5-BUSINESS ASSOCIATES AGREEMENT.docx

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("BAA") supplements and is made a part of any and all agreements including the attached agreement by and between the COUNTY OF ROCKLAND, on behalf of its Department of ____________________, and __________________________ [Insert name of agency/contractor/consultant] (the "Agreement").

WHEREAS, Covered Entity and Business Associate are parties to the Agreement pursuant to which Business Associate provides certain services to Covered Entity. In connection with Business Associate's services, Business Associate creates or receives Protected Health Information from or on behalf of Covered Entity, which information is subject to protection under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Public Law 104-191, 100 Stat. 2548, the HIPAA Administrative Simplification Rules (the "HIPAA Rules"), which are set forth in 45 CFR Parts 160, 162 and 164, the American Recovery and Reinvestment Act of 2009 ("ARRA"), Public Law 111-5, 123 Stat. 115, including, but not limited to, § 13402 of the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act"), Title XIII of Division A and Title IV of Division B of ARRA, codified at 42 U.S.C. § 300jj et seq., § 17901 et seq., and its implementing regulations, which are set forth in 45 CFR Part 164, and the HIPAA/HITECH Omnibus Final Rule effective March 26, 2013.

NOW, THEREFORE, in light of the foregoing, Business Associate and Covered Entity agree to be bound by the following terms and conditions:

1. GENERAL DEFINITIONS

Terms used, but not otherwise defined, in this BAA shall have the meanings ascribed to them in 45 CFR §§ 160.103, 164.103 and 164.501.

2. SPECIFIC DEFINITIONS

a. "Breach" shall have the meaning set forth in 42 U.S.C. § 17921 and shall include the unauthorized acquisition, access, use or disclosure of Protected Health Information that compromises the privacy or security of such information.

b. “Business Associate" shall have the meaning set forth in 45 CFR §160.103 and shall include an entity who, on behalf of a Covered Entity, creates, receives, maintains or transmits Protected Health Information. For purposes of this BAA, Business Associate shall mean _________________ [Insert name of agency/contractor/consultant].

c. "Covered Entity," for purposes of this BAA, shall mean the County of Rockland, on behalf of its Department of _____________ [Insert the name of Department].

d. "Data Aggregation" shall mean, with respect to Protected Health Information created or received by Business Associate in its capacity as Business Associate of Covered Entity, the combining of such Protected Health Information by Business Associate with the Protected Health Information received by Business Associate in its capacity as Business Associate of another Covered Entity, to permit data analyses that relate to the health care operations of the respective Covered Entities.

e. "Designated Record Set" shall have the meaning set forth in 45 CFR § 164.501.

f. "Individual" shall have the meaning set forth in 45 CFR § 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).

g. "Protected Health Information" shall have the meaning set forth in 45 CFR § 160.103, but it is limited to the Protected Health Information created or received by Business Associate from, for or on behalf of Covered Entity in connection with or in the course of Business Associate’s performance of the Agreement.

h. "Required by Law" shall have the meaning set forth in 45 CFR § 164.103.

i. "Secretary" shall mean the Secretary of the United States Department of Health and Human Services or his/her designee.

j. "Security Incident" shall have the meaning set forth in 45 CFR § 164.304.

k. "Security Rule" shall mean the Security Standards for the Protection of Electronic Protected Health Information set forth in 45 CFR Parts 160 and 164, subparts A and C.

l. "Unsecured Protected Health Information" shall have the meaning set forth in 42 U.S.C. § 17932 and shall include Protected Health Information that is not secured through the use of a technology or methodology specified by the Secretary.

3. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE

a. Business Associate agrees not to use or disclose Protected Health Information other than as permitted or required by the Agreement or as Required by Law.

b. Business Associate agrees to use appropriate safeguards to prevent the use or disclosure of Protected Health Information other than as provided for by the Agreement and to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of any electronic Protected Health Information that it creates, receives, maintains or transmits on behalf of Covered Entity pursuant to this Agreement in accordance with Subpart C of 45 CFR Part 62. Business Associate agrees to fully comply with the responsibilities of Business Associates as set forth in § 13401 of the HITECH Act.

c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of the Agreement.

d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health Information not provided for by the Agreement of which it becomes aware, including Breaches of Unsecured Protected Health Information as required in 45 CFR § 164.410, and any Security Incident of which it becomes aware. In the event of a Breach of Unsecured Protected Health Information:

(i) Business Associate shall promptly notify Covered Entity of the Breach when it is discovered, but no later than five (5) calendar days from the discovery of the Breach. A Breach is considered discovered on the first day on which Business Associate knows or should have known of such Breach. Such notification shall identify the Individuals whose Unsecured Protected Health Information has, or is reasonably believed to have, been the subject of the Breach, and their contact information. Business Associate further agrees to reimburse Covered Entity for all expenses, costs and/or fees incurred by Covered Entity in connection with such improper use of disclosure including, but not limited to, printing, mailing, telephone and publication costs.

(ii) Covered Entity shall promptly notify Individuals about a Breach of their Unsecured Protected Health Information as soon as possible, but no later than sixty (60) calendar days after discovery of the Breach, except where a law enforcement official determines that a notification would impede a criminal investigation or cause damage to national security. Notification shall meet the requirements of § 13402 of the HITECH Act.

e. In accordance with 45 CFR § 164.502(e)(1)(ii) and § 164.308(b)(2), if applicable, Business Associate agrees to ensure that any agent or subcontractor of Business Associate to whom Business Associate provides Protected Health Information received from, created, maintained or transmitted by Business Associate on behalf of Covered Entity pursuant to the Agreement agrees to at least the same restrictions and conditions that apply through this BAA to Business Associate with respect to such Protected Health Information. Business Associate will ensure that Business Associate Agreements are executed with all subcontractors that will perform functions or activities on behalf of Business Associate that involve the use or disclosure of Protected Health Information received from, created or received by Business Associate on behalf of Covered Entity.

f. To the extent that the information made available to Business Associate under the Agreement includes Protected Health Information in a Designated Record Set, Business Associate agrees to provide access, at the request of Covered Entity, in the time and manner designated by Covered Entity, to Protected Health Information in the Designated Record Set to Covered Entity or, as directed by Covered Entity, to an Individual in order to meet the requirements set forth in 45 CFR § 164.524.

g. To the extent that the information made available to Business Associate in connection with or in the course of Business Associate’s performance of the Agreement includes Protected Health Information in a Designated Record Set, Business Associate agrees to make any amendments to Protected Health Information in the Designated Record Set that Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of Covered Entity or an Individual, in the time and manner designated by Covered Entity.

h. Business Associate agrees to document such disclosures of Protected Health Information under the Agreement and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR § 164.528.

i. Business Associate agrees to provide to Covered Entity or an Individual, in a time and manner designated by Covered Entity, information collected in accordance with paragraph (h) above, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR § 164.528. If Business Associate assists Covered Entity in maintaining an electronic health record ("EHR"), Business Associate shall support Covered Entity in providing, upon the request of the Individual, an accounting of disclosures of Protected Health Information in the EHR within the prior three (3) years, as well as an electronic copy of Protected Health Information that is part of the EHR.

j. To the extent Business Associate is to carry out one (1) or more of Covered Entity’s obligations under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligations and shall be directly responsible for full compliance with the relevant requirements of the Privacy Rule to the same extent that Covered Entity is responsible for compliance with such rule.

k. Business Associate agrees to make its internal practices, books and records including policies and procedures and Protected Health Information relating to the use and disclosure of Protected Health Information received from, created or received by Business Associate on behalf of Covered Entity pursuant to the Agreement available to Covered Entity or, at the request of Covered Entity, to the Secretary in a time and manner as designated by Covered Entity for purposes of the Secretary’s determining Covered Entity’s compliance with the HIPAA Rules.

l. Business Associate shall make its internal practices, books and records available to the Secretary for purposes of determining its compliance with the HIPAA Rules.

4. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE

a. General Use. Except as otherwise limited in the Agreement or this BAA, Business Associate may use or disclose Protected Health Information to perform functions, activities or services for, or on behalf of, Covered Entity as specified in the Agreement, provided that such use or disclosure would not violate the HIPAA Rules if done by Covered Entity or the minimum necessary policies and procedures of Covered Entity.

b.

Specific Use.

(i) Except as otherwise limited in the Agreement or this BAA, Business Associate may use Protected Health Information for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate.

(ii) Except as otherwise limited in the Agreement or this BAA, Business Associate may disclose Protected Health Information for the proper management and administration of Business Associate, provided that disclosures are Required by Law, or Business Associate obtains reasonable assurances from the person to whom the Protected Health Information is disclosed that it will remain confidential and shall be used or further disclosed only as Required by Law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality obligations under this BAA have been breached.

(iii) Except as otherwise limited in the Agreement or this BAA, Business Associate may use Protected Health Information to provide Data Aggregation services relating to the health care operations of Covered Entity as permitted in accordance with 45 CFR § 164.504(e)(2)(i)(B).

(iv) Business Associate may use Protected Health Information to report violations of law to the appropriate Federal and State authorities, consistent with the New York State Mental Hygiene Law and 45 CFR § 164.502(j)(1).

5. OBLIGATIONS OF COVERED ENTITY

a. Covered Entity shall notify Business Associate of any limitations in its Notice of Privacy Practices produced in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate’s use or disclosure of Protected Health Information.

b. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose Protected Health Information, to the extent that such changes may affect Business Associate’s permitted or required uses and disclosures.

c. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 CFR § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of Protected Health Information.

6. PERMISSIBLE REQUESTS BY COVERED ENTITY

Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Rules if done by Covered Entity. Covered Entity may permit Business Associate to use or disclose Protected Health Information for Data Aggregation or management and administrative activities of Business Associate, if the Agreement includes provisions for same.

7. VIOLATIONS/INDEMNIFICATION

a. In the event of a breach by Business Associate of any of the covenants or assurances contained in this BAA, Business Associate hereby agrees that immediate and irreparable harm may result to Covered Entity, and to the business of Covered Entity, which harm would not be adequately compensated by monetary damages. As such, in the event of breach of any of the covenants and assurances contained in Sections 3 or 4 above, Covered Entity shall be entitled to enjoin and restrain Business Associate from any continued violation of such Sections and may seek any other remedy including an injunction or specific performance for such harm without bond, security or necessity of demonstrating actual damages.

b. Business Associate shall defend, indemnify and hold Covered Entity harmless against all actions, claims, losses, liability, costs and other expenses including reasonable attorneys’ fees, without limitation, resulting from or arising out of the acts or omissions of Business Associate in the performance of its duties and obligations under this BAA. Business Associate’s liability under the foregoing provision shall include responsibility to pay, or where appropriate, to reimburse Covered Entity, for all costs associated with notification required by HIPAA or HITECH due to a Breach within the meaning of this BAA. Business Associate shall be fully liable for the actions of its agents, employees and subBusiness Associates.

c. The terms of this Section 7 shall survive expiration or termination of the Agreement.

8. CONSIDERATION

Business Associate acknowledges that the promises it has made in this BAA shall, henceforth, be relied upon by Covered Entity in choosing to commence or continue a business relationship with Business Associate.

9. TERM AND TERMINATION

a. Term. The provisions of this BAA shall be effective as of the effective date of the Agreement and shall survive termination of the Agreement and shall not terminate unless and until all Protected Health Information is destroyed or, if agreed by Covered Entity, is returned to Covered Entity or, if it is infeasible to return or destroy Protected Health Information, in accordance with the termination provisions in Section (c)(2) of this Section, in which case Business Associate’s obligations hereunder shall continue for so long as Business Associate maintains the Protected Health Information.

b. Termination for Cause. Upon Covered Entity's knowledge of a material breach by Business Associate, which shall include, but not be limited to, a violation of this BAA, HIPPA or the HITECH Act, Covered Entity may (i) provide an opportunity for Business Associate to cure the breach and end the violation; (ii) if Business Associate does not cure the breach and end the violation within the time specified by Covered Entity, Covered Entity may terminate this BAA and the Agreement; or (iii) if Business Associate has breached a material term of this Agreement and cure is not possible, Covered Entity may immediately terminate this BAA and the Agreement.

c. Effect of Termination.

(i) Except as provided in subparagraph (ii) of this paragraph, upon termination of the Agreement for any reason, Business Associate shall return to Covered Entity or, if agreed to by Covered Entity, destroy all Protected Health Information received from Covered Entity or created or received by Business Associate on behalf of Covered Entity. This provision shall apply to all Protected Health Information that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information. Upon request by Covered Entity, Business Associate shall certify in writing to Covered Entity that all Protected Health Information has been returned or destroyed as required by this section.

(ii) In the event that Business Associate determines that returning or destroying the Protected Health Information is infeasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Parties that return or destruction of Protected Health Information is infeasible, Business Associate shall extend the protections of this BAA to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protected Health Information. Upon request by Covered Entity, Business Associate shall certify in writing to Covered Entity that it has taken all the steps required by this section to protect Protected Health Information which could not feasibly be returned or destroyed.

10. MISCELLANEOUS

a. Regulatory References. A reference in this BAA to the HIPAA Rules means the rules as in effect or amended, and for which compliance by Covered Entity and/or Business Associate is required.

b. Amendment. The Parties agree to take such action as is necessary to amend this BAA from time to time as is necessary for compliance with the requirements of HIPAA, the HIPAA Rules and the HITECH Act.

c. Survival. The respective rights and obligations of Business Associate under Section 7 of this BAA shall survive the termination of this BAA.

d. Interpretation. Any ambiguity in this BAA shall be resolved in favor of a meaning that permits compliance with the HIPAA Rules.

e. Conflicts. Should there be any conflicts between the language of this BAA and any other agreement entered into by the parties, the language in this BAA is controlling and shall prevail.

f. HIV/AIDS. If HIV/AIDS information is to be disclosed under this BAA, Business Associate acknowledges that it has been informed of the confidentiality requirements of Article 27-F of the Public Health Law.

IN WITNESS WHEREOF, the parties hereto have executed this BAA on the day and year first written below.

Date: _______________________________ Date: ______________________________

Revised BB/9.4.2014 2014-02485