2-BAA Agreement.pdf

ATTACHMENT G:

BUSINESS ASSOCIATE AGREEMENT (BAA)

ARIZONA DEPARTMENT OF

HEALTH SERVICES

150 N. 18th Avenue, Suite 530 Phoenix, Arizona 85007

Procurement Officer Brandon Durick

INVITATION FOR BID

BPM006675

PEST CONTROL SERVICES

AT THE ARIZONA STATE HOSPITAL

HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT OF 1996 (“HIPAA”)

BUSINESS ASSOCIATE AGREEMENT (“AGREEMENT”)

The Arizona Department of Health Services or an Arizona Department of Health Services’ Division, Bureau, Office, or Program and Business Associate hereby enter into this Agreement. The date when this Agreement is effective (“Effective Date”) shall be determined according to Sections 164.534, 164.532(d), and 164.532(e) of the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Parts 160 and Part 164, Subparts A and E (“Privacy Standards”). This Agreement supplements any service agreement(s) (“Service Agreement(s)”) between ADHS Covered Component and Business Associate relating to the disclosure of Protected Health Information (“PHI”). In the event of conflicting terms or conditions, this Agreement shall supersede the Service Agreement(s).

The ADHS Covered Component and Business Associate intend to comply with the Privacy Standards; the Security Standards for the Protection of Electronic Protected Health Information at 45 CFR Part 164, Subpart C (“Security Standards”); HIPAA; and other applicable federal and state laws, in order to protect the privacy of PHI in any form and to safeguard the confidentiality, integrity, and availability of Electronic PHI (“ePHI”) related to this Agreement.

1. DEFINITIONS. Capitalized terms not otherwise defined in this Agreement shall have the same meaning as in the

Privacy Standards and the Security Standards.

2. PERMITTED USES AND DISCLOSURES OF PHI. Business Associate will Use and disclose PHI only for those purposes necessary to perform functions, activities, or services for, or on behalf of, ADHS Covered Component as specified in the underlying Service Agreement(s) and this Agreement, provided that any Use or Disclosure would not violate: the Privacy Standards, the Security Standards, or HIPAA, if done by ADHS Covered Component; or ADHS Covered Component’s policies and procedures for using or disclosing only the Minimum Necessary PHI.

2.1. Business Activities of Business Associate. Business Associate may use PHI for the necessary management and administration of Business Associate, or to carry out the legal responsibilities of Business Associate if:

2.1.1. The disclosure is Required by Law; or

2.1.2. Business Associate obtains reasonable assurances from the person receiving the PHI that the person will:

2.1.2.1. Maintain the Confidentiality of the PHI,

2.1.2.2. Use or disclose the PHI only as Required by Law or for the purpose for which the PHI was disclosed to the person, and

2.1.2.3. Notify Business Associate when the person becomes aware that PHI confidentiality has been breached.

2.2. Aggregation of PHI. Business Associate may aggregate the PHI in its possession with the PHI of other

Covered Entities that Business Associate has in its possession through its capacity as a Business Associate of the other Covered Entities, provided that the purpose of the aggregation is to provide ADHS Covered Component with data analyses relating to the Health Care Operations of ADHS Covered Component.

Business Associate shall not disclose PHI between or among Covered entities, unless ADHS Covered Component specifically authorizes the disclosure.

2.3. De-Identification of PHI. Under 45 CFR 164.502(d)(2), de-identified information does not constitute PHI and is not subject to the terms of this Agreement. Business Associate may de-identify any and all PHI, provided:

2.3.1. The de-identification conforms to the requirements of 45 CFR Section 164.514(b),

2.3.2. Business Associate maintains the documentation required by 45 CFR Section 164.514(b), and

2.3.3. Business Associate gives written assurance to ADHS Covered Component that Business

Associate appropriately maintains the documentation required by 45 CFR Section 164.514(b).

3. OBLIGATIONS OF BUSINESS ASSOCIATE REGARDING PHI IN ANY FORM.

3.1. Safeguards. Business Associate shall use appropriate safeguards to prevent any Use or Disclosure of PHI not otherwise permitted in this Agreement.

3.2. Reporting Impermissible Use or Disclosure. Recipient shall promptly report to the designated individual specified in the Notice Provision number “G” of this agreement. Any Use or Disclosure of any PHI not permitted by this Agreement or the Privacy Standards (“Impermissible Use or Disclosure”), upon becoming aware of such Use or Disclosure. Recipient agrees to mitigate, to the extent practicable, any harmful effect from an Impermissible Use or Disclosure known to Recipient or its agents or subcontractors.

3.3. Agents and Subcontractors. Business Associate shall ensure that any agent or subcontractor to whom

Business Associate provides PHI agrees to all the PHI-related restrictions and conditions that apply to Business Associate through this Agreement. Business Associate shall maintain an accounting of all disclosures of PHI to agents or subcontractors as provided in this Agreement.

3.4. Personnel. Business Associate shall appropriately inform all of its employees, agents, representatives, and members of its workforce (“Personnel”), whose services may be used to satisfy Business Associate’s obligations under this Agreement and the Service Agreement(s), of the terms of this Agreement. Business Associate represents and warrants that the Personnel are under sufficient legal obligation to Business Associate for Business Associate to fully comply with the provisions of this Agreement.

3.5. Access to PHI. Within five (5) business days after a written request by ADHS Covered Component for access to PHI held by Business Associate in a Designated Record Set, Business Associate shall make the requested PHI available to ADHS Covered Component. If the requested PHI is stored off site, Business Associate shall make the PHI available to ADHS Covered Component within ten (10) business days, to allow ADHS Covered Component time to respond to a request for access by an Individual within 60 calendar days.

If an Individual requests access to PHI directly from Business Associate, Business Associate shall provide or deny access according to 45 CFR 164.524, unless otherwise directed by ADHS Covered Component.

Business Associate shall notify ADHS Covered Component of the action taken in writing within five (5) business days after the action.

3.6. Amendment of PHI. Within five (5) business days after an Individual’s request to ADHS Covered

Component to amend the Individual’s PHI held by Business Associate in a Designated Record Set, Business Associate shall provide the Individual’s PHI to ADHS Covered Component for amendment. If ADHS Covered Component requests Business Associate to amend an Individual’s PHI, Business Associate shall incorporate into the Individual’s PHI the amendment, any statements of disagreement, and/or rebuttals within a reasonable time, as required by 45 CFR Section 164.526.

If an Individual requests amendment of PHI directly from Business Associate, Business Associate shall amend or deny amendment according to 45 CFR 164.526, unless otherwise directed by ADHS Covered Component. Business Associate shall notify ADHS Covered Component of the action taken in writing within five (5) business days after the action.

3.7. Documentation of Disclosures. Business Associate agrees to document all Disclosures of PHI made by

Business Associate as required for ADHS Covered Component to respond to a request by an Individual for an accounting of Disclosures of PHI according to 45 CFR Section 164.528. At a minimum, the documentation related to Business Associate’s Disclosure of PHI shall include:

3.7.1. The date of Disclosure;

3.7.2. The name of the PHI recipient and, if known, the address of the PHI recipient;

3.7.3. A brief description of the PHI disclosed; and

3.7.4. A brief statement of the purpose of the disclosure that reasonably informs the Individual of the basis for the Disclosure, or a copy of the Individual’s authorization, or a copy of the written request for Disclosure.

3.8. Accounting of Disclosures. Within ten (10) business days after notice by ADHS Covered Component to

Business Associate that ADHS Covered Component has received a request for an accounting of Disclosures of an Individual’s PHI, Business Associate shall provide ADHS Covered Component with the Disclosure records stated in the notice. Business Associate shall provide Disclosure records for the six years before the date on which the Individual requested the accounting, but not for a date earlier than April 14, 2003, unless otherwise Required by Law.

If an Individual requests an accounting of Disclosures directly from Business Associate, Business Associate shall, within sixty (60) business days, provide or deny an accounting according to 45 CFR 164.528, unless otherwise directed by ADHS Covered Component. Business Associate shall notify ADHS Covered Component of the action taken in writing within five (5) business days after the action. The accounting of Disclosures shall include all PHI Disclosures for the six years before the date on which the Individual requested the accounting, but not for a date earlier than April 14, 2003, unless otherwise Required by Law.

If Business Associate is unable to provide the accounting of Disclosures within the allowed time, Business Associate shall provide ADHS Covered Component with a written statement of the reason for delay and the date Business Associate will provide the accounting.

3.9. Governmental Access to Records. For the purpose of determining ADHS Covered Component’s compliance with the Privacy Standards, Business Associate shall make available to ADHS Covered Component or to the Secretary:

3.9.1. Business Associate’s internal practices, books, and records relating to the Use and Disclosure of

PHI;

3.9.2. Business Associate’s policies and procedures relating to the Use and Disclosure of PHI; and

3.9.3. All PHI received from ADHS Covered Component or created or received by Business Associate on behalf of ADHS Covered Component.

This provision does not constitute a waiver by ADHS Covered Component of any attorney-client privilege or other legal privilege.

3.10. Transaction Standards Regulation. If Business Associate conducts in whole or part Standard

Transactions for or on behalf of ADHS Covered Component, Business Associate shall comply with the Electronic Data Transaction Standards and Code Sets, 45 CFR Part 162, Subparts I through R (“Transaction Standards and Code Sets”). Business Associate shall require any subcontractor or agent involved in conducting Standard Transactions for or on behalf of ADHS Covered Component, to comply with the Transaction Standards and Code Sets. Business Associate and its subcontractors or agents shall not enter into any agreement related to conducting in whole or in part Standard Transactions for or on behalf of ADHS Covered Component that:

3.10.1. Changes the definition, Data Condition, or use of a Data Element or Segment in a Standard

Transaction;

3.10.2. Adds any Data Elements or Segments to the maximum defined Data Set;

3.10.3. Uses any code or Data Element that is marked “not used” in the Standard Transaction’s implementation specification or that is not in the Standard Transaction’s implementation specification; or

3.10.4. Changes the meaning or intent of the Standard Transaction’s implementation specification.

4. OBLIGATIONS OF BUSINESS ASSOCIATE REGARDING ePHI.

4.1. Safeguards. Business Associate shall implement Administrative, Physical, and Technical Safeguards that reasonably and appropriately protect the Confidentiality, Integrity, and Availability of the ePHI that Business Associate creates, receives, maintains, or transmits on behalf of ADHS Covered Component.

4.2. Agents and Subcontractors. Business Associate shall ensure that any agent or subcontractor to whom

Business Associate provides ePHI agrees to implement reasonable and appropriate safeguards to protect the Confidentiality, Integrity, and Availability of the ePHI.

4.3. Report of Security Incident. Business Associate shall promptly report to ADHS Covered Component any

Security Incident of which Business Associate becomes aware that involves ePHI created, received, maintained, or transmitted by Business Associate.

4.4. Governmental Access to Records. Business Associate shall make its policies, procedures, and the documentation required by the Security Standards available to ADHS Covered Component and to the Secretary for purposes of determining ADHS Covered Component’s compliance.

4.5. Termination Authorized. Business Associate agrees that ADHS Covered Component may terminate this

Agreement if ADHS Covered Component determines that Business Associate has violated a material term of this Agreement related to the Security of ePHI.

5. OBLIGATIONS OF ADHS COVERED COMPONENT.

5.1. Notice of Privacy Practices. ADHS Covered Component shall notify Business Associate of any changes or limitation(s) in ADHS Covered Component’s Notice of Privacy Practices according to 45 CFR Section 164.520, to the extent that such changes or limitation(s) may affect Business Associate’s Use or Disclosure of PHI.

5.2. Changes in Permission by Individual. ADHS Covered Component shall notify Business Associate of any changes in, or revocation of, an Individual’s permission to use or disclose PHI, to the extent that such changes may affect Business Associate’s Use or Disclosure of PHI.

5.3. Restrictions on PHI. ADHS Covered Component shall notify Business Associate of any restriction of PHI

Uses and Disclosures that ADHS Covered Component has agreed to in accordance with 45 CFR Section 164.522, to the extent that such restriction may affect Business Associate’s PHI Use or Disclosure.

5.4. Permissible Requests by ADHS Covered Component. ADHS Covered Component shall not request

Business Associate to use or disclose PHI in any manner not permitted under the Privacy Standards if done by ADHS Covered Component.

6. TERM AND TERMINATION:

6.1. Term. The term of this Agreement shall begin on the Effective Date and shall terminate when all PHI provided by ADHS Covered Component to Business Associate, or created or received by Business Associate on behalf of ADHS Covered Component, is destroyed or returned to ADHS Covered Component.

If it is not feasible for Business Associate to return or destroy all PHI, the term of this Agreement shall terminate, except to the extent protections are extended to any PHI not returned or destroyed, according to the provisions in Section F(2)(c).

6.2. Effect of Termination.

6.2.1. Except as provided in paragraph (c) of this Subsection, upon termination of this Agreement, for any reason, Business Associate shall return or destroy all PHI received from ADHS Covered Component, or created or received by Business Associate on behalf of ADHS Covered Component.

6.2.2. This provision shall apply to PHI in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the returned or destroyed PHI.

6.2.3. If Business Associate determines that returning or destroying PHI is not feasible, Business

Associate shall provide to ADHS Covered Component notification of the conditions making return or destruction not feasible. Business Associate shall extend the protections of this Agreement to the PHI and shall limit further Uses and Disclosures of the PHI to the purposes that make the return or destruction not feasible, for so long as Business Associate maintains the PHI. If it is not feasible for Business Associate to recover from a subcontractor or agent any PHI, Business Associate shall provide a written explanation to ADHS Covered Component. Business Associate shall require the subcontractor or agent to agree:

6.2.3.1. To extend the protections of this Agreement to the PHI in the possession of the subcontractor or agent, and

6.2.3.2. To limit any further Uses or Disclosures of the PHI to the purposes that make the return or destruction not feasible, for so long as the subcontractor or agent maintains the PHI.

6.2.4. Termination for Cause. Upon ADHS Covered Component’s knowledge of a material breach by

Business Associate of the terms of this Agreement, ADHS Covered Component shall:

6.2.4.1. Terminate this Agreement and the underlying Service Agreement(s) if Business Associate does not cure the breach or end the violation within the time specified by ADHS Covered Component;

6.2.4.2. Immediately terminate this Agreement and the underlying Service Agreement(s); or

6.2.4.3. Report the violation to the Secretary if:

6.2.4.3.1. Termination is not feasible, and

6.2.4.3.2. Business Associate does not cure the breach or end the violation within the time specified by ADHS Covered Component.

7. NOTICES:

All notices or other communications by either party to the other hereunder shall be in writing and shall be deemed properly delivered (i) when received by the party; or (ii) three (3) days after deposit in the United States mail of such notice or communications to the parties entitled hereto, registered or certified mail, postage prepaid, to the parties at the following address (or to such other addresses as are designated in writing to all parties):

To: Chief Procurement Officer Copy to: Chief Operating Officer Arizona Department of Health Services Arizona Department of Health Services Office of Procurement Arizona State Hospital 150 North 18th Avenue, Suite 530 2500 East Van Buren Street Phoenix, Arizona 85007 Phoenix, Arizona 85008 Phone Number: (602) 364-2116 Phone Number: (602) 220-6006

To: ________________________________________________

Attn: ________________________________________________

Address: ________________________________________________

Phone: ________________________________________________

8. MISCELLANEOUS:

8.1. References. A reference in this Agreement to HIPAA, the Privacy Standards, or the Security Standards means the law or regulation as in effect on the Effective Date or as subsequently amended, and for which compliance is required.

8.2. Amendment. The parties agree to take the action necessary to amend this Agreement from time to time so that ADHS Covered Component may comply with the requirements of HIPAA.

8.3. Survival. The obligations of Business Associate under this Agreement shall survive the termination of this Agreement and of the underlying Service Agreement(s) to the extent required by Section F(2)(c).

8.4. Effect on Service Agreement(s). Except as specifically required to implement the purposes of this

Agreement, or to the extent not consistent with this Agreement, all provisions of the underlying Service Agreement(s) shall remain in force and effect.

Rob Ryan

Rob Ryan

1005 N Stadem Dr Tempe, AZ 85288

602-326-0431

Contractor hereby acknowledges receipt and acceptance The above referenced HIPAA Agreement is hereby of this HIPAA Agreement and that a signed copy must executed this day of 20___ by the be filed with the Procurement Office. Arizona Department of Health Services.

Signature Date: Chief Procurement Officer

Authorized signatory’s name and title:

Contractor’s Name:

Truly Nolen of America, Inc

Rob Ryan - Account Manager