Maine Department of Health and Human Services
Business Associate Agreement
This Business Associate Agreement (“Agreement”) is made this ___ day of _________, 20___
(the “Effective Date”) by and between the State of Maine, Department of Health and Human
Services (the Covered Entity, hereinafter, the “Department”) and ________________________
(“Business Associate”), together (the “Parties”); and
WHEREAS, Business Associate may use, disclose, create, receive, maintain or transmit
protected health information in a variety of form or formats, including verbal, paper and
electronic (together, “PHI”) on behalf of the Department in connection with Business
Associate’s performance of its obligations under the following agreement between the parties:
____________________________________________________________________________
dated ___________, 20___ (the “Underlying Agreement”); and
WHEREAS, the Parties intend to ensure the confidentiality, privacy and security of
Department’s PHI as required by law, including the Health Insurance Portability and
Accountability Act of 1996, P.L. 104-191 (HIPAA), and its implementing regulations at 45 CFR
Parts 160 and 164 (the Privacy, Security, Breach Notification and Enforcement Rules or
“HIPAA Rules”) as updated by the Health Information Technology for Economic and Clinical
Care Act (HITECH) enacted under Title XII of the American Recovery and Reinvestment Act of
2009, and its implementing Regulations (together, the “HIPAA and HITECH Rules”); and
WHEREAS, the Parties agree that certain federal and state laws, rules, regulations and
accreditation standards also impose confidentiality restrictions that apply to this business
relationship, and may include, but are not limited to: 42 CFR 2 et. seq;, 5 M.R.S.A. §19203-D;
22 M.R.S.A. §§42, 261, 815, 824, 833, 1494, 1596, 1711-C, 1828, 3173, 3292, 4008, 5328,
7250, 7703, 8754; 10 M.R.S.A 1346 et. seq; 34-B M.R.S.A. §1207; 14-193 C.M.R, Ch. 1, Part
A, § IX; and applicable accreditation standards of The Joint Commission or other appropriate
accreditation body regarding confidentiality.
NOW THEREFORE, the parties agree as follows:
1 of 7