13-BAA HC Insert (Updated 4-26-13).pdf

BAA Revised4-26-13

BUSINESS ASSOCIATE ADDENDUM

This Business Associate Addendum (“BAA”) is entered into by and between ___________________________ (hereinafter referred to as “VENDOR”), and Harris County, a body corporate and politic under the laws of the State of Texas (hereinafter referred to as

“COUNTY”).

RECITALS

The purpose of this BAA is to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 (codified at 45 C.F.R. Parts 160 and 164), as amended (“HIPAA”); privacy and security regulations promulgated by the United States Department of Health and Human Services (“DHHS”); Title XIII, Subtitle D of the American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5, as amended (“HITECH Act”);

provisions regarding Confidentiality of Alcohol and Drug Abuse Patient Records (codified at 42 C.F.R. Part 2), as amended; and TEX. HEALTH & SAFETY CODE ANN. §§ 81.046, as amended,

181.001 et seq., as amended, 241.151 et seq., as amended, and 611.001 et seq., as amended (collectively referred to herein as the “Privacy and Security Requirements”).

TERMS

VENDOR’S RESPONSIBILITIES REGARDING USE AND DISCLOSURE OF

PROTECTED HEALTH INFORMATION (“PHI”) AND ELECTRONIC PROTECTED

HEALTH INFORMATION (“EPHI”)

A. Definitions.

1. Confidential Information is information that has been deemed or designated confidential by law (i.e., constitutional, statutory, regulatory, or by judicial decision).

2. Protected Health Information (“PHI”) is defined in 45 C.F.R. § 160.103 and is limited to information created or received by VENDOR from or on behalf of

COUNTY.

3. Electronic Protected Health Information (“EPHI”) shall mean individually identifiable health information that is transmitted by or maintained in electronic media.

4. Security Incident shall mean the unauthorized access, use, disclosure, modification, or destruction of Confidential Information, including, but not limited to, PHI and EPHI, or interference with the systems operations in an information system, including, but not limited to, information systems containing EPHI. This definition includes, but is not limited to, lost or stolen transportable media devices (e.g., flash drives, CDs, PDAs, cell phones, and cameras), desktop and laptop computers, photographs, and paper files containing Confidential Information, including, but not limited to, PHI and EPHI.

Revised 4-26-13

B. General.

1. VENDOR agrees to hold all PHI and EPHI confidential except to the extent that disclosure is required by Federal or State law, including the Texas Public Information Act, TEX. GOV’T CODE ANN. §§ 552.001 et seq., as amended.

2. VENDOR agrees to be bound by and comply with all applicable Federal and State of Texas licensing authorities’ laws, rules, and regulations regarding records and governmental records, including the Privacy and Security Requirements.

Compliance with this paragraph is at VENDOR’s own expense.

3. VENDOR agrees to cooperate with state and federal agencies and to make appropriate personnel available for interviews, consultation, grand jury proceedings, pre-trial conferences, hearings, trials, and any other process, including investigations, required as a result of VENDOR’s services to COUNTY. Compliance with this paragraph is at VENDOR’s own expense.

4. The terms used in this BAA shall have the same meaning as those terms in the

Privacy and Security Requirements.

C. Representation. VENDOR represents that it is familiar with and is in compliance with the Privacy and Security Requirements, which include Federal and State of Texas requirements governing information relating to HIV/AIDS, mental health, and drugs or alcohol treatment or referral.

D. Business Associate. VENDOR is a “Business Associate” of COUNTY as that term is defined under the Privacy and Security Requirements.

1. Nondisclosure of PHI. VENDOR agrees not to use or disclose PHI received from or on behalf of COUNTY or created, compiled, or used by VENDOR pursuant to the ____(Name of Agreement)___ to which this BAA is attached (hereinafter the “Agreement”) other than as permitted or required by this BAA, or as otherwise required by law.

2. Limitation on Further Use or Disclosure. VENDOR agrees not to further use or disclose PHI or EPHI received from or on behalf of COUNTY or created, compiled, or used by VENDOR pursuant to this BAA in a manner that would be prohibited by the Privacy and Security Requirements if disclosure was made by COUNTY, or if either VENDOR or COUNTY is otherwise prohibited from making such disclosure by any present or future State or Federal law, regulation, or rule.

3. Safeguarding PHI. VENDOR agrees to use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this BAA or as required by State or Federal law, regulation, or rule.

4. Safeguarding EPHI. VENDOR agrees to implement and use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI that it creates, receives, maintains, or transmits on behalf of COUNTY and to comply with Subpart C of 45 C.F.R. Part 164. These safeguards shall include, but not be limited to, the following:

a) Encryption of EPHI that VENDOR stores and transmits;

b) Implementation of strong access controls, including physical locks, firewalls, and strong passwords;

c) Use of updated antivirus software;

d) Adoption of contingency planning policies and procedures, including data backup and disaster recovery plans; and

e) Periodic security training.

5. Reporting Security Incidents. VENDOR agrees to report to COUNTY any

Security Incident immediately upon becoming aware of such. VENDOR further agrees to provide COUNTY with the following information regarding the Security Incident as soon as possible, but no more than five (5) business days after becoming aware of the Security Incident: (1) a brief description of what happened, including the dates the Security Incident occurred and was discovered;

(2) a reproduction of the PHI or EPHI involved in the Security Incident; and (3) a description of whether and how the PHI or EPHI involved in the Security Incident was rendered unusable, unreadable, or indecipherable to unauthorized individuals either by encryption or otherwise destroying the PHI or EPHI prior to disposal. If VENDOR determines that it is infeasible to reproduce the PHI or EPHI involved in the Security Incident, VENDOR agrees to notify COUNTY in writing of the conditions that make reproduction infeasible and any information VENDOR has regarding the PHI or EPHI involved.

VENDOR agrees to cooperate in a timely fashion with COUNTY regarding all Security Incidents reported to COUNTY.

VENDOR agrees that COUNTY will review all Security Incidents reported by VENDOR and COUNTY, in its sole discretion, will take steps in response, to the extent necessary or required by law including, but not limited to, (1) notifying the individual(s) whose PHI or EPHI was involved in the Security Incident, either in writing, via telephone, through the media, or by posting a notice on COUNTY’s website, or through a combination of those methods, of the Security Incident; (2) providing the individual(s) whose PHI or EPHI was involved in the Security Incident with credit monitoring and related services for a period of time to be determined by COUNTY, at no cost to the individual(s); and (3) providing notice of the Security Incident, as required by law, to the Secretary of the United States Department of Health and Human Services (“HHS”).

VENDOR agrees to reimburse COUNTY for all expenses incurred as a result of VENDOR’s Security Incidents, including, but not limited to, expenses related to the activities described above. VENDOR agrees that COUNTY will select the vendors and negotiate the contracts related to said expenses.

6. EPHI and Subcontractors. VENDOR shall require any agent to whom it provides PHI or EPHI, including a subcontractor, to agree to implement reasonable and appropriate safeguards to protect such PHI or EPHI and comply with Subpart C of 45 C.F.R. Part 164. Further, VENDOR agrees to give COUNTY at least sixty

(60) days advance notice of its intent to provide PHI or EPHI to an agent located outside of the United States. VENDOR understands and agrees that it remains ultimately responsible for any breaches of PHI or EPHI and violations of the Privacy and Security Requirements by its agent(s) or subcontractor(s).

7. Subcontractors and Agents. VENDOR shall require any subcontractor or agent that creates, receives, maintains, or transmits PHI or EPHI on behalf of VENDOR pursuant to this BAA and the Agreement, to agree to the same restrictions and conditions that apply to VENDOR with respect to such PHI and EPHI. VENDOR agrees to terminate its agreement with its agent(s) or subcontractor(s), if (a) VENDOR becomes aware of a pattern of activity or practice of its agent(s) or subcontractor(s) that constitute a material breach or violation of the agent or subcontractor’s obligation under the agreement or other arrangement with VENDOR or (b) agent(s) or subcontractor(s) takes steps to cure the breach or end the violation and such steps are unsuccessful.

8. Reciprocal Disclosures. The Parties agree that the Parties may reciprocally disclose and use PHI or EPHI for the purposes set out in this agreement, for initial and continuing eligibility and compliance determinations related to the provision of benefits, for auditing and legal compliance purposes, and for compliance with laws, regulations, and rules related to the provision of medical or drug benefits to persons who may be eligible for such benefits under the Medicare Prescription Drug Benefit Program, Part D, or other federal or State of Texas programs.

COUNTY agrees:

a) to be bound by these provisions with regard to PHI or EPHI received from

VENDOR;

b) to restrict access to such PHI or EPHI to COUNTY’s Auditor, the

COUNTY Attorney’s Office, and designated employees of Harris County’s Benefits Department for legal and auditing services, and to such County Agency or employees as set out in the agreement for the purposes of this agreement; and

c) to take disciplinary action against any employee whose willful act violates these provisions and results in an unlawful disclosure of PHI or EPHI.

9. Mitigation. VENDOR agrees to mitigate, to the extent practicable, any harmful effect that is known to VENDOR of a use or disclosure of PHI or EPHI by VENDOR, or by a subcontractor or agent of VENDOR, resulting from a violation of this BAA, including violations of the Privacy and Security Requirements stated herein. VENDOR also agrees to inform Harris County in advance of its actual mitigation and of the details of its mitigation plan, unless doing so would cause additional harm.

10. Notice – Access by Individual. VENDOR agrees to notify COUNTY in writing within three (3) business days of any request by an individual for access to the individual’s PHI or EPHI and, upon receipt of such request, direct the individual to contact COUNTY to obtain access to the individual’s PHI. Upon request by COUNTY and within three (3) business days of the request, VENDOR agrees to make available PHI and EPHI to COUNTY in accordance with 45 C.F.R. § 164.524.

11. Notice – Request for Amendment. VENDOR agrees to notify COUNTY in writing within three (3) business days of any request by an individual for an amendment to the individual’s PHI or EPHI and, upon receipt of such request from the individual, direct the individual to COUNTY to request an amendment of the individual’s PHI or EPHI. VENDOR agrees to make available upon request PHI and EPHI for amendment and to incorporate any amendments to PHI and EPHI agreed to in accordance with 45 C.F.R. § 164.526 within three (3) business days of receipt of the notice to incorporate the amendment(s).

12. Notice – Request for Accounting. Upon receipt of any request from an individual for an accounting of disclosures made of the individual’s PHI or EPHI, VENDOR agrees to notify COUNTY in writing within three (3) business days of any such request, and upon receipt of such request from the individual, direct the individual to COUNTY for an accounting of the disclosures of the individual’s PHI or EPHI.

VENDOR agrees to make available to COUNTY upon request, within three (3) business days of the request, the information required to provide an accounting of disclosures in accordance with 45 C.F.R. § 164.528. Pursuant to 45 C.F.R. § 164.528(a), an individual has a right to receive an accounting of certain disclosures of PHI or EPHI in the six (6) years prior to the date on which the accounting is requested.

13. HHS Inspection. Upon written request, VENDOR agrees to make available to

HHS or its designee, VENDOR’s internal practices, books, and records relating to the use and disclosure of PHI and EPHI received from, or created or received on behalf of, COUNTY in a time or manner designated by HHS for purposes of HHS determining COUNTY’s compliance with the Privacy and Security Requirements.

14. COUNTY Inspection. Upon written request, VENDOR agrees to make available to COUNTY and its duly authorized representatives during normal business hours VENDOR's internal practices, books, records and documents relating to the use and disclosure of confidential information, including, but not limited to, PHI and EPHI received from, or created or received on behalf of, COUNTY in a time and manner designated by COUNTY for the purposes of COUNTY determining compliance with the Privacy and Security Requirements. VENDOR agrees to allow such access until the expiration of four (4) years after the services are furnished under the contract or subcontract or until the completion of any audit or audit period, whichever is later. VENDOR agrees to allow similar access to books, records, and documents related to contracts between VENDOR and organizations related to or subcontracted by VENDOR to whom VENDOR provides confidential information, including, but not limited to, PHI and EPHI received from, or created or received on behalf of, COUNTY.

15. PHI or EPHI Amendment. Within three (3) business days of receipt of notification, VENDOR agrees to incorporate any amendments, corrections, or additions to the PHI or EPHI received from or created, compiled, or used by COUNTY pursuant to this BAA when notified by COUNTY that the PHI or EPHI is inaccurate or incomplete, or that other documents are to be added as required or allowed by the Privacy and Security Requirements.

16. Documentation of Disclosures. VENDOR agrees to document disclosure of PHI or EPHI and information related to such disclosures as is necessary for COUNTY to respond to a request by an individual for an accounting of disclosures of PHI or EPHI in accordance with 45 C.F.R. § 164.528, as amended.

17. Termination Procedures. Upon termination of this BAA for any reason, VENDOR agrees to deliver all PHI or EPHI received from COUNTY or created, compiled, or used by VENDOR pursuant to this BAA within thirty (30) days from the date of termination, or, if specially requested to do so by COUNTY in writing, to destroy all PHI or EPHI and retain no copies and certify to COUNTY in writing that all PHI and EPHI not returned has been destroyed, within the time frame determined by COUNTY, which will be no less than thirty (30) days from the date of the notice of termination. This provision applies when VENDOR maintains PHI or EPHI from COUNTY in any form. If VENDOR determines that transferring or destroying the PHI or EPHI is infeasible, VENDOR agrees:

a) to notify COUNTY of the conditions that make transfer or destruction infeasible;

b) to extend the protections of this BAA to such PHI or EPHI;

c) to limit any further uses and disclosures of such PHI or EPHI to those purposes that make the return, or transfer to COUNTY, or destruction infeasible; and

d) to return or, if requested by COUNTY, to destroy the PHI or EPHI retained by VENDOR when it becomes feasible.

18. Notice-Termination. Upon written notice to VENDOR, COUNTY may terminate any portion of the Agreement under which VENDOR maintains, compiles, or has access to PHI or EPHI. Additionally, upon written notice to VENDOR, COUNTY may terminate the entire Agreement if COUNTY determines, at its sole discretion, that VENDOR has repeatedly violated a Privacy or Security Requirement.

19. Obligations of COUNTY. To the extent COUNTY requests in writing that

VENDOR carry out one or more of COUNTY’s obligations under Subpart E of 45 C.F.R. Part 164, VENDOR agrees to comply with the requirements of Subpart E that apply to COUNTY in the performance of such obligation.

E. Survival of Privacy Provisions. VENDOR’s obligations with regard to PHI and EPHI shall survive termination of this BAA and the Agreement.

F. Amendment Related to Privacy and Security Requirements. The Parties agree to take such action as is necessary to amend this BAA if COUNTY, in its reasonable discretion, determines that amendment is necessary for COUNTY to comply with the Privacy and Security Requirements or any other law or regulation affecting the use or disclosure of PHI or EPHI. Any ambiguity in this BAA shall be resolved to permit COUNTY to comply with the Privacy and Security Requirements.

G. INDEMNIFICATION. VENDOR AGREES TO INDEMNIFY, DEFEND, AND

HOLD HARMLESS, TO THE EXTENT ALLOWED BY LAW, COUNTY AND

ITS COMMISSIONERS COURT, OFFICERS, EMPLOYEES, AND AGENTS

(INDIVIDUALLY AND COLLECTIVELY “INDEMNITEES”) AGAINST ANY

AND ALL LOSSES, LIABILITIES, JUDGMENTS, GOVERNMENTAL FINES

AND PENALTIES, AWARDS, AND COSTS (INCLUDING COSTS OF

INVESTIGATIONS, LEGAL FEES, AND EXPENSES) ARISING OUT OF OR

RELATED TO:

1. A BREACH OF THIS BAA RELATING TO THE PRIVACY AND

SECURITY REQUIREMENTS BY VENDOR; OR

2. ANY NEGLIGENT OR WRONGFUL ACTS OR OMISSIONS OF

VENDOR OR ITS EMPLOYEES, DIRECTORS, OFFICERS,

SUBCONTRACTORS, OR AGENTS, RELATING TO THE PRIVACY

AND SECURITY REQUIREMENTS, INCLUDING FAILURE TO

PERFORM THEIR OBLIGATIONS UNDER THE PRIVACY AND

SECURITY REQUIREMENTS.

H. Electronic Mail Addresses. VENDOR affirmatively consents to the disclosure of its e-mail addresses that are provided to COUNTY, including any agency or department of COUNTY. This consent is intended to comply with the requirements of the Texas Public Information Act, TEX. GOV’T CODE ANN. § 552.137 et seq., as amended, and shall survive termination of this BAA. This consent shall apply to e-mail addresses provided by VENDOR and agents acting on behalf of VENDOR and shall apply to any e-mail address provided in any form for any reason whether related to this BAA or otherwise.

I. Notices. Any notice required to be given pursuant to the terms and provisions of this

BAA will be in writing and deemed to be given: (a) upon delivery in person, (b) three (3) days after the date deposited with or sent by U.S. Mail (first class, postage paid, return receipt requested), or (c) upon receipt by commercial delivery service, and addressed as follows, or to such address as COUNTY may subsequently designate to VENDOR in writing:

Harris County Privacy Officer Human Resources Harris County Budget Management Department 1310 Prairie, 2nd Fl.

Houston, TX 77002

And to such Harris County agency or agencies for which services are performed under this agreement.

J. Except as otherwise limited in this BAA, VENDOR may use or disclose Protected Health Information it creates or receives from or on behalf of COUNTY to provide the services to or on behalf of COUNTY set out in the Agreement to which this BAA is attached.

K. This BAA is effective on the date a Court awarded bid is effective or on the later date an

Agreement is signed by the Parties and survives the termination of the Agreement for as long as VENDOR has access to PHI or EPHI plus six (6) years.