Current Assets

EX-10.28.2 6 a93753exv10w28w2.txt EXHIBIT 10.28.2 EXHIBIT 10.28.2 CONFIDENTIAL TREATMENT HAS BEEN REQUESTED FOR CERTAIN REDACTED PROVISIONS OF THIS AGREEMENT. THE REDACTED PROVISIONS ARE IDENTIFIED BY THREE ASTERISKS ENCLOSED BY BRACKETS AND UNDERLINED. THE CONFIDENTIAL PORTION HAS BEEN FILED SEPARATELY WITH THE SECURITIES AND EXCHANGE COMMISSION. AMENDMENT NO. 4 TO SERVICES AGREEMENT HIPAA BUSINESS ASSOCIATE AMENDMENT This HIPAA Business Associate Amendment (the "AMENDMENT"), shall be effective as of April 14, 2003 (the "EFFECTIVE DATE"), shall amend that certain Services Agreement by and between Prudential and Company dated as of January 11, 2002, as amended (the "SERVICES AGREEMENT"), and is entered into by and between The Prudential Insurance Company of America ("PLAN SPONSOR"), with offices at 751 Broad Street, Newark, NJ 07102 and the Administrative Committee on behalf of The Prudential Welfare Benefits Plan, The Prudential Flexible Benefits Plan, the Prudential Medical Access Plan and the Prudential Executive Medical Access Plan ("PLAN ADMINISTRATOR") (together "PRUDENTIAL") and Exult, Inc. ("COMPANY"). Prudential and Company agree that the terms and conditions of this Amendment shall supplement and govern uses and disclosures of Protected Health Information ("PHI") as defined in the federal health Privacy Rules (as defined below), and shall be effective and apply notwithstanding any conflicting provisions of the Services Agreement. Company and Prudential acknowledge the provisions herein are set forth pursuant to the requirements promulgated by the Secretary ("SECRETARY") of the Department of Health & Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191), and promulgated in the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E (the "PRIVACY RULES"). Company and Prudential further acknowledge that (i) Company is, or may be deemed to be, a "Business Associate" of Prudential, as the term is defined under the Privacy Rules, and (ii) The Prudential Welfare Benefits Plan, The Prudential Flexible Benefits Plan, the Prudential Medical Access Plan and the Prudential Executive Medical Access Plan are "Covered Entities" as that term is defined under the Privacy Rules. The terms used in this Amendment, but not otherwise defined, shall have the same meanings as those terms in 45 CFR 160.103 and 164.501 or in the Services Agreement, as applicable. References to the Privacy Rules shall mean as enacted and shall include any later amendments, deletions or revisions. A. OBLIGATIONS OF COMPANY 1. Company shall only use or disclose PHI as set forth in and in accordance with this Amendment or as required by law. Company shall not use or disclose PHI in any manner, for any other purpose, or disclose it to any third party, other than as authorized by this Amendment or as required by law. The term "REQUIRED BY LAW" shall have the same meaning as the term "required by law" in 45 CFR Section 164.501. "PHI" shall have the same meaning as it has in 45 CFR Section 164.501 of the Privacy Rules, limited to the information created or received by Company from or AMENDMENT NO. 4 TO SERVICES AGREEMENT HIPAA BUSINESS ASSOCIATE AMENDMENT on behalf of Prudential. The PHI subject to this Amendment shall be that pertaining to any "INDIVIDUAL" (as that term is defined in 45 CFR Section 164.501 of the Privacy Rules, and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g)) who has made application to be or is covered under: the Medical, Global Medical, Dental, Global Dental, Vision, or Long Term Care Benefits provided under the Prudential Welfare Benefits Plan; the Health Care Reimbursement Benefits provided under the Prudential Flexible Benefits Plan; the Prudential Medical Access Plan; or the Prudential Executive Medical Access Plan and whose PHI is subject to the Privacy Rules. Company hereby represents that it will make reasonable efforts to limit any PHI it shall require from Prudential to the minimum necessary, as defined in 45 CFR Section 164.502(b), for the Company's stated purposes under the Services Agreement and acknowledges that Prudential shall rely upon such representation with respect to any request for PHI from Company. Company shall not use or disclose PHI in a manner that would violate the requirements of the Privacy Rules if such use or disclosure were made by Prudential. In addition: (a) Company may use or disclose PHI for the proper management and administration of Company, and to carry out the legal responsibilities of Company; provided that: (i) the disclosure is required by law; or (ii) Company obtains reasonable assurance from a third person to whom the PHI is disclosed that such PHI will remain confidential, be used or further disclosed only as required by law or for the reasons it was disclosed to the third person, and the third person notifies Company of any instances of which it is aware in which the confidentiality of the PHI has been breached; (b) Company may use or disclose PHI to provide data aggregation services relating to the "HEALTH CARE OPERATIONS," (as defined in the Privacy Rules) of Prudential if such services are provided for in the applicable arrangements or agreements between Prudential and Company. 2. Company shall not use or further disclose PHI other than as permitted or required by this Amendment or as required by law. 3. Company shall use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this Amendment or as required by law. 4. Company shall report to Prudential any use or disclosure of PHI, not provided for by this Amendment or as required by law, of which Company becomes aware. 5. Company shall ensure that any agents, including any subcontractors, to whom it provides PHI received from, or created or received by the Company on behalf of Prudential agrees to substantially the same restrictions and conditions that apply to it through this Amendment with respect to such PHI. 6. Company shall, at the reasonable request of Prudential make available PHI to Prudential in accordance with Section 164.524 of the Privacy Rules. AMENDMENT NO. 4 TO SERVICES AGREEMENT HIPAA BUSINESS ASSOCIATE AMENDMENT 7. Company shall make available, at the reasonable request of Prudential, PHI for amendment by Prudential and shall incorporate any amendments to PHI in Company's designated record sets in accordance with Section 164.526 of the Privacy Rules. For all requested amendments under this Section 7, Company shall be entitled to rely entirely on such requests for all matters relating to the accuracy and completeness of such PHI. 8. Company will reasonably assist Prudential in responding to any disclosure request made by a subject of PHI. Accordingly, Company will keep an accounting of all disclosures ("Disclosures") of PHI (the "DISCLOSURE ACCOUNTING") on an ongoing basis and maintain the Disclosure Accounting for a period of at least six (6) years from the date of each Disclosure. For the purposes of this Amendment, Disclosures shall not include any disclosure of PHI by Company (i) to carry out treatment, payment and health care operations solely as set forth in 45 CFR Section 164.506; (ii) pursuant to an instruction from Prudential as approved by an authorization received from a subject of PHI; (iii) directly to the subject of the PHI; or (iv) that occurred prior to the April 14, 2003. At a minimum, the Disclosure Accounting shall contain (w) the date of the Disclosure; (x) the name of the entity or person who received the PHI and, if known, the address of such entity or person; (y) a brief description of the PHI disclosed; and (z) a brief statement of the purpose of the Disclosure that reasonably informs the subject of the PHI of the basis for the Disclosure; or in lieu of such statement a copy of the subject's written authorization or request for Disclosure pursuant to the Privacy Rules. Company will provide the Disclosure Accounting to Prudential within forty-five (45) days after receipt of a written request from Prudential. 9. Subject to Company's security requirements, confidentiality obligations and the audit rights set forth in the Services Agreement, Company shall make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by the Company on behalf of, Prudential available to Prudential or, at the request of Prudential, to the Secretary for purposes of the Secretary determining Prudential's compliance with the Privacy Rules. 10. Company agrees to use commercially reasonable efforts to mitigate, to the extent practicable, any harmful effect that is known to Company of a use or disclosure of PHI in violation of the requirements of this Amendment. 11. Company's obligations under this Amendment exist and occur solely to the extent required by the Privacy Rules. B. OBLIGATIONS OF PRUDENTIAL 1. Prudential shall provide Company with a copy of the Notice of Privacy Practices Prudential produces in accordance with the Privacy Rules, as well as any changes to such Notice of Privacy Practices. 2. Prudential shall provide Company with any changes in, or revocation of, permission by Individuals to use or disclose PHI, if such changes affect Company's permitted uses or disclosures. AMENDMENT NO. 4 TO SERVICES AGREEMENT HIPAA BUSINESS ASSOCIATE AMENDMENT 3. Prudential shall notify Company of any restriction to the use or disclosure of PHI Prudential agrees to in accordance with the Privacy Rules. 4. Prudential shall not request Company to use or disclose PHI in any manner that would not be permissible under the Privacy Rules if done by Prudential. 5. Company's obligations under this Amendment are conditioned upon Prudential's satisfactory performance of its obligations hereunder. Any failure of Prudential to perform its obligations hereunder shall excuse Company from performing its obligations hereunder to the extent such performance is hindered or prevented by such failure to perform by Prudential. Prudential and Company agree to discuss in good faith any modifications or changes to the Services provided pursuant to the Services Agreement and the fees paid thereunder that result from any changes in the use or disclosure of PHI. C. TERM AND TERMINATION 1. Term. The term of this Amendment shall be effective as of the Effective Date of this Amendment and shall terminate upon the earlier of: (i) the Privacy Rules are repealed or no longer in effect; (ii) the termination of expiration of the Services Agreement pursuant to its terms; or (ii) all of the PHI provided by Prudential to Company, or created or received by Company on behalf of Prudential, is destroyed or returned to Prudential, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with this Amendment. 2. Termination for Cause. Upon Prudential's knowledge of a material breach of this Amendment by Company, Prudential shall either: (a) terminate this Amendment if Company fails to cure such breach within thirty (30) days after receipt of written notice thereof; or (b) immediately terminate this Amendment if Company has breached a material term of this Amendment and cure is not reasonably possible; or (c) if neither termination nor cure is feasible, Prudential shall report the violation to the Secretary. 3. Effect of Termination. (a) Upon termination of this Amendment for any reason, Company shall return or destroy all PHI received from Prudential, or created or received by Company on behalf of Prudential. This provision shall apply to PHI that is in the possession of subcontractors or agents of Company. Company shall retain no copies of the PHI; (b) in the event that Company determines that returning or destroying the PHI is infeasible, Company shall provide to Prudential notification of the conditions that make return or destruction infeasible. Company shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make return or destruction infeasible, for so long as Company maintains such PHI. AMENDMENT NO. 4 TO SERVICES AGREEMENT HIPAA BUSINESS ASSOCIATE AMENDMENT D. MISCELLANEOUS. 1. Regulatory References. A reference in this Amendment to a section in the Privacy Rules means the section as in effect or amended. 2. Amendment. The Parties agree to take such reasonable action as is necessary to amend this Amendment from time to time as is necessary for Prudential to comply with the requirements of the Privacy Rules and the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191. 3. Survival. The respective rights and obligations of Company under Section C (3) of this Amendment shall survive the termination of this Agreement and/or the other agreements or arrangements. 4. Interpretation. Any ambiguity in this Amendment shall be resolved in favor of a meaning that permits Prudential to comply with the Privacy Rules. 5. Limitation of Liability. IN NO EVENT SHALL COMPANY'S TOTAL AGGREGATE LIABILITY TO PRUDENTIAL ARISING FROM OR RELATING TO THIS AMENDMENT EXCEED [***]*, REGARDLESS OF THE FORM OF ACTION, WHETHER IN CONTRACT, TORT OR OTHERWISE; AND COMPANY SHALL NOT BE LIABLE TO PRUDENTIAL FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY OR SPECIAL DAMAGES, INCLUDING WITHOUT LIMITATION LOST PROFITS OR REVENUE, EVEN IF COMPANY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 6. No Warranties. COMPANY SPECIFICALLY DISCLAIMS ANY AND ALL WARRANTIES OF ANY KIND WITH REGARD TO ANY SUBJECT MATTER OF THIS AMENDMENT, INCLUDING WITHOUT LIMITATION ANY WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE, FUNCTIONALITY OR MERCHANTABILITY, WHETHER EXPRESS OR IMPLIED. 7. Effect on Services Agreement. Prudential and Company agree that any failure of Company to achieve any Service Levels under the Services Agreement or performance of any other obligations under the Services Agreement shall be excused to the extent such failures are caused by Company's performance of its obligations under this Amendment. 8. No Third Party Beneficiaries. Nothing in this Amendment is intended to confer any rights, benefits, remedies, obligations or liabilities on any third party (including without limitation any employees or agents of either party) other than the parties or their respective successors and assigns. AMENDMENT NO. 4 TO SERVICES AGREEMENT HIPAA BUSINESS ASSOCIATE AMENDMENT Except as amended herein, all terms and conditions of the Services Agreement between the Parties shall remain in full force and effect in accordance with such agreement. Agreed to and Accepted by: NAME DATE - ---------------------------------------------------- The Prudential Insurance Company of America NAME DATE - ---------------------------------------------------- The Administrative Committee on behalf of The Prudential Welfare Benefits Plan, The Prudential Flexible Benefits Plan, the Prudential Medical Access Plan and the Prudential Executive Medical Access Plan NAME DATE - ---------------------------------------------------- Exult, Inc