HIPPA.doc

Health Insurance Portability and Accountability Act (HIPAA)

BUSINESS ASSOCIATE AGREEMENT

Pursuant to the Health Insurance Portability and Accountability Act (HIPAA) of 1996; its implementing regulations, the Standards of Privacy of Individual Identifiable Health Information at 45 C.F.R. Parts 160 and 164, Subparts A and E (“Privacy Rule”), and 45 C.F.R. Parts 160 and 164, Subparts A and C (“Security Rule”); and the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”), Title XIII, Subtitle D of the American Reinvestment and Recovery Act of 2009, Pub. L. No. 111-5, 123 Stat. 115 (2009) (“ARRA”), the Indian Health Service is required to enter into an agreement with the Business Associate, pursuant to which the Business Associate shall comply with and appropriately safeguard Protected Health Information ("PHI”) that it will use and disclose when performing functions, activities or services ("Services") for the Indian Health Service pursuant to Contract No.

(“Contract”). The Business Associate by signing the Contract shall comply with the following terms in addition to other applicable Contract terms and conditions relating to the safekeeping, use and disclosure of PHI.

Section 1 - Definitions Terms used in this Agreement, if not otherwise defined, shall have the same meaning as those terms contained within the Privacy Rule and the HITECH Act.

a.

Breach: “Breach” shall mean the unauthorized acquisition, access, use, or disclosure of Protected Health Information (defined hereinafter) which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information;

b.

Covered Entity: "Covered Entity" shall mean the Indian Health Service (IHS);

c.

De-identified protected health information: “De-identified protected health information” shall have the same meaning as the term “de-identified protected health information” in 45 C.F.R. § 164. 514;

d.

Designated Record Set: "Designated Record Set" shall mean (1) a group of records maintained by or for a covered entity that is: (i) The medical records and billing records about individuals maintained by or for a covered health care provider, (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan, or (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals. (2) For purposes of this paragraph, the term record means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity; (45 C.F.R. § 164.501) e.

Electronic Health Record: “Electronic Health Record” shall mean an electronic record of health-related information on an individual that is created, gathered, managed, and consulted by authorized health care clinicians and staff;

f.

Individual: "Individual" shall have the same meaning as the term "individual" in 45 C.F.R. § 164.501 and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g);

g.

Limited Data Set: “Limited Data Set” shall have the same meaning as the term “limited data set” in 45 C.F.R. § 164. 514(e)(2);

h.

Privacy Rule: "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Parts 160 and 164, Subparts A and E;

i.

Protected Health Information: "Protected Health Information" or “PHI” shall have the same meaning as the term "protected health information" in 45 C.F.R. § 160.103;

j.

Required By Law: "Required By Law" shall have the same meaning as the term "required by law" in 45 C.F.R. § 164.501;

k.

Secretary: "Secretary" shall mean the Secretary of the United States Department of Health and Human Services or her designee;

l.

Unsecured Protected Health Information: “Unsecured Protected Health Information” or “Unsecured PHI” shall mean protected health information that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in guidance on the HHS website issued under section 13402(h)(2) of the HITECH Act.

Section 2 - Compliance The Business Associate agrees to comply with the business associate contract requirements under the Privacy Rule, the HITECH Act and the provisions of this Agreement throughout the term of this Agreement. The Business Associate agrees that it will require all of its agents, employees, subsidiaries, affiliates and subcontractors, to whom the Business Associate provides PHI, or who create or receive PHI on behalf of the Business Associate for the IHS, to comply with the Privacy Rule and the HITECH Act, and to enter into written agreements with the Business Associate that provide the same restrictions, terms and conditions as set forth in this Agreement.

In the event the Business Associate awards a subcontract under the Contract pursuant to which the Business Associate will disclose PHI to the subcontractor, notwithstanding any clause to the contrary contained in the Contract, the Business Associate agrees to obtain the IHS Contracting Officer’s written consent prior to awarding such subcontract.

Section 3 - Permitted Uses and Disclosures The Business Associate shall not use or disclose PHI except to perform functions, activities or services for or on behalf of the IHS as provided for in this Agreement, the Privacy Rule, the HITECH Act or other applicable law. The Business Associate agrees that it may use or disclose PHI on behalf of the IHS only (1) upon obtaining the authorization of the patient to whom the PHI pertains (45 C.F.R. §§ 164.502(a)(1)(iv) and 164.508(b)); (2) for the purpose of treatment, payment or health care operations (45 C.F.R. §§ 164.502(a)(1)(ii), and 164.506)), unless disclosure has been restricted pursuant to the HITECH Act at § 13405(a), or (3) without an authorization or consent, if in accordance with 45 C.F.R. §§ 164.506, 164.5 10, 164.512, 164.514(e), 164.514(f) or 164.514(g). The Business Associate shall use and disclose PHI in compliance with each applicable requirement of 45 C.F.R. § 164.504(e), which section is fully incorporated herein. Except as otherwise limited in this Agreement, the Business Associate may use PHI for the management and administration of the Business Associate or to carry out responsibilities that are required of it by law (45 C.F.R. § 164.502(e)(4)(i)).

Section 4 - Safeguards The Business Associate shall develop and use appropriate procedural, physical and electronic safeguards to protect against the use or disclosure of PHI in a manner not permitted by the Privacy Rule or this Agreement. The Business Associate will limit any use, disclosure or request for use or disclosure of PHI to the minimum amount necessary to accomplish the intended purpose of the use, disclosure or request in accordance with the applicable requirements of the Privacy Rule. As mandated by the HITECH Act, Privacy Rule sections 164.308 (administrative safeguards requirements), 164.310 (physical safeguards requirements), 164.312 (technical safeguards requirements) and 164.316 (policies and procedures and documentation requirements) shall apply to the Business Associate in the same manner that such sections apply to covered entities under the Privacy Rule.

Section 5 – Minimum Necessary

Prior to the Secretary issuing guidance on what constitutes “minimum necessary” for purposes of the Privacy Rule, the Business Associate will limit, to the extent practicable, any use, disclosure or request for use or disclosure of PHI (other than those uses, disclosures or requests for use or disclosure of PHI set forth at 45 CFR section 164.502(b)(2)) , to the Limited Data Set, or, if needed, to the minimum amount necessary to accomplish the intended purpose of such use, disclosure or request, respectively. Upon the effective date of the Secretary’s ”minimum necessary” guidance, the Business Associate will limit any use, disclosure or request for use or disclosure of PHI, to the minimum amount necessary as set forth in such guidance.

Section 6 - Safeguards for Electronic PHI The Business Associate shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any electronic PHI that it creates, receives, maintains, or transmits on behalf of the IHS as required by 45 C.F.R. Part 164, subpart C, Security Standards for the Protection of Electronic Health Information. Section 4 above shall apply in full to this Section 6.

Section 7 - Reporting of Unauthorized Uses or Disclosures The Business Associate shall promptly report to the IHS any knowledge of uses or disclosures of PHI that are not in accordance with this Agreement or applicable law. In addition, the Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to the Business Associate of a use or disclosure of PHI by the Business Associate in violation of the requirements of the Privacy Rule or the HITECH Act. For those uses or disclosures that involve a breach of the security of any unsecured PHI received from, or created or received on behalf of, the IHS, the Business Associate shall comply with the requirements set forth in Section 8 below.

Section 8 - Reporting of Breach of Unsecured PHI

The Business Associate shall notify the IHS of a breach of the security of any unsecured PHI that the Business Associate received from, or created or received on behalf of, the IHS within thirty (30) calendar days after the discovery of the breach by the Business Associate, its employees, officers and/or other agents unless a law enforcement official has determined that such notification would impede a criminal investigation or cause damage to national security, in which case the notification shall be delayed in accordance with the requirements of 45 C.F.R. § 164.412.. Such notice shall include, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed by the Business Associate to have been, accessed, acquired, or disclosed during such breach; a brief description of the circumstances of the breach of security, including the date of the breach and the date of the Business Associate’s discovery of the breach; and the type of unsecured PHI involved in the breach. In the event notification is delayed, evidence demonstrating the necessity of the delay shall accompany the notification. A breach shall be treated as discovered as of the first day on which such breach is known to Business Associate (including any person, other than the individual committing the breach that is an employee, officer or other agent of Business Associate) or should have reasonably been known to Business Associate (or person) to have occurred.

Section 9 – Maintenance of Records and Accounting of Disclosures The Business Associate shall maintain records of PHI received from or created or received on behalf of the IHS and shall document subsequent uses and disclosures of such information by the Business Associate. The Business Associate shall, within 5 calendar days after receiving a request from the IHS, provide to the IHS such information as the IHS may require to fulfill its obligations to provide access to, provide a copy of, and account for disclosures with respect to PHI pursuant to the Privacy Rule (e.g., 45 C.F.R. § 164.528) (individual request for an accounting of PHI disclosures), the HITECH Act and other applicable law.

In accordance with the requirements of HITECH Act section 13405(c), beginning on [need to determine if BA already has EHR system and then put in applicable date based on requirement of HITECH section 13405(c)(4)], the Business Associate shall account for all disclosures of PHI for treatment, payment and health care operational purposes.

Section 10 - Maintenance of Records and Accounting: Individual Access The Business Associate shall maintain a Designated Record Set for each patient for which it has PHI. In accordance with a patient's right to access his/her PHI under the Privacy Rule, the Business Associate shall make available all PHI in the patient's Designated Record Set to the patient to whom that information pertains, or, upon the request of the patient, to that patient's authorized representative, in compliance with 45 C.F.R. § 164.524. Availability shall be made within 5 calendar days of receipt of a request.

Section 11 – Disclosure for Purposes of Verifying Compliance Upon request, the Business Associate shall make available to the IHS or to the Secretary, PHI and the Business Associate's internal practices, books and records, including its policies and procedures and any agreements required by Section 2 herein that it has with subcontractors, vendors and other agents relating to the use and disclosure of PHI received from the IHS, or created or received by the Business Associate on behalf of the IHS, for purposes of determining both the Business Associate’s and the IHS’s compliance with the Privacy Rule and the HITECH Act and its implementing regulations. The Business Associate shall not disclose PHI to any requesting party other than as provided for in this Section and Sections 3 and 10 above. The Business Associate shall forward all other disclosure requests to the IHS for processing, except those it receives directly from individuals in accordance with Section 10 above.

Section 12 - Amendments of Information

The Business Associate shall, within 5 calendar days of a request by the IHS, make PHI available to the IHS for the IHS to fulfill its obligations pursuant to the Privacy Rule to amend PHI and shall, as directed by the IHS, within 5 calendar days of receipt of such direction, incorporate any amendments into PHI held by the Business Associate. The Business Associate shall ensure incorporation of any such amendments into PHI held by its agents or subcontractors within 10 days of its request that they do so, and shall notify the IHS within 5 calendar days of when those agents or subcontractors have completed the incorporation of the amendments. The Business Associate shall not make any amendments to PHI except upon request of the IHS. The Business Associate shall forward to the IHS Contracting Officer for approval all requests to amend PHI that it may receive directly from individuals within 5 calendar days of its receipt of the request.

Section 13 - Obligations of IHS The IHS Contracting Officer shall provide the Business Associate with its notice of privacy practices, produced under 45 C.F.R. § 164.520 and any changes to the notice. The IHS Contracting Officer shall also provide the Business Associate with any changes in, or revocation of, individuals' authorizations to use or disclose PHI of which the IHS becomes aware, if such changes affect the Business Associate's permitted or required uses or disclosures of PHI. The IHS Contracting Officer shall notify the Business Associate of any restrictions to the use or disclosure of PHI with which IHS must comply pursuant to an individual's request for restriction of disclosure of the individual’s PHI pursuant to 45 C.F.R. § 164.522 and § 13405(a) of the HITECH Act. The IHS shall not request that the Business Associate use or disclose PHI in any manner that would violate either the Privacy Rule or the HITECH Act if used or disclosed by the IHS.

Section 14 - Material Breach; Termination

a. Breach by Business Associate

If the Business Associate breaches a material obligation of this Agreement or fails to comply with the Privacy Rule or the HITECH Act, the IHS will give the Business Associate an opportunity to cure the breach, but if the Business Associate fails to cure the breach, the IHS will terminate the Agreement. If, in the determination of the IHS Contracting Officer, neither cure nor termination is feasible, the IHS shall report the material breach to the Secretary. Termination of this Agreement shall not affect any provision of this Agreement which, by its wording or nature, is intended to remain in effect and continue to operate in the event of termination. Termination of the Contract between the parties will result in the termination of this Agreement and termination of this Agreement for Business Associate breach will result in termination of the Contract as provided in the default clause, FAR Clause No.

b. Breach by IHS

If the IHS breaches a material obligation of this Agreement or fails to comply with the Privacy Rule or HITECH Act, the Business Associate will give the IHS an opportunity to cure the breach, but if the IHS fails to cure the breach, the Business Associate will terminate the Agreement. If, in the determination of the Business Associate, neither cure nor termination is feasible, the Business Associate shall report the material breach to the Secretary. Termination of this Agreement shall not affect any provision of this Agreement which, by its wording or nature, is intended to remain in effect and to continue to operate in the event of termination. Termination of the Contract between the parties will result in the termination of this Agreement and termination of this Agreement for IHS breach will result in termination of the Contract as provided in the FAR Clause No. 52.212-4, Contract Terms and Conditions—Commercial Items, (l) Termination for Convenience Section 15 – Prohibition on Sale of EHR or PHI As of February 18, 2011, or beginning six (6) months following the Secretary’s promulgations of regulations to carry out the requirements of HITECH Act section 13405(d), whichever is earlier, the Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI of an individual unless: (1) the IHS has previously obtained from the individual, in accordance with 45 C.F.R. § 164.508, a valid authorization that includes in accordance with such section, a specification of whether the PHI can be further exchanged for remuneration by the entity receiving that individual’s PHI; or (2) such remuneration falls under an exception set forth in HITECH Act section 13405(d)(2).

Section 16 - Indemnification

In the event the Business Associate is investigated and/or becomes a party to a civil or criminal cause of action in any forum relating to its failure to comply with the Privacy Rule or the HITECH Act, the Business Associate shall reimburse IHS all reasonable costs and expenses the IHS may incur relating to such investigation and/or cause of action, and will otherwise hold IHS harmless for any and all reasonable costs and expenses relating to the foregoing.

Section 17 - Return or Destruction of Information When the Contract terminates, the Business Associate, at the IHS's option, shall either return to the IHS, or destroy, if the IHS agrees that destruction is feasible, all PHI received from, or created or received by it that it still maintains in any form and it shall keep no copies of PHI except as requested by the IHS or required by law. The IHS Contracting Officer shall notify the Business Associate whether the Business Associate must return or destroy any PHI in its possession. If the Business Associate or its agent or subcontractor destroys any PHI, the Business Associate will provide the IHS with documentation evidencing such destruction within 30 days of completion of destruction. The Business Associate shall extend the protections of this Agreement to any PHI that is not feasible to either return or destroy for as long as it maintains the PHI. The Business Associate shall limit further uses and disclosures of this PHI to those purposes that rendered the return or destruction of the PHI infeasible.

Section 18 - Term The term of this Agreement shall begin on February 18, 2010 and end with the termination of the Contract, except as provided in Section 14.

Section 19 - Amendments of Agreement Upon learning that material changes have been made to the Privacy Rule and/or the HITECH Act, the parties agree to promptly amend this Agreement to ensure that it remains in compliance with the Privacy Rule and/or the HITECH Act, as amended.

Section 20 - Miscellaneous Provisions

(1) This Agreement is attached to and fully incorporated into the Contract.

(2) All notices under this Agreement shall be provided by certified mailing, and shall require proof of date of receipt.

(3) This Agreement shall be binding upon, inure to the benefit of and be enforceable by and against the parties and their successors and assigns. Any novation, assignment, or other transfer of rights, interests, or duties under this Agreement by Business Associate shall be as provided in the Contract and Section 2 of this Agreement, as applicable.

(4) Any ambiguity in this Agreement shall be resolved in a manner that brings the Agreement into compliance with the most current versions of the Privacy Rule and the HITECH Act.

(5) If a court of competent jurisdiction deems any provision of this Agreement unenforceable, such provision shall be severed from this Agreement and every other provision of the Agreement shall remain in full force and effect.