14-Exhibit L.pdf

EXHIBIT L:

BUSINESS ASSOCIATE AGREEMENT

BUSINESS ASSOCIATE AGREEMENT

INTRODUCTION

The use and disclosure of protected health information (“PHI”) is regulated by the Health

Insurance Portability and Accountability Act of 1996 (“HIPAA”), Public Law 104-191, the Health

Information Technology for Economic and Clinical Health Act (“HITECH”), Public Law 111-5, and the regulations promulgated under HIPAA and HITECH by the U.S. Department of Health and Human Services (“HHS”), including the HIPAA Omnibus Final Rule, which amended the

HIPAA Privacy and Security Rules. The HIPAA Privacy and Security Rules extend certain obligations to BA and its subcontractors. The purpose of this BAA is to satisfy certain standards and requirements of HIPAA, the Privacy Rule and the Security Rule, and HITECH, including, but not limited to, Title 45 §§ 164.314(a)(2)(i), 164.502(e), and 164.504(e) of the Code of Federal

Regulations (“C.F.R.”).

This Business Associate Agreement (“BAA”), an Exhibit to the underlying contract, is entered into between the City of Columbus, Ohio (“City”) and Contractor (“Business Associate” or “BA”).

Pursuant to the underlying contract, the City wishes to disclose certain information to BA, some of which may constitute protected health information (“PHI”), for the purpose of seeking reimbursement for emergency medical service transport to emergency departments. Under 45

C.F.R. § 160.103, the City of Columbus is a “hybrid entity” and the Division of Fire is a “covered entity” because the Division of Fire, as a division of the City, is a health care provider that maintains electronic PHI and seeks reimbursement for emergency medical services through various electronic transactions. Under 45 C.F.R. § 160.103, Contractor is a “business associate” because Contractor provides services to the City where the provision of services involves the disclosure of PHI from the City to the Contractor.

1.0 DEFINITIONS

The following terms, which are incorporated into this BAA by reference, will have the same meanings as set forth in the Privacy Rule, the Security Rule, and the HIPAA Final Rule: Breach;

Breach Notification Rule; Data Aggregation; Designated Records Set; Disclosure; Electronic

Protected Health Information or Electronic PHI; Health Care Operations; Individual; Privacy Rule;

Protected Health Information or PHI; Required by Law; Secretary; Security Incident; Security

Rule; Unsecured PHI; and Use. All terms used in this BAA and not otherwise defined herein will be defined to have the same meanings as are set forth in the Privacy Rule, the Security Rule, and the HIPAA Final Rule.

2.0 PERMITTED USES AND DISCLOSURES OF PHI

2.1. Uses and Disclosures Pursuant to Underlying Contract: Except as otherwise limited in this BAA, BA may use or disclose PHI to perform functions, activities, or services for, or on behalf of, the City as specified in the underlying contract, provided that such use or disclosure would not violate the Privacy Rule if done by the City.

2.2. Permitted Uses of PHI by BA: Except as otherwise limited in this BAA, BA may use PHI for the proper management and administration of BA or to carry out the legal responsibilities of BA.

2.3. Permitted Disclosures by BA: Except as otherwise limited in this BAA, BA may disclose

PHI for the proper management and administration of BA, provided that the disclosures are required by law, or BA obtains reasonable assurances, in accordance with 45 C.F.R.

§ 164.504(e)(1)(i), from the person to whom the information is disclosed that it will remain confidential and will be used or further disclosed only as required by law or for the purpose for which it was disclosed to the person (which purpose must be consisted with the limitations imposed upon BA pursuant to this BAA), and that the person agrees to notify BA of any instances of which it is aware in which the confidentiality of the information has been breached. BA may disclose PHI to report violations of law to appropriate federal and state authorities, consistent with 45 C.F.R. § 164.502(j)(1).

2.4. Required Use and Disclosure: BA is required to disclose PHI (a) when required by the

Secretary to investigate or determine BA’s compliance with HIPAA; and (b) to the City, individual, or individual’s designee, as necessary to satisfy the City’s obligations under

45 C.F.R. § 164.524(c)(2)(ii) and (3)(ii) with respect to an individual’s request for an electronic copy of PHI.

2.5. Data Aggregation: Except as otherwise limited in this BAA, BA may use PHI to provide data aggregation services or data analytics for the health care operations of the City as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).

2.6. De-identified Data: BA may de-identify PHI in accordance with the standards set forth in

45 C.F.R. § 164.514(b) and may use or disclose such de-identified data unless prohibited by applicable law.

3.0 OBLIGATIONS OF BUSINESS ASSOCIATE

3.1. Appropriate Safeguards: BA will use appropriate safeguards and will comply with the

Security Rule with respect to Electronic PHI, to prevent use or disclosure of such information other than as provided for by the underlying contract and this BAA.

3.2. Reporting Improper Use or Disclosure, Security Incident or Breach: BA will report to the

City any use or disclosure of PHI not permitted under this BAA, breach of unsecured PHI or any security incident, without unreasonable delay, and in any event no more than thirty

(30) days following discovery.

3.3. BA’s Agents or Subcontractors: In accordance with 45 C.F.R. § 164.502(e)(1)(ii) and 45

C.F.R. § 164.308(b)(2), as applicable, BA will enter into a written agreement with any agent or subcontractor that creates, receives, maintains, or transmits PHI on behalf of BA for services provided to the City, providing that the agent or subcontractor agrees to restrictions and conditions that are substantially similar to those that apply through this

BAA to BA with respect to such PHI.

3.4. Access to PHI: To the extent BA possesses PHI in a designated records set, BA agrees to make such information available to the City pursuant to 45 C.F.R. § 164.524 within ten

(10) business days of BA’s receipt of a written request from the City. If an individual makes a request for access pursuant to 45 C.F.R. § 164.524 directly to BA, or inquiries about his or her right to access, BA will either forward such request to the City or direct the individual to the City.

3.5. Amendment of PHI: To the extent BA possesses PHI in a designated records set, BA agrees to make such information available to the City for amendment pursuant to 45

C.F.R. § 164.526 within ten (10) business days of BA’s receipt of a written request from the City. If an individual submits a written request for amendment pursuant to 45 C.F.R.

§ 164.526 directly to BA, or inquiries about his or her right to amendment, BA will either forward such request to the City or direct the individual to the City.

3.6. Documentation of Disclosures: BA agrees to document such disclosures of PHI and information related to such disclosures as would be required for the City to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45

C.F.R. § 164.528. BA will document, at a minimum, the following information

(“disclosure information”): (a) the date of the disclosure; (b) the name and, if known, the address of the recipient of the PHI; (c) a brief description of the PHI disclosed; (d) the purpose of the disclosure that includes an explanation of the basis for such disclosure;

and (e) any additional information required under HITECH and any implementing regulations.

3.7. Accounting of Disclosures: BA agrees to provide to the City, within ten (10) business days of BA’s receipt of a written request from the City, information collected in accordance with Section 3.6 of this BAA, to permit the City to respond to a request by an individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. §

164.528. If an individual submits a written request for an accounting of disclosures of

PHI pursuant to 45 C.F.R. § 164.528 directly to BA, or inquiries about his or her right to an accounting, BA will direct the individual to the City.

3.8. Government Access to Records: BA will make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by BA on behalf of, the City available to the Secretary for purposes of the Secretary determining the City’s compliance with the Privacy and Security Rule.

3.9. Mitigation: To the extent practicable, BA will cooperate with the City’s efforts to mitigate a harmful effect that is known to BA of a use or disclosure of PHI by BA that is not permitted by this BAA or the underlying contract.

3.10. Minimum Necessary: BA will request, use, and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use, or disclosure in accordance with

45 C.F.R. § 164.514(d), and any amendments thereto.

3.11. Audit Report: Upon request, BA will provide the City with a copy of its most recent independent HIPAA compliance report (AT-C 315), HITRUST certification, or other mutually agreed upon independent standards based third-party audit report. To the extent permitted by R.C. Chapter 149 and other applicable law, the City agrees not to re-disclose

BA’s audit report. If the City receives a request pursuant to R.C. Chapter 149, the City agrees to notify BA so that BA may take any appropriate legal action to prevent the release of the requested audit report.

3.12. HIPAA Final Rule Applicability: BA acknowledges that HIPAA or HITECH may be amended in the future. BA agrees to comply with applicable requirements imposed under

HIPAA or HITECH in the future.

4.0 OBLIGATIONS OF THE CITY OF COLUMBUS

4.1. Notice of Privacy Practices: The City will notify BA of any limitation in its notice of privacy practices in accordance with 45 C.F.R. 164.520, to the extent that such limitation may affect BA’s use or disclosure of PHI. The City will provide such notice no later than ten (10) days prior to the effective date of the limitation.

4.2. Notification of Changes Regarding Individual Permission: The City will obtain any consent or authorization that may be required by the Privacy Rule, or applicable state law, prior to furnishing BA with PHI. The City will notify BA of any changes in, or revocation of, permission by an individual to use of disclose PHI, to the extent that such changes may affect BA’s use or disclosure of PHI. The City will provide such notice no later than ten (10 ) days prior to the effective date of the change.

4.3. Notification of Restrictions to Use or Disclosure of PHI: The City will notify BA of any restriction to the use or disclosure of PHI that the City has agreed to in accordance with

45 C.F.R. § 164.522, to the extent that such restriction may affect BA’s use or disclosure of PHI. The City will provide such notice no later than ten (10) days prior to the effective date of the restriction. If BA reasonably believes that any restriction agreed to by the City pursuant to this Section may materially impair BA’s ability to perform its obligations under the underlying contract or this BAA, the parties will mutually agree upon any necessary modification of BA’s obligations under such agreements.

4.4. Permissible Requests by the City: The City will not request BA to use or disclose PHI in any manner that would not be permissible under the Privacy Rule, the Security Rule, or

HITECH if done by the City, except as permitted pursuant to Sections 2.2 – 2.5 of this

BAA.

5.0 TERM AND TERMINATION

5.1. Term: The term of this BAA will commence as of the effective date of the underlying contract and will terminate when all of the PHI provided by the City to BA, or created or received by BA on behalf of the City, is destroyed or returned to the City. If it is infeasible to return or destroy PHI, BA will extend protections to such information in accordance with Section 5.3.

5.2. Termination for Cause: Upon either party’s knowledge of a material breach by the other party of this BAA, such party may terminate this BAA and the underlying contract immediately if cure is not possible. Otherwise, the non-breaching party will provide written notice to the breaching party and provide an opportunity to cure the breach within thirty (30) business days. Upon the expiration of such thirty (30) day cure period, the non-breaching party may terminate this BAA or underlying contract if the breaching party does not cure the breach or if cure is not possible. If termination is not feasible, the non-breaching party may report the breach or violation to the Secretary.

5.3. Effect of Termination:

5.3.1. Except as provided by Section 5.3.2, upon termination of this BAA or the underlying contract for any reason, BA will return or destroy all PHI received from the City, or created or received by BA on behalf of the City, at BA’s expense, and will retain no copies of the PHI. This provision will apply to PHI that is in the possession of agents or subcontractors of BA.

5.3.2. If it is infeasible for BA to return or destroy the PHI upon termination of this BAA or the underlying contract, BA will: (a) extend the protections of this BAA to such

PHI and (b) limit further uses and disclosures of such PHI to those purposes that make return or destruction infeasible, for so long as BA maintains such PHI.

6.0 COOPERATION IN INVESTIGATIONS

The parties acknowledge that certain breaches or violations of this BAA may result in litigation or investigations pursued by federal or state governmental authorities of the United States resulting in civil liability or criminal penalties. Each party will cooperate in good faith in all respects with the other party in connection with any request by a federal or state governmental authority for additional information and documents or any governmental investigation, complaint, action, or other inquiry.

7.0 SURVIVAL

The respective rights and obligations of BA under Section 5.3 of this BAA will survive the termination of this BAA and the underlying contract.

8.0 AMENDMENT

8.1. This BAA may be modified, or any rights under it waived, only by a written document executed by the authorized representatives of both parties.

8.2. If any relevant provision of the Privacy Rule, the Security Rule, or the HIPAA Final Rule is amended in a manner that changes the obligations of BA or the City that are embodied in terms of this BAA, then the parties agree to negotiate in good faith appropriate non-financial terms or amendments to this BAA to give effect to such revised obligations.

9.0 EFFECT OF BAA

9.1. In the event of any inconsistency between the provisions of this BAA and the underlying contract, the provisions of this BAA will control.

9.2. If a court or regulatory agency with authority over BA or the City interprets the mandatory provisions of the Privacy Rule, the Security Rule, or the HIPAA Final Rule, in a way that is inconsistent with the provisions of this BAA, such interpretation will control.

9.3. Where provisions of this BAA are different from those mandated in the Privacy Rule, the

Security Rule, or the HIPAA Final Rule, but are nonetheless permitted by such rules as interpreted by courts or agencies, the provisions of this BAA shall control.

10.0 GENERAL TERMS

10.1. This BAA is governed by, and will be construed in accordance with, the laws of the State of Ohio.

10.2. Any action relating to this BAA must be commenced within one year after the date upon which the cause of action accrued.

10.3. The City will not assign this BAA without prior written consent of BA, which will not be unreasonably withheld.

10.4. If any part of a provision of this BAA is found illegal or unenforceable, it will be enforced to the maximum extent permissible, and the legality and enforceability of the remainder of that provision and all other provisions of this BAA will not be affected.

10.5. All notices relating to the parties’ legal rights and remedies under this BAA will be provided in writing to a party, will be sent to its address as set forth in the underlying contract, or to such other address as may be designated by that party by notice to the sending party, and will reference this BAA.

10.6. Nothing in this BAA will confer any right, remedy, or obligation upon anyone other than the City and BAA. This BAA is not intended to create, and shall not be construed to create, any rights in third parties.

10.7. This BAA is the complete and exclusive agreement between the parties with respect to the subject matter hereof, superseding and replacing all prior agreements, communications, and understandings (written and oral) regarding this subject matter.

10.8. In the event of a breach caused solely by BA or its employees or its subcontractors and the Privacy Rule and Security Rule require notice to individuals pursuant to 45 C.F.R. §§

164.404 and 164.406, BA shall reimburse the City for the reasonable and substantiated costs related to the following: providing notifications to affected individuals, the media, and the Secretary; providing credit monitoring services to affected individuals, if appropriate, for up to 1 year after discovery of the breach; any fines and penalties assessed against the City directly attributable to a breach by BA or its employees or its subcontractors; investigation costs; and mitigation efforts required under the Privacy

Rule, Security Rule, or imposed by the Security following any investigation.