1-Business Associate Agreement.pdf

-1-

BUSINESS ASSOCIATE AGREEMENT (BAA)

This BAA is entered into between Hillsborough County (“Covered Entity”) and

(“Business Associate”) effective on this ___ day of ________, .

WHEREAS, select Hillsborough County departments meet the definitions of a Covered Entity 45 C.F.R.

§ 160.103.

WHEREAS, select Hillsborough County departments have been designated as a Hybrid Entity under the

HIPAA Privacy and Security Rules 45 C.F.R. §§ 164.103, 164.105.

WHEREAS, Hillsborough County, as a Covered Entity, pursuant to 45 C.F.R. § 164.105(a)(2)(iii)(D), has documented that Hillsborough County’s Aging Services Department is a health care component of the

County and as such will be treated as a “Covered Entity.”

WHEREAS, in connection with providing services to the Covered Entity (“Services”) by the Business

Associate, the Covered Entity discloses to the Business Associate certain Protected Health Information

(“PHI”) that is subject to protection under the HIPAA Privacy and Security Rules 45 C.F.R. Parts

160,162, and 164.

WHEREAS, the HIPAA Privacy and Security Rules require that Covered Entity receive adequate assurances that the Business Associate will comply with certain obligations with respect to the PHI received in the course of providing Services to or on behalf of Covered Entity; and

WHEREAS, the purpose of this Agreement is to comply with the requirements of the HIPAA Privacy and Security Rules 45 C.F.R. Parts 160, 162, and 164.

NOW, THEREFORE, in consideration of the terms, conditions, covenants, agreements and obligations herein stated, the Parties agree as follows:

I. INCORPORATION OF RECITALS

1.1 Recitals Incorporated. The above recitals are true and correct and are hereby incorporated as a material part of this Agreement.

1.2 HIPAA Privacy and Security Rules 45 C.F.R. Parts 160, 162, and 164.

1.3 The parties hereby incorporate into the Agreement, the requirements and obligations imposed upon them by the HIPAA Privacy and Security Rules 45 C.F.R. Parts 160,162, and 164. To the extent that the Agreement imposed more stringent requirements than those contained in HIPAA Privacy and Security Rules 45 C.F.R. Parts 160,162, and 164, those more stringent requirements of the Agreement will control.

II. DEFINITIONS

2.1 Terms. Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 C.F.R. §§ 160.103, 162.103, 164.103, 164.402, and

164.501.

2.2 Breach. Breach shall have the meaning given to such term as found in 45 C.F.R. §

164.402.

2.3 Designated Record Set. A group of records maintained by or for a covered entity that is: (A) The medical records and billing records about individuals maintained by or for a covered health care provider; (B) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (C) Used, in whole or in part, by or for the covered entity to make decisions about individuals. For

-2-purposes of this paragraph, the term record means any item, collection, or grouping of information that includes PHI and is maintained, collected, used, or disseminated by or for a covered entity.

2.4 Disclosure. The release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.

2.5 HIPAA Privacy and Security Rules. Standards for Privacy, Security, Breach, Notification, and Enforcement at 45 C.F.R. Parts 160, 162 and 164.

2.6 Individual. The person who is the subject of PHI, and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g).

2.7 Individually Identifiable Health Information. Information that is a subset of health information, including demographic information collected from an individual, and: (A) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (B) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) that identifies the individual; or (ii) with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

2.8 Party or Parties. Are the terms the Covered Entity and Business Associate may be referred to in this Agreement, individually or collectively.

2.9 Privacy Officer. The individual designated by the County or Covered Entity, pursuant to

45 C.F.R. § 164.530, who is responsible for the development and implementation of the

Covered Entity’s policies and procedures as they relate to the HIPAA Privacy and

Security Rules.

2.10 Personal Information. Personal Information (“PI”) means either of the following:

2.10.1 An individual’s first name or first initial and last name in combination with any one or more of the following data elements for that individual:

2.10.1.1 A social security number;

2.10.1.2 A driver’s license or identification card number, passport number, military identification number, or other similar number issued on a government document used to verify identity;

2.10.1.3 A financial account number or credit or debit card number in combination with any required security code, access code, or password that is necessary to permit access to an individual’s financial account;

2.10.1.4 Any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; or

2.10.1.5 An individual’s health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual.

2.10.1.6 A user name or e-mail address in combination with a password or security question and answer that would permit access to an online account.

2.10.1.7 The term does not include information about an individual that has been made publicly available by a federal, state, or local governmental entity. The term also does not include information that is encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable.

2.11 Protected Health Information. Protected Health Information (“PHI”) is individual identifiable health information that is or has been created, received, transmitted or

-3-maintained in any form or medium, on or behalf of the Covered Entity, with the exception of education records covered by the Family Educational Rights and Privacy

Act, as amended, 20 U.S.C. 1232g, and the health care records of students at post-secondary educational institutions or of students eighteen (18) years of age or older, used exclusively for their health care treatment which have not been disclosed to anyone other than a health care provider at the student’s request.

2.12 Required by law. Required by law shall have the same meaning as the term “required by law” in 45 C.F.R. § 164.103.

2.13 Secretary of HHS. Secretary of Health and Human Services or any other officer or employee of Health and Human Services (“HHS”) to whom the authority involved has been delegated.

2.14 Security Incident or Incident. Security Incident or Incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of PHI or PI contained in any form or interference with system operations in an information system that contains PHI or PI.

2.15 Use. Use shall mean the sharing, employment, application, utilization, examination, or analysis of PI or PHI within an entity that maintains such information.

III. SCOPE OF AGREEMENT

3.1 INDEPENDENT STATUS OF PARTIES. The Parties agree that they are and shall be independently responsible for complying, and shall independently comply, with the

HIPAA Privacy and Security Rules as they may be amended from time to time. The

Parties further agree that they are and shall be responsible for their own actions and conduct and shall not assume responsibility for the actions and conduct of one another.

The Parties agree that they are and shall independently maintain all corporate formalities establishing separate and individual control by each organization's board of directors, as applicable.

3.2 Business Associate acknowledges that the confidentiality requirements herein apply to all its employees, agents and representatives. Business Associate assumes responsibility and liability for any damages or claims, including state and federal administrative proceedings and sanctions, including costs and attorneys' fees, resulting from the breach by Business Associate of the confidentiality requirements of this Agreement.

IV. PRIVACY OF PROTECTED HEALTH INFORMATION AND CONFIDENTIALITY OF

PERSONAL INFORMATION.

4.1 Permitted Uses and Disclosures of PHI and PI by Business Associate. Business

Associate may use or disclose PHI and PI received from Covered Entity to its officers and employees. Business Associate may disclose PHI and PI to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit PHI and PI on its behalf if the Business Associate obtains satisfactory assurances in accordance with 45 C.F.R. §164.504(e)(1)(i) and section 501.171(2) Florida Statutes that the subcontractor will appropriately safeguard the information. All other uses or disclosures not authorized by this Agreement or otherwise governed by law are prohibited.

4.2 Responsibilities of Business Associate. Regarding the use or disclosure of PHI and PI, Business Associate agrees to:

4.2.1 Only use or further disclose the PHI and PI as allowable under this

Agreement or applicable law.

4.2.2 Only use or further disclosure PHI and PI in a manner that would not violate the HIPAA Privacy and Security Rules if done so by the Covered Entity.

-4-

4.2.3 Establish and implement appropriate procedures, physical, and technical safeguards to prevent improper access, uses, transmissions, or disclosures of

PHI and PI for mitigating to the greatest extents possible under the circumstances any deleterious effects from any improper access, use, or disclosure of PHI and PI that Business Associate reports to Covered Entity.

Safeguards shall include, but are not limited to, the implementation and use of electronic security measures to safeguard electronic data, requiring employees to agree to access, use, or disclose PHI and PI only as permitted or required by this Agreement and taking related disciplinary action for inappropriate access, use or disclosure as necessary.

4.2.4 Report to Covered Entity’s Privacy Officer, in writing, any suspected or confirmed access, use or disclosure of PHI or PI, regardless of form, not permitted or required by this Agreement of which Business Associate becomes aware within two (2) days of Business Associate’s discovery of such unauthorized use or disclosure.

4.2.5 Ensure that Business Associate’s subcontractors or agents to whom Business

Associate provides PHI or PI, received from, created, or received by the

Business Associate on behalf of the Covered Entity, agree to the same restrictions and conditions that apply to the Business Associate with respect to PHI and PI, and ensure that its subcontractors or agents agree to establish and implement reasonable and appropriate safeguards to protect the confidentiality, integrity, and availability of all PHI and PI that it creates receives, maintains, or transmits on behalf of Covered Entity.

4.2.6 The Business Associate must make its records, books, accounts, agreements, policies, and procedures available to the Secretary of HHS for determining the Covered Entity’s compliance with the HIPAA Privacy and Security

Rules.

4.2.7 Use or disclose to its subcontractors, agents, other third parties, and Covered

Entity, only the minimum PHI and PI necessary to perform or fulfill a specific function required or permitted hereunder.

4.2.8 Provide information to Covered Entity to permit Covered Entity to respond to a request by an individual for an accounting of disclosures within five (5) days of receiving a written request from Covered Entity, if Business

Associate maintains a Designated Records Set on behalf of Covered Entity.

4.2.9 At the request of, and in the time and manner designated by Covered Entity, provide access to the PHI and PI maintained by Business Associate to

Covered Entity or individual, if Business Associate maintains a Designated

Records Set on behalf of Covered Entity.

4.2.10 At the request of, and in the time and manner designated by Covered Entity, make any amendment(s) to the PHI and PI when directed by Covered Entity, if Business Associate maintains a Designated Record Set on behalf of

Covered Entity.

4.2.11 Establish and implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any PHI and PI Business Associate creates, receives, maintains or transmits on behalf of Covered Entity.

4.2.12 Report to Covered Entity any Security Incident involving PHI and PI that

Business Associate discovers.

4.3 Compliance with Covered Entity’s Policies. Business Associate hereby agrees to abide by Covered Entity’s policies and practices relating to the confidentiality, privacy, and

-5-security of PHI and PI. Please see Hillsborough County’s Notice of Privacy Practices

(Exhibit A).

4.4 Use of PHI and PI for Management and Administration or Legal Responsibilities of

Business Associate. The Business Associate may use PHI and PI received by the

Covered Entity pursuant to this Agreement for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the

Business Associate. However, Business Associate will only be allowed to use PHI and PI for the aforementioned uses if (A) the disclosure is required by law; or (b) the Business

Associate obtains reasonable assurances from the person to whom the PHI and PI is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notified the Business Associate of any instances in which the person is aware of a confidentiality breach of PHI or PI.

4.5 Data Aggregation Services. With respect to PHI and PI created or received by the

Business Associate in its capacity as the Business Associate of the Covered Entity, Business Associate may combine such PHI and PI it has received from the Covered

Entity with the PHI and PI received by the Business Associate in its capacity as a

Business Associate of another Covered Entity to permit data analysis that relates to the health care operation of the respective Covered Entity, if data analysis is part of the

Services that Business Associate is to provide to Covered Entity.

4.6 Compliance. Business Associate agrees to keep all PHI and PI confidential and secure in compliance with the provisions of this Agreement and according to current state and federal laws.

V. CONFIDENTIALITY

5.1 In the course of performing under this Agreement, each Party may receive, be exposed to, or acquire the confidential information including, but not limited to, all information, data, reports, records, summaries, tables and studies, whether written or oral, fixed in hard copy or contained in any computer database or computer readable form, as well as any information identifiable as confidential (“Confidential Information”) of the other Party.

5.2 For purposes of this Agreement, Confidential Information shall not include PHI, the security and privacy of which is the subject of this Agreement. The Parties including their employees, agents, and representatives shall (A) not disclose to any third party the

Confidential Information of the other Party except as otherwise permitted by this

Agreement, (B) only permit use of such Confidential Information by employees, agents, and representatives having a need to know in connection with performance under this

Agreement, and (c) advise each of their employees, agents, and representatives of their obligations to keep such Confidential Information confidential.

5.3 This provision shall not apply to Confidential Information: (A) after it becomes publically available through no fault of either Party; (B) which is later publically released by either Party in writing; (C) which is lawfully obtained from third parties without restrictions; or (D) which can be shown to be previously known or developed by either Party independently of the other Party.

VI. SECURITY

6.1 Security of Electronic Protected Health Information and Personal Information.

Business Associate will develop, implement, maintain, and use administrative, technical, and physical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI (as defined in 45 C.F.R. §160.103) and PI

-6-that Business Associate creates, receives, maintains, or transmits on behalf of Covered

Entity consistent with the HIPAA Privacy and Security Rules.

6.2 Reporting Security Incidents. Business Associate will report to the Covered Entity and

County’s Privacy Officer any Incident of which Business Associate becomes aware that is (1) a successful unauthorized access, use or disclosure of Electronic PHI or PI; or (2)

(a) modification or destruction of Electronic PHI or PI or (b) interference with system operations in an information system containing Electronic PHI or PI.

VII. REPORTING REQUIREMENTS

7.1 Reporting. The Business Associate shall make a good faith effort to identify any use or disclosure of protected information not provided for in this Agreement.

7.2 To Covered Entity. The Business Associate will report to the Covered Entity and the

County’s Privacy Officer, within (2) business days of discovery, any use or disclosure of

PHI or PI not provided for in this Agreement of which the Business Associate is aware.

The Business Associate will report to the Covered Entity and the County’s Privacy

Officer within twenty-four (24) hours of discovery, any Security Incident of which the

Business Associate is aware. A violation of this paragraph shall be a material violation of this Agreement. Such notice shall include the identification of each individual whose unsecured PHI and PI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during such breach.

Title: Hillsborough County’s Privacy Officer, Elizabeth Cardenas

Telephone: (813) 276-2640

Address: 601 E. Kennedy Blvd

Tampa, FL 33602

E-Mail: CardenasE@hillsboroughcounty.org

7.2.1 Reports of Security Incidents shall include a detailed description of each

Incident, at a minimum to include the date of the Incident, the nature of the

Incident, the information involved, whether the information was accessed, disclosed, used, modified, destroyed, etc., and the identities of the individual(s) and their relationship to the Business Associate, a description of the Business’s response to each Incident, and the name and title of the individual the Covered Entity should contact for additional information.

7.2.2 Business Associate will conduct such further investigation as is reasonably required by the Covered Entity and promptly advise the Covered Entity of additional information pertinent to the Incident.

7.2.3 Business Associate will cooperate with Covered Entity in conducting any required risk analysis related to such Security Incident(s).

7.2.4 Business Associate will cooperate with Covered Entity in complying with any applicable notification requirements pursuant to the Breach Notification

Rule and in taking steps determined by Covered Entity to be necessary to mitigate any potential harm caused by a Security Incident. Business

Associate will pay and/or reimburse Covered Entity for any reasonable expenses Covered Entity incurs in notifying individuals of, and /or mitigating potential harm caused by a Security Incident caused by Business Associate and/or its subcontractors or agents.

7.3 To Individuals. In the case of a breach of PHI or PI discovered by the Business

Associate, the Business Associate shall first notify the Covered Entity and the County’s

Privacy Officer of the pertinent details of the breach and upon prior approval of the

County’s Privacy Officer shall notify each individual whose unsecured PHI or PI has been, or is reasonably believed by the Business Associate to have been, accessed, -7-acquired or disclosed as a result of such breach. Such notification shall be in writing by first-class mail to the individual (or the next of kin if the individual is deceased) at the last known address of the individual or next of kin, respectively, or, if specified as a preference by the individual, by electronic mail. Where there is insufficient, or out-of-date contact information (including a phone number, email address, or any other form of appropriate communication) that precludes written (or, if specifically requested, electronic) notification to the individual, a substitute form of notice shall be provided, including, in the case that there are ten (10) or more individuals for which there is insufficient or out-of-date contact information, a conspicuous posting on the web site of the Business Associate involved or notice in major print of broadcast media, including major media in the geographic areas where the individuals affected by the breach likely reside. In any case deemed by the Business Associate to require urgency because of possible imminent misuse of unsecured PHI or PI, the Business Associate may also provide information to individuals by telephone or other means, as appropriate.

7.4 To Media. In the case of a breach of PHI discovered by the Business Associate where the unsecured PHI of more than five hundred (500) persons or unsecured PI or more than five thousand (5000) persons is reasonably believed to have been, accessed, acquired, or disclosed, after prior approval by the Covered Entity, the Business Associate shall provide notice to prominent media outlets serving the State or relevant portion of the

State involved.

7.5 To HHS. The Business Associate shall cooperate with the Covered Entity to provide notice to the Secretary of HHS, of unsecured PHI that has been acquired or disclosed in a breach. If the breach was with respect to five hundred (500) or more individuals, such notice must be provided immediately. If the breach was with respect to less than five hundred (500) individuals, the Business Associate may maintain a log of such breach occurring and annually submit such log to the Covered Entity so that it may satisfy its obligation to notify the Secretary of HHS documenting such breaches occurring in the year involved.

7.6 Content of Notices. All notices required under this Attachment shall include the content set forth 45 C.F.R § 164.404. Notification to individuals except that references therein to a "covered entity" shall be read as references to the Business Associate.

Regardless of the method by which notice is provided to individuals under this section, notice of a breach shall include, to the extent possible, the following: (1) a brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; (2) a description of the types of unsecured PHI and PI that were involved in the breach (such as full name, social security number, date of birth, home address, account number, or disability code); (3) the steps individuals should take to protect themselves from potential harm resulting from the breach; (4) a brief description of what the covered entity involved is doing to investigate the breach, to mitigate losses, and to protect against any further breaches; (5) contact procedures for individuals to ask questions or learn additional information, which shall include a toll free telephone number, an e-mail address, web site, or postal address.

7.7 Notice to Credit Reporting Agencies. In the case of a breach of PI discovered by the

Business Associate where the unsecured PI of more than one thousand (1000) individuals has reasonably believed to have been, accessed, acquired, or disclosed, after prior approval by the Covered Entity, the Business Associate shall notify all consumer reporting agencies nationwide, that complete and maintain files in accordance with the provisions of section 501.171(5), Florida Statutes.

7.8 Financial Responsibility. The Business Associate shall be responsible for all costs related to the notice required by this Section.

-8-

7.9 Mitigation. Business Associate shall mitigate, to the extent practicable, any harmful effects that are known to the Business Associate of use or disclosure of PHI or PI in violation of this Agreement, the HIPAA Privacy and Rules.

VIII. TERMINATION

8.1 Automatic Termination. Covered Entity is authorized to automatically terminate this

Agreement, if it determines that the Business Associate has violated a material term of the Agreement.

8.2 Opportunity to Cure or Terminate. At the Covered Entity’s sole discretion, Covered

Entity may either (a) provide notice of breach and an opportunity for Business Associate to reasonably and promptly cure the breach or end the violation, and terminate this

Agreement if Business Associate does not cure the breach, or end the violation within the reasonable time specified by Covered Entity, or (b) immediately terminate this

Agreement if Business Associate has breached a material term of this Agreement and cure is not possible.

8.3 Effects of Termination. Termination of this Agreement shall not affect any claim or rights that arise based on the acts or omissions of the parties prior to the effective date of termination.

8.4 Duties of Business Associate Upon Termination.

8.4.1 When this Agreement is terminated, the PHI and PI that Business Associate received from, created, or received on behalf of Covered Entity must be destroyed or returned to Covered Entity, at the Business Associate's expense, including all PHI and PI in the possession of Business Associate's subcontractors or agents. However, if Business Associate determines that returning or destroying PHI and PI is not feasible, Business Associate must maintain the privacy protections under this Agreement and according to applicable law for as long as Business Associate retains the PHI and PI, and

Business Associate may only use or disclose the PHI and PI for specific uses or disclosures that make it necessary for Business Associate to retain the PHI and PI.

8.4.2 If Business Associate determines that it is not feasible for Business Associate to return PHI or PI in the subcontractor's or agent's possession, Business

Associate must provide a written explanation to Covered Entity of such reasons and require the subcontractors and agents to agree to extend any and all protections, limitations, and restrictions contained in this Agreement to the subcontractor's or agent's use or disclosure of any PHI and PI retained after the termination of this Agreement, and to limit any further uses or disclosures for the purposes that make the return or destruction of the PHI or

PI not feasible.

IX. MISCELLANEOUS

9.1 Agreement Subject to All Applicable Laws. The Parties recognize and agree that this

Agreement and their activities are governed by federal, state, and local laws, including the regulations, rules, and policies of the U.S. Department of Health and Human Services including, but not limited to, HIPAA Privacy and Security Rules, and their accompanying regulations. The Parties further recognize and agree that this Agreement is subject to new legislation as well as amendments to government regulations, rules, and policies, and agree to amend this Agreement accordingly.

9.2 No Third party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than the Parties and the

-9-respective successors or assigns of the Parties any rights, remedies, obligations, or liabilities whatsoever.

9.3 Survival. The rights and obligations of the Parties in Articles IV, V, VI, VII, and

Sections 8.4, 9.6, 9.8, 9.9 shall survive termination of this Agreement indefinitely.

9.4 Amendment. This Agreement may be revoked, amended, changed, or modified only by a written amendment executed by both Parties.

9.5 Assignment. This Agreement, including each and every right and obligation referenced herein, shall not be assigned by the Business Associate without the express prior written consent of the County.

9.6 Enforcement Costs. If any legal action or other proceedings, including arbitration, is brought for the enforcement of this Agreement or because of an alleged dispute, breach, default, or misrepresentation in connection with any provision of this Agreement, the successful or prevailing Party or Parties shall be entitled to recover reasonable court costs and all expenses, if not taxable as court costs, incurred in that action or proceeding, including all appeals, in addition to any other relief to which such Party or Parties may be entitled. Such enforcement costs shall not be dischargeable in bankruptcy.

9.7 Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits Covered Entity to comply with the Privacy and Security Rules.

9.8 Indemnification. Business Associate agrees to defend, indemnify and hold harmless

Covered Entity, its officials and employees from all claims, actions, losses, suits, judgments, fines, liabilities, costs and expenses (including attorney’s fees) attributable to its negligent acts or omissions, or those of its officials and employees acting within the scope of their employment, or arising out of or resulting from the indemnifying party’s negligent performance under this Agreement. The foregoing shall not constitute an agreement by either party to assume any liability for the acts, omissions and/or negligence of the other party.

9.9 Execution/Authority. Each signatory to this Agreement represents and warrants that he or she possesses all necessary capacity and authority to act for, sign, and bind the respective entity or person on whose behalf he or she is signing.

9.10 Governing Law. This Agreement shall be governed by and construed in accordance with the laws of the state of Florida to the extent not preempted by the Privacy Rules or other applicable federal law.

9.11 Notice. All notices and other communications under this Agreement shall be in writing and shall be deemed received when delivered personally or when deposited in the U.S.

mail, postage prepaid, sent registered, or certified mail, return receipt requested, or sent via nationally recognized and receipted overnight courier service, to the Parties at their respective principal office or record as set forth below or as designed in writing from time-to-time. No notice of a change of address shall be effective until received by the other Party(ies).

Department Hillsborough County Administrator

Business Associate

-10-

9.12 Severability. If any provision of this Agreement or the application thereof to any person or circumstance, shall to any extent be invalid or unenforceable, the remainder of this

Agreement, or the application of such affected provision to persons or circumstances other than those to which it is held invalid or unenforceable, shall not be affected thereby, and each provision of this Agreement shall be valid and shall be enforced to the fullest extent permitted by law. It is further the intention of the Parties that if any provision of this Agreement were capable of two constructions, one that rendered the provision void and one that renders the provision valid, then the provision shall have the meaning that renders it valid.

9.13 Successors and Assigns. Business Associate shall not assign either its obligations or benefits under this Agreement without the expressed written consent of the Covered

Entity, which shall be at the sole discretion of the Covered Entity. Given the nature of this Agreement, neither subcontracting nor assignment by the Business Associate is anticipated and the use of those terms herein does not indicate that permission to assign or subcontract has been granted.

9.14 Venue. Any action or proceeding seeking to enforce any provision, or based on any right arising out of this Agreement shall be brought against any of the Parties in the courts of the State of Florida, County of Hillsborough and each of the Parties consents to the jurisdiction of such courts (and of the appropriate appellate courts) in any such action or proceeding and waives any objection to venue therein. Process in any action or proceeding referred to in the proceeding sentence may be served on any Party anywhere.

9.15 Waiver and Breach. No failure by a Party to insist upon the strict performance of any covenant, agreement, term, or condition of this Agreement shall constitute a waiver of any such breach or such covenant, agreement, term, or condition. Any party may waive compliance by the other Party with any of the provisions of this Agreement if done so in writing. No waiver of any provision shall be construed as a waiver of any other provision or any subsequent waiver of the same provision.

9.16 Entire Agreement. The original Contract executed by the Parties known as Contract

_________, this Agreement, and any addenda or attachments thereto shall construe the entire understanding between the Parties as to the rights, obligations, duties, and services to be performed hereunder.

-11-

IN WITNESS WHEREOF, the parties hereto have executed this Business Associate Agreement effective as of the date stated above.

COVERED ENTITIY:

HILLSBOROUGH COUNTY, through its

County Administrator

By:______________________________

Print Name:_______________________

Title:____________________________

Dated:___________________________

BUSINESS ASSOCIATE:

Print Name:_______________________

Title:____________________________

Dated:___________________________

APPROVED AS TO FORM

OFFICE OF THE COUNTY ATTORNEY

Attorney

Dated:____________________________

-12-

For an acknowledgment ACKNOWLEDGEMENT FOR CORPORATION in a representative capacity:

STATE OF FLORIDA

COUNTY OF ___________________

The foregoing instrument was acknowledged before me by means of □ physical presence or

□ online notarization, this ____ day of ____________ 20___, by ______________________ as (Name of Person)

__________________ for ______________________________________________________.

(Title of Officer) (Name of Corporation)

(Signature of Notary Public - State of Florida)

(Print, Type or Stamp Commissioned Name of Notary Public)

Personally Known or Produced Identification

Type of Identification Produced _______________

-13-

ACKNOWLEDGEMENT FOR AN INDIVIDUAL

STATE OF FLORIDA

COUNTY OF HILLSBOROUGH

SWORN TO OR AFFIRMED before me by means of � physical appearance OR � online notarization this _______ day of ______________, 2020, by _________________________, who is � personally known OR � produced identification in the form of _______________________.

Notary Public, State of Florida

My Commission Expires: ____________________________________

Printed Name of Notary

-14-

EXHIBIT A

Notice of Privacy Practices

Hillsborough County Notice of Privacy Practices

IMPORTANT: THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU

MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS

INFORMATION. PLEASE REVIEW IT CAREFULLY.

Hillsborough County is committed to protecting your personal health information under the HIPAA

Privacy and Security Rules 45 C.F.R. §§ 164.103, 164.105. We are required by law to maintain the privacy of health information that could reasonably be used to identify you, known as “protected health information” or “PHI.” We are also required by law to provide you with the attached detailed Notice of

Privacy Practices (“Notice”) explaining our legal duties and privacy practices with respect to your PHI.

We respect your privacy, and treat all healthcare information about our patients with care under strict policies of confidentiality that our staff is committed to following at all times.

PLEASE READ THE ATTACHED DETAILED NOTICE. IF YOU HAVE ANY QUESTIONS

ABOUT IT, PLEASE CONTACT Elizabeth Cardenas, OUR HIPAA PRIVACY OFFICER, AT 1-800-

466-5400 or CardenasE@hillsboroughcounty.org.

-15-

Detailed Notice of Privacy Practices

Purpose of This Notice: This Notice describes your legal rights, advises you of our privacy practices, and lets you know how Hillsborough County is permitted to use and disclose PHI about you.

Uses and Disclosures of Your PHI We Can Make Without Your Authorization

Hillsborough County may use or disclose your PHI without your authorization, or without providing you with an opportunity to object, for the following purposes:

Treatment. This includes such things as verbal and written information that we obtain about you and use pertaining to your medical condition and treatment provided to you by us and other medical personnel

(including doctors and nurses who give orders to allow us to provide treatment to you). It also includes information we give to other healthcare personnel to whom we transfer your care and treatment, and includes transfer of PHI via radio or telephone to the hospital or dispatch center as well as providing the hospital with a copy of the written record we create in the course of providing you with treatment and transport.

Payment. This includes any activities we must undertake in order to get reimbursed for the services that we provide to you, including such things as organizing your PHI, submitting bills to insurance companies

(either directly or through a third party billing company), managing billed claims for services rendered, performing medical necessity determinations and reviews, performing utilization reviews, and collecting outstanding accounts.

Healthcare Operations. This includes quality assurance activities, licensing, and training programs to ensure that our personnel meet our standards of care and follow established policies and procedures, obtaining legal and financial services, conducting business planning, processing grievances and complaints, creating reports that do not individually identify you for data collection purposes, fundraising, and certain marketing activities.

Fundraising. We may contact you when we are in the process of raising funds for Hillsborough County, or to provide you with information about our annual subscription program.

In addition, we may use your PHI for certain fundraising activities. For example, we may use PHI that we collect about you, such as your name, home address, phone number or other information, in order to contact you to raise funds for our agency. We may also share this information with another organization that may contact you to raise money on our behalf. If Hillsborough County does use your PHI to conduct fundraising activities, you have the right to opt out of receiving such fundraising communications from

Hillsborough County. If you do not want to be contacted for our fundraising efforts, you should contact our HIPAA Privacy Officer, Elizabeth Cardenas, in writing, by phone, or by email. Contact information for our HIPAA Privacy Officer is listed at the end of this Notice. We will also remind you of this right to opt out of receiving future fundraising communications every time that we use your PHI to conduct fundraising and contact you to raise funds. Hillsborough County will not condition the provision of medical care on your willingness, or non-willingness, to receive fundraising communications.

Reminders for Scheduled Transports and Information on Other Services. We may also contact you to provide you with a reminder of any scheduled appointments for non-emergency ambulance and medical transportation, or for other information about alternative services we provide or other health-related benefits and services that may be of interest to you.

-16-

Hillsborough County is also permitted to use or disclose your PHI without your written authorization in situations including:

• For the treatment activities of another healthcare provider.

• To another healthcare provider or entity for the payment activities of the provider or entity that receives the information (such as your hospital or insurance company).

• To another healthcare provider (such as the hospital to which you are transported) for the healthcare operations activities of the entity that receives the information as long as the entity receiving the information has or has had a relationship with you and the PHI pertains to that relationship.

• For healthcare fraud and abuse detection or for activities related to compliance with the law.

• To a family member, other relative, or close personal friend or other individual involved in your care if we obtain your verbal agreement to do so or if we give you an opportunity to object to such a disclosure and you do not raise an objection. We may also disclose health information to your family, relatives, or friends if we infer from the circumstances that you would not object.

For example, we may assume that you agree to our disclosure of your personal health information to your spouse when your spouse has called the ambulance for you. In situations where you are incapable of objecting (because you are not present or due to your incapacity or medical emergency), we may, in our professional judgment, determine that a disclosure to your family member, relative, or friend is in your best interest. In that situation, we will disclose only health information relevant to that person's involvement in your care. For example, we may inform the person who accompanied you in the ambulance that you have certain symptoms and we may give that person an update on your vital signs and treatment that is being administered by our ambulance crew.

• To a public health authority in certain situations (such as reporting a birth, death or disease, as required by law), as part of a public health investigation, to report child or adult abuse, neglect or domestic violence, to report adverse events such as product defects, or to notify a person about exposure to a possible communicable disease, as required by law.

• For health oversight activities including audits or government investigations, inspections, disciplinary proceedings, and other administrative or judicial actions undertaken by the government (or their contractors) by law to oversee the healthcare system.

• For judicial and administrative proceedings, as required by a court or administrative order, or in some cases in response to a subpoena or other legal process.

• For law enforcement activities in limited situations, such as when there is a warrant for the request, or when the information is needed to locate a suspect or stop a crime.

• For military, national defense and security and other special government functions.

• To avert a serious threat to the health and safety of a person or the public at large;

• For workers’ compensation purposes, and in compliance with workers’ compensation laws.

• To coroners, medical examiners, and funeral directors for identifying a deceased person, determining cause of death, or carrying on their duties as authorized by law.

• If you are an organ donor, we may release health information to organizations that handle organ procurement or organ, eye or tissue transplantation, or to an organ donation bank, as necessary to facilitate organ donation and transplantation; and

• For research projects, but this will be subject to strict oversight and approvals and health information will be released only when there is a minimal risk to your privacy and adequate safeguards are in place in accordance with the law.

Uses and Disclosures of Your PHI That Require Your Written Consent

Any other use or disclosure of PHI, other than those listed above, will only be made with your written authorization (the authorization must specifically identify the information we seek to use or disclose, as

-17-well as when and how we seek to use or disclose it). Specifically, we must obtain your written authorization before using or disclosing your: (a) psychotherapy notes, other than for the purpose of carrying out our own treatment, payment or health care operations purposes, (b) PHI for marketing when we receive payment to make a marketing communication; or (c) PHI when engaging in a sale of your

PHI. You may revoke your authorization at any time, in writing, except to the extent that we have already used or disclosed medical information in reliance on that authorization.

Your Rights Regarding Your PHI

As a patient, you have a number of rights with respect to your PHI, including:

Right to access, copy or inspect your PHI. You have the right to inspect and copy most of the medical information that we collect and maintain about you. Requests for access to your PHI should be made in writing to our HIPAA Privacy Officer. In limited circumstances, we may deny you access to your medical information, and you may appeal certain types of denials. We have available forms to request access to your PHI, and we will provide a written response if we deny you access and let you know your appeal rights. If you wish to inspect and copy your medical information, you should contact Elizabeth

Cardenas, our HIPAA Privacy Officer.

We will normally provide you with access to this information within 30 days of your written request. If we maintain your medical information in electronic format, then you have a right to obtain a copy of that information in an electronic format. In addition, if you request that we transmit a copy of your PHI directly to another person, we will do so provided your request is in writing, signed by you (or your representative), and you clearly identify the designated person and where to send the copy of your PHI.

We may also charge you a reasonable cost-based fee for providing you access to your PHI, subject to the limits of applicable state law.

Right to request an amendment of your PHI. You have the right to ask us to amend protected health information that we maintain about you. Requests for amendments to your PHI should be made in writing and you should contact Elizabeth Cardenas, our HIPAA Privacy Officer if you wish to make a request for amendment and fill out an amendment request form.

When required by law to do so, we will amend your information within 60 days of your request and will notify you when we have amended the information. We are permitted by law to deny your request to amend your medical information in certain circumstances, such as when we believe that the information you have asked us to amend is correct.

Right to request an accounting of uses and disclosures of your PHI. You may request an accounting from us of disclosures of your medical information. If you wish to request an accounting of disclosures of your PHI that are subject to the accounting requirement, you should contact Elizabeth Cardenas, our

HIPAA Privacy Officer and make a request in writing.

You have the right to receive an accounting of certain disclosures of your PHI made within six (6) years immediately preceding your request. But, we are not required to provide you with an accounting of disclosures of your PHI: (a) for purposes of treatment, payment, or healthcare operations; (b) for disclosures that you expressly authorized; (c) disclosures made to you, your family or friends, or (d) for disclosures made for law enforcement or certain other governmental purposes.

Right to request restrictions on uses and disclosures of your PHI. You have the right to request that we restrict how we use and disclose your medical information for treatment, payment or healthcare operations purposes, or to restrict the information that is provided to family, friends and other individuals involved in your healthcare. However, we are only required to abide by a requested restriction under

-18-limited circumstances, and it is generally our policy that we will not agree to any restrictions unless required by law to do so. If you wish to request a restriction on the use or disclosure of your PHI, you should contact Elizabeth Cardenas, our HIPAA Privacy Officer and make a request in writing.

Hillsborough County is required to abide by a requested restriction when you ask that we not release PHI to your health plan (insurer) about a service for which you (or someone on your behalf) have paid

Hillsborough County in full. We are also required to abide by any restrictions that we agree to.

Notwithstanding, if you request a restriction that we agree to, and the information you asked us to restrict is needed to provide you with emergency treatment, then we may disclose the PHI to a healthcare provider to provide you with emergency treatment.

A restriction may be terminated if you agree to or request the termination. Most current restrictions may also be terminated by Hillsborough County as long we notify you. If so, PHI that is created or received after the restriction is terminated is no longer subject to the restriction. But, PHI that was restricted prior to the notice to you voiding the restriction must continue to be treated as restricted PHI.

Right to notice of a breach of unsecured protected health information. If we discover that there has been a breach of your unsecured PHI, we will notify you about that breach by first-class mail dispatched to the most recent address that we have on file. If you prefer to be notified about breaches by electronic mail, please contact Elizabeth Cardenas, our HIPAA Privacy Officer, to make Hillsborough County aware of this preference and to provide a valid email address to send the electronic notice. You may withdraw your agreement to receive notice by email at any time by contacting the Privacy Officer.

Right to request confidential communications. You have the right to request that we send your PHI to an alternate location (e.g., somewhere other than your home address) or in a specific manner (e.g., by email rather than regular mail).