Attachment_4_Business_Associate_Agreement.pdf

TEMPLATE

HIPAA-Required

BUSINESS ASSOCIATE AGREEMENT

Between the

UNITED STATES COAST GUARD (USCG)

and

[ENTER BUSINESS ASSOCIATE/CONTRACTOR HERE]

1. Parties. The parties to this Business Associate Agreement (BAA) are the United States Coast

Guard (“USCG”)—the HIPAA covered entity—and [INSERT BUSINESS

ASSOCIATE/CONTRACTOR NAME] (“Business Associate or BA”) having its offices at

[BUSINESS ASSOCIATE/CONTRACTOR ADDRESS] (collectively the “Parties”).

2. Authorities.

2.1. HIPAA Rules: Health Insurance Portability and Accountability Act of 1996 (HIPAA), Pub. L. No. 104-191, 110 Stat. 1936 – Privacy, Security, Breach, Breach Notification, and

Compliance & Enforcement Rules, 45 CFR Parts 160 and 164; combined regulation text at https://www.hhs.gov/sites/default/files/hipaa-simplification-201303.pdf.

2.2. DoD Policy – via Military Health System: 1 DoD Manual 6025.18, Implementation of the

HIPAA Privacy Rule in DoD Health Care Programs (by virtue of the USCG organized health care arrangement with the Military Health System (MHS), a single DoD covered entity)

2.3. USCG: Coast Guard Medical Manual, COMDTINST M6000.1 (series)

3. Purpose. The Parties enter into this BAA to ensure that, while performing the specific functions, activities, or services on behalf of the USCG that involve access to, and use and disclosure of PHI, the

Business Associate will appropriately safeguard PHI in compliance with Federal laws.

4. Background. The HIPAA Rules set national standards for the protection and security of PHI by covered entities who conduct the standard health care transactions electronically. By virtue of its clinic operations and health care providers, HIPAA Rules require the USCG to enter into BAAs with Business

Associates who perform services involving PHI. This BAA serves to clarify and limit, as appropriate, the permissible uses and disclosures of PHI by the Business Associate, based on the relationship between the

Parties and the activities or services being performed by the Business Associate for the USCG. The

Business Associate may use or disclose PHI only as permitted or required by this BAA or as required by law.

5. Definitions of Terms Used in This BAA.

5.1. Catchall Definitions: The following terms shall have the same meaning as those terms are defined in the HIPAA Rules: Data Aggregation, Disclosure, Health Care Operations, 1 DoD Manual 6025.18, “Implementation of the Health Insurance Portability And Accountability Act (HIPAA) Privacy Rule in

DoD Health Care Programs” (March 13, 2019), establishes rules and procedures for uses and disclosures of Protected Health

Information (PHI) in the conduct of health care operations by DoD covered entities. All covered entities of the MHS (including health care providers) are designated as a single covered entity. Accordingly, MHS—a single covered entity—is part of an organized health care arrangement with certain elements of the Coast Guard. Those elements are (1) health care providers under the control of the Commandant and the Director, Health, Safety, and Work-life Directorate (CG-11); and (2) the Health Care

Program (CG-112), extending to the Coast Guard the status of a covered entity under HIPAA.

https://www.hhs.gov/sites/default/files/hipaa-simplification-201303.pdf

USCG Business Associate Agreement Template

p. 2

Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health

Information (PHI), Required By Law, Security Incident, Subcontractor, and Use.

5.2. Specific Definitions (in alphabetical order):

a. Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate performs services involving access to PHI on behalf of the USCG to this BAA.

b. Breach means the suspected or confirmed acquisition, access, use, or disclosure of protected health information in a manner not permitted which compromises the security or privacy of the protected health information as defined in 45 CFR

§ 164.402.

c. Business Associate shall generally have the same meaning as the term “business associate” at 45 CFR § 160.103, and specific to this BAA, shall mean [insert name of Business Associate to this BAA].

d. Covered Entity shall generally have the same meaning as the term “covered entity” at 45 CFR § 160.103, and specific to this BAA, shall mean the USCG.

e. Designated Record Set means a group of records (maintained by or for the

USCG as a HIPAA Covered Entity) that comprises medical and billing records;

enrollment, payment, claims adjudication, and case medical management records; or other records that are used, in whole or in part, to make health-related decisions about individuals as per 45 CFR § 164.501.

f. Minimum Necessary is when a covered entity is using or disclosing PHI all parties must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request as per 45

CFR § 164.50

g. USCG HIPAA-Privacy Office means one or more offices with oversight authority over Privacy Act and HIPAA privacy compliance, and may include the DHS Privacy Office; the USCG Chief Privacy Officer (CG-6P); and/or the

HIPAA Privacy/Security Officer (CG-12).

6. Obligations and Activities of the Business Associate.

6.1. The Business Associate shall not use or disclose PHI other than as permitted or required by the Agreement or as required by law.

6.2. The Business Associate shall use appropriate safeguards, and comply with the

HIPAA Rules with respect to electronic PHI, and to prevent use or disclosure of

p. 3

PHI other than as provided for by the Agreement.

6.3. The Business Associate shall report to the Covered Entity any breach of which it becomes aware in compliance with 45 C.F.R. 164.410and shall comply with breach response steps as required by Section 10 of this BAA. With respect to electronic

PHI, the Business Associate shall also respond to any security incident(s) of which it becomes aware in accordance with any Information Assurance provisions of the

Agreement. If at any point the Business Associate becomes aware that a security incident involves a Breach, the Business Associate shall immediately initiate breach response steps as required by Section 10 of this BAA.

6.4. In accordance with 45 C.F.R. Parts 164.502(e)(1)(ii)) and 164.308(b)(2), respectively and as applicable, the Business Associate shall ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the

Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such PHI.

6.5. The Business Associate shall make available PHI in a Designated Record Set, to the

Covered Entity or, as directed by the Covered Entity, to an Individual, as necessary to satisfy the Covered Entity obligations under 45 C.F.R. 164.524.

6.6. The Business Associate shall make any amendment(s) to PHI in a Designated

Record Set as directed or agreed to by the Covered Entity pursuant to 45 C.F.R.

164.526, or take other measures as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. 164.526.

6.7. The Business Associate shall maintain and make available the information required to provide an accounting of disclosures to the Covered Entity or an individual as necessary to satisfy the Covered Entity’s obligations under 45 C.F.R. 164.528.

6.8. To the extent the Business Associate is to carry out one or more of Covered Entity's obligation(s) under the HIPAA Rules, the Business Associate shall comply with the requirements of the HIPAA Privacy Rule that applies to the Covered Entity in the performance of such obligation(s); and

6.9. The Business Associate shall make its internal practices, books, and records available to the USCG Commandant or designee for purposes of determining compliance with the HIPAA Rules.

7. Permitted Uses and Disclosures by the Business Associate.

7.1 The Business Associate may only use or disclose PHI as necessary to perform the services set forth in the service agreement to which this BAA is included in (the

Agreement), or as required by law. The Business Associate is not permitted to de-

p. 4 identify PHI under the HIPPA Rules at 45 C.F.R. 164.514(a)-(c), nor is it permitted to use or disclose de-identified PHI, except as provided by this Agreement or directed by the Covered Entity.

7.2 The Business Associate agrees to make reasonable efforts to limit the use, disclosure, or request of PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request in accordance with the HIPAA Rule’s minimum necessary standard.

7.3 The Business Associate shall not use or disclose PHI in a manner that would violate the HIPAA Rule if done by the Covered Entity, except uses and disclosures for the

Business Associate’s own management, administration, and legal responsibilities or for data aggregation services as set forth in the following three paragraphs:

a. Use. Except as otherwise limited in the Agreement, the Business Associate may internally use PHI for the proper management and administration of the

Business Associate, or to carry out the legal responsibilities of the Business

Associate. The foregoing authority to use PHI does not apply to disclosure of

PHI, which is covered in the next paragraph.

b. Disclosure. Except as otherwise limited in the Agreement, the Business

Associate may internally disclose PHI for the proper management and administration of the Business Associate, or to carry out the legal responsibilities of the Business Associate, provided that disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the PHI is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person. The person to whom the Business Associate has disclosed PHI must notify the Business Associate of any known or suspected incidents/breach of the PHI once disclosed.

c. Data Aggregation Services. Except as otherwise limited in the Agreement, the

Business Associate may use PHI to provide Data Aggregation services only relating to the Covered Entity’s health care operations.

8. Provisions for the Covered Entity to Inform Business Associate of Privacy Practices

Restrictions.

8.1. The Covered Entity shall provide the Business Associate with the Notice of Privacy

Practices (NoPPs) that the Covered Entity produces in accordance with 45 C.F.R. 164.520.

8.2. The Covered Entity shall notify the Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose his or her PHI, to the extent that such changes affect the Business Associate’s use or disclosure of PHI.

p. 5

8.3. The Covered Entity shall notify the Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by under 45

C.F.R. 164.522 (in accordance with the patient’s request to restrict uses and disclosures) to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

9. Permissible Requests by the USCG.

The Covered Entity shall not request the Business Associate to use or disclose PHI in any manner that would not be permissible under the HIPAA Rule if done by the Covered Entity, except for providing Data Aggregation services to the Covered Entity and for management and administrative activities of the Business Associate as otherwise permitted by this BAA.

10. Breach Response, Notification, and Reporting.

[The parties may wish to add additional specificity regarding the breach notification obligations of the business associate, such as a stricter timeframe for the business associate to report a potential breach to the covered entity and/or whether the business associate will handle breach notifications to individuals, the HHS Office for Civil Rights (OCR), and potentially the media, on behalf of the covered entity.]

10.1. In the event of unauthorized use, access to, or disclosure of PHI, hereinafter referred to as a breach, held by the Business Associate, the Business Associate shall follow the breach response requirements set forth in the Agreement’s Homeland Security Acquisition

Regulation (HSAR) clauses, the Privacy Incident Response, Notification, and Reporting

Procedures for Personally Identifiable Information (PII), COMDINST 5260.5 (series), and the HIPAA Rules.

10.2. Reporting Provisions. The Business Associate is deemed to have discovered a breach as of the time a breach (suspected or confirmed) is known, or by exercising reasonable diligence would have been known, to any person (other than the person committing it) who is an employee, officer or other agent of the Business Associate.

a. All initial and subsequent reports shall be provided to the USCG Privacy and HIPAA

Officers, as well as the, the Contracting Officer (KO) and Contracting Officer’s

Representative (COR), [add contact information] if applicable, or the Business

Associate’s USCG POC.

b. The Business Associate shall make an initial report of a breach within one hour of discovery either via phone or email, which should include as much information as possible. Encryption is not required for the initial notification, because the notification should not contain PII/PHI. If electronic mail is not available, telephone notification is also acceptable, but all notification and reports delivered telephonically must be confirmed by email as soon as technically feasible.

c. Within 24 hours, the remaining required data should be provided in a supplemental report.

I. Termination

p. 6

(a) Termination. Noncompliance by the Business Associate (or any of its staff, agents, or subcontractors) with any requirement in this BAA may subject the Business Associate to termination under any applicable default or other termination provision of the Agreement.

(b) Effect of Termination.

(1) If the Agreement has records management requirements, the Business Associate shall handle such records in accordance with the records management requirements.

If the Agreement does not have records management requirements, the records should be handled in accordance with paragraphs (2) and (3) below. If the

Agreement has provisions for transfer of records and PII/PHI to a successor

Business Associate, or if USCG gives directions for such transfer, the Business

Associate shall handle such records and information in accordance with such

Agreement provisions or USCG direction.

(2) If the Agreement does not have records management requirements, except as provided in the following paragraph (3), upon termination of the Agreement, for any reason, the Business Associate shall return or destroy all PHI received from the

Covered Entity, or created or received by the Business Associate on behalf of the

Covered Entity, that the Business Associate still maintains in any form. This provision shall apply to PHI that is in the possession of subcontractors or agents of the Business Associate. The Business Associate shall retain no copies of the PHI.

(3) If the Agreement does not have records management provisions, and the Business

Associate determines that returning or destroying the PHI is unfeasible, the

Business Associate shall provide to the Covered Entity written notification of the conditions that make return or destruction unfeasible. Upon written mutual agreement of the Covered Entity and the Business Associate that return or destruction of PHI is unfeasible, the Business Associate shall extend the protections of the Agreement to such PHI and limit further disclosures of such PHI to those purposes that make the return or destruction unfeasible, for so long as the Business

Associate maintains such PHI.

II. Miscellaneous

(a) Survival. The obligations of Business Associate under the “Effect of Termination” provision of this

BAA shall survive the termination of the Agreement.

(a) Interpretation. Any ambiguity in the Agreement shall be resolved in favor of a meaning that permits the Covered Entity and the Business Associate to comply with the HIPAA Rules.

[Business Associate] USCG HIPAA Privacy Officer

[insert name here]

Date Date

p. 7