Attachment F_Business Associate Agreement.pdf

BUSINESS ASSOCIATE AGREEMENT BETWEEN THE DEPARTMENT OF

VETERANS AFFAIRS OFFICE OF INFORMATION AND TECHNOLOGY (OI&T)

AND

<COMPANY/ORGANIZATION>

Revised August 2013 1

Purpose. The purpose of this Business Associate Agreement (Agreement) is to establish requirements for the Department of Veterans Affairs (VA) Office of

Information and Technology (OI&T) (“Business Associate”) and <COMPANY/ORGANIZATION> (“Subcontractor”) in accordance with the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH) Act, and the HIPAA

Privacy, Security, Breach Notification, and Enforcement Rules (“HIPAA Rules”), 45 C.F.R. Parts 160 and 164, for the Use and Disclosure of Protected Health Information (PHI) under the terms and conditions specified below.

Scope. Under this Agreement and other applicable contracts or agreements, Subcontractor will provide storage and compute infrastructure at facilities across the United States and abroad as a managed service. The Infrastructure as a Managed Service (IaaMS) solution includes all hardware, software, and services to perform project management; solution requirements; VI requirements; lab system; installation, implementation, and configuration; Operations & Maintenance, technology refresh, and training for the IaaMS solution to, for, or on behalf of Business Associate.

In order for Subcontractor to provide such services, Business Associate will disclose Protected Health Information received from the Veterans Health Administration (VHA) to Subcontractor and Subcontractor will use or disclose Protected Health Information in accordance with this Agreement.

Definitions. Unless otherwise provided, the following terms used in this Agreement have the same meaning as defined by the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum

Necessary, Notice of Privacy Practices, Protected Health Information (PHI), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use. “Protected Health Information” and “PHI” as used in this Agreement include “Electronic Protected Health Information” and “EPHI.”

“Business Associate” shall have the same meaning as described at 45 C.F.R.

§ 160.103. For the purposes of this Agreement, Business Associate shall refer to the Office of Information and Technology (OI&T) including its employees, officers, or any other agents that create, receive, maintain, or transmit PHI as described below.

“Covered Entity” shall have the same meaning as the term is defined at 45

C.F.R. § 160.103. For the purposes of this Agreement, Covered Entity shall refer to the Veterans Health Administration (VHA).

“Protected Health Information” or “PHI” shall have the same meaning as described at 45 C.F.R. § 160.103. For the purposes of this Agreement and unless otherwise provided, the term shall also refer to PHI that subcontractor creates, receives, maintains, or transmits on behalf of Business Associate or receives from any Business Associate.

Revised August 2013 2

“Subcontractor” shall have the same meaning as the term is defined at 45

C.F.R. § 160.103. For the purposes of this Agreement, Subcontractor shall refer to a contractor of any person or entity, other than Covered Entity or Business Associate, that creates, receives, maintains, or transmits PHI under the terms of this Agreement .

Terms and Conditions. Business Associate and Subcontractor agree as follows:

1. Ownership of PHI. PHI is and remains the property of Covered Entity as long as Business Associate or subcontractor creates, receives, maintains, or transmits

PHI, regardless of whether a compliant Business Associate agreement is in place.

2. Use and Disclosure of PHI by Subcontractor. Unless otherwise provided, Subcontractor:

A. May not use or disclose PHI other than as permitted or required by this Agreement, or in a manner that would violate the HIPAA Privacy Rule if done by Covered Entity or Business Associate, except that it may use or disclose PHI:

(1) As required by law or to carry out its legal responsibilities;

(2) For the proper management and administration of Subcontractor; or

(3) To provide Data Aggregation services relating to the health care operations of Covered Entity.

B. Must use or disclose PHI in a manner that complies with Covered Entity’s minimum necessary policies and procedures.

C. May de-identify PHI created or received by Subcontractor under this Agreement, provided that the de-identification conforms to the requirements of the HIPAA Privacy Rule.

3. Obligations of Subcontractor. In connection with any Use or Disclosure of PHI, Subcontractor must:

A. Consult with Business Associate before using or disclosing PHI whenever Subcontractor is uncertain whether the Use or Disclosure is authorized under this Agreement.

B. Implement appropriate administrative, physical, and technical safeguards and controls to protect PHI and document applicable policies and procedures to prevent any Use or Disclosure of PHI other than as provided by this Agreement.

C. Provide satisfactory assurances that PHI created or received by Subcontractor under this Agreement is protected to the greatest extent feasible.

Revised August 2013 3

D. Notify Business Associate within twenty four (24) hours of Subcontractor’s discovery of any potential access, acquisition, use, disclosure, modification, or destruction of either secured or unsecured PHI in violation of this agreement, including any Breach of PHI.

(1) Any incident as described above will be treated as discovered as of the first day on which such event is known to Subcontractor or, by exercising reasonable diligence, would have been known to Subcontractor.

(2) Notification shall be sent to the Office of Information and Technology

Privacy Officer by email to Rita.Grewal@va.gov, or by phone (202) 632-7861.

(3) Subcontractor shall not notify individuals or Department of Health and Human Services (HHS) directly unless Subcontractor is not acting as an agent of Business Associate but in its capacity as a Covered Entity itself.

E. Provide a written report to Business Associate of any potential access, acquisition, use, disclosure, modification, or destruction of either secured or unsecured PHI in violation of this agreement, including any Breach of PHI, within ten (10) business days of the initial notification.

(1) The written report of an incident as described above will document the following:

(a) The identity of each Individual whose PHI has been, or is reasonably believed by Subcontractor to have been, accessed, acquired, used, disclosed, modified, or destroyed;

(b) A description of what occurred, including the date of the incident and the date of the discovery of the incident (if known);

(c) A description of the types of secured or unsecured PHI that was involved;

(d) A description of what is being done to investigate the incident, to mitigate further harm to Individuals, and to protect against future incidents;

and

(e) Any other information as required by 45 C.F.R. §§ 164.404(c) and 164.410.

mailto:Rita.Grewal@va.gov

Revised August 2013 4

(2) The written report shall be addressed to:

Department of Veterans Affairs Office of Information and Technology Privacy Officer Office of Privacy & Records Management (OPRM 005R1A) 810 Vermont Ave, NW

Washington, DC 20420 Attn: Rita Grewal and submitted by email at Rita.Grewal@va.gov.

F. To the greatest extent feasible, mitigate any harm due to a Use or Disclosure of PHI by Subcontractor in violation of this Agreement that is known or, by exercising reasonable diligence, should have been known to Subcontractor.

G. Use only contractors and subcontractors that are physically located within a jurisdiction subject to the laws of the United States, and ensure that no contractor or subcontractor maintains, processes, uses, or discloses PHI in any way that will remove the information from such jurisdiction. Any modification to this provision must be approved by Covered Entity in advance and in writing.

H. Enter into Business Associate Agreements as appropriate under the HIPAA

Rules and this Agreement. Subcontractor:

(1) Must ensure that the terms of any agreement between Subcontractor and a contractor or subcontractor are at least as restrictive as Business Associate

Agreement between Business Associate and Subcontractor.

(2) Must ensure that contractors and subcontractors agree to the same restrictions and conditions that apply to Subcontractor and obtain satisfactory written assurances from them that they agree to those restrictions and conditions.

(3) May not amend any terms of such agreement without Business Associate’s prior written approval.

I. Within five (5) business days of a written request from Business Associate:

(1) Make available information for Business Associate or Covered Entity to respond to an Individual’s request for access to PHI about him/her.

(2) Make available information for Business Associate or Covered Entity to respond to an Individual’s request for amendment of PHI about him/her and, as determined by and under the direction of Covered Entity, incorporate any amendment to the PHI.

mailto:Rita.Grewal@va.gov

Revised August 2013 5

(3) Make available PHI for Business Associate or Covered entity to respond to an Individual’s request for an accounting of Disclosures of PHI about him/her.

J. Subcontractor may not take any action concerning an individual’s request for access, amendment, or accounting other than as instructed by Business Associate or Covered Entity.

K. To the extent Subcontractor is required to carry out Covered Entity's obligations under Subpart E of 45 CFR Part 164, comply with the provisions that apply to

Covered Entity in the performance of such obligations.

L. Provide to the Secretary of Health and Human Services, Covered Entity and Business Associate records related to Use or Disclosure of PHI, including its policies, procedures, and practices, for the purpose of determining Covered Entity’s, Business Associate’s or a Subcontractor’s compliance with the HIPAA Rules.

M. Upon completion or termination of the applicable contract(s) or agreement(s), return or destroy, as determined by and under the direction of Business Associate, all PHI and other VA data created or received by Subcontractor during the performance of the contract(s) or agreement(s). No such information will be retained by Subcontractor unless retention is required by law or specifically permitted by Business Associate. If return or destruction is not feasible, Subcontractor shall continue to protect the PHI in accordance with the Agreement and use or disclose the information only for the purpose of making the return or destruction feasible, or as required by law or specifically permitted by Business Associate. Subcontractor shall provide written assurance that either all PHI has been returned or destroyed, or any information retained will be safeguarded and used and disclosed only as permitted under this paragraph.

4. Obligations of Business Associate. Business Associate agrees that it:

A. Will not request Subcontractor to make any Use or Disclosure of PHI in a manner that would not be permissible under Subpart E of 45 C.F.R. Part 164 if made by Business Associate, except as permitted under Section 3 of this agreement.

B. Will promptly notify Subcontractor in writing of any restrictions on Business

Associate’s or Covered Entity’s authority to use or disclose PHI that may limit Subcontractor’s Use or Disclosure of PHI or otherwise affect its ability to fulfill its obligations under this Agreement.

C. Has obtained or will obtain from Individuals any authorization necessary for Subcontractor to fulfill its obligations under this Agreement.

Revised August 2013 6

D. Will promptly notify Subcontractor in writing of any change in Covered Entity’s Notice of Privacy Practices, or any modification or revocation of an Individual’s authorization to use or disclose PHI, if such change or revocation may limit Subcontractor’s Use and Disclosure of PHI or otherwise affect its ability to perform its obligations under this Agreement.

5. Amendment. Subcontractor and Business Associate will take such action as is necessary to amend this Agreement for Business Associate to comply with the requirements of the HIPAA Rules or other applicable law.

6. Termination.

A. Automatic Termination. This Agreement will automatically terminate upon completion of Subcontractor’s duties under all underlying agreements or by termination of such underlying agreements.

B. Termination Upon Review. This Agreement may be terminated by Business Associate, at its discretion, upon review as provided by Section 9 of this Agreement.

C. Termination for Cause. In the event of a material breach by Subcontractor, Business Associate:

(1) Will provide an opportunity for Subcontractor to cure the breach or end the violation within the time specified by Business Associate;

(2) May terminate this Agreement and underlying contract(s) if Subcontractor does not cure the breach or end the violation within the time specified by Business Associate.

D. Effect of Termination. Termination of this Agreement will result in cessation of activities by Subcontractor involving PHI under this Agreement.

E. Survival. The obligations of Subcontractor under this Section shall survive the termination of this Agreement as long as Subcontractor creates, receives, maintains, or transmits PHI, regardless of whether a compliant Business Associate agreement is in place.

7. No Third Party Beneficiaries. Nothing expressed or implied in this Agreement confers any rights, remedies, obligations, or liabilities whatsoever upon any person or entity other than Business Associate and Subcontractor, including their respective successors or assigns.

8. Other Applicable Law. This Agreement does not abrogate any responsibilities of the parties under any other applicable law.

Revised August 2013 7

9. Review Date. The provisions of this Agreement will be reviewed by Business Associate every two years from Effective Date to determine the applicability and accuracy of the agreement based on the circumstances that exist at the time of review.

10. Effective Date. This Agreement shall be effective on the last signature date below.

Revised August 2013 8

Department of Veterans Affairs Office of Information and Technology

By: ______________________________

Name: ______________________________ <VA OI&T PROGRAM MGR.>

Title: ______________________________

Date: ______________________________

Company/Organization

By: ______________________________

Name: ______________________________

Title: ______________________________

Date: ______________________________