Microsoft word - loyaltyscripttcs_wbaa_7_2_13.docx

LOYALTYSCRIPT® CARD PROGRAM
TERMS AND CONDITIONS
BUSINESS ASSOCIATE AGREEMENT
THESE TERMS AND CONDITIONS, INCLUDING THE BUSINESS ASSOCIATE AGREEMENT APPENDED AS APPENDIX , (“TERMS”) GOVERN PHARMACY’S (“PHARMACY”, “YOU” OR “YOUR”) PARTICIPATION IN THE LOYALTYSCRIPT® CARD
PROGRAM (THE “PROGRAM” OR “LOYALTYSCRIPT®”) ADMINISTERED BY McKESSON PATIENT RELATIONSHIP SOLUTIONS, A
BUSINESS UNIT OF MCKESSON SPECIALTY ARIZONA INC. (“ADMINISTRATOR”). BY PARTICIPATING IN THIS PROGRAM, YOU
AGREE TO BE BOUND BY THESE TERMS. In consideration of Pharmacy participation in the Program, Pharmacy agrees as follows: 1. Program Participation. LOYALTYSCRIPT® cards may be pre-activated or patients may call Administrator, or visit a website to activate their Card or otherwise enroll in the Program. You understand and agree that enrollment in the Program is not a requirement and is subject to criteria established by LOYALTYSCRIPT®, Administrator and Administrator’s customers and that the criteria are subject to change without notice, and that some patients may not qualify for participation in the Program. Eligibility determinations shall be made by Administrator on behalf of its manufacturer customers in its sole discretion. Individuals who are eligible to participate in the Program (the “Eligible Members”) shall be provided with a voucher or card (the “LOYALTYSCRIPT® Card”) to indicate their participation in the Program. Eligible Members must present their LOYALTYSCRIPT® Card or voucher to You in order to participate in the Program at Your pharmacy. You understand and agree that all beneficiaries of any state of federally funded program such as Medicare, Medicaid, TriCare, VA, DOD, etc. are ineligible for participation in the Program. 2. Program Payments. For each of Your patients who: (1) is an Eligible Member; (2) presents the LOYALTYSCRIPT® Card with respect to the filling of a prescription for a Customer’s Covered Drug (as defined below), and (3) pays pharmacy the charge for such Covered Drug consistent with these Terms, You shall be entitled to receive an amount equal to the Amount Due Pharmacy, upon submission of Your claim as provided below. “Amount Due Pharmacy” shall mean the amount payable to Pharmacy by Administrator acting on behalf of its Customer in connection with any Program Transaction and in accordance with the terms set forth in Exhibit 1 to these Terms. “Usual and Customary Price” means the lowest price Pharmacy would charge to its patients if such patients were paying cash for an identical prescription on that particular day, including any applicable discounts offered to attract patients. 3. Program Participation and Reimbursement. Program participation and reimbursement terms are set forth in Exhibit 1 to these Terms, which may be revised by Administrator with such revisions becoming effective upon posting such revisions on www.mckesson.com/MPRS at any time and from time to time in its discretion consistent with the LOYALTYSCRIPT® Card Program. 4. Pharmacy Remittance. Administrator shall process Pharmacy’s claims every fourteen (14) days (the “Claims Processing Date”) and shall pay Pharmacy for such claims fourteen (14) days after the Claims Processing Date. As an example for illustrative purposes only, for claims submitted by Pharmacy between February 1 and February 14, the Claims Processing Date shall be February 14 and payment will be made on February 28. 5. Help Desk. Administrator shall make available to Pharmacies the services of a telephone help desk to answer questions regarding Transaction submissions. 6. Proprietary Notices. You understand and agree that You are not granted any rights, title, interest or licenses in or to the business or product names of Administrator or LOYALTYSCRIPT® or any of the member companies thereof. 7. No Warranty. You agree that Your participation in the Program is voluntary, and at Your own risk. YOU UNDERSTAND AND AGREE THAT ADMINISTRATOR, LOYALTYSCRIPT®, ITS ELIGIBLE MEMBERS AND CUSTOMERS,
DISCLAIM ANY AND ALL WARRANTIES, REPRESENTATIONS AND CONDITIONS, WHETHER EXPRESS OR IMPLIED, WITH RESPECT TO THE PROGRAM AND YOUR PARTICIPATION IN IT. YOU FURTHER UNDERSTAND AND AGREE THAT, EXCEPT FOR THE AMOUNT
DUE PHARMACY, YOU ARE NOT ENTITLED TO PAYMENT OR COMPENSATION OF ANY KIND, INCLUDING, BUT NOT LIMITED
TO, REIMBURSEMENT FOR ANY ADVERTISING OR OTHER COSTS THAT YOU MAY EXPEND AS A RESULT OF YOUR PARTICIPATION
IN THE PROGRAM. You shall make no representations or warranties of any kind on behalf of Administrator, LOYALTYSCRIPT®, Eligible Members or Customer. Administrator shall not be liable for any clam, injury, demand or judgment based on tort or other grounds (including warranty of merchantability) arising out of the sale or dispensing of any prescription drug provided by Pharmacy or any Pharmacy pharmacist to any person or arising out of Your negligence, violation of law, or willful misconduct; and Pharmacy agrees to defend Administrator and indemnify and hold Administrator harmless from and against any and all such claims, injuries, demands and judgments, including, without limitation, payment of all costs and reasonable attorneys’ fees. 8. Limitation of Liability. YOU UNDERSTAND AND AGREE THAT IN NO EVENT SHALL ADMINISTRATOR, LOYALTYSCRIPT®, ITS ELIGIBLE MEMBERS OR ANY CUSTOMER, OR THEIR RESPECTIVE OFFICERS, DIRECTORS, SUBSIDIARIES, AFFILIATES, OR SUPPLIERS BE LIABLE FOR DAMAGES OF ANY KIND, WHETHER DIRECT, INDIRECT, CONSEQUENTIAL, INCIDENTAL, PUNITIVE, OR OTHERWISE, HOWEVER CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF THESE TERMS OR YOUR PARTICIPATION IN THE PROGRAM, EVEN IF ADMINISTRATOR HAS BEEN INFORMED OF Termination. You understand and agree that the Program (and/or Your participation in it) may be terminated by Administrator at any time with or without cause upon notice to you. Notwithstanding the foregoing, You shall no longer be eligible to participate in the Program and receive the Amount Due Pharmacy (together the “Payment”) if you fail to comply with these Terms. You shall receive Payments for covered pharmacy services prior to the effective date of termination and such amounts shall be payable to You in accordance with these Terms. After the effective date of termination of the Program or your participation therein, however, no new Payments shall be payable to You for any reason. Administrator shall not be liable to You or any third party for damages as a result of termination of the Program, and/or Your participation in it. You may terminate Your participation in the Program at any time by ten (10) days’ written notice to Administrator. If Pharmacy continues to submit to Administrator Program transactions after notifying Administrator that it no longer intends to participate in such Program, Pharmacy’s notice shall become null and void and of no further force or effect. Administrator shall process such transactions at the then current Amount Due calculation in effect for the Program. Sections 6, 7, 8, and 10 of these Terms shall survive the termination of the Program, and/or Your participation in it. 10. Audit Rights. Administrator or its designee shall have the right upon reasonable prior written notice, and during normal business hours, during the term of these Terms and for a period of two (2) years thereafter, subject to applicable law (including those governing confidentiality), to audit Your records as they pertain to Your compliance with these Terms and Conditions. In the event that any such audit reveals any erroneous amounts paid to You, You agree within thirty (30) days after completion and delivery of the audit findings to pay to Administrator any such amounts. The rights provided in this Section shall be cumulative and in addition to any other rights or remedies that may be available to Administrator. 11. Compliance. Failure by You to comply with these Terms and Conditions of participation in the Program, including without limitation, failure to limit Your charge to Eligible Members as set forth in Section 3, shall result in your disqualification to submit LOYALTYSCRIPT® transactions and Administrator shall have no further obligation to process any such claims submitted by you or to remit payment to you. 12. Confidentiality. Each party shall maintain the confidentiality of any individually identifiable health information ("IIHI") in accordance with the Business Associate Agreement attached and incorporated herein as Appendix A, and all applicable laws and regulations, without limitation, privacy regulations (45 C.F.R. Parts 160, 162 and 164) implementing the Health Insurance Portability and Accountability Act of 1996 and the HITECH regulations (the “HIPAA”). By way of illustration and not limitation, Pharmacy shall insure that it shall comply with applicable authorization or consent procedures under the HIPAA Regulations in creating and disclosing IIHI to Administrator. 13. Miscellaneous. These Terms shall be governed by and construed in accordance with the internal laws of the State of Delaware, without giving effect to the conflicts of law principles thereof. Any disputes arising under or in connection with these Terms shall be resolved in the state or federal courts in San Francisco, California, and the parties hereby submit to personal jurisdiction and venue in such courts. Pharmacy shall be deemed to have accepted such modification to the formula used to calculate the Amount Due and transaction fees upon posting of such modifications on www.mckesson.com/MPRS. Under no circumstances shall Pharmacy be entitled to receive any payments for any Program other than the Amount Due Pharmacy for the Program under which a Pharmacy is filing a claim on behalf of the Eligible Member. The parties are independent contractors, and nothing contained herein shall be construed as creating any agency, partnership, or other form of joint enterprise between the parties. If any portion of these Terms is found to be void or unenforceable, it shall be enforced to the extent allowable, and the remaining provisions shall remain in full force and effect. If You are not a party to a provider agreement with Administrator, these Terms constitute the entire agreement of the parties with respect to Your participation in the Program. LOYALTYSCRIPT® Card Program Participation and Reimbursement Terms Program Participation. Throughout the term of the Program, whenever an Eligible Member presents his or her LOYALTYSCRIPT® Card to You along with a valid prescription for a Covered Drug (as defined in this paragraph below), You agree: to submit Your claim to McKesson using BIN #610524. If You do not transmit claims electronically, submit a Universal Claim form to McKesson at P.O. Box 52090, Phoenix, AZ 85072. For the purpose of these Terms, a "Covered Drug" is a designated product for which a Customer in the Program shall provide savings to Eligible Members. Administrator may, at the request or direction of one or more Customers, revise the list of Covered Drugs at any time and from time to time in its discretion. The total amount of the Consumer Savings must be provided to the Eligible Member at the time of service. The LOYALTYSCRIPT® Card is not valid for use with any other prescription drug discount card, or manufacturer's coupon for the purchase of Covered Drugs. The LOYALTYSCRIPT® Card is not valid for any prescriptions reimbursed under any federal health care program, including Medicare or Medicaid, or any similar state assistance program. The LOYALTYSCRIPT® Card is void where prohibited by law, void outside the United States of America and Puerto Rico, or where taxed prohibited, assigned or transferred. 2. a. Primary Transaction Adjudication. “Primary Transaction” shall mean a Transaction that is submitted to Administrator where Administrator acts as the primary payor of benefits because the Eligible Member is not covered by any third-party prescription benefit plan. All Primary transactions must comply with the following procedures in dispensing Covered Drugs under the Program: i. Transmit an electronic transaction request in accordance with the then current NCPDP transaction format; ii. Accept a calculation for pricing of AWP less an amount, plus a dispensing fee and a transaction fee or the Pharmacy’s U&C, plus any applicable sales tax in each case, less any patient co-payment amount all of which will be visible to pharmacy when the transaction is adjudicated. iii. Collect the Co-Payment, if any, as directed by the Online System. b. COB Transaction Adjudication. “Coordination of Benefits” shall mean the Transactions submitted by pharmacy to Administrator that include the coordination of benefits or other payment segment of the current NCPDP transmission format. Administrator shall accept Coordination of Benefit (“COB”) Transactions from Pharmacies that transmit such a Transaction in accordance with the then current NCPDP transaction format. i. Administrator shall pay to Pharmacy any applicable discount amount as indicated by Administrator’s system when the transaction is adjudicated less the patient’s co-pay amount plus a transaction fee, all of which will be visible to pharmacy when the transaction is adjudicated ii. Collect the Co-Payment, if any, as directed by the Online System. c. “Average Wholesale Price” or “AWP” shall mean the average wholesale price of the Covered Drug on the date the Pharmacy dispenses the Covered Drug, as published by a nationally recognized provider of pharmacy pricing data from time to time. If you have any questions about pricing or fees payable for processing transactions, please call the Pharmacy Help Desk at 800.657.7613. BUSINESS ASSOCIATE ADDENDUM
SECTION 1: DEFINITIONS

“Electronic Protected Health Information” or “Electronic PHI” will have the meaning given to such term under the
Privacy Rule and the Security Rule, including, but not limited to, 45 C.F.R. § 160.103, as applied to the information that McKesson creates, receives, maintains or transmits from or on behalf of Customer. “Privacy Rule” will mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Part 160
“Protected Health Information” or “PHI” will have the same meaning as the term “protected health information” in 45
C.F.R. § 160.103, as applied to the information created, received, maintained or transmitted by McKesson from or on behalf of Customer.
“Security Rule” will mean the Security Standards at 45 C.F.R. Part 160 and Part 164, Subparts A and C.

Capitalized Terms. Capitalized terms used in this Addendum and not otherwise defined herein will have the meanings
set forth in the Privacy Rule, the Security Rule, and the HIPAA Final Rule, which definitions are incorporated in this Addendum by
reference.
SECTION 2: PERMITTED USES AND DISCLOSURES OF PHI

2.1
Uses and Disclosures of PHI Pursuant to the Underlying Arrangement. Except as otherwise limited in this Addendum, McKesson may use or disclose PHI to perform functions, activities or services for, or on behalf of, Customer as specified in the underlying arrangement subject to the attached Terms and Conditions (the “Underlying Arrangement”), provided that such use or disclosure would not violate the Privacy Rule if done by Customer. 2.2 Permitted Uses of PHI by McKesson. Except as otherwise limited in this Addendum, McKesson may use PHI for the proper management and administration of McKesson or to carry out the legal responsibilities of McKesson. 2.3 Permitted Disclosures of PHI by McKesson. Except as otherwise limited in this Addendum, McKesson may disclose PHI for the proper management and administration of McKesson, provided that the disclosures are Required by Law, or McKesson obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and will be used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person (which purpose must be consistent with the limitations imposed upon McKesson pursuant to this Addendum), and that the person agrees to notify McKesson of any instances of which it is aware in which the confidentiality of the information has been breached. McKesson may disclose PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. § 164.502(j)(1). 2.4 Data Aggregation. Except as otherwise limited in this Addendum, McKesson may use PHI to provide Data Aggregation services for the Health Care Operations of the Customer as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B). 2.5 De-identified Data. McKesson may de-identify PHI in accordance with the standards set forth in 45 C.F.R. § 164.514(b) and may use or disclose such de-identified data unless prohibited by applicable law.
SECTION 3:
OBLIGATIONS OF MCKESSON
Safeguards. McKesson will use appropriate safeguards and will, after the compliance date of the HIPAA Final Rule, comply with the Security Rule with respect to Electronic PHI, to prevent use or disclosure of such information other than as provided for by the Underlying Arrangement and this Addendum. Except as expressly provided in the Underlying Arrangement or this Addendum, McKesson will not assume any obligations of Customer under the Privacy Rule. To the extent that McKesson is to carry out any of Customer’s obligations under the Privacy Rule as expressly provided in the Underlying Arrangement or this Addendum, McKesson will comply with the requirements of the Privacy Rule that apply to Customer in the performance of such obligations. 3.2 Reporting of Improper Use or Disclosure, Security Incident or Breach. McKesson will report to Customer any use or disclosure of PHI not permitted under this Addendum, Breach of Unsecured PHI or any Security Incident, without unreasonable delay, and in any event no more than thirty (30) days following discovery; provided, however, that the Parties acknowledge and agree that this Section constitutes notice by McKesson to Customer of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents (as defined below). “Unsuccessful Security Incidents” will include, but not be limited to, pings and other broadcast attacks on McKesson’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PHI. McKesson’s notification to Customer of a Breach will include: (i) the identification of each individual whose Unsecured PHI has been, or is reasonably believed by McKesson to have been, accessed, acquired or disclosed during the Breach; and (ii) any particulars regarding the Breach that Customer would need to include in its notification, as such particulars are identified in 45 C.F.R. § 164.404. 3.3 McKesson’s Agents. In accordance with 45 C.F.R. § 164.502(e)(1)(ii) and 45 C.F.R. § 164.308(b)(2), as applicable, McKesson will enter into a written agreement with any agent or subcontractor that creates, receives, maintains or transmits PHI on behalf of McKesson for services provided to Customer, providing that the agent agrees to restrictions and conditions that are substantially similar to those that apply through this Addendum to McKesson with respect to such PHI. 3.4 Access PHI. The Parties do not intend for McKesson to maintain any PHI in a Designated Record Set for Customer. To the extent McKesson possesses PHI in a Designated Record Set, McKesson agrees to make such information available to Customer pursuant to 45 C.F.R. § 164.524, within ten (10) business days of McKesson’s receipt of a written request from Customer; provided, however, that McKesson is not required to provide such access where the PHI contained in a Designated Record Set is duplicative of the PHI contained in a Designated Record Set possessed by Customer. If an Individual makes a request for access pursuant to 45 C.F.R. § 164.524 directly to McKesson, or inquires about his or her right to access, McKesson will either forward such request to Customer or direct the Individual to Customer. Amendment of PHI. The Parties do not intend for McKesson to maintain any PHI in a Designated Record Set for Customer. To the extent McKesson possesses PHI in a Designated Record Set, McKesson agrees to make such information available to Customer for amendment pursuant to 45 C.F.R. § 164.526 within twenty (20) business days of McKesson’s receipt of a written request from Customer. If an Individual submits a written request for amendment pursuant to 45 C.F.R. § 164.526 directly to McKesson, or inquires about his or her right to amendment, McKesson will either forward such request to Customer or direct the Individual to Customer. 3.6 Documentation Disclosures. McKesson agrees to document such disclosures of PHI and information related to such disclosures as would be required for Customer to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. McKesson will document, at a minimum, the following information (“Disclosure Information”): (a) the date of the disclosure; (b) the name and, if known, the address of the recipient of the PHI; (c) a brief description of the PHI disclosed; (d) the purpose of the disclosure that includes an explanation of the basis for such disclosure; and (e) any additional information required under the HITECH Act and any implementing regulations. 3.7 Accounting Disclosures. McKesson agrees to provide to Customer, within twenty (20) business days of McKesson’s receipt of a written request from Customer, information collected in accordance with Section 3.6 of this Addendum, to permit Customer to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. If an Individual submits a written request for an accounting of disclosures of PHI pursuant to 45 C.F.R. § 164.528 directly to McKesson, or inquires about his or her right to an accounting, McKesson will direct the Individual to Customer. 3.8 Governmental Access to Records. McKesson will make its internal practices, books and records relating to the use and disclosure of PHI received from, or created or received by McKesson on behalf of, Customer available to the Secretary for purposes of the Secretary determining Customer’s compliance with the Privacy Rule and the Security Rule. 3.9 Mitigation. To the extent practicable, McKesson will cooperate with Customer’s efforts to mitigate a harmful effect that is known to McKesson of a use or disclosure of PHI by McKesson that is not permitted by this Addendum. Necessary. McKesson will request, use and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure, in accordance with 45 C.F.R. § 164.514(d), and any amendments thereto. HIPAA Final Rule Applicability. McKesson acknowledges that enactment of the HITECH Act, as implemented by the HIPAA Final Rule, amended certain provisions of HIPAA in ways that now directly regulate, or will on future dates directly regulate, McKesson under the Privacy Rule and Security Rule. McKesson agrees, as of the compliance date of the HIPAA Final Rule, to comply with applicable requirements imposed under the HIPAA Final Rule, including any amendments thereto.
SECTION 4: OBLIGATIONS OF CUSTOMER

4.1
Notice of Privacy Practices. Customer will notify McKesson of any limitation(s) in its notice of privacy practices in accordance with 45 C.F.R. § 164.520, to the extent that such limitation may affect McKesson’s use or disclosure of PHI. Customer will provide such notice no later than fifteen (15) days prior to the effective date of the limitation. 4.2 Notification of Changes Regarding Individual Permission. Customer will obtain any consent or authorization that may be required by the Privacy Rule, or applicable state law, prior to furnishing McKesson with PHI. Customer will notify McKesson of any changes in, or revocation of, permission by an Individual to use or disclose PHI, to the extent that such changes may affect McKesson’s use or disclosure of PHI. Customer will provide such notice no later than fifteen (15) days prior to the effective date of the change. Notification of Restrictions to Use or Disclosure of PHI. Customer will notify McKesson of any restriction to the use or disclosure of PHI that Customer has agreed to in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect McKesson’s use or disclosure of PHI. Customer will provide such notice no later than fifteen (15) days prior to the effective date of the restriction. If McKesson reasonably believes that any restriction agreed to by Customer pursuant to this Section may materially impair McKesson’s ability to perform its obligations under the Underlying Arrangement or this Addendum, the Parties will mutually agree upon any necessary modification of McKesson’s obligations under such agreements. Permissible Requests by Customer. Customer will not request McKesson to use or disclose PHI in any manner that would not be permissible under the Privacy Rule, the Security Rule or the HITECH Act if done by Customer, except as permitted pursuant
to the provisions of Sections 2.2, 2.3, 2.4 and 2.5 of this Addendum.

SECTION 5: TERM AND TERMINATION

5.1 Term. The term of this Addendum will commence as of the Effective Date, and will terminate when all of the PHI
provided by Customer to McKesson, or created or received by McKesson on behalf of Customer, is destroyed or returned to
Customer. If it is infeasible to return or destroy PHI, McKesson will extend the protections to such information, in accordance with
Section 5.3.
5.2
Termination for Cause. Upon either Party’s knowledge of a material breach by the other Party of this Addendum, such Party may terminate this Addendum immediately if cure is not possible. Otherwise, the non-breaching party will provide written notice to the breaching Party detailing the nature of the breach and providing an opportunity to cure the breach within thirty (30) business days. Upon the expiration of such thirty (30) day cure period, the non-breaching Party may terminate this Addendum if the breaching party does not cure the breach or if cure is not possible. If termination is not feasible, the non-breaching party may report the breach or violation to the Secretary. 5.3 Effect Except as provided in Section 5.3.2, upon termination of the Underlying Arrangement or this Addendum for any reason, McKesson will return or destroy all PHI received from Customer, or created or received by McKesson on behalf of Customer, at Customer’s expense, and will retain no copies of the PHI. This provision will apply to PHI that is in the possession of subcontractors or agents of McKesson. If it is infeasible for McKesson to return or destroy the PHI upon termination of the Underlying Arrangement or this Addendum, McKesson will: (a) extend the protections of this Addendum to such PHI and (b) limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as McKesson maintains such PHI.

Source: http://mprsannounce.mckesson.com/MPRS/microsite/pdf/LoyaltyScriptTCs_110410.pdf