7. DMH Business Associate Terms and Conditions 2017~1.doc

STANDARD TERMS AND CONDITIONS

I. GENERAL PROVISIONS

Section 1. Department. The Department of Mental Health (Department) is a Covered Entity under the Health Insurance Portability and Accountability Act (HIPAA) and therefore subject to the HIPAA Privacy and Security Rules. It is also an agency of the Commonwealth of Massachusetts and subject to the Fair Information Practices Act (FIPA), M.G.L. c. 66A; M.G.L. c. 93H and State confidentiality requirements governing the records of the Department (M.G.L c. 123, §36; 104 CMR 27.17 & 28.09).

Section 2. Business Associate. The Contractor providing services to the Department pursuant to the contract awarded under the Western Massachusetts Respite Services: Request For Response (DMH Document Number 2017-DMH-3048-01) to which these Massachusetts Department of Mental Health Respite Business Associate Agreement Standard Terms and Conditions (Business Associate Agreement) are attached (hereinafter the RFR and the resulting contract are are referred to as the “Contract”) is a Business Associate of the Department as the term is defined in 45 CFR 160.103.

Section 3. Business Associate Agreement. This Business Associate Agreement is intended to protect the privacy and security of all Personal Data, including Protected Health Information, that the Contractor may receive from and/or create on behalf of the Department in the performance of its duties and responsibilities under the Contract, and to ensure that the Department complies with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HIPAA Privacy and Security Rules, 45 CFR Parts 160 and 164, and the HITECH Act; the Fair Information Practices Act (FIPA), M.G.L. c. 66A; M.G.L. c. 93H and State confidentiality requirements governing the records of the Department (M.G.L c. 123, §36; 104 CMR 27.17 & 28.09).

II. DEFINITIONS FOR USE IN THIS SECTION

All terms used, but not otherwise defined herein shall be construed in a manner consistent with the HIPAA Privacy and Security Rules, The Fair Information Practices Act, and other applicable state or federal privacy or confidentiality laws.

“Breach” means the acquisition, access, use, or disclosure of protected health information in a manner not permitted under HIPAA or M.G.L. c. 93 H which compromises the security or privacy of the PHI.

“Business Associate” means a person or entity, who, on behalf of a covered component of the Department, and other than in the capacity of a workforce member, performs or assists in the performance of a function or activity that involves the use or disclosure of protected health information; or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation or financial services, where the provision of the service involves the use or disclosure of protected health information.

“Data Subject” means an individual to whom Personal Data or Protected Health Information refers.

“Electronic Media” means:

· Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card; or

· Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the internet (wide-open), extranet (using internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Faxes sent directly from one fax machine to another, person-to-person telephone calls, video teleconferencing, and messages left on voice-mail are not considered transmission media. However, any faxes sent from a computer, including those made by a fax-back system, are considered transmission media.

“Electronic Protected Health Information” (EPHI) means PHI that is created, accessed, stored, or transmitted by electronic media.

“The Health Insurance Portability and Accountability Act” (HIPAA) means Public Law 104-191.

“The HITECH Act” means Title XIII of the American Recovery and Reinvestment Act of 2009, specifically the provisions of Subtitle D – Privacy , which shall hereinafter be included under references to HIPAA.

“Personal Data” (PD) means any information in any medium concerning an individual, which because of name, identifying number, mark or description can be associated with a particular individual. Protected Health Information and Electronic Protected Health Information as defined herein, constitute subsets of Personal Data.

“Privacy Rule” means the privacy regulations set forth in 45 CFR Parts 160 and 164 and as amended.

“Protected Health Information” (PHI) means information in any form or medium that relates to the past, present or future, physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe can be used to identify the individual, that the Contractor receives, creates or uses under the Contract. The terms “Protected Health Information” and “PHI” apply to the original data and to any data derived or extracted from the original data. PHI includes EPHI and is a subset of Personal Data.

“Required By Law” means a mandate contained in law that compels an entity to make a use or disclosure of protected health information and that is enforceable in a court of law.

“Secretary” means the Secretary for the Office of Health and Human Services or his designee.

“Security Rule” means the Security standards for the protection of EPHI as set forth at 45 CFR Parts 160, 162 and 164 and as amended.

“Security Incident” means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

III. OBLIGATIONS OF THE CONTRACTOR

Section 1. Compliance with State and Federal Law. The Contractor acknowledges that in the performance of the Contract, it may receive PHI.

The Contractor acknowledges that by accepting the PHI it becomes a “holder” within the meaning of M.G.L. c. 66A and that it must comply with the requirements of that law in addition to HIPAA. It also acknowledges that it must comply with all other applicable state or federal laws governing the privacy or security of any PHI received or created under the Contract. This includes, but is not limited to: the State confidentiality requirements governing the records of the Department’s (M.G.L. c. 123 §36; 104 CMR 27.17 and 28.09), M.G.L. c. 93H and implementing regulations at 201 CMR 17.00.

Section 2. Ownership of PHI. The Contractor shall at all times recognize the Department as sole owner of the PHI. As owner of the PHI, the Department shall at all times have complete control over the access, use, disclosure and disposition of the PHI including, if relevant, editorial control over the output.

Section 3. Agreements With Third Parties. The Contractor shall not engage a subcontractor or agent that will receive PHI originating from the Department or create or receive PHI on behalf of the Department without prior authorization from the Department. If the Department authorizes the Contractor in advance to engage such a subcontractor or an agent, the Department shall obtain and maintain a written agreement with each agent or subcontractor. The subcontract shall provide that such agent or subcontractor agrees to be bound by the same restrictions, terms and conditions that apply to the Contractor pursuant to this Contract with respect to such PHI, including but not limited to implementing reasonable and appropriate safeguards to protect the information. All provisions of the Contract apply to all such PHI, whether in the possession of the Contractor or any agent or subcontractor. The Contractor is responsible for ensuring each agent’s and subcontractor’s compliance with all applicable provisions of the Contract. Upon request, the Contractor shall provide the Department with a copy of the written terms between the Contractor and the subcontractor or agent.

Section 4. Compliance with Use and Disclosure Provisions. In addition to Part IV, below, Contractor agrees to comply with the use and disclosure provisions of HIPAA as established in 45 CFR §164.502(e)(2) and the requirements of §164.504(e) shall apply to Contractor in the same way they apply to the Department.

Section 5. Security: Appropriate Safeguards. 45 CFR §§164.308, 164.310, 164.312 and 164.316 shall apply to the Contractor. Contractor agrees to implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the PHI. Such safeguards shall meet, at a minimum, the standards as set forth in the Privacy and Security Rules, and Department standards. Appropriate safeguards shall include, at a minimum:

· Protecting the physical and electronic security of the PHI, including any data created, accessed, stored, or transmitted by electronic media.

· Compliance with applicable provisions of Executive Order 504.

· Not removing any data from Commonwealth premises, unless authorized under the contract.

· Not removing any data from the Contractor premises, unless the Contractor has a policy regarding when and how such data may be removed.

· Taking steps to prevent unauthorized access to the PHI, including preventing unauthorized access through the use of individual user accounts which are password protected and can be audited.

· Providing appropriate training in the privacy and security policies and procedures applicable to PHI for each of its employees, agents, or subcontractors who will have access to the Department’s PHI as set forth in applicable laws and regulations.

· Requiring each of its employees, agents, or subcontractors having any involvement with the PHI to comply with applicable laws and regulations relating to confidentiality and privacy of the PHI as well as the security of EPHI.

· To the extent that the Contractor’s employees physically work on site at the Department, they shall be subject to the Department’s Confidentiality and Security Policies and Procedures.

· Laptop security – When a laptop maintaining PHI is not in use, the PHI must be secured as encrypted files, or in an encrypted volume on the hard drive (Example: PGP Disk File and Disk Encryption). Laptops should not be left unattended and must be stored securely in locked cabinets or rooms. Portable electronic media used to maintain PHI must include encryption functionality, and must be stored in locked cabinets or rooms.

· USB Thumb Drives must have password or biometric protection to provide for encrypted file security. The encryption must be enabled whenever the PHI is not being used. (Example: the Lexar Jumpdrive Secure)

· PHI stored on a CD-Rom must be maintained in an encrypted file. (Example: WinZip 9 with 256 bit AES encryption)

· Unless otherwise authorized under the terms of the Contract, all copies of any Department data stored on electronic storage media, including thumb drives, controlled by the Contractor, must be destroyed upon termination of the Contract

· Data must be destroyed so that it cannot be recovered from the electronic storage media. Acceptable methods include the use of file wiping software implementing at a minimum DoD.5200.28-STD (7) disk wiping, and the degaussing of backup tapes. Electronic storage media such as floppy disks, CDs, and DVDs used to store data must be made unusable by physical destruction.

· Upon request, the Contractor will furnish the Department with a description of the steps it has taken to prevent use or disclosure of the PHI not authorized by this Contract and agrees to allow authorized representatives of the Department access to premises where the PHI is kept for the purpose of inspecting security (physical and electronic) arrangements.

· The Contractor shall provide appropriate training regarding the requirements of this Business Associate Agreement and its privacy and security procedures to any employee or agent accessing, Using or Disclosing PHI.

· The Contractor shall develop and implement a system of sanctions for any employee, agent or subcontractor who violated any of the terms and conditions of this Business Associate Agreement. If at any time such sanctions are imposed, the Contractor shall document the details concerning such (who, what, when, why, etc.) and the documentation shall be provided to the Department on its request.

Section 6. Non-Secure Transmissions Prohibited. The Contractor agrees that it will not transmit the PHI over any unsecured network or over any wireless communication device without the prior written permission of the designated representative of the Department. Transmissions over the Internet must be limited to the secure transmission protocols and methods specified in the Contract. The Contractor is expected to comply with NIST standard FIPS 140-2 when transmitting PHI over the Internet.

Section 7. Reporting of Breach or Security Incident. The Contractor shall notify the DMH Privacy Officer both orally and in writing within five days following the discovery of any breach of PHI, including but not limited to any use or disclosure of unsecured PHI not permitted by the contract or any security incident involving or potentially involving the Department’s PHI. The contact information for the Department’s Privacy Officer is:

Privacy Officer

Legal Division

Department of Mental Health

25 Staniford Street

Boston, MA 02114

(617) 626-8160

Fax (617) 626-8242

DMHPrivacyOfficer@MassMail.state.ma.us

The Contractor shall cooperate in the Department’s Breach analysis procedures, including risk assessment, if requested.

Section 8. Responsibility for Breach Notification. The Contractor shall pay the full cost of breach notification for any notification required under HIPAA or M.G.L. c. 93 A, for any breach for which Contractor, its agents or employees is responsible or any breach that occurred through its information system(s), whether the notice is given by the Department or Contractor.

Section 9. Mitigation. The Contractor must investigate all occurrences reported to the Department pursuant to Part III, Section 7 and to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of its use or disclosure of PHI in violation of the Contract or any security breach. The Contractor shall in consultation with the Department take measures that the Department deems appropriate to recover the PHI and prevent a future breach of the confidentiality and security of the PHI. The Contractor shall report to the Department the results of all mitigation actions taken. Nothing in this Section will be deemed to waive any of the Department’s legal rights or remedies that arise from the Contractor’s unauthorized use or disclosure of the PHI or security breach.

Section 10. Red Flags Rule. Where applicable, and at the direction of the Department, the Contractor shall implement and maintain appropriate identity theft management programs in compliance with the federal Red Flags Rule.

Section 11. Notice of Request for Data. The Contractor agrees to notify the Department Privacy Officer promptly, but no later than one business day of the Contractor’s receipt of any legal request, court order, or subpoena for PHI. To the extent that the Department decides to assume responsibility for challenging the validity of such requests, the Contractor agrees to cooperate fully with the Department in such challenge as set forth in Part IV.

Section 12. Access to PHI.

The Contractor must take such reasonable measures as the Department determines are necessary for the Department to satisfy its obligations under 45 CFR 164.525-164.528 and M.G.L. c. 66A. These actions include, but are not limited to the following:

A. Department’s Access to PHI. Within five (5) business days of the Department making a request, the Contractor must provide the Department with access to or copies of any PHI that it maintains pursuant to the Contract.

B. Amendments. Within five (5) business days of the Department making a request, the Contractor must make available to the Department PHI for amendment purposes and it shall incorporate any amendments that are made to the PHI in accordance with 45 CFR 164.526.

Section 13. Accounting of Disclosures. The Contractor shall document PHI disclosures and required information related to such disclosures, as is necessary for the Department to respond to an individual’s request for accounting of disclosures of PHI under 45 CFR § 164.528 and M.G.L. c. 66A. The Contractor agrees to provide to the Department or the individual, within ten (10) days of the request an accounting of disclosures of PHI. At a minimum, the Contractor will provide the following information: (i) the date of the disclosure, (ii) the name of the entity or person who received the PHI, and if known, the address of such entity or person, (iii) a brief description of the PHI disclosed, and (iv) a brief statement of the purpose of such disclosure which includes an explanation of the basis for such disclosure. The Contractor agrees to implement an appropriate record keeping process to enable it to comply with the requirements of this Section and to provide upon the Department’s request documentation of its method of tracking disclosures and a list of all accountings of disclosures provided under this Section.

Section 14. Access by Secretary to Records. The Contractor shall make available to the Department or the Secretary its internal practices, books, and records including policies and procedures relating to the use and disclosure of the PHI received from the Department, or created or received by the Contractor on behalf of the Department as well as policies and procedures relating to the confidentiality and security of the data. The Department or the Secretary shall determine the time and manner for making such material available for purposes of the Secretary determining the Department’s compliance with the Privacy and Security Rules.

Section 15. Prohibition on the Sale of PHI or Electronic Health Records. The Contractor shall comply with 45 CFR § 164.502(a)(5), which relates to the prohibition on the sale of electronic health records and PHI.

Section 16 Indemnification. The Contractor shall indemnify, defend and hold harmless Department from and against all claims, actions, damages, losses, liabilities, fines, penalties, costs or expenses (including, without limitation, reasonable attorneys’ fees) suffered by Department arising from or in connection with any breach of this Business Associate Agreement, or any negligent or wrongful acts or omissions in connection with this Business Associate Agreement, by Contractor or by its employees, directors, officers, subcontractors, or agents.

IV. PERMITTED USES AND DISCLOSURES BY THE CONTRACTOR

Section 1. Uses and Disclosures of PHI. The Contractor agrees to use or disclose PHI that it receives from and/or creates or receives on behalf of the Department only as specified in Part III, Section 4; Part IV or as required by law. if a Disclosure is being made as it is Required by Law, the Contractor must obtain reasonable assurances from the person to whom the PHI is Disclosed that the information will remain confidential and used or further disclosed only as Required by Law or for the purposes for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the PHI has been breached.

A. To Perform the Contract. The Contractor may use or disclose PHI, or create PHI on behalf of the Department, as is necessary for the Contractor to administer or perform the functions, activities and services that are required to satisfy its obligations under the Contract. This shall include providing the Secretary and the Department with full access to such PHI for purposes of auditing the performance of the Contractor under the Contract and as the Department determines is otherwise necessary for: (1) providing treatment to individuals receiving services under the Contract; (2) the payment for or reimbursement of those services; and/or (3) health care operations. Operations shall include reporting to the Department to fulfill state or federal reporting requirements. If the Contractor concludes that a client authorization is required for the release of PHI to the Department as required in this Section, the Contractor agrees to timely secure client authorizations.

B. For Research or Publication. The Contractor agrees that it shall not conduct any research utilizing the PHI received from the Department or created or derived from the contracted data for research purposes without application to and the written approval of the Department Central Office Research Review Committee (its Institutional Review Board) for the specific research. Further the Contractor agrees that it shall not utilize the PHI received from or created or derived from the contracted data without the written approval of the Department for the specific publication.

C. For Management and Administration. The Contractor may use PHI that it receives from and/or creates or receives on behalf of the Department for the proper management and administration of the Contractor as provided for by 45 CFR § 164.504(e)(4), provided that such use complies with the requirements of the Contract, including, but not limited to this Business Associate Agreement, and all other applicable state or federal privacy or confidentiality laws.

D. As Required By law. Contractor may Use or Disclose PHI as Required By Law; provided, however, that, if a Disclosure is to be made pursuant to a subpoena or judicial or administrative order, the Contractor’s must first notify the Department (Part III, Section 11) of the receipt the subpoena or judicial or administrative order to disclose PHI and if the Department decides to assume responsibility for challenging the validity of such subpoena or order, the Contractor agrees to cooperate with Department in such challenge. In addition, if a Disclosure is being made as it is Required by Law, the Contractor must obtain reasonable assurances from the person to whom the PHI is Disclosed that the information will remain confidential and used or further disclosed only as Required by Law or for the purposes for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the PHI has been breached.

E. Use and Disclosure Limitations. Notwithstanding anything in this Part IV to the contrary, the Contractor may not Use or Disclose PHI received or created by it in performing its duties and responsibilities under the Contract if:

1.

The Use or Disclosure would violate HIPAA if done by the Department.

2.

The Use or Disclosure would conflict with a statement made in the Department of Mental Health Notice of Privacy Practices, which may be changed from time to time. A current copy of the Privacy Notice may be found on the Department’s Internet Site (www.Mass.gov/eohhs/gov/departments/dmh/).

3.

The Use or Disclosure would conflict with a restriction on Use or Disclosure of PHI to which the Department agreed pursuant to 45 CFR § 164.522 and of which the Department informed the Contractor of in writing.

Section 2. Minimum Necessary. The Contractor agrees to take reasonable steps to limit the amount of PHI used and/or disclosed pursuant to this Part IV to the minimum necessary to achieve the purpose of the use and disclosure.

V. OBLIGATIONS OF THE DEPARTMENT

Section 1. Notice of Privacy Practices. The Department shall notify the Contractor of any limitation(s) in its notice of privacy practices in accordance with 45 CFR § 164.520, to the extent that such limitation may affect the Contractor’s use or disclosure of PHI.

Section 2. Revocation of Permission to Use PHI. The Department shall notify the Contractor of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent that such changes may affect the Contractor’s use or disclosure of PHI.

Section 3. Restriction to Use or Disclose PHI. The Department shall notify the Contractor of any restriction to the use or disclosure of PHI that the Department has agreed to in accordance with 45 CFR § 164.522, to the extent that such changes may affect the Contractor’s use or disclosure of PHI.

Section 4. Notice of Changes and Restrictions. Department shall notify Contractor of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent such changes affect Contractor’s permitted or required uses and disclosures. Such notification shall include any restriction that Department has agreed to in accordance with 45 CFR § 164.522. If Contractor receives a request to restrict the disclosure of PHI directly from an Individual, Contractor shall notify Department of such request and Department shall be responsible for making the determination, in accordance with the Privacy Rule, as to whether Contractor shall comply with the Individual's request.

VI. TERMINATION OR COMPLETION OF CONTRACT WITH THE CONTRACTOR

Section 1. Termination Upon Breach of Confidentiality or Security Provisions Applicable to PHI. The Department may terminate the Contract immediately upon written notice, if the Department determines, in its sole discretion, that the Contractor has materially breached any of its obligations regarding PHI. For purposes of the termination provisions set forth in the Commonwealth Terms and Conditions for Human and Social Services, if applicable to the Contract, such a breach shall be considered to be one that poses an immediate threat to the life, health or safety of a client.

Prior to terminating this Contract as permitted above, the Department, in its sole discretion, may provide an opportunity for the Contractor to cure the breach or end the violation. If such an opportunity is provided, but cure is not feasible, or the Contractor fails to cure the breach or end the violations within a time period set by the Department, the Department may terminate the Contract immediately upon written notice.

Section 2. Termination is Not Feasible. In the event that termination of this Contract is not feasible, in the Department’s sole discretion, the Contractor hereby acknowledges that the Department will have the right to report this breach to the Secretary, notwithstanding any other provisions of this Business Associate Agreement to the contrary.

Section 3. Effect of Termination or Completion.

A. The Contractor agrees that within 14 days of the termination or completion of this Contract, it will return or destroy, at the Department’s direction and according to standards approved by the Department, any and all PHI that it maintains in any form, including PHI that is in the possession of its subcontractors or agents and will retain no copies of the PHI.

B. Notwithstanding the foregoing, to the extent that the Department agrees that if it is not feasible to return or destroy such PHI, all protections pertaining to any PHI covered by the Contract shall remain in force and the Contractor will limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such PHI.

VII. MISCELLANEOUS PROVISIONS

Section 1. Regulatory References. A reference in this Business Associate Agreement to a section of the Privacy or Security Rule means the section as now in effect or if subsequently amended as amended.

Section 2. Survival. The obligations of the Contractor under Part VI of this Business Associate Agreement shall survive the termination of the Contract.

Section 3. Amendment. The Contractor and the Department agree to negotiate to amend the Contract (and this Business Associate Agreement) to the extent necessary to allow either party to comply with any amendments to the Privacy or Security Rules or the Standards for Electronic Transactions.

Section 4. Remedies. Nothing in this Business Associate Agreement shall be construed to waive or limit any of the Department’s legal rights or remedies that may arise from the Contractor’s unauthorized use or disclosure of PHI or security breach. The Department’s exercise or non-exercise of any authority in the Contract (including this Business Associate Agreement) including, for example, any rights of inspection or approval of privacy or security practices or approval of subcontractors, shall not relieve the Contractor of any obligations as set forth in the Contract nor be construed as a waiver of any of the Contractor’s obligations, or as an acceptance of any unsatisfactory practices, or privacy or security failures by the Contractor.

Section 5. Interpretation. Any ambiguity in this Business Associate Agreement shall be resolved to permit the Department to comply with HIPAA’s Privacy or Security Rules, M.G.L. c. 66A, M.G.L. c. 93 H, and any other law pertaining to the privacy or security of PHI.

Section 6. No Third Party Beneficiaries. Nothing expressed or implied in this Business Associate Agreement is intended to confer, nor shall anything herein confer, upon any person or entity, other than the Department and the Contractor any rights, remedies, obligations or liabilities whatsoever. None of the provisions of this Business Associate Agreement are intended to create, nor will they be deemed to create any relationship between the parties other than that of independent parties contracting with each other solely for the purposes of effecting the provisions of the Contract.

Section 7. Waiver. No change, waiver or discharge of any liability or obligation under this Business Associate Agreement on any one or more occasions shall be deemed a waiver of performance of any continuing or other obligation, or shall prohibit enforcement of any obligation on any other occasion.

� Hereinafter this Business Associate Agreement shall use the reference “PHI” to conform to the terms of the HIPAA Privacy Rule. However, to the extent that Contractor holds any PD, as defined by M.G.L. c. 66A, which does not constitute PHI, the PD shall also be covered under all the terms of this Agreement that refer to PHI.

PAGE