6. DMH Business Associate Terms and Conditions for Hearing Officers 2017.doc

DRAFT

September 25, 2002

BUSINESS ASSOCIATE TERMS AND CONDITIONS FOR HEARING OFFICERS

I. GENERAL PROVISIONS

Section 1. Department. The Department of Mental Health (Department) is a Covered Entity under the Health Insurance Portability and Accountability Act (HIPAA) and therefore subject to the HIPAA Privacy and Security Rules.

Section 2. Business Associate. The Department and Contractor ( a DMH Hearing Officer) acknowledge that the Contractor in its performance of hearing officers services to the Department, pursuant to the Department of Mental Health Master Agreement for Hearing Officers issued under the Request For Response For Hearing Officers that was first published on August 15, 2017, DMH RFR#2018-DMH-3005-01 (collectively referred to herein after as the” Contract”) is a Business Associate of the Department as the term is defined in 45 C.F.R. § 160.103.

Section 3. Business Associate Terms and Conditions. These are intended to protect the privacy and security of all Personal Data, including Protected Health Information, that the Contractor may receive from and/or create on behalf of the Department in the performance of its duties and responsibilities under the Contract, and to ensure that the Department complies with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HIPAA Privacy and Security Rules, 45 C.F.R. Parts 160 and 164, and the HITECH Act; the Fair Information Practices Act (FIPA), M.G.L. c. 66A; M.G.L. c. 93H and State confidentiality requirements governing the records of the Department (M.G.L c. 123, §36; 104 CMR 27.17 & 28.09).

II. DEFINITIONS FOR USE IN THIS SECTION

All terms used, but not otherwise defined herein shall be construed in a manner consistent with the HIPAA Privacy and Security Rules, The Fair Information Practices Act, and other applicable state or federal privacy or confidentiality laws.

“Breach” means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under HIPAA or M.G.L. c. 93 H which compromises the security or privacy of the PHI.

“Business Associate” means a person or entity, who, on behalf of a covered component of the Department, and other than in the capacity of a workforce member, performs or assists in the performance of a function or activity that involves the use or disclosure of protected health information; or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services, where the provision of the service involves the use or disclosure of protected health information.

“Data Subject” means an individual to whom Personal Data or Protected Health Information refers.

“Electronic Media” means:

· Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card; or

· Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the internet (wide-open), extranet (using internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Faxes sent directly from one fax machine to another, person-to-person telephone calls, video teleconferencing, and messages left on voice-mail are not considered transmission media. However, any faxes sent from a computer, including those made by a fax-back system, are considered transmission media.

“Electronic Protected Health Information” (EPHI) means PHI that is created, accessed, stored, or transmitted by electronic media.

“The Health Insurance Portability and Accountability Act” (HIPAA) means Public Law 104-191.

“The HITECH Act” means Title XIII of the American Recovery and Reinvestment Act of 2009, specifically the provisions of Subtitle D – Privacy , which shall hereinafter be included under references to HIPAA.

“Personal Data” (PD) means any information in any medium concerning an individual, which because of name, identifying number, mark or description can be associated with a particular individual. Protected Health Information and Electronic Protected Health Information as defined herein, constitute subsets of Personal Data.

“Privacy Rule” means the privacy regulations set forth in 45 C.F.R. Parts 160 and 164 and as amended.

“Protected Health Information” (PHI) means information in any form or medium that relates to the past, present or future, physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe can be used to identify the individual, that the Contractor receives, creates or uses under the Agreement. The terms “Protected Health Information” and “PHI” apply to the original data and to any data derived or extracted from the original data. PHI includes EPHI and is a subset of Personal Data.

“Required By Law” means a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law.

“Secretary” means the Secretary for the Office of Health and Human Services or his designee.

“Security Rule” means the Security standards for the protection of EPHI as set forth at 45 C.F.R. Parts 160, 162 and 164 and as amended.

“Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

III. OBLIGATIONS OF THE CONTRACTOR

Section 1. Compliance with State and Federal Law. The Contractor acknowledges that in the performance of the Contract, it may receive PHI.

The Contractor acknowledges that by accepting the PHI it becomes a “holder” within the meaning of M.G.L. c. 66A and that it must comply with the requirements of that law in addition to HIPAA. It also acknowledges that it must comply with all other applicable state or federal laws governing the privacy or security of any PHI received or created under the Contract. This includes, but is not limited to: the State confidentiality requirements governing the records of the Department’s (M.G.L. c. 123 §36; 104 CMR 28.09), M.G.L. c. 93H, and implementing regulations at 201 CMR 17.00.

Section 2. Ownership of PHI. The Contractor shall at all times recognize the Department as sole owner of the PHI. As owner of the PHI, the Department shall at all times have complete control over the access, use, disclosure and disposition of the PHI including, if relevant, editorial control over the output.

Section 3. Agreements by Third Parties. The Contractor shall not engage a subcontractor or agent that will receive PHI originating from the Department or create or receive PHI on behalf of the Department without prior authorization from the Department. If the Department authorizes the Contractor in advance to engage such a subcontractor or an agent, the Department shall obtain and maintain a written agreement with each agent or subcontractor. The agreement shall provide that such agent or subcontractor agrees to be bound by the same restrictions, terms and conditions that apply to the Contractor pursuant to the Contract (including these Business Associate terms and Conditions which are incorporated in full into the Contract) with respect to such PHI, including but not limited to implementing reasonable and appropriate safeguards to protect the information. All provisions of the Contract apply to all such PHI, whether in the possession of the Contractor or any agent or subcontractor. The Contractor is responsible for ensuring each agent’s and subcontractor’s compliance with all applicable provisions of the Contract. Upon request, the Contractor shall provide the Department with a copy of the written terms between the Contractor and the subcontractor or agent.

Section 4. Compliance with Use and Disclosure Provisions. Contractor agrees to comply with the use and disclosure provisions of HIPAA as established in 45 C.F.R. §164.502(e)(2) and the requirements of §164.504(e) shall apply to Contractor in the same way they apply to the Department.

Section 5. Security: Appropriate Safeguards. 45 C.F.R. §§164.308, 164.310, 164.312 and 164.316 shall apply to the Contractor. Contractor agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the PHI. Such safeguards shall meet, at a minimum, the standards as set forth in the Privacy and Security Rules, and Department standards. Appropriate safeguards shall include, at a minimum:

· Protecting the physical and electronic security of the PHI, including any data created, accessed, stored, or transmitted by electronic media.

· Compliance with applicable provisions of Executive Order 504.

· Not removing any data from Commonwealth premises, unless authorized under the contract.

· Not removing any data from the Contractor premises, unless the Contractor has a policy regarding when and how such data may be removed.

· Taking steps to prevent unauthorized access to the PHI, including preventing unauthorized access through the use of individual user accounts which are password protected and can be audited.

· Providing appropriate training in the privacy and security policies and procedures applicable to PHI for each of its employees, agents, or subcontractors who will have access to the Department’s PHI as set forth in applicable laws and regulations.

· Requiring each of its employees, agents, or subcontractors having any involvement with the PHI to comply with applicable laws and regulations relating to confidentiality and privacy of the PHI as well as the security of EPHI.

· To the extent that the Contractor’s employees physically work on site at the Department, they shall be subject to the Department’s Confidentiality and Security Policies and Procedures.

· Laptop security – When a laptop maintaining PHI is not in use, the PHI must be secured as encrypted files, or in an encrypted volume on the hard drive (Example: PGP Disk File and Disk Encryption). Laptops should not be left unattended and must be stored securely in locked cabinets or rooms. Portable electronic media used to maintain PHI must include encryption functionality, and must be stored in locked cabinets or rooms.

· USB Thumb Drives must have password or biometric protection to provide for encrypted file security. The encryption must be enabled whenever the PHI is not being used. (Example: the Lexar Jumpdrive Secure)

· PHI stored on a CD-Rom must be maintained in an encrypted file. (Example: WinZip 9 with 256 bit AES encryption)

· Unless otherwise authorized under the terms of the contract, all copies of any Department data stored on electronic storage media, including thumb drives, controlled by the Contractor, must be destroyed upon termination of this Agreement. Data must be destroyed so that it cannot be recovered from the electronic storage media. Acceptable methods include the use of file wiping software implementing at a minimum DoD.5200.28-STD (7) disk wiping, and the degaussing of backup tapes. Electronic storage media such as floppy disks, CDs, and DVDs used to store data must be made unusable by physical destruction.

· Upon request, the Contractor will furnish the Department with a description of the steps it has taken to prevent use or disclosure of the PHI not authorized by this Contract and agrees to allow authorized representatives of the Department access to premises where the PHI is kept for the purpose of inspecting security (physical and electronic) arrangements.

· The Contractor shall provide appropriate training regarding the requirements of this Agreement and its privacy and security procedures to any employee or agent accessing, Using or Disclosing PHI.

· The Contractor shall develop and implement a system of sanctions for any employee, agent or subcontractor who violated any of the terms and conditions of this Agreement. If at any time such sanctions are imposed, the Contractor shall document the details concerning such (who, what, when, why, etc.) and the documentation shall be provided to the Department on its request.

Section 6. Non-Secure Transmissions Prohibited. The Contractor agrees that it will not transmit the PHI over any unsecured network or over any wireless communication device without the prior written permission of the designated representative of the Department accessing the Contractor services under this Agreement. Transmissions over the Internet must be limited to the secure transmission protocols and methods specified in the Contract. The Contractor is expected to comply with NIST standard FIPS 140-2 when transmitting PHI over the Internet.

Section 7. Reporting of Breach or Security Incident. The Contractor shall notify the DMH Privacy Officer both orally and in writing within five days following the discovery of any breach of PHI, including but not limited to any use or disclosure of unsecured PHI not permitted by the contract or any security incident involving or potentially involving the Department’s PHI. The contact information for the Department’s Privacy Officer is:

Privacy Officer

Legal Division

Department of Mental Health

25 Staniford Street

Boston, MA 02114

(617) 626-8160

Fax (617) 626-8242

DMHPrivacyOfficer@MassMail.state.ma.us

The Contractor shall cooperate in the Department’s Breach analysis procedures, including risk assessment, if requested.

Section 8. Responsibility for Breach Notification. The Contractor shall pay the full cost of breach notification for any notification required under HIPAA or M.G.L. c. 93 A, for any breach for which Contractor, its agents or employees is responsible or any breach that occurred through its information system(s), whether the notice is given by the Department or Contractor.

Section 9. Mitigation. The Contractor must investigate all occurrences reported to the Department pursuant to Section 7 and to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of its use or disclosure of PHI in violation of the Contract or any security breach. The Contractor shall in consultation with the Department take measures that the Department deems appropriate to recover the PHI and prevent a future breach of the confidentiality and security of the PHI. The Contractor shall report to the Department the results of all mitigation actions taken. Nothing in this Section will be deemed to waive any of the Department’s legal rights or remedies that arise from the Contractor’s unauthorized use or disclosure of the PHI or security breach.

Section 10. Red Flags Rule. Where applicable, and at the direction of the Department, Contractor shall implement and maintain appropriate identity theft management programs in compliance with the federal Red Flags Rule.

Section 11. Notice of Request for Data. The Contractor agrees to notify the Department Privacy Officer within five (5) days of the Contractor’s receipt of any legal request, court order, or subpoena for PHI. To the extent that the Department decides to assume responsibility for challenging the validity of such requests, the Contractor agrees to cooperate fully with the Department in such challenge.

Section 12. Access to PHI. The Contractor shall provide the Department with access to or copies of any PHI, which it maintains pursuant to the Contract such access or copies, shall be provided to the Department or individual within five (5) days of a request.

Section 15. Access by Secretary to Records. The Contractor shall make available to the Department or the Secretary its internal practices, books, and records including policies and procedures relating to the use and disclosure of the PHI received from the Department, or created or received by the Contractor on behalf of the Department as well as policies and procedures relating to the confidentiality and security of the data. The Department or the Secretary shall determine the time and manner for making such material available for purposes of the Secretary determining the Department’s compliance with the Privacy and Security Rules.

Section 16. Prohibition on the Sale of PHI or Electronic Health Records. The Contractor shall comply with 45 C.F.R. § 164.502(a)(5), which prohibits the sale of electronic health records and PHI.

Section 17 Indemnification. The Contractor shall indemnify, defend and hold harmless Department from and against all claims, actions, damages, losses, liabilities, fines, penalties, costs or expenses (including, without limitation, reasonable attorneys’ fees) suffered by Department arising from or in connection with any breach of this Agreement, or any negligent or wrongful acts or omissions in connection with the Agreement, by Contractor or by its employees, directors, officers, subcontractors, or agents.

IV. PERMITTED USES AND DISCLOSURES BY THE CONTRACTOR

Section 1. Uses and Disclosures of PHI. The Contractor agrees to use or disclose PHI that it receives from and/or creates or receives on behalf of the Department only to perform his or her duties and responsibilities under the Contract.

Section 2. Minimum Necessary. The Contractor agrees to take reasonable steps to limit the amount of PHI used and/or disclosed pursuant to Section 1 above to the minimum necessary to achieve the purpose of the use and disclosure.

V. OBLIGATIONS OF THE DEPARTMENT

Section 1. Notice of Privacy Practices. The Department shall notify the Contractor of any limitation(s) in its notice of privacy practices in accordance with 45 C.F.R. § 164.520, to the extent that such limitation may affect the Contractor’s use or disclosure of PHI.

Section 2. Revocation of Permission to Use PHI. The Department shall notify the Contractor of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent that such changes may affect the Contractor’s use or disclosure of PHI.

Section 3. Restriction to Use or Disclose PHI. The Department shall notify the Contractor of any restriction to the use or disclosure of PHI that the Department has agreed to in accordance with 45 C.F.R. § 164.522, to the extent that such changes may affect the Contractor’s use or disclosure of PHI.

Section 4. Notice of Changes and Restrictions. Department shall notify Contractor of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent such changes affect Contractor’s permitted or required uses and disclosures. Such notification shall include any restriction that Department has agreed to in accordance with 45 C.F.R. § 164.522. If Contractor receives a request to restrict the disclosure of PHI directly from an Individual, Contractor shall notify Department of such request and Department shall be responsible for making the determination, in accordance with the Privacy Rule, as to whether Contractor shall comply with the Individual's request.

VI. TERMINATION OR COMPLETION OF CONTRACT WITH THE CONTRACTOR

Section 1. Termination Upon Breach of Confidentiality or Security Provisions Applicable to PHI. The Department may terminate the Contract immediately upon written notice, if the Department determines, in its sole discretion, that the Contractor has materially breached any of its obligations regarding PHI. Prior to terminating this Contract as permitted above, the Department, in its sole discretion, may provide an opportunity for the Contractor to cure the breach or end the violation. If such an opportunity is provided, but cure is not feasible, or the Contractor fails to cure the breach or end the violations within a time period set by the Department, the Department may terminate the Contract immediately upon written notice.

Section 2. Termination is Not Feasible. If termination of this Contract is not feasible, in the Department’s sole discretion, the Contractor hereby acknowledges that the Department will have the right to report this breach to the Secretary, notwithstanding any other provisions of this Agreement to the contrary.

Section 3. Effect of Termination or Completion.

A. The Contractor agrees that within 14 days of the termination or completion of this Contract, it will return or destroy, at the Department’s direction and according to standards approved by the Department, any and all PHI that it maintains in any form, including PHI that is in the possession of its subcontractors or agents and will retain no copies of the PHI.

B. Notwithstanding the foregoing, to the extent that the Department agrees that if it is not feasible to return or destroy such PHI, all protections pertaining to any PHI covered by the Contract shall remain in force and the Contractor will limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such PHI.

VII. MISCELLANEOUS PROVISIONS

Section 1. Regulatory References. A reference in this Agreement to a section of the Privacy or Security Rule means the section as in effect or as amended.

Section 2. Survival. The obligations of the Contractor under Part VI of this Agreement shall survive the termination of this agreement.

Section 3. Amendment. The Contractor and the Department agree to negotiate to amend the Business Associate Agreement to the extent necessary to allow either party to comply with amendments to the Privacy or Security Rules or the Standards for Electronic Transactions.

Section 4. Remedies. Nothing in this Agreement shall be construed to waive or limit any of the Department’s legal rights or remedies that may arise from the Contractor’s unauthorized use or disclosure of PHI or security breach. The Department’s exercise or non-exercise of any authority under the Agreement including, for example, any rights of inspection or approval of privacy or security practices or approval of subcontractors, shall not relieve the Contractor of any obligations as set forth herein nor be construed as a waiver of any of the Contractor’s obligations, or as an acceptance of any unsatisfactory practices, or privacy or security failures by the Contractor.

Section 5. Interpretation. Any ambiguity in this Agreement shall be resolved to permit the Department to comply with HIPAA’s Privacy or Security Rules, M.G.L. c. 66A, M.G.L. c. 93 H, and any other law pertaining to the privacy or security of PHI.

� Hereinafter this agreement shall use the reference “PHI” to conform to the terms of the HIPAA Privacy Rule. However, to the extent that Contractor holds any PD, as defined by M.G.L. c. 66A, which does not constitute PHI, the PD shall also be covered under all the terms of this agreement that refer to PHI.