250012_Business_Associate_Agreement.pdf

Business Associate Agreement Between

The City of Tucson and_________________________________

This Agreement is entered into between the City of Tucson (hereinafter “Covered Entity”) and________________________________ (hereinafter “Business Associate”).

This Agreement is incorporated into all existing and current contract(s) between the parties (the “Underlying Contract(s)”) under which Business Associate is carrying out activities or functions involving the use of protected health information (PHI), as this term is defined in 45 CFR Parts 160 and 164, and it replaces any prior agreement(s) entered concerning such PHI. Business Associates must comply with all requirements for protecting PHI under federal Privacy and Information Security regulations and are subject to the application of civil and criminal penalties under sections 1176 and 1177 of the Social Security Act. Covered Entity is committed to providing high quality patient care, education, and research. In furtherance of its mission, Covered Entity wishes to conduct transactions involving the disclosure of PHI to Business Associate for the purpose of conducting the activities set forth in the Underlying Contract(s).

Some or all of the information to be disclosed is required by law to be protected against unauthorized use, disclosure, modification or loss. In order to comply with applicable legal requirements for the protection of information, the parties agree as follows:

A. ALLOWABLE USES OF PHI

Only the minimum necessary PHI to accomplish the intended purpose of this agreement can be used or disclosed only for the following purposes:

1.

2.

3. __________________________________________________________

B. OBLIGATIONS OF BUSINESS ASSOCIATE

Section 1. Safeguarding Information.

A. Business Associate shall only use, store, disclose, or access PHI:

(1) In accordance with, and only to the extent permissible under the Underlying Contract; and

(2) In full compliance with any and all applicable laws, regulations, rules or standards, including, but without limitation, FERPA, HIPAA, the Gramm- Leach-Bliley Financial Services Modernization Act (GLB), the Federal Trade Commission Identity Theft Rules, the Export Administration Regulations (EAR), the International Traffic in Arms Regulations (ITAR), and the Social Security Act, RCW 19.255.010 and RCW 42.56.590.

B. Business Associate shall have in place policies and procedures to implement and maintain all safeguards necessary to ensure the confidentiality, availability, and integrity of all Covered Entity data. Such safeguards shall include as appropriate, and without limitation, use of: policies and procedures to prevent any unauthorized use or disclosure of, or access to, PHI; restrictions on administrative access to PHI;

system firewalls, secure network and transfer protocols such as Secure Socket Shell (SSH), Secure Copy Protocol (SCP), Hyper-Text Transfer Protocol over Secure Sockets Layer (HTTPS), or Internet Protocol Security (IPSec); industry compliant network authentication protocols such as Kerberos or Lightweight Directory Access Protocol (LDAP); encryption; regular and timely system upgrades, including implementation of security patches; disk quotas to ensure system availability;

logging in accordance with City of Tucson specifications, maintenance of logs on centralized servers; and backup systems for disaster recovery, security, and forensics purposes.

C. Business Associate shall have in place policies and procedures to detect patterns, practices, or specific activities that indicate the possible existence of identity theft (The Federal Trade Commission has regulations known as the Red Flag Rules which are part of the Fair and Accurate Credit Transactions (FACT) Act of 2003) that may arise in the performance of Business Associate’s activities and shall:

(1) Report all Red Flags to Covered Entity at the address provided for reporting unauthorized use or disclosure of PHI in Section 3; and

(2) Take prompt steps to prevent or mitigate possible identity theft when Red Flags are detected.

Section 2. Use or disclosure of Protected Health Information.

Business Associate shall not use or disclose PHI received from Covered Entity in any manner that would constitute a violation of federal law, including but not limited to the Health Insurance Portability and Accountability Act of 1996 and any regulations enacted pursuant to its provisions (“HIPAA Standards”), or applicable provisions of Arizona state law..

Business Associate shall ensure that any use or disclosure by its directors, officers, employees, contractors, and agents of PHI received from Covered Entity, or created or received on behalf of Covered Entity is in accordance with the provisions of this Agreement and applicable federal and state law. Business Associate shall not use or disclose PHI in any manner other than that permitted or required by the Covered Entity for the purpose of accomplishing services to or on behalf of Covered Entity in accordance with the Underlying Contracts. Notwithstanding the foregoing, Business Associate may use PHI for the proper management and administration of the Business Associate and to carry out its legal responsibilities.

Section 3. Reporting of Unauthorized Use or Disclosure of PHI.

Business Associate shall, within five (5) working days of becoming aware of an unauthorized use or disclosure of PHI by Business Associate, its officers, directors, employees, contractors, agents or by a third party to which Business Associate disclosed PHI, report any such disclosure to Covered Entity. Such notice shall be made to the following:

The City Attorney City of Tucson 255 West Alameda Street Tucson, AZ 85701

Section 4. Agreements by Third Parties.

Business Associate shall obtain satisfactory assurances from any agent or subcontractor who will have access to PHI that is received from Covered Entity, or created or received on behalf of the Covered Entity, and shall ensure that the agent or subcontractor agrees to be bound by the same restrictions, terms and conditions that apply to Business Associate through this Agreement with respect to PHI. Business Associate shall require that any agent or subcontractor notify Business Associate of any instances in which PHI is used or disclosed in an unauthorized manner. Business Associate agrees to notify Covered Entity of any such unauthorized use or disclosure. Business Associate shall take steps to cure the breach of confidentiality and end the violation, or shall terminate the agency agreement or subcontract.

Section 5. Access to Information.

If Business Associates maintains Designated Record Set (DRS) documentation on behalf of Covered Entity, Business Associate agrees to provide access to the documentation maintained by the Covered Entity. Business Associate shall make available to Covered Entity such information for so long as it is maintained. If any individual requests access to PHI directly from Business Associate, Business Associate shall forward such request to the Covered Entity. Business Associate shall not deny any individual's request for access to the individual's PHI. A denial of access to PHI requested is the responsibility of the Covered Entity.

Section 6. Availability of PHI for Amendment.

Within five days of a request from Covered Entity for the amendment of an individual’s PHI or a record regarding an individual contained in a DRS (for so long as the PHI is maintained in the DRS), Business Associate shall provide such information to Covered Entity for amendment and incorporate any such amendments in the PHI as required by 45 C.F.R.

§164.526.

Section 7. Accounting of Disclosures.

Business Associate agrees to implement an appropriate record keeping and reporting process to enable it to provide the following information regarding disclosures of PHI: (i) the date of the disclosure, (ii) the name of the entity or person who received the PHI, and if known, the address of such entity or person, (iii) a brief description of the PHI disclosed, and (iv) a brief statement of the purpose of such disclosure which includes an explanation of the basis for such disclosure. If Business Associate receives a request for an accounting of disclosures, Business Associate shall forward such request to Covered Entity within a reasonable time frame to allow Covered Entity to prepare and deliver any required accounting of disclosures.

Section 8. Restrictions on Certain Disclosure of Health Information.

Business Associate agrees to restrict the disclosure of the protected health information of an individual, if Covered Entity agrees to a requested restriction by an individual. If Business Associate receives a request for a restriction, Business Associate shall forward such request to Covered Entity within five business days to allow Covered Entity to respond to the requested restriction.

Section 9. Availability of Books and Records.

Business Associate agrees to make its internal practices, books and records relating to the use and disclosure of PHI received from Covered Entity, or created or received on behalf of Covered Entity, available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining Covered Entity’s and Business Associate’s compliance with the HIPAA Standards. Business Associate shall provide to Covered Entity a copy of any documentation that Business Associate provides to the Secretary within five business days.

Section 10. Return or Destruction of Information.

At the termination of the Underlying Contract(s), Business Associate shall return or destroy all PHI received from Covered Entity, or created or received on behalf of Covered Entity, that Business Associate maintains in any form. Business Associate will retain no copies of PHI. If Business Associate determines that return or destruction of any PHI is not feasible, Business Associate shall notify Covered Entity of the reasons why return or destruction is not feasible. If destruction or return of PHI is not feasible, Business Associate shall not use PHI received from Covered Entity, or created or received on behalf of Covered Entity, in a manner other than those permitted or required by state and federal laws or for the purposes described herein.

Section 11. Electronic Protected Health Information (“ePHI”).

If Business Associate creates, receives, maintains or transmits ePHI on behalf of Covered Entity, Business Associate agrees to (1) implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Covered Entity’s ePHI in accordance with Sections 164.308, 164.310, 164.312, and 164.316 of title 45, Code of Federal Regulations; (2) ensure that any third party agent or subcontractor who receives Covered Entity’s ePHI from Business Associate agrees to implement equivalent administrative, physical and technical safeguards; and (3) deploy appropriate safeguards to implement the Secretary of Health and Human Services’ annual guidance on the most effective and appropriate technical safeguards for use in carrying out security standards; and (4) report any security incidents involving Covered Entity’s ePHI within five business days of discovery.

Section 12. Potential Breach of PHI.

A. If Business Associate has reason to believe that personal information or PHI transmitted pursuant to this Agreement may have been accessed, disclosed, or acquired without proper authorization, Business Associate will, within five business days of discovery, give City of Tucson notice and take actions as may be necessary to preserve forensic evidence and to identify, mitigate and remediate the cause of the breach. A breach shall be treated as discovered by the BA as of the first day on which such breach is known to the BA, (including any person, other than the individual committing the breach, that is an employee, officer, or other agent of the BA) or should reasonably have been known to the BA (or person referenced above) to have occurred. Business Associate shall give highest priority to immediately mitigate and remediate any unauthorized access and shall devote such resources as may be required to accomplish that goal. The BA shall cooperate with all Covered Entity efforts, including providing any and all information necessary to enable Covered Entity to fully understand the nature and scope of the unauthorized access, including but not limited to identification of each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed during the breach.

B. To the extent City of Tucson deems warranted, City of Tucson may provide notice or may require Business Associate to provide notice to any or all individuals affected by any unauthorized access, whose personal and/or PHI may have been improperly accessed or disclosed that was not protected according to the Secretary of Health and Human Services’ annual guidance on the most effective and appropriate technical safeguards for use in carrying out security standards. In such case, Business Associate shall consult with Covered Entity regarding appropriate steps required to notify third parties. In the event that the Business Associate’s assistance is required to reinstall software, such assistance shall be provided at no cost to Covered Entity and in accordance with the Covered Entity’s policies and standards. Business Associate must coordinate with City of Tucson any public notification to any individual, media outlet, or the Secretary of Health and Human Services.

If City of Tucson determines that notification is required, the BA shall pay the full costs of notice to impacted individuals, including the costs to retain an outside consulting firm to undertake the notification effort and will supply City of Tucson Compliance with the following information to make such notification:

(1) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known.

(2) A description of the types of unsecured protected health information that were involved in the breach (such as full name, Social Security number, date of birth, home address, account number, or disability code).

(3) A brief description of what the BA is doing to investigate the breach, to mitigate losses, and to protect against any further breaches.

C. Business Associate shall indemnify, hold harmless, and defend City of Tucson from and against any penalties, claims, actions, loss, liability, damage, costs, or expenses, including but not limited to reasonable attorneys’ fees, system remediation, or forensic analysis, arising from or pertaining to a breach of this agreement, the violation of any state or federal law applicable to the use, disclosure or protection of personal information or PHI, and the unauthorized access to PHI.

The indemnification provided hereunder includes the full costs of notice to impacted individuals, including the costs to retain an outside consulting firm to undertake the notification effort.

D. City of Tucson has the right, at any time, to monitor, audit, and review activities and methods in implementing this Agreement in order to assure compliance therewith, within the limits of Business Associate’s technical capabilities.

C. Miscellaneous.

Section 13. Termination.

Notwithstanding any provision to the contrary in the Underlying Contract(s), Covered Entity may terminate its participation in the Underlying Contract(s) immediately upon written notice to Business Associate without liability for such termination, in the event that Covered Entity determines that Business Associate has violated a material provision of this Agreement.

Section 14. Third Party Beneficiaries.

Nothing in this Addendum is intended to create any third party beneficiaries.

Section 15. Definitions.

Personal Information means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:

(a) Social security number;

(b) Driver's license number or Arizona identification card number; or

(c) Account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account.

Breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the agency.

All terms not otherwise defined herein shall be defined in accordance with 45 CFR Parts 160 and 164.

Signature Position Date

Signature Position Date