expenses B. Privacy Protection Module: Sub Limit* $ 3,000,000 a.) Regulatory* $ 250,000 b.)Regulator Compensatory Award* $ 3,000,000 Retention Each and Every Claim* $ 10,000 *Single Aggregate Limit, inclusive of costs and expenses C. Breach Costs Module: Sub Limit* $ 3,000,000 Computer Forensic Costs $ 250,000 Breach Notification Costs $ 500,000 Credit Monitoring Service Costs $ 3,000,000 Retention Each and Every Claim** $ 10,000 *Single Aggregate Limit, inclusive of costs and expenses **Applies to each and every failtre to maintain the security, confidentiality, or integrity of personal information. November 1,2011 John O.Bronson Co. Page 5 Wesley Carson be n efitSCONNECT Addendum B March 20, 2013 Addendum B serves to amend the Technology and Services Agreement dated 4/1/2013 between Transcend Technologies Group, Inc. and the City of Palm Springs, hereby referred to as the Employer.Therefore, in consideration of and reliance upon the terms and conditions set forth herein, the parties agree to the following amendment explanations: Section 4.5 -This explanation is in addition to the language written in the agreement. This section is put in place in the rare event a carrier or TPA is unable to communicate using EDI technology. Therefore, TTG cannot be held liable for a carrier's technical incompetency. Part of our service offering is to provide EDI connections with EDI capable carriers and should a problem arise, we will work with the carrier and the Employer to find a solution agreeable to all parties involved. Employer will be responsible in maintaining the integrity of the data transmitted electronically between Employer, benefit providers and third party systems. Employer carries the responsibility of keying in the data into the benefitsCONNECT® system; TTG carries the responsibility of transmitting the data electronically from benefitsCONNECT® to the carriers In question. Section 6.8—This explanation Is in addition to the language written in the agreement; during the renewal process, if there is a more favorable pricing structure available to Employer,TTG will make It available for the new term. Section 10.2—benefitsCONNECT®agrees to strike section 10.2 and instead will adhere to federal HIPAA regulations in the event of a suit or claim brought against Employer or TTG based on a claim that Employer improperly collected, used or disseminated any Information or other data using the software. Copyright 2013 Transcend Technologies Group.All Rights Reserved. For Transcend Technologies Group,Inc. For The City of Palm Springs a Si Sig G�7y� /! /✓ir t �ar Neve KaV�k d ° y✓ip C Printed Printed P(qf (dj.4- I Coo �i� /� .fO.✓�1G" Title Title 3 �21 Iza13 -� Date Date AS TO FORM ity Aft"Y Date f3 ''/ ' APPROVED BY CITY MANAGER hkt 26 DODp° Abn ATTEST: ��3 ty Clerk Copyright 2013 Transcend Technologies Group.All Rights Reserved. US mroamwriCrve §164.504 45 CFR Subtitle A (10-1-11 Edition) §164.504 Uses and disclosures: Organ- business associate to use or further dis- zational requirements, close the information in a manner that (a) Definitions. As used in this sec- would violate the requirements of this tion: subpart, if done by the covered entity, Plan administration functions means except that: administration functions performed by (A) The contract may permit the the plan sponsor of a group health plan business associate to use and disclose on behalf of the group health plan and protected health information for the excludes functions performed by the proper management and administra- plan sponsor in connection with any tion of the business associate, as pro- other benefit or benefit plan of the plan vided in paragraph (e)(4) of this sec- sponsor. tion; and Summary health information means in- (B) The contract may permit the formation, that may be individually business associate to provide data ag- identifiable health information, and: gregation services relating to the (1) That summarizes the claims his- health care operations of the covered tory, claims expenses, or type of claims entity. experienced by individuals for whom a plan sponsor has provided health bene- (ii) Provide that the business asso- fits under a group health plan; and ciate will: (2) From which the information de- (A)Not use or further disclose the in- scribed at §164.514(b)(2)(i) has been de- formation other than as permitted or leted, except that the geographic infor- required by the contract or as required mation described in §164.514(b)(2)(i)(B) by law; need only be aggregated to the level of (B) Use appropriate safeguards to a five digit zip code. prevent use or disclosure of the infor- (bHd) mation other than as provided for by (e)(1) Standard: Business associate con- its contract; tracts. (i) The contract or other ar- (C) Report to the covered entity any rangement between the covered entity use or disclosure of the information and the business associate required by not provided for by its contract of §164.502(e)(2) must meet the require- which it becomes aware; ments of paragraph (e)(2) or (e)(3) of (D)Ensure that any agents, including this section, as applicable. a subcontractor, to whom it provides (ii)A covered entity is not in compli- protected health information received ance with the standards in §164.502(e) from, or created or received by the and paragraph (e) of this section, if the business associate on behalf of, the covered entity knew of a pattern of ac- covered entity agrees to the same re- tivity or practice of the business asso- strictions and conditions that apply to ciate that constituted a material the business associate with respect to breach or violation of the business as- such information; sociate's obligation under the contract (E) Make available or other arrangement, unless the cov- Protected health information in accordance with ered entity took reasonable steps to cure the breach or end the violation, as §164.524; applicable, and, if such steps were un- Make available protected health successful: information for amendment and meet- (A) Terminated the contract or ar- porate any amendments to protected rangement, if feasible; or health information in accordance with (B) If termination is not feasible, re- §164.526; ported the problem to the Secretary. (G) Make available the information (2) Implementation specifications: Busi- required to provide an accounting of ness associate contracts. A contract be- disclosures in accordance with §164.528; tween the covered entity and a busi- (H) Make its internal practices, ness associate must: books, and records relating to the use (i) Establish the permitted and re- and disclosure of protected health in- quired uses and disclosures of such in- formation received from, or created or formation by the business associate. received by the business associate on The contract may not authorize the behalf of, the covered entity available 868 Department of Health and Human Services §164.504 to the Secretary for purposes of deter- that such assurances cannot be ob- mining the covered entity's compliance tained. with this subpart;and (iii) The covered entity may omit (I) At termination of the contract, if from its other arrangements the termi- feasible, return or destroy all protected nation authorization required by para- health information received from, or graph (e)(2)(iii) of this section, if such created or received by the business as- authorization is inconsistent with the sociate on behalf of, the covered entity statutory obligations of the covered that the business associate still main- entity or its business associate. tains in any form and retain no copies (4) Implementation specifications: Other of such information or, if such return requirements for contracts and other ar- or destruction is not feasible, extend rangements. W The contract or other the protections of the contract to the arrangement between the covered enti- information and limit further uses and ty and the business associate may per- disclosures to those purposes that mit the business associate to use the make the return or destruction of the information received by the business information infeasible. associate in its capacity as a business (iii) Authorize termination of the associate to the covered entity, if nec- contract by the covered entity, if the essary: covered entity determines that the (A) For the proper management and business associate has violated a mate- administration of the business asso- rial term of the contract. ciate; or (3) Implementation specifications: Other (B) To carry out the legal respon- arrangements. (i)If a covered entity and sibilities of the business associate. its business associate are both govern- (ii) The contract or other arrange- mental entities: ment between the covered entity and (A) The covered entity may comply the business associate may permit the business associate to disclose the infor- with paragraph (e) of this section by mation received by the business asso- entering into a memorandum of under- standing with the business associate ciate in its capacity as a business asso- that contains terms that accomplish date for the purposes described in the objectives of paragraph (e)(2) of paragraph this section, if: (A) The disclosure is required by law; this section. or (B) The covered entity may comply (B)(1) The business associate obtains with paragraph (e) of this section, if reasonable assurances from the person other law (including regulations adopt- to whom the information is disclosed ed by the covered entity or its business that it will be held confidentially and associate) contains requirements appli- used or further disclosed only as re- cable to the business associate that ac- quired by law or for the purpose for complish the objectives of paragraph which it was disclosed to the person; (e)(2)of this section. and (ii) If a business associate is required (2) The person notifies the business by law to perform a function or activ- associate of any instances of which it ity on behalf of a covered entity or to is aware in which the confidentiality of Provide a service described in the defi- the information has been breached. nition of business associate in§160.103 of (f)(1) Standard: Requirements for group this subchapter to a covered entity, health plans. (i) Except as provided such covered entity may disclose pro- under paragraph (f)(1)(ii) or (iii) of this tected health information to the busi- section or as otherwise authorized ness associate to the extent necessary under §164.508, a group health plan, in to comply with the legal mandate order to disclose protected health in- without meeting the requirements of formation to the plan sponsor or to this paragraph (e), provided that the provide for or permit the disclosure of covered entity attempts in good faith protected health information to the to obtain satisfactory assurances as re- plan sponsor by a health insurance quired by paragraph(e)(3)(i) of this sec- issuer or HMO with respect to the tion, and, if such attempt fails, docu- group health plan, must ensure that ments the attempt and the reasons the plan documents restrict uses and 869 §164.504 45 CFR Subfifle A (10-1-11 Edifion) disclosures of such information by the any other benefit or employee benefit plan sponsor consistent with the re- plan of the plan sponsor; quirements of this subpart. (D) Report to the group health plan (ii) The group health plan, or a any use or disclosure of the informa- health insurance issuer or HMO with tion that is inconsistent with the uses respect to the group health plan, may or disclosures provided for of which it disclose summary health information becomes aware; to the plan sponsor, if the plan sponsor (E) Make available protected health requests the summary health informa- information in accordance with tion for the purpose of: §164.524; (A) Obtaining premium bids from (F) Make available protected health health plans for providing health insur- information for amendment and incor- ance coverage under the group health porate any amendments to protected plan; or health information in accordance with (B) Modifying, amending, or termi- §164.526; nating the group health plan. (G) Make available the information (iii) The group health plan, or a required to provide an accounting of health insurance issuer or HMO with disclosures in accordance with §164.528; respect to the group health plan, may (H) Make its internal practices, disclose to the plan sponsor informa- books, and records relating to the use tion on whether the individual is par- and disclosure of protected health an- ticipating in the group health plan, or formation received from the group is enrolled in or has disenrolled from a health plan available to the Secretary health insurance issuer or HMO offered by the plan. for purposes of determining compliance (2) Implementation specifications: Re- by the group health plan with this sub- quirements for plan documents. The plan part; documents of the group health plan (1) If feasible, return or destroy all must be amended to incorporate provi- protected health information received sions to: from the group health plan that the (i) Establish the permitted and re- sponsor still maintains in any form and quired uses and disclosures of such in- retain no copies of such information formation by the plan sponsor, pro- when no longer needed for the purpose vided that such permitted and required for which disclosure was made, except uses and disclosures may not be incon- that, if such return or destruction is sistent with this subpart. not feasible, limit further uses and dis- (ii) Provide that the group health closures to those purposes that make plan will disclose protected health in- the return or destruction of the infor- formation to the plan sponsor only mation infeasible; and upon receipt of a certification by the (J) Ensure that the adequate separa- plan sponsor that the plan documents tion required in paragraph (f)(2)(iii) of have been amended to incorporate the this section is established. following provisions and that the plan (iii) Provide for adequate separation sponsor agrees to: between the group health plan and the (A) Not use or further disclose the in- plan sponsor. The plan documents formation other than as permitted or must: required by the plan documents or as (A) Describe those employees or required by law; classes of employees or other persons (B)Ensure that any agents, including under the control of the plan sponsor a subcontractor, to whom it provides to be given access to the protected protected health information received health information to be disclosed, pro- from the group health plan agree to the vided that any employee or person who same restrictions and conditions that receives protected health information apply to the plan sponsor with respect relating to payment under, health care to such information; operations of, or other matters per- (C) Not use or disclose the informa- taining to the group health plan in the tion for employment-related actions ordinary course of business must be in- and decisions or in connection with cluded in such description; 870 Department of Health and Human Services §164.506 (B) Restrict the access to and use by for purposes related to the appropriate such employees and other persons de- function being performed. scribed in paragraph(f)(2)(iii)(A) of this section to the plan administration [65 FR 82802, Dec. 28, 2000, as amended at 67 functions that the plan sponsor per- FR 53267, Aug. 14. 2002; 68 FR 8381, Feb. 20, forms for the group health plan; and 20031 (C) Provide an effective mechanism §164.506 Uses and disclosures to carry for resolving any issues of noncompli- out treatment, payment, or health ance by persons described in paragraph care operations. (f)(2)(iii)(A) of this section with the plan document provisions required by (a)Standard: Permitted uses and disclo- this paragraph. sures. Except with respect to uses or (3) Implementation specifications: Uses disclosures that require an authoriza- and disclosures. A group health plan tion under §164.508(a)(2) and (3), a cov- may: ered entity may use or disclose pro- (i) Disclose protected health informa- tected health information for treat- tion to a plan sponsor to carry out plan ment, payment, or health care oper- administration functions that the plan ations as set forth in paragraph (c) of sponsor performs only consistent with this section, provided that such use or the provisions of paragraph (f)(2) of disclosure is consistent with other ap- this section; plicable requirements of this subpart. (ii) Not permit a health insurance (b) Standard: Consent for uses and dis- issuer or HMO with respect to the closures permitted. (1) A covered entity group health plan to disclose protected may obtain consent of the individual to health information to the plan sponsor use or disclose protected health infor- except as permitted by this paragraph; mation to carry out treatment, pay- (iii) Not disclose and may not permit ment, or health care operations. a health insurance issuer or HMO to disclose protected health information (2) Consent, under paragraph (b) of to a plan sponsor as otherwise per- this section, shall not be effective to mitted by this paragraph unless a permit a use or disclosure of protected statement required by health information when an authoriza- §164.520(b)(1)(iii)(C) is included in the tion, under§164.508,is required or when appropriate notice; and (iv) Not dis- another condition must be met for such close protected health information to use or disclosure to be permissible the plan sponsor for the purpose of em- under this subpart. ployment-related actions or decisions (c) Implementation specifications: or in connection with any other benefit Treatment, payment, or health care oper- or employee benefit plan of the plan ations. (1) A covered entity may use or sponsor. disclose protected health information (g) Standard: Requirements for a cov- for its own treatment, payment, or ered entity with multiple covered func- health care operations. tions. (1) A covered entity that per- (2)A covered entity may disclose pro- forms multiple covered functions that tected health information for treat- would make the entity any combina- meat activities of a health care pro- tion of a health plan, a covered health vider. care provider, and a health care clear- (3)A covered entity may disclose pro- inghouse, must comply with the stand- tected health information to another ards, requirements, and implementa- tion specifications of this subpart, as covered entity or a health care pro- applicable to the health plan, health vider for the payment activities of the care provider, or health care clearing- entity that receives the information. house covered functions performed. (4)A covered entity may disclose pro- (2) A covered entity that performs tected health information to another multiple covered functions may use or covered entity for health care oper- disclose the protected health informa- ations activities of the entity that re- tion of individuals who receive the cov- ceives the information, if each entity ered entity's health plan or health care either has or had a relationship with provider services, but not both, only the individual who is the subject of the 871 HIPAA Business Associate Agreements Page 1 of 2 480-425-2600 1 Map Attorne" I Legal Services I Articles I O000rt "niss I ContaR Us I Home SacksTierney P.A. ;; in IN A TTOR NeYS ♦qg•^ AUGUST 2003 HIPAA Business Associate Agreements Before you sign,look out for provisions that obligate you beyond the legal requirements You may be familiar with the Health Insurance Portability and Accountability Act (HIPAA), and the privacy ' regulations issued under that Act.Those privacy regulations took effect on April 14,2003. One important regulation requires "covered entities" - health care providers, health plans, and health care clearinghouses-to enter into agreements with their"business associates," i.e.,third party administrators,legal counsel,accountants,consultants and other plan providers who may have access to protected health information. Steve GOEatein If you work with a health rare provider,health plan or health care clearinghouse,you may be asked to sign a "Business Associate Agreement"These agreements take many forms,from a simple paragraph addendum to an existing agreement to a brand-new,lengthy agreement.You should carefully review such a document before you sign it,as it can impose significant responsibilities on you.Here are the main points to consider: • Your obligations described in the agreement should be limited only to those required in the federal regulation (see "Reouired Obligations"below). • The provisions requiring you to provide patients with access to records in your possession,as well as the opportunity for patients to amend records in your possession,should apply to you only if the records in your possession are a"Designated Record Set."(Most business associates will not have records bearing that designation.) • If the agreement requires you to mitigate any damages,make sure that requirement is limited"to the extent practicable." • The agreement should allow you to use the protected health information for your own management and administration and to carry out your own legal responsibilities. • The agreement should require the return or destruction of information in your possession upon termination of the agreement"only if such return or destruction is feasible." • You are not required to indemnify the other party to the agreement. If the agreement contains an indemnity provision, remove it. • You should add a provision to any business associate agreement stating that"no person or entity is to be considered a third- party beneficiary under the agreement,nor shall any third party have any rights as a result of the agreement"This will limit an individual patient's ability to use the agreement as a basis to make a claim against you. • Avoid unnecessary boilerplate in the agreement.If there are additional provisions that are unnecessary or unusual,do not agree to them. REQUIRED OBLIGATIONS According to 45 CFR Section 164.504(e)(2)(h),a contract between the covered entity and a business associate must provide that the business associate will: • not use or further disclose the information other than as permitted or required by the contract or as required by law; • use appropriate safeguards to prevent use or disclosure of the information other than as provided for by its contract; • report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware; • ensure that any agents, including a subcontractor, to whom it provides protected health information received from, or created or received by the business associate on behalf of,the covered entity agrees to the same restrictions and conditions that apply to the business associate with respect to such information; • make available protected health information in accordance with§164.524; • make available protected health information for amendment and incorporate any amendments to protected health information in accordance with§164.526; • make available the information required to provide an accounting of disclosures in accordance with§164.528; • make its internal practices,books,and records relating to the use and disclosure of protected health information received from,or created or received by the business associate on behalf of,the covered entity available to the Secretary for purposes of determining the covered entity's compliance with this subpart;and • at termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of,the covered entity that the business associate still maintains in any form and retain no copies of such information or,if such return or destruction is not feasible,extend the protections of the contract to the information and limit further uses and disclosures to those purposes that make the return or destruction of the http://www.sackstiemey.com/articles/hipaa.htm 3/20/2013 HIPAA Business Associate Agreements Page 2 of 2 information infeasible.m These materials are designed to Provide general information prepared by professionals in regard to the subject matter covered.it is provided with the understanding that the author is not engaged in rendering legal,accounting,or other professional service.Although prepared by professionals,these materials should not be utilized as a substitute for professional service in specific situations.If legal advice or other expert assistance is required,the service of a professional should be sought. Attorneys I Legal Services I Articles IOpportunities I Contact Us I Home I Notices and Disclaimer l sham ©2000-2013.Sacks Tierney P.A.•4250 N.Drinkwater Blvd.,Fourth Floor•Scottsdale,AZ 85251•480.425.2600 The act of visiting or communicating with Sacks Tierney P.A.via this wactre or by email does not chnstimte an attzmayclient relationship.Communications from non-clients via this website are not subject to diem confiderrtality or attorney-client privilege.Further,the articles,discusvon,commentary,forms and sample documentation contained in this website are offered as general guidance only and are not to he relied upon as spe ifc legal advice.For legal advice on a specific matter,pleas,consult wit an attorney who is knowledgeable and experienced In that area. http://www.sackstiemey.com/articles/hipaa.htm 3/20/2013 HIPAA Business Associate - Definition and History Page 1 of 3 HIPAA [AS3uS [N� ss C`CIAIi Pr-avered Iri HddAclronr se cra'se h Home Resources ❑ Products ❑ About Us ❑ Contact Us BridgeFront.com History> Business Associates g ax HIPAA.Business Associate Agreements Home HIPAA Privacy and Security rules require covered entities to enter into special agreements HIPAA eNewsletter with business associates that come into contact with protected health information (PHI). History of Business Asso. These rules require business associates to agree to treat PHI similarly to the way a covered Free-RA Agreement entity must treat It. Free-HIPAA whitepapers HIPAA requires "satisfactory assurances'from a business associate that the business Compliance Officer Duties associate will appropriately safeguard PHI.Those assurances take the form of required What is a Covered entity contract language. Covered entities may not disclose protected health information to their Web Links&Resources business associates (or allow business associates to create or receive protected health "'�]C,i"$f� �y�"'l�y .,. information on their behalf) unless the required contract language is in place. [45 CFR§ R f , 164.5O4(e)(1).] ! cl tea. HIPAA Certification .. in hi HIPAA Consulting Services Business Associate Agreement Requirements I ai HIPAA Demo Course HIPAA Education HIPAA requires business associate contracts to contain specific terms.Those terms are A listed below. Download a sample Business Associate agreement template here. rr a ` The required provisions are: 01 About Us Ct Contact Us 1. A statement of permitted and required uses and disclosures. [45 CFR § 164.5O4(e) di Our Clients (2)(i).] ' H Our Partners 2. A limitation on the business associate using or disclosing protected health ct information other than as stated in the contract or as required by law. [45 CFR rE § 164.5O4(e)(2)(ii)(A).] Bi i Bi rE 3. A statement that the business associate will use appropriate safeguards to prevent the inappropriate use or disclosure of protected health information. [45 CFR § 164.5O4(e)(2)(ii)(B).] 4. A statement that the business associate will report uses or disclosures of protected health information that violate the business associate agreement. [45 CFR § 164.504 (e)(2)(ii)(C).] 5. A statement ensuring that the business associate's agents and subcontractors agree to the same restrictions and conditions that apply to the business associate. [45 CFR § 164.5O4(e)(2)(ii)(D).] 6. A statement that the business associate will make protected health information available as required by the Privacy Rules' "right to access" provision. [45 CFR § 164.5O4(e)(2)(ii)(E).] 7. A statement that the business associate will make protected health information available for amendment and will incorporate amendments as required by the Privacy http://www.hipaabusinessassociates.com/history_business_associate 2.php 3/20/2013 HIPAA Business Associate - Definition and History Page 2 of 3 Rules'"right to request an amendment" provision. [45 CFR § 164.504(e)(2)(ii)(F).] B. A statement that the business associate will provide an accounting of uses and disclosures as required by the Privacy Rules' "right to an accounting" provision. [45 CFR§ 164.504(e)(2)(ii)(G).] 9. A statement that the business associate will let HHS audit it to determine compliance with the business associate agreement provisions. [45 CFR § 164.504(e)(2)(ii)(H).] 10. A statement that the business associate will return or destroy all protected health information at the termination of the contract(or, if that is not feasible, continue to protect the information while maintaining the protected health information). 145 CFR § 164.504(e)(2)(ii)(I)j 11. A statement authorizing the group health plan to terminate the contract upon a determination that the business associate breached the contract. [45 CFR § 164.504 (e)(2)(iii).] Appropriate PHI Safeguards Includes Training& Policies, Procedures Regarding the treatment of protected health information, Business Associate shall use all appropriate safeguards to prevent use or disclosure of Protected Health Information received from, or created or received on behalf of, the Covered Entity other than as provided for in the Business Associate Agreement or as required by law. These safeguards will include, but not be limited to: 1. Training o Providing annual training to relevant employees, contractors and subcontractors on how to prevent the improper use or disclosure of Protected Health Information; Update and repeat training on a regular basis; 2. Administrative Safeguards • Adopting policies and procedures regarding the safeguarding of Protected Health Information; • Enforcing those policies and procedures, including sanctions for anyone found not in compliance 3. Technical and Physical Safeguards Implementing appropriate technical safeguards to protect Protected Health Information, including access controls, authentication and transmission security; and o Implementing appropriate physical safeguards to protect Protected Health Information, including workstation security and device and media controls. 4 1 1 b 1 3 v (Go to Next Page) http://www.hipaabusinessassociates.com/history_business_associate_2.php 3/20/2013 HIPAA Business Associate- Definition and History Page 3 of 3 Home j HistorvI sample Agreement Template I WhitepapersI Compliance Officers Covered Entities I Resou roes&Links HIPAA Certification I HIPAA Consultina I HIPAA Demo Courses HIPAA Education About Us IContact Us IOU!Clients I Our Partners I site M ©2002-2013 6ridgeFront http://www.hipaabusinessassociates.com/history_business_associate_2.php 3/20/2013