3-Business Associate Agreement.pdf

BUSINESS ASSOCIATE AGREEMENT

RECITALS

The purpose of this Business Associate Agreement (“BAA”) is to comply with the requirements of the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 (codified at 45 C.F.R. Parts 160 and 164), as amended (“HIPAA”); privacy and security regulations promulgated by the United States Department of Health and Human Services (“DHHS”); Title XIII, Subtitle D of the American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5, as amended (“HITECH Act”); provisions regarding Confidentiality of Alcohol and Drug Abuse Patient Records (codified at 42 C.F.R. Part 2), as amended; and TEX. HEALTH & SAFETY CODE ANN. §§ 81.046, as amended, 181.001 et seq., as amended, 241.151 et seq., as amended, and

611.001 et seq., as amended (collectively referred to herein as the “Privacy and Security Requirements”).

TERMS

Contractor’s RESPONSIBILITIES REGARDING USE AND DISCLOSURE OF

PROTECTED HEALTH INFORMATION (“PHI”) AND ELECTRONIC PROTECTED

HEALTH INFORMATION (“EPHI”)

A. Definitions.

1. Confidential Information is information that has been deemed or designated confidential by law (i.e., constitutional, statutory, regulatory, or by judicial decision).

2. Protected Health Information (“PHI”) is defined in 45 C.F.R. § 160.103 and is limited to information created or received by Contractor from or on behalf of the Department or Board.

3. Electronic Protected Health Information (“EPHI”) shall mean individually identifiable health information that is transmitted by or maintained in electronic media.

4. Security Incident shall mean the unauthorized access, use, disclosure, modification, or destruction of Confidential Information, including, but not limited to, PHI and EPHI, or interference with the systems operations in an information system, including, but not limited to, information systems containing EPHI. This definition includes, but is not limited to, lost or stolen transportable media devices (e.g., flash drives, CDs, PDAs, cell phones, and cameras), desktop and laptop computers, photographs, and paper files containing Confidential Information, including, but not limited to, PHI and EPHI.

B. General.

1. Contractor agrees to hold all PHI and EPHI confidential except to the extent that disclosure is required by Federal or State law, including the Texas Public Information Act, TEX. GOV’T CODE ANN. §§ 552.001 et seq., as amended.

2. Contractor agrees to be bound by and comply with all applicable Federal and State of Texas licensing authorities’ laws, rules, and regulations regarding records and governmental records, including the Privacy and Security Requirements.

Compliance with this paragraph is at Contractor’s own expense.

3. Contractor agrees to cooperate with state and federal agencies and to make appropriate personnel available for interviews, consultation, grand jury proceedings, pre-trial conferences, hearings, trials, and any other process, including investigations, required as a result of Contractor’s services to the Department or Board. Compliance with this paragraph is at Contractor’s own expense.

4. The terms used in this BAA shall have the same meaning as those terms in the

Privacy and Security Requirements.

C. Representation. Contractor represents that it is familiar with and is in compliance with the

Privacy and Security Requirements, which include Federal and State of Texas requirements governing information relating to HIV/AIDS, mental health, and drugs or alcohol treatment or referral.

D. Business Associate. Contractor is a “Business Associate” of the Department or Board as that term is defined under the Privacy and Security Requirements.

1. Nondisclosure of PHI. Contractor agrees not to use or disclose PHI received from or on behalf of the Department or Board or created, compiled, or used by Contractor pursuant to this Agreement other than as permitted or required by this BAA, or as otherwise required by law.

2. Limitation on Further Use or Disclosure. Contractor agrees not to further use or disclose PHI or EPHI received from or on behalf of the Department or Board or created, compiled, or used by Contractor pursuant to this BAA in a manner that would be prohibited by the Privacy and Security Requirements if disclosure was made by the Department or Board, or if either Contractor or the Department or Board is otherwise prohibited from making such disclosure by any present or future State or Federal law, regulation, or rule.

3. Safeguarding PHI. Contractor agrees to use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this BAA or as required by State or Federal law, regulation, or rule.

4. Safeguarding EPHI. Contractor agrees to implement and use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of EPHI that it creates, receives, maintains, or transmits on behalf of the Department or Board. These safeguards shall include the following:

a) Encryption of EPHI that Contractor stores and transmits;

b) Implementation of strong access controls, including physical locks, firewalls, and strong passwords;

c) Use of updated antivirus software;

d) Adoption of contingency planning policies and procedures, including data backup and disaster recovery plans; and

e) Conduct of periodic security training.

5. Reporting Security Incidents. Contractor agrees to report to the Department or

Board any Security Incident immediately upon becoming aware of such.

Contractor further agrees to provide the Department or Board with the following information regarding the Security Incident as soon as possible, but no more than five (5) business days after becoming aware of the Security Incident: (1) a brief description of what happened, including the dates the Security Incident occurred and was discovered; (2) a reproduction of the PHI or EPHI involved in the Security Incident; and (3) a description of whether and how the PHI or EPHI involved in the Security Incident was rendered unusable, unreadable, or indecipherable to unauthorized individuals either by encryption or otherwise destroying the PHI or EPHI prior to disposal. If Contractor determines that it is infeasible to reproduce the PHI or EPHI involved in the Security Incident, the Contractor agrees to notify the Department or Board in writing of the conditions that make reproduction infeasible and any information the Contractor has regarding the PHI or EPHI involved.

Contractor agrees to cooperate in a timely fashion with the Department or Board regarding all Security Incidents reported to the Department or Board.

Contractor agrees that the Department or Board will review all Security Incidents reported by Contractor and the Department or Board, in its sole discretion, will take the following steps in response, to the extent necessary or required by law, including, but not limited to, (1) notifying the individual(s) whose PHI or EPHI was involved in the Security Incident, either in writing, via telephone, through the media, or by posting a notice on the Department or Board’s website, or through a combination of those methods, of the Security Incident; (2) providing the individual(s) whose PHI or EPHI was involved in the Security Incident with credit monitoring services for a period of time to be determined by the Department or Board, at no cost to the individuals; and (3) providing notice of the Security

Incident, as required by law, to the Secretary of the United States Department of Health and Human Services (“HHS”).

Contractor agrees to reimburse the Department or Board for all expenses incurred as a result of Contractor’s Security Incidents, including, but not limited to, expenses related to the activities described above. Contractor agrees that the Department or Board will select the Contractors and negotiate the contracts related to said expenses.

6. EPHI and Subcontractors. Contractor shall require any agent to whom it provides PHI or EPHI, including a subcontractor, to agree to implement reasonable and appropriate safeguards to protect such PHI or EPHI. Further, Contractor agrees to give the Department or Board at least sixty (60) days advance notice of its intent to provide PHI or EPHI to an agent located outside of the United States.

7. Subcontractors and Agents. Contractor shall require any subcontractor or agent to whom Contractor provides PHI or EPHI received from or on behalf of the Department or Board or created, compiled, or used by Contractor pursuant to this BAA, to agree to the same restrictions and conditions that apply to Contractor with respect to such PHI and EPHI.

8. Reciprocal Disclosures. The Parties agree that the Parties may reciprocally disclose and use PHI or EPHI for initial and continuing eligibility and compliance determinations related to the provision of benefits, for auditing and legal compliance purposes, and for compliance with laws, regulations, and rules related to the provision of medical or drug benefits to persons who may be eligible for such benefits under the Medicare Prescription Drug Benefit Program, Part D, or other federal or State of Texas programs. The Department or Board agrees:

a) to be bound by these provisions with regard to PHI or EPHI received from

Contractor;

b) to restrict access to such PHI or EPHI to the Department or Board’s Chief

Financial Office, the Department or Board’s Controller, the Department or Board’s Compliance Officer, the Harris Department or Board Attorney’s Office, and designated employees of the Department or Board’s Benefits Department for legal and auditing services; and

c) to take disciplinary action against any employee whose willful act violates these provisions and results in an unlawful disclosure of PHI or EPHI.

9. Mitigation. Contractor agrees to mitigate, to the extent practicable, any harmful effect that is known to Contractor of a use or disclosure of PHI or EPHI by Contractor, or by a subcontractor or agent of Contractor, resulting from a violation of this BAA, including violations of the Privacy and Security Requirements stated herein. Contractor also agrees to inform the Department or Board in advance of its actual mitigation and of the details of its mitigation plan, unless doing so would cause additional harm.

10. Notice – Access by Individual. Contractor agrees to notify the Department or Board in writing within three (3) business days of any request by an individual for access to the individual’s PHI or EPHI and, upon receipt of such request, direct the individual to contact the Department or Board to obtain access to the individual’s PHI. Upon request by the Department or Board, Contractor agrees to make available PHI and EPHI to the Department or Board or, as directed by the Department or Board, to an individual in accordance with 45 C.F.R. § 164.524.

11. Notice – Request for Amendment. Contractor agrees to notify the Department or

Board in writing within three (3) business days of any request by an individual for an amendment to the individual’s PHI or EPHI and, upon receipt of such request from the individual, direct the individual to the Department or Board to request an amendment of the individual’s PHI or EPHI. Contractor agrees to make available upon request PHI and EPHI for amendment and to incorporate any amendments to PHI and EPHI agreed to or directed by the Department or Board in accordance with 45 C.F.R. § 164.526.

12. Notice – Request for Accounting. Upon receipt of any request from an individual for an accounting of disclosures made of the individual’s PHI or EPHI, Contractor agrees to notify the Department or Board in writing within three (3) business days of any such request, and upon receipt of such request from the individual, direct the individual to the Department or Board for an accounting of the disclosures of the individual’s PHI or EPHI. Contractor agrees to make available upon request the information required to provide an accounting of disclosures in accordance with 45 C.F.R. § 164.528. Pursuant to 45 C.F.R. § 164.528(a), an individual has a right to receive an accounting of certain disclosures of PHI or EPHI in the six (6) years prior to the date on which the accounting is requested.

13. HHS Inspection. Upon written request, Contractor agrees to make available to HHS or its designee, Contractor’s internal practices, books, and records relating to the use and disclosure of PHI and EPHI received from, or created or received on behalf of, the Department or Board in a time or manner designated by HHS for purposes of HHS determining the Department or Board’s compliance with the Privacy and Security Requirements.

14. Department or Board Inspection. Upon written request, Contractor agrees to make available to the Department or Board and its duly authorized representatives during normal business hours Contractor's internal practices, books, records and documents relating to the use and disclosure of confidential information, including, but not limited to, PHI and EPHI received from, or created or received on behalf of, the Department or Board in a time and manner designated by the Department or Board for the purposes of the Department or Board determining compliance with the Privacy and Security

Requirements. Contractor agrees to allow such access until the expiration of four

(4) years after the services are furnished under the contract or subcontract or until the completion of any audit or audit period, whichever is later. Contractor agrees to allow similar access to books, records, and documents related to contracts between Contractor and organizations related to or subcontracted by Contractor to whom Contractor provides confidential information, including, but not limited to, PHI and EPHI received from, or created or received on behalf of, the Department or Board.

15. PHI or EPHI Amendment. Contractor agrees to incorporate any amendments, corrections, or additions to the PHI or EPHI received from or created, compiled, or used by the Department or Board pursuant to this BAA when notified by the Department or Board that the PHI or EPHI is inaccurate or incomplete, or that other documents are to be added as required or allowed by the Privacy and Security Requirements.

16. Documentation of Disclosures. Contractor agrees to document disclosure of PHI or

EPHI and information related to such disclosures as is necessary for the Department or Board to respond to a request by an individual for an accounting of disclosures of PHI or EPHI in accordance with 45 C.F.R. § 164.528, as amended.

17. Termination Procedures. Upon termination of this BAA for any reason, Contractor agrees to deliver all PHI or EPHI received from the Department or Board or created, compiled, or used by Contractor pursuant to this BAA within thirty (30) days from the date of termination, or, if specially requested to do so by the Department or Board in writing, to destroy all PHI or EPHI within the time frame determined by the Department or Board, which will be no less than thirty (30) days from the date of the notice of termination. This provision applies when Contractor maintains PHI or EPHI from the Department or Board in any form. If Contractor determines that transferring or destroying the PHI or EPHI is infeasible, Contractor agrees:

a) to notify the Department or Board of the conditions that make transfer or destruction infeasible;

b) to extend the protections of this BAA to such PHI or EPHI; and

c) to limit any further uses and disclosures of such PHI or EPHI to those purposes that make the return, or transfer to the Department or Board, or destruction infeasible.

18. Notice-Termination. Upon written notice to Contractor, the Department or Board may terminate any portion of the Agreement under which Contractor maintains, compiles, or has access to PHI or EPHI. Additionally, upon written notice to Contractor, the Department or Board may terminate the entire Agreement if the Department or Board determines, at its sole discretion, that Contractor has repeatedly violated a Privacy or Security Requirement.

E. Survival of Privacy Provisions. Contractor’s obligations with regard to PHI and EPHI shall survive termination of this BAA and the Agreement.

F. Amendment Related to Privacy and Security Requirements. The Parties agree to take such action as is necessary to amend this BAA if the Department or Board, in its reasonable discretion, determines that amendment is necessary for the Department or Board to comply with the Privacy and Security Requirements or any other law or regulation affecting the use or disclosure of PHI or EPHI. Any ambiguity in this BAA shall be resolved to permit the Department or Board to comply with the Privacy and Security Requirements.

G. Indemnification. Contractor agrees to indemnify and hold harmless, to the extent allowed by law, the Department or Board and its Board of Managers, officers, employees, and agents (individually and collectively “Indemnitees”) against any and all losses, liabilities, judgments, penalties, awards, and costs (including costs of investigations, legal fees, and expenses) arising out of or related to:

1. a breach of this BAA relating to the Privacy and Security Requirements by

Contractor; or

2. any negligent or wrongful acts or omissions of Contractor or its employees, directors, officers, subcontractors, or agents, relating to the Privacy and Security Requirements, including failure to perform their obligations under the Privacy and Security Requirements.

H. Electronic Mail Addresses. Contractor affirmatively consents to the disclosure of its e-mail addresses that are provided to the Department or Board, including any agency or department of the Department or Board. This consent is intended to comply with the requirements of the Texas Public Information Act, TEX. GOV’T CODE ANN. § 552.137 et seq., as amended, and shall survive termination of this BAA. This consent shall apply to e-mail addresses provided by Contractor and agents acting on behalf of Contractor and shall apply to any e-mail address provided in any form for any reason whether related to this BAA or otherwise.

I. Except as otherwise limited in this BAA, Contractor may use or disclose Protected Health

Information it creates or receives from or on behalf of the Department or Board to provide the services to or on behalf of the Department or Board set out in the Agreement to which this BAA is attached.

J. This BAA survives the termination of the Agreement and expires six (6) years after its termination.

Access to Books and Records Contractor agrees to keep a separate record of all funds received and disbursed under this Agreement and to provide Department or Board or its designee all information, records, papers, reports, and other documents regarding any aspect of the services furnished as requested by

Department or Board or its designee, and shall make records, books, documents, and papers of Contractor that relate in any way to the services provided available for inspection, audit, examination, and copying by the Department or Board or the Department or Board’s representative. Contractor agrees to allow the Comptroller General of the United States, the Department of Health and Human Services (“HHS”), the Department or Board Auditor, and their duly authorized representatives access to contracts, books, documents, and records necessary to verify the nature and extent of the costs of the services provided by Contractor. Contractor agrees to allow such access until the expiration of four (4) years after the services are furnished under the contract or subcontract or until the completion of any audit or audit period, whichever is later.

Such access will be provided in accordance with the regulations of the Centers for Medicare and Medicaid Services (“CMS”) and 42 C.F.R. § 420.302, as amended. Contractor agrees to allow similar access to books, records, and documents related to contracts between Contractor and organizations related to or subcontracted by Contractor, as defined by the regulations of CMS. No records shall be destroyed that are required to be kept by federal, state, or Department or Board statute, law, rule, ordinance, or order, or by application of conditions of Medicaid or Medicare provider agreements, or by other applicable agreements, including grant applications and requirements entered into between the Department or Board or state and a third-party payer.

Contractor shall keep all PHI, as defined herein, and records relating to disclosure of PHI for six years after the last date of service or, at Department or Board’s option, shall transfer such records to Department or Board upon termination of this Agreement.

E-Mail Addresses Contractor affirmatively consents to disclosure of its e-mail addresses provided to Department or Board, including any agency or department of Department or Board. This consent is intended to comply with the requirements of section 552.137 of the Texas Government Code, as amended, and shall survive termination of this Agreement. This consent shall apply to e-mail addresses provided by Contractor and agents acting on Contractor’s behalf and shall apply to any e-mail address provided in any form for any reason whether related to this Agreement or otherwise.

Governing Law This Agreement shall be interpreted under the laws of the State of Texas and applicable federal law. Exclusive venue for any cause of action arising out of or in relation to this Agreement shall be in Harris Department or Board,