2-6. HIPAA BCHP Business Associate Agreement.pdf

Exhibit __ HIPAA Business Associate Agreement

This HIPAA Business Associate Agreement (“Agreement”) between the Boulder County Public Health and Contractor is agreed to in connection with, and as an exhibit to, the Contract. For purposes of this Agreement, Boulder County Public Health is a “Covered Entity” as defined in 45 C.F.R. 160.103 and Contractor is a “Business Associate” as defined in 45 C.F.R. 160.103. Unless the context clearly requires a distinction between the Contract and this Agreement, all references to “Contract” include this Agreement.

1. Purpose Covered Entity may disclose information to Business Associate, which may include Protected Health Information ("PHI"), as necessary for Business Associate to perform its work for Covered Entity under the Contract, and the Parties are required to protect the privacy and security of the disclosed PHI in compliance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Pub. L. No.

104-191 (1996) as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”) enacted under the American Recovery and Reinvestment Act of 2009 (“ARRA”) Pub. L. No.

111–5 (2009), implementing regulations promulgated by the U.S. Department of Health and Human Services at 45 C.F.R. Parts 160, 162 and 164 (the “HIPAA Rules”) and other applicable laws, as amended.

2. Definitions The following terms used in this Agreement have the same meanings as in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use. “Information Technology” and “Information Security” have the same meanings as the terms “information technology” and “information security”, respectively, in § 24-37.5-102, C.R.S. Capitalized terms used herein and not otherwise defined herein or in the HIPAA Rules have the meanings ascribed to them in the Contract.

3. Obligations and Activities of Business Associate

a. Permitted Uses and Disclosures.

i. Business Associate may use and disclose PHI only to accomplish Business Associate’s obligations under the Contract.

ii. To the extent Business Associate carries out one or more of Covered Entity’s obligations under Subpart E of 45 C.F.R. Part 164, Business Associate must comply with any requirements of Subpart E that apply to Covered Entity in the performance of such obligation.

iii. Business Associate may disclose PHI to a third party if necessary to accomplish its obligations under the Contract, provided that the disclosure is Required by Law or Business Associate obtains reasonable written assurances from the person to whom the information is disclosed that:

A. the information will remain confidential and will be used or disclosed only as Required by Law or for the purpose for which Business Associate originally disclosed the information to that person, and;

B. the person notifies Business Associate of any Breach involving PHI of which it is aware.

b. Minimum Necessary. Business Associate, its Subcontractors and agents, will access, use, and disclose only the minimum amount of PHI necessary to accomplish the objectives of the

BCPH - Business Associate Agreement Terms Approved by County Attorney's Office - 9.2024

Contract, in accordance with the Minimum Necessary Requirements of the HIPAA Rules including, but not limited to, 45 C.F.R. 164.502(b) and 164.514(d).

c. Business Associate's Subcontractors.

i. Business Associate will, in accordance with 45 C.F.R. 164.502(e)(1)(ii) and

164.308(b)(2), ensure that any Subcontractors who create, receive, maintain, or transmit PHI on behalf of Business Associate agree in writing to the same restrictions, conditions, and requirements that apply to Business Associate with respect to safeguarding PHI.

ii. Business Associate will provide to Covered Entity, on Covered Entity’s request, a list of Subcontractors who have entered into any such agreement with Business Associate.

iii. Business Associate will provide to Covered Entity, on Covered Entity’s request, copies of any such agreements Business Associate has entered into with Subcontractors.

d. Access to System. If Business Associate needs access to a Covered Entity Information Technology system to comply with its obligations under the Contract or this Agreement, Business Associate will request, review, and comply with any and all policies applicable to Covered Entity regarding such system including, but not limited to, any policies promulgated by the Boulder County Information Technology Department.

e. Access to PHI. Business Associate will, within ten days of receiving a written request from Covered Entity, make available PHI in a Designated Record Set to Covered Entity as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. 164.524.

f. Amendment of PHI.

i. Business Associate will within ten days of receiving a written request from Covered Entity make any amendment to PHI in a Designated Record Set as directed by or agreed to by Covered Entity pursuant to 45 C.F.R. 164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. 164.526.

ii. Business Associate will promptly forward to Covered Entity any request for amendment of PHI that Business Associate receives directly from an Individual.

g. Accounting Rights. Business Associate will, within ten days of receiving a written request from Covered Entity, maintain and make available to Covered Entity the information necessary for Covered Entity to satisfy its obligations to provide an accounting of Disclosure under 45 C.F.R.

164.528.

h. Restrictions and Confidential Communications.

i. Business Associate will restrict the Use or Disclosure of an Individual’s PHI within ten days of notice from Covered Entity of:

A. a restriction on Use or Disclosure of PHI pursuant to 45 C.F.R. 164.522; or B. a request for confidential communication of PHI pursuant to 45 C.F.R. 164.522.

ii. Business Associate will not respond directly to an Individual’s requests to restrict the Use or Disclosure of PHI or to send all communication of PHI to an alternate address.

iii. Business Associate will refer such requests to Covered Entity so that Covered Entity can coordinate and prepare a timely response to the requesting Individual and provide direction to Business Associate.

i. Governmental Access to Records. Business Associate will make its facilities, internal practices, books, records, and other sources of information, including PHI, available to the Secretary for purposes of determining compliance with the HIPAA Rules in accordance with 45 C.F.R.

160.310.

j. Audit, Inspection and Enforcement.

i. Business Associate will obtain and update at least annually a written assessment performed by an independent third party reasonably acceptable to Covered Entity, which evaluates the Information Security of the applications, infrastructure, and processes that interact with the Covered Entity data Business Associate receives, manipulates, stores and distributes. Upon request by Covered Entity, Business Associate will provide to Covered Entity the executive summary of the assessment.

ii. Business Associate, upon the request of Covered Entity, will fully cooperate with Covered Entity’s efforts to audit Business Associate’s compliance with applicable HIPAA Rules. If, through audit or inspection, Covered Entity determines that Business Associate’s conduct would result in violation of the HIPAA Rules or is in violation of the Contract or this Agreement, Business Associate will promptly remedy any such violation and will certify completion of its remedy in writing to Covered Entity.

k. Appropriate Safeguards.

i. Business Associate will use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic PHI to prevent use or disclosure of PHI other than as provided in this Agreement.

ii. Business Associate will safeguard the PHI from tampering and unauthorized disclosures.

iii. Business Associate will maintain the confidentiality of passwords and other data required for accessing this information.

iv. Business Associate will extend protection beyond the initial information obtained from Covered Entity to any databases or collections of PHI containing information derived from the PHI. The provisions of this section will be in force unless PHI is de-identified in conformance to the requirements of the HIPAA Rules.

l. Safeguard During Transmission.

i. Business Associate will use reasonable and appropriate safeguards including, without limitation, Information Security measures to ensure that all transmissions of PHI are authorized and to prevent use or disclosure of PHI other than as provided for by this Agreement.

ii. Business Associate will not transmit PHI over the internet or any other insecure or open communication channel unless the PHI is encrypted or otherwise safeguarded with a FIPS-compliant encryption algorithm.

m. Reporting of Improper Use or Disclosure and Notification of Breach.

i. Business Associate will, as soon as reasonably possible, but immediately after discovery of a Breach, notify Covered Entity of any use or disclosure of PHI not provided for by this Agreement, including a Breach of Unsecured Protected Health Information as such notice is required by 45 C.F.R. 164.410 or a breach for which notice is required under §24-73-103, C.R.S.

ii. Such notice will include the identification of each Individual whose Unsecured Protected Health Information has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such Breach.

iii. Business Associate will, as soon as reasonably possible, but immediately after discovery of any Security Incident that does not constitute a Breach, notify Covered Entity of such incident.

iv. Business Associate will have the burden of demonstrating that all notifications were made as required, including evidence demonstrating the necessity of any delay.

v. All notices will be provided as set forth in the Contract.

n. Business Associate’s Insurance and Notification Costs.

i. Business Associate will bear all costs of a Breach response including, without limitation, notifications, and will maintain insurance to cover:

A. loss of PHI data;

B. Breach notification requirements specified in HIPAA Rules and in §24-73-103, C.R.S.; and C. claims based upon alleged violations of privacy rights through improper use or disclosure of PHI.

ii. All such policies will meet or exceed the minimum insurance requirements of the

Contract or otherwise as may be approved by Covered Entity (e.g., occurrence basis, combined single dollar limits, annual aggregate dollar limits, additional insured status, and notice of cancellation).

iii. Business Associate will provide Covered Entity a point of contact who possesses relevant Information Security knowledge and is accessible 24 hours per day, 7 days per week to assist with incident handling.

iv. Business Associate, to the extent practicable, will mitigate any harmful effect known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of this Agreement.

o. Subcontractors and Breaches.

i. Business Associate will enter into a written agreement with each of its Subcontractors and agents, who create, receive, maintain, or transmit PHI on behalf of Business Associate. The agreements will require such Subcontractors and agents to report to Business Associate any use or disclosure of PHI not provided for by this Agreement, including Security Incidents and Breaches of Unsecured Protected Health Information, on the first day such Subcontractor or agent knows or should have known of the Breach as required by 45 C.F.R. 164.410.

ii. Business Associate will notify Covered Entity of any such report and will provide copies of any such agreements to Covered Entity on request.

p. Data Ownership.

i. Business Associate acknowledges that Business Associate has no ownership rights with respect to the PHI.

ii. Upon request by Covered Entity, Business Associate immediately will provide Covered

Entity with any keys to decrypt information that the Business Association has encrypted and maintains in encrypted form, or will provide such information in unencrypted usable form.

q. Retention of PHI. Except upon termination of this Agreement as provided below, Business

Associate and its Subcontractors or agents will retain all PHI throughout the term of this Agreement, and will continue to maintain the accounting of disclosures required under Section 3.h, above, for a period of six years.

4. Obligations of Covered Entity

a. Safeguards During Transmission. Covered Entity will be responsible for using appropriate safeguards including encryption of PHI, to maintain and ensure the confidentiality, integrity, and security of PHI transmitted pursuant to this Agreement, in accordance with the standards and requirements of the HIPAA Rules.

b. Notice of Changes.

i. Covered Entity will provide Business Associate with any changes in, or revocation of, permission to use or disclose PHI, to the extent that it may affect Business Associate’s permitted or required uses or disclosures.

ii. Covered Entity will notify Business Associate of any restriction on the use or disclosure of PHI to which Covered Entity has agreed in accordance with 45 C.F.R. 164.522, to the extent that it may affect Business Associate’s permitted use or disclosure of PHI.

5. Termination

a. Breach.

i. In addition to any Contract provision regarding remedies for breach, Covered Entity will have the right, in the event of a breach by Business Associate of any provision of this Agreement, to terminate immediately the Contract, or this Agreement, or both.

ii. Subject to any directions from Covered Entity, upon termination of the Contract, this Agreement, or both, Business Associate will take timely, reasonable, and necessary action to protect and preserve property in the possession of Business Associate in which Covered Entity has an interest.

b. Effect of Termination.

i. Upon termination of this Agreement for any reason, Business Associate, at the option of Covered Entity, will return or destroy all PHI that Business Associate, its agents, or its Subcontractors maintain in any form, and will not retain any copies of such PHI.

ii. If Covered Entity directs Business Associate to destroy the PHI, Business Associate will certify in writing to Covered Entity that such PHI has been destroyed.

iii. If Business Associate believes that returning or destroying the PHI is not feasible, Business Associate will promptly provide Covered Entity with notice of the conditions making return or destruction infeasible. Business Associate will continue to extend the protections of Section 3 of this Agreement to such PHI, and will limit further use of such PHI to those purposes that make the return or destruction of such PHI infeasible.

6. Injunctive Relief

Covered Entity and Business Associate agree that irreparable damage would occur in the event Business Associate or any of its Subcontractors or agents use or disclose PHI in violation of this Agreement, the HIPAA Rules or any applicable law. Covered Entity and Business Associate further agree that money damages would not provide an adequate remedy for such Breach. Accordingly, Covered Entity and Business Associate agree that Covered Entity will be entitled to injunctive relief, specific performance, and other equitable relief to prevent or restrain any Breach or threatened Breach of and to enforce specifically the terms and provisions of this Agreement.

7. Limitation of Liability Any limitation of liability set forth in the Contract will not apply to Business Associate’s liability under this Agreement.

8. Disclaimer Covered Entity makes no warranty or representation that compliance by Business Associate with this Agreement or the HIPAA Rules will be adequate or satisfactory for Business Associate’s own purposes.

Business Associate is solely responsible for all decisions made and actions taken by Business Associate regarding the safeguarding of PHI.

9. Certification Covered Entity has a legal obligation under HIPAA Rules to certify as to Business Associate’s Information Security practices. Covered Entity or its authorized agent or contractor will have the right to examine Business Associate’s facilities, systems, procedures, and records, at Covered Entity’s expense, if Covered Entity determines that examination is necessary to certify that Business Associate’s Information Security safeguards comply with the HIPAA Rules or this Agreement.

10. Amendment

a. Amendment to Comply with Law. The Parties acknowledge that state and federal laws and regulations relating to data security and privacy are rapidly evolving and that amendment of this Agreement may be required to provide procedures to ensure compliance with such developments.

i. In the event of any change to state or federal laws and regulations relating to data security and privacy affecting this Agreement, the Parties will take such action as is necessary to implement the changes to the standards and requirements of HIPAA, the HIPAA Rules and other applicable rules relating to the confidentiality, integrity, availability and security of PHI with respect to this Agreement.

ii. Business Associate will provide to Covered Entity written assurance satisfactory to Covered Entity that Business Associate will adequately safeguard all PHI, and obtain written assurance satisfactory to Covered Entity from Business Associate’s Subcontractors and agents that they will adequately safeguard all PHI.

iii. Upon the request of either Party, the other Party promptly will negotiate in good faith the terms of an amendment to the Agreement embodying written assurances consistent with the standards and requirements of HIPAA, the HIPAA Rules, or other applicable rules.

iv. Covered Entity may terminate this Agreement upon 30 days’ prior written notice in the event that:

A. Business Associate does not promptly enter into negotiations to amend the Contract and this Agreement when requested by Covered Entity pursuant to this Section; or

B. Business Associate does not enter into an amendment to the Contract and this Agreement, which provides assurances regarding the safeguarding of PHI sufficient, in Covered Entity’s sole discretion, to satisfy the standards and requirements of the HIPAA, the HIPAA Rules and applicable law.

11. Assistance in Litigation or Administrative Proceedings

Covered Entity will provide written notice to Business Associate if litigation or administrative proceeding is commenced against Covered Entity, its directors, officers, or employees, based on a claimed violation by Business Associate of HIPAA, the HIPAA Rules or other laws relating to security and privacy or PHI. Upon receipt of such notice and to the extent requested by Covered Entity, Business Associate will, and will cause its employees, Subcontractors, or agents assisting Business Associate in the performance of its obligations under the Contract to, assist Covered Entity in the defense of such litigation or proceedings.

Business Associate will, and will cause its employees, Subcontractor’s and agents to, provide assistance, to Covered Entity, which may include testifying as a witness at such proceedings. Business Associate or any of its employees, Subcontractors or agents will not be required to provide such assistance if Business Associate is a named adverse party.

12. Interpretation and Order of Precedence Any ambiguity in this Agreement will be resolved in favor of a meaning that complies and is consistent with the HIPAA Rules. In the event of an inconsistency between the Contract and this Agreement, this Agreement will control. This Agreement supersedes and replaces any previous, separately executed HIPAA business associate agreement between the Parties.

13. Survival Provisions of this Agreement requiring continued performance, compliance, or effect after termination will survive termination of this Contract or this Agreement and will be enforceable by Covered Entity.

[THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK}

Text1: