5-Attachment C-2 - Business Associate Agreement.docx

Attachment C-2 Business Associate Agreement

This Business Associate Agreement (this "Agreement") is entered into between (insert name of Business Associate), ("Business Associate"), and Pinal County Public Health Services District ("Covered Entity"), and shall be effective (the "Effective Date") upon the date this Agreement is executed by the Covered Entity.

Covered Entity and Business Associate mutually agree to modify any current or future services agreement executed by and between them in order to incorporate the terms of this Agreement to comply with the requirements of the implementing regulations at 45 Code of Federal Regulations ("C.F.R.") Parts 160-64 for the Administrative Simplification provisions of Title II, Subtitle F of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").

The parties further agree that Business Associate will function as a "business associate" of Covered Entity and Covered Entity will function as a "covered entity" as those terms are defined in 45 C.F.R. §160.103.

1. DEFINITIONS. The terms "Electronic Protected Health Information" and "Protected Health Information" have the meanings set out in 45 C.F.R. §160.103. The term "Unsecured Protected Health Information" has the meaning set forth at 45 C.F.R. §164.402. The term "Required by Law" has the meaning set out in 45 C.F.R. §164.103. The term "Treatment" has the meaning set out in 45 C.F.R. §164.501. The term "Authorization" has the meaning set out in 45 C.F.R. §164.508. The term "Subcontractor" has the meaning set out in 45 C.F.R. §160.103. The term "Breach" will have the meaning set out at 45 C.F.R. §164.402. The term "Designated Record Set" will have the meaning set out at 45 C.F.R. §164.501.

2. PRIVACY OF PROTECTED HEALTH INFORMATION.

2.1 Permitted Uses and Disclosures. Business Associate is only permitted to use and disclose Protected Health Information, whether in paper form or in electronic form, that it creates or receives from Covered Entity (or another business associate of Covered Entity) ("Covered Entity's Protected Health Information") as follows:

a. Functions and Activities on Covered Entity's Behalf. To perform functions, activities, services, and operations on behalf of Covered Entity as specified in the services agreement.

b. Covered Entity's Operations. For Business Associate's proper management and administration or to carry out Business Associate's legal responsibilities, provided that, with respect to disclosure of Covered Entity's Protected Health Information, either:

1) The disclosure is Required by Law; or

2) Business Associate obtains reasonable assurance, evidenced by a written contract with terms substantially similar to this Agreement, from any third party person or entity to which Business Associate will disclose Covered Entity's Protected Health Information that the person or entity will:

a) Hold Covered Entity's Protected Health Information in confidence and use or further disclose Covered Entity's Protected Health Information only for the purpose for which Business Associate disclosed Covered Entity's Protected Health Information to the person or entity or as Required by Law; and

b) Promptly notify Business Associate (who will in turn notify Covered Entity in accordance with Sections 4(a) and (b) of this Agreement) of any instance of which the person or entity.

2.2 Minimum Necessary. Business Associate will, in its performance of the functions, activities, services, and operations specified in Section 2(a) above, make best efforts to use, to disclose, and to request of Covered Entity only the minimum amount of Covered Entity's Protected Health Information reasonably necessary to accomplish the intended purpose of the use, disclosure or request, except that Business Associate will not be obligated to comply with this minimum necessary limitation with respect to:

a. Use for or disclosure to an individual who is the subject of Covered Entity's Protected Health Information, or that individual's personal representative;

b. Use or disclosure made pursuant to an Authorization that is signed by an individual who is the subject of Covered Entity's Protected Health Information to be used or disclosed, or by that individual's personal representative;

c. Disclosure to the United States Department of Health and Human Services ("DHHS") in accordance with Section 7(a) of this Agreement;

d. Use or disclosure that is Required by Law; or

e. Any other use or disclosure that is excepted from the minimum necessary limitation as specified in the Privacy Rule (as hereinafter defined).

2.3 Prohibition on Unauthorized Use or Disclosure. Business Associate will neither use nor disclose Covered Entity's Protected Health Information, except as permitted or required by this Agreement or as Required by Law. This Agreement does not authorize Business Associate to use or disclose Covered Entity's Protected Health Information in a manner that would violate 45 C.F.R. Part 164, Subpart E "Privacy of Individually Identifiable Health Information" ("Privacy Rule").

2.4 Information Safeguards.

a. Privacy of Covered Entity's Protected Health Information. Business Associate will develop, implement, maintain, and use appropriate administrative, technical, and physical safeguards to protect the privacy of Covered Entity's Protected Health Information. The safeguards must reasonably protect Covered Entity's Protected Health Information from any intentional or unintentional use or disclosure in violation of the Privacy Rule and limit incidental uses or disclosures made pursuant to a use or disclosure otherwise permitted by this Agreement.

b. Security of Covered Entity's Protected Health Information. Business Associate will use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to Covered Entity's Electronic Health Information, to prevent use or disclosure of that Electronic Protected Health Information other than as provided for by the Agreement.

2.5 Subcontractors. Business Associate will require any of its Subcontractors, to which Business Associate is permitted by this Agreement to disclose Covered Entity's Protected Health Information, to agree, as evidenced by written contract with terms substantially similar to those found in this Agreement, that such Subcontractor will comply with the same privacy and security safeguard obligations with respect to Covered Entity's Protected Health Information that are applicable to Business Associate under this Agreement.

2.6 Indemnification and Insurance. Business Associate shall indemnify, defend and hold harmless Covered Entity and its directors, officers, subcontractors, employees, affiliates, agents, and representatives from and against any and all third party liabilities, costs, claims, suits, actions, proceedings, demands, losses and liabilities of any kind (including court costs, reasonable attorneys’ fees, primary loss investigation, judgement costs, expert witness fees, and any and all fees and costs from appellate proceedings), and civil and criminal penalties brought by a third party, arising from or relating to the acts or omissions of Business Associate or any of its directors, officers, subcontractors, employees, affiliates, agents, and representatives in connection with the Business Associate’s performance under this Agreement or Service Agreement, without regard to any limitation or exclusion of damages provision otherwise set forth in the Agreement. The indemnification provisions of this Section shall survive the termination of this Agreement. Business Associate shall obtain no later than one (1) month from Effective Date of this Agreement and maintain during the term of this Agreement liability insurance covering claims based on a violation of the Privacy Rule or any applicable law or regulation concerning the privacy of a patient information and claims based on its obligations (Name of Practice) HIPAA BUSINESS ASSOCIATE AGREEMENT 6/12 pursuant to this Section in an amount not less than $ 1,000,000 per claim. Such insurance shall be in the form of occurrence-based coverage. A copy of such policy or certificate evidencing the policy shall be provided to Covered Entity upon written notice.

3 INDIVIDUAL RIGHTS.

3.1 Access. Business Associate will, within five (5) days following Covered Entity's request, make available to Covered Entity or, at Covered Entity's direction, to an individual (or the individual's personal representative) for inspection and obtaining copies, Covered Entity's Protected Health Information, in a Designated Record Set, about the individual that is in Covered Entity's custody or control.

3.2 Amendment. Business Associate will, upon receipt of written notice from Covered Entity, promptly amend, or permit Covered Entity access to amend, any portion of Covered Entity's Protected Health Information.

3.3 Disclosure Accounting. So that Covered Entity may meet its disclosure accounting obligations under the Privacy Rule:

a. Disclosures Not Subject to Accounting. Business Associate will not be obligated to record Disclosure Information or otherwise account for disclosures of Covered Entity's Protected Health Information that are expressly excluded from such disclosure accounting requirement as set forth at 45 C.F.R. § 164.528(a)(1).

b. Disclosures Subject to Accounting and Necessary Information. Business Associate will record the information specified in Section 3(c)(ii)(A) or (B), as applicable, for each disclosure of Covered Entity's Protected Health Information that Business Associate makes to third party. With respect to any disclosure by Business Associate of Covered Entity's Protected Health Information that is not excepted from disclosure accounting by Section 3(c)(ii) above, Business Associate will record the following Disclosure Information as applicable to the type of accountable disclosure made:

1) Disclosure Information Generally. Except for repetitive disclosures of Covered Entity's Protected Health Information as specified in Section 3(c)(ii)(B) below, the Disclosure Information that Business Associate must record for each accountable disclosure is (1) the disclosure date, (2) the name and (if known) address of the entity to which Business Associate made the disclosure, (3) a brief description of Covered Entity's Protected Health Information disclosed, and (4) a brief statement of the purpose of the disclosure.

2) Disclosure Information for Repetitive Disclosures. For repetitive disclosures of Covered Entity's Protected Health Information that Business Associate makes for a single purpose to the same person or entity, the Disclosure Information that Covered Entity must record is either (1) the Disclosure Information specified in Section 3(c)(ii)(A) above for each accountable disclosure; or (2) the Disclosure Information specified in Section 3(c)(ii)(A) for the first of the repetitive accountable disclosures, the frequency, periodicity, or number of the repetitive accountable disclosures, and the date of the last of the repetitive accountable disclosures.

c. Availability of Disclosure Information. Business Associate will maintain the Disclosure Information for at least six (6) years following the date of the accountable disclosure to which the Disclosure Information relates. Business Associate will make the Disclosure Information available to Covered Entity within thirty (30) days following Covered Entity's request for such Disclosure Information to comply with an individual's request for disclosure accounting.

3.4 Restriction Agreements and Confidential Communications. Business Associate will comply with any agreement that Covered Entity makes that either (i) restricts use or disclosure of Covered Entity's Protected Health Information, or (ii) requires confidential or alternate methods of communication about Covered Entity's Protected Health Information, provided that Covered Entity notifies Business Associate in writing of the restriction or confidential or alternate communication obligations that Covered Entity must follow. Covered Entity will promptly notify Business Associate in writing of the termination of any such restriction agreement or confidential or alternate communication requirement and, with respect to termination of any such restriction agreement, instruct Business Associate whether any of Covered Entity's Protected Health Information will remain subject to the terms of the restriction agreement.

4. PRIVACY/SECURITY BREACH INVESTIGATIONS & REPORTING.

4.1 Business Associate will promptly and thoroughly investigate any suspected Breach of Covered Entity's Unsecured Protected Health Information not permitted by this Agreement or applicable law.

4.2 Business Associate will notify Covered Entity regarding a Breach of Covered Entity's Unsecured Protected Health Information ("Covered Entity Privacy Event") without unreasonable delay, but in no event later than three (3) calendar days of discovering that a Breach occurred, regardless if such Covered Entity Privacy Event is discovered by Business Associate or by any Subcontractor of Business Associate. Additionally, Business Associate will use its best efforts to assist with Covered Entity's breach investigation by making a timely written report to Covered Entity on any substantiated investigation of a Covered Entity Privacy Event. Business Associate will include as much of the information described in Sections 4(c) as is available at the time the report is written and will supplement the report with additional information once that information is known.

4.3 Business Associate's initial written report concerning a Covered Entity Privacy Event will, at a minimum:

a. Identify the names and respective titles of those who conducted the investigation on the part of Business Associate, be delivered on Business Associate's official letterhead, be signed by an officer or director of Business Associate or other responsible person and contain appropriate contact information should Covered Entity need further clarification regarding the content of the report;

b. Identify Covered Entity's Protected Health Information (at the individual level) that was subject to the Breach and the date the Breach occurred;

c. Identify the date the Breach was discovered by Business Associate;

d. Identify the storage medium (e.g. floppy disc, paper record, electronic server) wherein the affected Protected Health Information was housed;

e. Identify who committed the Breach of Covered Entity's Protected Health Information and if a disclosure of Covered Entity's Protected Health Information was made, the identity of the person or entity to which that disclosure was made and the date or dates those disclosures occurred;

f. Identify what corrective action Business Associate took or will take to prevent further non- permitted uses or disclosures;

g. Identify what Business Associate did or will do to mitigate any harmful effect of the non- permitted use or disclosure; and

h. Provide any other information to Covered Entity as Covered Entity may request to fulfill its reporting obligations to an affected individual as required under 45 C.F.R. §164.41

5. OTHER COVERED ENTITY OBLIGATION. To the extent Business Associate is to carry out Covered Entity's obligation under the Privacy Rule, Business Associate will comply with the requirements applicable to the obligation.

6. TERMINATION OF AGREEMENT.

6.1 Right to Terminate for Breach. Covered Entity may terminate the Agreement if Business Associate has breached any provision of this Agreement. Any such termination will be effective immediately or at such other date specified in Covered Entity's notice of termination.

6.2 Termination of Agreement on Conclusion of Services Agreement. This Agreement will terminate pursuant to Section 6(a) or upon the termination of the services agreement.

a. Obligations on Termination.

1) Return or Destruction of Covered Entity's Protected Health Information as Feasible. Upon termination Business Associate will, if feasible, return to Covered Entity or destroy all of Covered Entity's Protected Health Information in whatever form or medium, including all copies thereof and all data, compilations, and other works derived therefrom that allow identification of any individual who is a subject of Covered Entity's Protected Health Information. Business Associate will require any Subcontractor, to which Business Associate has disclosed Covered Entity's Protected Health Information to, if feasible, return to Business Associate (so that Business Associate may return it to Covered Entity) or destroy all of Covered Entity's Protected Health Information in whatever form or medium received from Covered Entity, including all copies thereof and all data, compilations, and other works derived therefrom that allow identification of any individual who is a subject of Covered Entity's Protected Health Information, and certify on oath to Covered Entity that all such information has been returned or destroyed. Covered Entity will complete these obligations as promptly as possible, but not later than thirty (30) days following the effective date of the termination or other conclusion of the Agreement.

2) Procedure When Return or Destruction Is Not Feasible. Business Associate will identify any of Covered Entity's Protected Health Information, including any that Business Associate has disclosed to Subcontractors of this Agreement, that cannot feasibly be returned to Covered Entity or destroyed and explain why return or destruction is infeasible. Business Associate will limit its further use or disclosure of such information to those purposes that make return or destruction of such information infeasible. Business Associate will, by its written contract with any Subcontractor to which Business Associate discloses Covered Entity's Protected Health Information require such Subcontractor to limit its further use or disclosure of Covered Entity's Protected Health Information that such Subcontractor cannot feasibly return or destroy to those purposes that make the return or destruction of such information infeasible. Business Associate will complete these obligations as promptly as possible, but not later than thirty (30) days following the effective date of the termination or other conclusion of the Agreement.

3) Continuing Privacy and Security Obligation. Business Associate's obligation to protect the privacy and safeguard the security of Covered Entity's Protected Health Information as specified in this Agreement will be continuous and survive termination or other conclusion of the Agreement and this Agreement.

7. GENERAL PROVISIONS.

7.1 Inspection of Internal Practices, Books, and Records. Business Associate will make its internal practices, books, and records relating to its use and disclosure of Covered Entity's Protected Health Information available to Covered Entity and to DHHS to determine Covered Entity's compliance with the Privacy Rule.

7.2 Amendment. The parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of HIPAA and any other applicable law.

7.3 Conflicts. The terms and conditions of this Agreement will override and control any conflicting term or condition of any services agreement. All non-conflicting terms and conditions of the services agreement remain in full force and effect.

In Witness Whereof, Business Associate and Covered Entity have caused this Addendum to be signed and delivered by their duly authorized representatives, as of the date set forth above.

PUBLIC HEALTH SERVICES DISTRICT

“Covered Entity”

COMPANY/ENTITY NAME

“Business Associate”

Att. C-2 #263631SOQ, Page 7 image1.png