Exhibit 10.27
BUSINESS SERVICES AGREEMENT
dated , 2004
between
GNA CORPORATION
and
UNION FIDELITY LIFE INSURANCE COMPANY
CONFIDENTIAL TREATMENT REQUESTED
CONFIDENTIAL TREATMENT REQUESTED: INFORMATION FOR WHICH CONFIDENTIAL TREATEMENT HAS BEEN REQUESTED IS OMITTEED AND IS NOTED WITH “**”.
AN UNREDACTED VERSION OF THIS DOCUMENT HAS BEEN FILED
SEPARATELY WITH THE SECURITIES AND
EXCHANGE COMMISSION.
|
|
||
|
|
||
|
|
||
|
|
|
|
|
|
||
|
|
||
|
|
|
|
|
|
||
|
|
||
|
|
|
|
|
STANDARD FOR SERVICE; COMPLIANCE WITH LAWS; LIMITED LIABILITY |
|
|
|
|
||
|
|
||
|
|
||
|
|
|
|
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
|
|
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
|
|
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
|
|
||
|
|
||
|
|
||
|
|
||
|
|
|
|
|
SCHEDULES |
|
|
|
|
|
|
|
|
||
|
|
||
|
|
||
|
|
ii
This Business Services Agreement, dated , 2004 (this “Agreement”), is made by and between GNA CORPORATION, a Washington corporation (“GNA”) and UNION FIDELITY LIFE INSURANCE COMPANY, an insurance company organized under the laws of the State of Illinois (the “Company”).
RECITALS
A. WHEREAS, GNA, General Electric Company, a New York corporation (“General Electric”), and certain of its other affiliates entered into a Master Agreement, dated as of , 2004 (the “Master Agreement”); and
B. WHEREAS, it is contemplated by the Master Agreement that after the date hereof GNA will continue to perform, or GNA will cause its Subsidiaries and Affiliates to continue to perform, certain administrative and support services with respect to the Reinsured Businesses (as defined below) in accordance with the terms and subject to the conditions set forth herein.
NOW, THEREFORE, in consideration of the foregoing and the mutual agreements contained herein and for other good and valuable consideration, the receipt and adequacy of which are hereby acknowledged, the parties hereto hereby agree as follows:
The following capitalized terms used in this Agreement shall have the meanings set forth below:
“CPR Arbitration Rules” shall have the meaning specified in Section 5.04(a)
“GEFA” means GE Financial Assurance Holdings, Inc.
“Governmental Authority” means any foreign or national government, any state or other political subdivision thereof, and any entity exercising executive, legislative, judicial, regulatory or administrative functions of or pertaining to government.
“Initial Notice” shall have the meaning specified in Section 5.02.
“Long-Term Care Retroceded Business” means the long-term care insurance business reinsured by the Company pursuant to those Reinsurance Agreements identified as numbered items 7 and 8 on Schedule B hereto.
“Reinsurance Agreements” means those reinsurance agreements relating to the Reinsured Businesses and which are listed on Schedule B hereto.
“Reinsured Businesses” means collectively, the Long-Term Care Retroceded Business, the Structured Settlement Annuity Reinsured Business and the Variable Annuity Reinsured Business.
“Response” shall have the meaning specified in Section 5.02.
“Structured Settlement Annuity Reinsured Business” means the structured settlement annuity business reinsured by the Company pursuant to those Reinsurance Agreements identified as numbered items 1 through 6 on Schedule B hereto.
“Termination Date” means the effective date of any termination, in whole or in part, of this Agreement as provided in Section 6.01.
“Variable Annuity Reinsured Business” means the variable annuity business reinsured by the Company pursuant to those Reinsurance Agreements identified as numbered items 9 and 10 on Schedule B hereto.
|
Term |
|
Section |
|
Affiliate |
|
Master Agreement |
|
Agreement |
|
Preamble |
|
Closing |
|
Master Agreement |
|
Company |
|
Recitals |
|
Force Majeure |
|
Master Agreement |
|
GE Confidential Information |
|
Master Agreement |
|
General Electric |
|
Preamble |
|
Genworth Confidential Information |
|
Master Agreement |
|
Laws |
|
Master Agreement |
|
Master Agreement |
|
Recitals |
|
Services |
|
Section 2.01(a) |
|
Service Charges |
|
Section 3.01(a) |
|
Service Provider |
|
Section 4.03 |
|
Standard for Services |
|
Section 4.01 |
|
Subsidiary |
|
Master Agreement |
|
Taxes |
|
Section 7.03 |
|
Third Party Claim |
|
Master Agreement |
2
3
4
5
6
7
8
SECTION 7.03. Taxes.
9
If to GNA:
[ ]
[ ]
[ ]
Facsimile: [ ]
Attention: [ ]
With a copy to:
[ ]
[ ]
[ ]
Facsimile: [ ]
Attention: [ ]
If to the Company:
Union Fidelity
Life Insurance Company
200 North Martingale Road
Shaumburg, IL 60173-2096
Facsimile: (847) 330-3404
Attention: Chief Financial Officer
With a copy to:
Union Fidelity
Life Insurance Company
200 North Martingale Road
Shaumburg, IL 60173-2096
Facsimile: (847) 605-3044
Attention: General Counsel
or to such other address or to such other Person as either party may have last designated by notice to the other party.
10
11
[SIGNATURE PAGE FOLLOWS]
12
IN WITNESS WHEREOF, the parties have caused this Agreement to be executed on the date first written above by their respective duly authorized officers.
|
|
GNA CORPORATION |
||
|
|
|
||
|
|
|
||
|
|
By: |
|
|
|
|
|
Name: |
|
|
|
|
Title: |
|
|
|
|
||
|
|
|
||
|
|
UNION FIDELITY LIFE INSURANCE COMPANY |
||
|
|
|
||
|
|
|
||
|
|
By: |
|
|
|
|
|
Name: |
|
|
|
|
Title: |
|
13
SERVICES
The Services are broadly defined as activities performed by GNA and its Subsidiaries and Affiliates that benefit the Reinsured Businesses. The Services are more fully defined, without limitation, below by functional area under the general headings “Business Overhead Services” and “Corporate Overhead Services.”
Business Overhead Services
The services below will be provided by the “WIM” business unit of GNA and its Subsidiaries and Affiliates with regards to the Structured Settlement Annuity Reinsured Business and the Variable Annuity Reinsured Business:
Executive:
General support, counsel, strategy and leadership provided by WIM’s Chief
Executive Officer.
Human Resources:
General business level Human Resource related activities including but not
limited to leadership development, employee recruitment and staffing,
implementation of compensation policies and practices, payroll and benefit
administration, organizational communication, training, general security and
employee issue resolution and guidance.
Finance:
Cost of finance activities including but not limited to product financial
support and analysis, account reconciliations, state reporting, product
profitability analysis, investment income planning & analysis, expense
management, audit support, statutory & GAAP accounting, reporting &
analysis and ad hoc financial analysis.
Legal/Compliance:
Cost of support and coordination of litigation, government relations, human
resource, intellectual property, insurance regulatory, consumer privacy,
contract, compliance, and public relations matters.
Risk:
Cost of Risk Management and reinsurance support—Monitor production vs.
authority limits, monitor and review key risk measures. General oversight of inforce product
performance analysis and reviews.
Reinsurance oversight and treaty management including settlement with
reinsurers.
Facilities:
Campus expenses including building rent and maintenance, parking garage,
cafeteria, campus lawn care and utilities.
Information Technology:
General business technology infrastructure costs including but not limited to
general management, help desk assistance, data center management, disaster
recovery plans and digitization of processes.
Six Sigma Quality:
Costs including business project management and process improvement coaching,
execution and leadership.
Product Management:
Costs for product line managers to manage inforce policies and general product
line maintenance activities such as risk assessment, return on equity (“ROE”) variance analysis and related ROE
improvement projects.
Operations:
Costs including management, project leadership and administrative support for
service operations supporting customers, policyholders and other stakeholders.
Other:
Costs including corporate insurance allocation to product lines (e.g.,
cost of building insurance and other property, plant and equipment).
Retention:
Costs including monitoring of inforce policy retention levels, design and
execute programs to retain inforce business.
Corporate Overhead Services
The services listed below will be provided by the “HQ” or corporate functions at GNA with regard to each of the Reinsured Businesses:
Executive Office:
Costs including general support, counsel, strategy and leadership provided by
CEO, various HQ business insurance charges and allocations.
Human Resources:
Costs of general HR related activities such as leadership development, employee
recruitment and
2
staffing, compensation policies and practices, payroll and benefit administration, organizational communication, that which is currently known as the “GEFA University” learning center including online course development and administration, physical security of the business locations and employee issue resolution and guidance.
Actuarial Department and Capital Management:
Costs including rating agency coordination such as answering queries, making
presentations, and providing other required information for rating agencies;
state insurance department regulatory support, NAIC lobbying and investor
relations, including issues related to risk based capital; completion of
various actuarial and capital management functions such as: reserve
calculations, experience analysis, asset/liability management, cash flow
testing support, dividend forecasting, capital management, reinsurance and
capital markets support.
Finance:
HQ related finance costs, such as business level financial planning and
analysis, Statutory and GAAP accounting, reinsurance accounting, reporting and
analysis, annual statement (“blue book”) preparation and related disclosures
and schedules, statutory audit support, tax information needed to prepare
returns, treasury services, financial systems related support, maintenance and
infrastructure, technical accounting expertise.
Product Management:
Costs including general product management and product marketing compliance,
support pricing and retention initiatives.
Legal:
Costs including support and coordination of litigation, government relations,
human resource, intellectual property, insurance regulatory, consumer privacy,
contract, compliance, and public relations matters.
Risk:
Costs including business risk policies (currently known as “Policy 5.0/6.0”)
development and monitoring, treaty management, reinsurance and controllership
oversight. These policies are developed
and implemented by the Risk team with others at Headquarters to manage assets
and liabilities, control business risks associated with investments,
controllership, systems infrastructure, process management, etc. Various
metrics are used to “trigger” leadership decision points in an effort to reduce
business risks. Includes the
leadership of projects to reduce the business risks associated with various
systems and processes across the business.
Sourcing (Purchasing) and Facilities:
Costs including sourcing related services including Purchasing card (“P-card”)
Administration, Oracle sourcing/purchasing/receiving system (know as the “SSS
System”) Administration, requisition processing, competitive bidding/auction
services, spend data tracking/analysis, and
3
contract definition/negotiation. Leadership of certain expense reduction projects currently known as “Bullet Trains” (which focus across the business on reducing individual expense categories (PC leasing, postage, consulting, telecommunications, office supplies, etc.) and other projects related to the increase in purchasing efficiency and reduction of costs.
IT and e-Solutions:
General management costs associated with IT infrastructure, management of on
and off shore contractors, help desk, asset management (PC’s, printers,
servers, etc.), email service, Wide Area Networks (WAN), desktop support
(visiting actual users to assist them with IT needs), web hosting, Unix and NT
system administration, global computer operations, intellectual property,
contract and licenses of software, services and hardware, U.S.-based consulting
and control over remote infrastructure (for example, those systems currently
housed in Alpharetta, GA).
Costs of HQ security team, who provides disaster recovery, including risk analysis & coordination of all IT associated with Disaster Recovery. In addition, security includes coordination with all local business security officers, relating to intrusion detection, anti-virus and other protections of systems.
Costs including project management, oversight and project manager
certification, using several industry standard processes including Six Sigma
“DMAIC” process improvement and other process improvement/development regimes.
Costs of developing and monitoring architectural plans for future operations
including technology related standards, guidelines and polices.
Costs of IT Vendor Management — includes negotiations and oversight for vendor agreements on hardware, software and services.
Costs of IT Solutions — delivers IT solutions that meet business needs through digitization of processes and deployment of web applications.
Operations Excellence:
Costs of Consolidation, Analysis, Management Strategy, and Leadership for Operations
and Shared Services. Provide strategic
leadership and oversight to all operations departments, ensuring that best
practices are shared.
Costs of managing services used by all GEFA businesses, including Xerox (current outsourced document processing provider), “1-800 Think GE” call center (a point of contact for all GEFA products), and One Front Door (inbound imaging strategy).
Changes in Services
The Business Overhead Services and Corporate Overhead Services shall include such other comparable and/or successor Services implemented or maintained from time to time by GNA and its Subsidiaries and Affiliates.
4
REINSURED BUSINESSES
Structured Settlement Annuities
1. Coinsurance Agreement, dated as of , 2004, by and between the Company and GE Life and Annuity Assurance Company, a Virginia domiciled life insurance company
2. Coinsurance Agreement, dated as of , 2004, by and between the Company and Federal Home Life Insurance Company, a Virginia domiciled life insurance company
3. Coinsurance Agreement, dated as of , 2004, by and between the Company and First Colony Life Insurance Company, a Virginia domiciled life insurance company
4. Coinsurance Agreement, dated as of , 2004, by and between the Company and General Electric Capital Assurance Company, a Delaware domiciled life insurance company
5. Coinsurance Agreement, dated as of , 2004, by and between the Company and GE Capital Life Assurance Company of New York, a New York domiciled life insurance company
6. Coinsurance Agreement, dated as of , 2004, by and between the Company and American Mayflower Life Insurance Company of New York, a New York domiciled life insurance company
Long Term Care
7. Retrocession Agreement, dated as of , 2004, by and between the Company and General Electric Capital Assurance Company, a Delaware domiciled life insurance company
8. Retrocession Agreement, dated as of , 2004, by and between the Company and GE Capital Life Assurance Company of New York, a New York domiciled life insurance company
Variable Annuities
9. Reinsurance Agreement, dated as of , 2004, by and between the Company and GE Life and Annuity Assurance Company, a Virginia domiciled life insurance company
10. Reinsurance Agreement, dated as of , 2004, by and between the Company and GE Capital Life Assurance Company of New York, a New York domiciled life insurance company
SERVICE CHARGES
The “Annual Expense Reimbursement Factors” used to calculate the Service Charges for each respective line of business are as follows:
|
Structured Settlement Annuity Reinsured Business: |
|
|
|
|
|
|
|
Corporate Overhead Factor |
|
$** per Annum |
|
|
|
|
|
Business Overhead Factor |
|
$** per Policy |
|
|
|
|
|
Variable Annuity Reinsured Business |
|
|
|
|
|
|
|
Corporate Overhead Factor |
|
$** per Annum |
|
|
|
|
|
Business Overhead Factor |
|
$** per Policy |
|
|
|
|
|
Long-Term Care Retroceded Business |
|
|
|
|
|
|
|
Corporate Overhead Factor |
|
$** per Annum |
The Service Charges will be determined quarterly and billed to the Company in three equal installments at the end of the month during the quarter. Each monthly installment billed for a particular line of business will be determined by (a) multiplying the actual number of units at the beginning of the quarter covered by this Agreement times the Business Overhead Factor (divided by twelve), if applicable, and (b) adding the applicable Corporate Overhead Factor (divided by twelve).
The Annual Expense Reimbursement Factors for each respective line of business will be adjusted (i) for the year beginning January 1, 2005 and, thereafter, every three (3) years during the term of this Agreement based on a triennial cost/time study prepared in accordance with the methodology set forth below (the “Triennial Study”) and (ii) for the years between the Triennial Studies based on a report setting forth the Annual Expense Reimbursement Factors prepared in accordance with the methodology set forth below (the “Annual Expense Reimbursement Factors Report”).
(a) Triennial Study. As soon as practicable (and in any event within sixty (60) days) prior to January 1, 2005 and prior to the beginning of every third calendar year thereafter during the term of this Agreement, GNA shall cause to be prepared and delivered to the Company the Triennial Study which sets forth the Annual Expense Reimbursement Factors for the next calendar year, together with all supporting data used in preparing the Triennial Study and work papers, in reasonable detail, setting forth the determination of such Annual Expense Reimbursement Factors based on such Triennial Study (such documents, together with the Triennial Study, the “Triennial Study Documents”).
(b) Annual Expense Reimbursement Factors Report. As soon as practicable (and in any event within thirty (30) days) prior to January 1, 2006 and prior to the beginning of each calendar year thereafter in which no Triennial Study is prepared, GNA shall cause to be prepared and delivered to the Company the Annual Expense Reimbursement Factors Report, together with all supporting data used in preparing the Annual Expense Reimbursement Factors Report and work papers, in reasonable detail, setting forth the determination of such Annual Expense Reimbursement Factors for the next calendar year (such documents, together with the Annual Expense Reimbursement Factors Report, the “Annual Expense Reimbursement Factors Documents”).
(c) Methodology. At the time of the Triennial Study, historical costs (to include costs for those services identified as Business Overhead Services and Corporate Overhead Services in Schedule A and any changes thereto pursuant to Schedule A) will be determined for the Annual Expense Reimbursement Factors identified above. For a given Business Overhead Factor (identified above in this Schedule C) the identified or allocated costs, as applicable, will be divided by the total number of remaining Reinsured Policies or Reinsured Contracts (as such terms are defined in the applicable Reinsurance Agreement), as applicable, and the Company’s current in-force business to derive an historical cost per unit. The historical cost per unit will be used as a prospective cost per unit for the next calendar year. For the purposes of allocating costs of providing Business Overhead Services, actual identified costs allocable to each of the lines of business specified above (Structured Settlement Annuity Reinsured Business and Variable Annuity Reinsured Business) shall be allocated to such lines of business. For the purpose of allocating costs of providing the Corporate Overhead Services, the historical costs of such services shall be allocated equally to each of the lines of business specified above.
For the two succeeding years in the period between the Triennial Studies the historical dollar amounts by Annual Expense Reimbursement Factors will be adjusted (rolled forward) for current year cost changes agreed to by GNA and the Company (in accordance with the procedures set forth above). The costs for Business Overhead Services will then be divided by the total number of remaining Reinsured Policies or Reinsured Contracts (as such terms are defined in the applicable Reinsurance Agreement) for the current period to determine a prospective cost per unit for the next calendar year. The costs for Corporate Overhead Services shall be allocated equally to each of the lines of business specified above.
An additional adjustment, positive or negative, to the prospective cost per unit for Business Overhead Services or per annum for Corporate Overhead Services determined by either the Triennial Study or the two succeeding years may be negotiated between the parties. The additional adjustment is for special projected costs or benefits of productivity, process improvements, inflation, loss of scale, and any other cost variation which was not included in the prior Triennial Study or the succeeding roll forward.
The combined prospective unit cost, per annum cost and additional adjustment for a respective line of business is the Annual Expense Reimbursement Factor for that line of business.
(d) Review of Documents. Following the delivery of the Annual Expense Reimbursement Factors Documents or the Triennial Study Documents, as applicable, GNA shall (i) provide to
2
the Company or its designated representative copies of such additional work papers and other documents relating to its preparation of the Annual Expense Reimbursement Factors Report or Triennial Study, as applicable, as the Company or its designated representative may reasonably request, including, without limitation, claims files and practices and (ii) cooperate with, and make its personnel and facilities reasonably available to, the Company and the Company’s designated representative for the purpose of providing such other information as the Company or the Company’s designated representative may reasonably request concerning Annual Expense Reimbursement Factor Documents or the Triennial Study Documents, as applicable, and the calculation of the Annual Expense Reimbursement Factors.
(e) Notice of Disagreement. In the event that the Company has any disagreement with any of the Annual Expense Reimbursement Factor Documents or the Triennial Study Documents, as applicable, the Company shall give written notice of all such disagreements (a “Notice of Disagreement”) to GNA within thirty (30) days after the Annual Expense Reimbursement Factors Documents or the Triennial Study Documents, as applicable, are delivered to the Company. Any Notice of Disagreement shall set forth each item in disagreement and shall provide reasonable specificity as to the basis for each disagreement and shall specify the total adjustment to the Annual Expense Reimbursement Factors as proposed by GNA as a result of such items in disagreement.
(f) Dispute Resolution. If the Company does not deliver a Notice of Disagreement to the Company within such thirty (30) day period, the Annual Expense Reimbursement Factors Documents and the Triennial Study Documents, as applicable, shall be final and binding upon the parties hereto and shall constitute the final calculation of the Annual Expense Reimbursement Factors for the next calendar year. If the Company delivers a Notice of Disagreement to GNA within such thirty (30) day period, the parties shall (and shall cause their respective designated representatives to) negotiate in good faith to resolve all disagreements as promptly as practicable. Any changes in the Annual Expense Reimbursement Factors, if any, that are agreed to by the Company and GNA within sixty (60) days of the aforementioned delivery of the Annual Expense Reimbursement Factors Documents or the Triennial Study Documents, as applicable, shall be incorporated into a final calculation of the Annual Expense Reimbursement Factors. If the parties and their respective designated representatives are unable to resolve all disagreements within sixty (60) days of delivery of the Annual Expense Reimbursement Factors Documents or the Triennial Study Documents, as applicable, then all unresolved disagreements will be submitted within ten (10) days after the end of such sixty (60) day period for resolution in accordance herewith to an independent certified public accounting firm of national standing and reputation (the “Accounting Firm”) mutually acceptable to the Company and GNA. The parties shall cooperate in good faith with the Accounting Firm and shall give the Accounting Firm access to all data and other information requested by the Accounting Firm for purposes of such resolution. The Accounting Firm shall, within thirty (30) days after its engagement, deliver to the Company and GNA a definitive calculation of the Business Overhead Factors, which shall be final and binding upon the parties hereto and shall be so reflected in the calculation of the Business Overhead Factors. The Company and GNA shall each pay one-half of the fees and expenses of the Accounting Firm.
(g) Service Charges Pending Resolution. In the event of a dispute with respect to any Annual Expense Reimbursement Factors for the next succeeding Calendar year, the Company and GNA
3
agree that the Annual Expense Reimbursement Factors then in effect under this Agreement shall remain in effect pending resolution of such dispute and adjustment, if any, in accordance with the dispute resolution procedure set forth in paragraph (f) above.
4
BUSINESS ASSOCIATE ADDENDUM
I Purpose.
In order to disclose certain information to GNA (for purposes of this Addendum, the “Provider”) under this Addendum, some of which may constitute Protected Health Information (“PHI”) (defined below), the Company (for purposes of this Addendum, the “Recipient”) and Provider mutually agree to comply (and Provider shall cause its Subsidiaries and Affiliates performing Services to comply) with the terms of this Addendum for the purpose of satisfying the requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing privacy regulations at 45 C.F.R. Parts 160-164 (“HIPAA Privacy Rule”). These provisions shall apply to Provider and its Subsidiaries and Affiliates to the extent that any or Provider or its Subsidiaries and Affiliates is considered a “Business Associate” under the HIPAA Privacy Rule and all references in this section to Business Associates shall refer to Provider or such Subsidiary or Affiliate. Capitalized terms not otherwise defined herein shall have the meaning assigned in the Agreement. Notwithstanding anything else to the contrary in the Agreement, in the event of a conflict between this Addendum and the Agreement, the terms of this Addendum shall prevail.
II Permitted Uses and Disclosures.
Business Associate agrees to use or disclose Protected Health Information (“PHI”) that it creates for or receives from Recipient or its Subsidiaries only as follows. The capitalized term “Protected Health Information or PHI” has the meaning set forth in 45 Code of Federal Regulations Section 164.501, as amended from time to time. Generally, this term means individually identifiable health information including, without limitation, all information, data and materials, including without limitation, demographic, medical and financial information, that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past present, or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual. This definition shall include any demographic information concerning members and participants in, and applicants for, Recipient’s or its Subsidiaries’ health benefit plans. All other terms used in this Addendum shall have the meanings set forth in the applicable definitions under the HIPAA Privacy Rule.
A. Functions and Activities on Company’s Behalf. Business Associate is permitted to use and disclose PHI it creates for or receives from Recipient or its Subsidiaries only for the purposes described in this Addendum or the Agreement that are not inconsistent with the provisions of this Addendum, or as required by law, or following receipt of prior written approval from whichever of the Recipient or its Subsidiary or Affiliate for which the relevant PHI was created or from which the relevant PHI was received. In addition to these specific requirements below, Business Associate may use or disclose PHI only in a manner that would not violate the HIPAA Privacy Rule if done by the Recipient or its Subsidiaries.
B. Business Associate’s Operations. Business Associate is permitted by this Agreement to use PHI it creates for or receives from Recipient or its Subsidiaries: (i) if such use is reasonably necessary for Business Associate’s proper management and administration; and (ii) as reasonably necessary to carry out Business Associate’s legal responsibilities. Business Associate is permitted to disclose PHI it creates for or receives from Recipient or its Subsidiaries for the purposes identified in this Section only if the following conditions are met:
(1) The disclosure is required by law; or
(2) The disclosure is reasonably necessary to Business Associate’s proper management and administration, and Business Associate obtains reasonable assurances in writing from any person or organization to which Business Associate will disclose such PHI that the person or organization will:
a. Hold such PHI as confidential and use or further disclose it only for the purpose for which Business Associate disclosed it to the person or organization or as required by law; and
b. Notify Business Associate (who will in turn promptly notify whichever of the Recipient or its Subsidiary or Affiliate for which the relevant PHI was created or from which the relevant PHI was received) of any instance of which the person or organization becomes aware in which the confidentiality of such PHI was breached.
C. Minimum Necessary Standard. In performing the functions and activities on Recipient’s or its Subsidiaries’ behalf pursuant to the Agreement, Business Associate agrees to use, disclose or request only the minimum necessary PHI to accomplish the purpose of the use, disclosure or request. Business Associate must have in place policies and procedures that limit the PHI disclosed to meet this minimum necessary standard.
D. Prohibition on Unauthorized Use or Disclosure. Business Associate will neither use nor disclose PHI it creates or receives for or from Recipient, its Subsidiaries, or from another business associate of Recipient or its Subsidiaries, except as permitted or required by this Addendum or the Agreement that are not inconsistent with the provisions of this Addendum, or as required by law, or following receipt of prior written approval from whichever of the Recipient or its Subsidiary or Affiliate for which the relevant PHI was created or from which the relevant PHI was received.
E. De-identification of Information. Business Associate agrees neither to de-identify PHI it creates for or receives from Recipient or its Subsidiaries or from another business associate of Recipient or its Subsidiaries, nor use or disclose such de-identified PHI, unless such de-identification is expressly permitted under the terms and conditions of this Addendum or the Agreement and related to Recipient’s or its Subsidiaries’ activities for purposes of “treatment”, “payment” or “health care operations”, as those terms are defined under the HIPAA Privacy Rule. De-identification of PHI, other than as expressly permitted under the terms and conditions of the Addendum for Business Associate to perform services for Recipient or its Subsidiaries, is not a permitted use of PHI under this Addendum.
2
Business Associate further agrees that it will not create a “Limited Data Set” as defined by the HIPAA Privacy Rule using PHI it creates or receives, or receives from another business associate of Recipient or its Subsidiaries, nor use or disclose such Limited Data Set unless: (i) such creation, use or disclosure is expressly permitted under the terms and conditions of this Addendum or the Agreement that are not inconsistent with the provisions of this Addendum; and such creation, use or disclosure is for services provided by Business Associate that relate to Recipient’s or its Subsidiaries’ activities for purposes of “treatment”, “payment” or “health care operations”, as those terms are defined under the HIPAA Privacy Rule.
F. Information Safeguards. Business Associate will develop, document, implement, maintain and use appropriate administrative, technical and physical safeguards to preserve the integrity and confidentiality of and to prevent non-permitted use or disclosure of PHI created for or received from Recipient or its Subsidiaries. These safeguards must be appropriate to the size and complexity of Business Associate’s operations and the nature and scope of its activities. Business Associate agrees that these safeguards will meet any applicable requirements set forth by the U.S. Department of Health and Human Services, including (as of the effective date or as of the compliance date, whichever is applicable) any requirements set forth in the final HIPAA security regulations. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate resulting from a use or disclosure of PHI by Business Associate in violation of the requirements of this Addendum.
III Conducting Standard Transactions. In the course of performing services for Recipient or its Subsidiaries, to the extent that Business Associate will conduct Standard Transactions for or on behalf of Recipient or its Subsidiaries, Business Associate will comply, and will require any subcontractor or agent involved with the conduct of such Standard Transactions to comply, with each applicable requirement of 45 C.F.R. Part 162. “Standard Transaction(s)” shall mean a transaction that complies with the standards set forth at 45 C.F.R. parts 160 and 162. Further, Business Associate will not enter into, or permit its subcontractors or agents to enter into, any trading partner agreement in connection with the conduct of Standard Transactions for or on behalf of the Recipient or its Subsidiaries that:
a. Changes the definition, data condition, or use of a data element or segment in a Standard Transaction;
b. Adds any data element or segment to the maximum defined data set;
c. Uses any code or data element that is marked “not used” in the Standard Transaction’s implementation specification or is not in the Standard Transaction’s implementation specification; or
d. Changes the meaning or intent of the Standard Transaction’s implementation specification.
IV Sub-Contractors, Agents or Other Representatives. Business Associate will require any of its subcontractors, agents or other representatives to which Business Associate is permitted by this Addendum or the Agreement (or is otherwise given Recipient’s or the relevant Subsidiary’s or Affiliate’s prior written approval) to disclose any of the PHI Business Associate creates or
3
receives for or from Recipient or its Subsidiaries, to provide reasonable assurances in writing that subcontractor or agent will comply with the same restrictions and conditions that apply to the Business Associate under the terms and conditions of this Addendum with respect to such PHI.
V Protected Health Information Access, Amendment and Disclosure Accounting.
G. Access. Business Associate will promptly upon Recipient’s or its Subsidiary’s or Affiliate’s request make available to Recipient, its Subsidiary, its Affiliate, or, at Recipient’s or such Subsidiary’s or Affiliate’s direction, to the individual (or the individual’s personal representative) for inspection and obtaining copies any PHI about the individual which Business Associate created for or received from Recipient or its Subsidiary or Affiliate and that is in Business Associate’s custody or control, so that Recipient or its Subsidiary or Affiliate may meet its access obligations under 45 Code of Federal Regulations § 164.524.
H. Amendment. Upon Recipient’s or its Subsidiary’s or Affiliate’s request Business Associate will promptly amend or permit Recipient or its Subsidiary or Affiliate access to amend any portion of the PHI which Business Associate created for or received from Recipient or its Subsidiary or Affiliate, and incorporate any amendments to such PHI, so that Recipient or its Subsidiary or Affiliate may meet its amendment obligations under 45 Code of Federal Regulations § 164.526.
I. Disclosure Accounting. So that Recipient or its Subsidiaries or Affiliates may meet their disclosure accounting obligations under 45 Code of Federal Regulations § 164.528:
1. Disclosure Tracking. Business Associate will record for each disclosure, not excepted from disclosure accounting under Section V.C.2 below, that Business Associate makes to Recipient or its Subsidiaries of PHI that Business Associate creates for or receives from Recipient or its Subsidiaries, (i) the disclosure date, (ii) the name and member or other policy identification number of the person about whom the disclosure is made, (iii) the name and (if known) address of the person or entity to whom Business Associate made the disclosure, (iv) a brief description of the PHI disclosed, and (v) a brief statement of the purpose of the disclosure (items i-v, collectively, the “disclosure information”). For repetitive disclosures Business Associate makes to the same person or entity (including Recipient or its Subsidiaries) for a single purpose, Business Associate may provide a) the disclosure information for the first of these repetitive disclosures, (b) the frequency, periodicity or number of these repetitive disclosures and (c) the date of the last of these repetitive disclosures. Business Associate will make this disclosure information available to Recipient or its Subsidiaries promptly upon Recipient’s or its Subsidiaries’ request.
2. Exceptions from Disclosure Tracking. Business Associate need not record disclosure information or otherwise account for disclosures of PHI that this Addendum or Recipient or the relevant Subsidiary or Affiliate in writing permits or requires (i) for the purpose of Recipient’s or its Subsidiaries’ treatment activities, payment activities, or health care operations, (ii) to the individual who is the subject of the PHI disclosed or to that individual’s personal representative; (iii) to persons involved in that individual’s
4
health care or payment for health care; (iv) for notification for disaster relief purposes, (v) for national security or intelligence purposes, (vi) to law enforcement officials or correctional institutions regarding inmates; or (vii) pursuant to an authorization; (viii) for disclosures of certain PHI made as part of a Limited Data Set; (ix) for certain incidental disclosures that may occur where reasonable safeguards have been implemented; and (x) for disclosures prior to April 14, 2003.
3. Disclosure Tracking Time Periods. Business Associate must have available for Recipient and its Subsidiaries the disclosure information required by this section for the 6 years preceding Recipient’s or its Subsidiaries’ request for the disclosure information (except Business Associate need have no disclosure information for disclosures occurring before April 14, 2003).
VI Additional Business Associate Provisions
J. Reporting of Breach of Privacy Obligations. Business Associate will provide written notice to whichever of the Recipient or its Subsidiary or Affiliate for which the relevant PHI was created or from which the relevant PHI was received of any use or disclosure of PHI that is neither permitted by this Addendum nor given prior written approval by Recipient or the relevant Subsidiary or Affiliate promptly after Business Associate learns of such non-permitted use or disclosure. Business Associate’s report will at least:
(i) Identify the nature of the non-permitted use or disclosure;
(ii) Identify the PHI used or disclosed;
(iii) Identify who made the non-permitted use or received the non-permitted disclosure;
(iv) Identify what corrective action Business Associate took or will take to prevent further non-permitted uses or disclosures;
(v) Identify what Business Associate did or will do to mitigate any deleterious effect of the non-permitted use or disclosure; and
(vi) Provide such other information, including a written report, as Recipient or the relevant Subsidiary or Affiliate may reasonably request.
K. Amendment. Upon the effective date of any final regulation or amendment to final regulations promulgated by the U.S. Department of Health and Human Services with respect to PHI, including, but not limited to the HIPAA privacy and security regulations, this Addendum and the Agreement will automatically be amended so that the obligations they impose on Business Associate remain in compliance with these regulations.
In addition, to the extent that new state or federal law requires changes to Business Associate’s obligations under this Addendum, this Addendum shall automatically be amended to include such additional obligations, upon notice by Recipient or its Subsidiaries to Business Associate of such obligations. Business Associate’s continued performance of services under the Agreement shall be deemed acceptance of these additional obligations.
5
L. Audit and Review of Policies and Procedures. Business Associate agrees to provide, upon Recipient request, access to and copies of any policies and procedures developed or utilized by Business Associate regarding the protection of PHI. Business Associate agrees to provide, upon Recipient’s request, access to Business Associate’s internal practices, books, and records, as they relate to Business Associate’s services, duties and obligations set forth in this Addendum and the Agreement(s) under which Business Associate provides services and / or products to or on behalf of Recipient or its Subsidiaries, for purposes of Recipient’s or its Subsidiaries’ review of such internal practices, books, and records.
6