APPENDIX CC

Standard_Appendices(AppendixCC) Rev 3_12, Rev 11_14, Rev 6_19, Rev 8_21, Rev 7_25

DELAWARE COUNTY DEPARTMENT OF HUMAN SERVICES

HIPAA BUSINESS ASSOCIATE AGREEMENT

WHEREAS, the Delaware County Department of Human Services (Covered Entity) and Provider (Business Associate) intend to protect the privacy and security of certain Protected Health Information (PHI) to which Business Associate may have access in order to provide goods or services to or on behalf of Covered Entity, in accordance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Pub. L. No.

111-5 (Feb. 17, 2009) and related regulations, the HIPAA Privacy Rule (Privacy Rule), 45 C.F.R. Parts 160 and 164, as amended, the HIPAA Security Rule (Security Rule), 45 C.F.R.

Parts 160, 162 and 164), as amended, 42 U.S.C. § 602(a)(1)(A)(iv), 42 U.S.C. § 1396a(a)(7), 35 P.S. § 7607, 50 Pa.C.S. § 7111,71 P.S. § 1690.108(c), 62 P.S. §404, 55 Pa. Code Chapter 105, 55 Pa. Code Chapter 5100, 42 C.F.R. §§ 431.301-431,302, 42 C.F.R. Part 2, 45 C.F.R. § 205.50, the Pennsylvania Breach of Personal Information Notification Act, 73 P.S. § 2301 et seq., and other relevant laws, including subsequently adopted provisions applicable to use and disclosure of confidential information, and applicable agency guidance.

WHEREAS, Business Associate may receive PHI from Covered Entity, or may create or obtain PHI from other parties for use on behalf of Covered Entity, which PHI may be used or disclosed only in accordance with the Agreement and the standards established by applicable laws and agency guidance.

WHEREAS, Business Associate may receive PHI from Covered Entity, or may create or obtain PHI from other parties for use on behalf of Covered Entity, which PHI must be handled in accordance with this BAA and the standards established by HIPAA, the HITECH Act and related regulations, and other applicable laws and agency guidance.

NOW, THEREFORE, Covered Entity and Business Associate agree as follows:

1. Definitions.

A. “Agreement” shall mean all agreements between the parties pursuant to which Business Associate provides services to the Covered Entity under which it receives PHI from Covered Entity.

B. “BAA” shall mean this Business Associate Agreement.

C. “HIPAA” shall mean the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191.

D. “HITECH Act” shall mean the Health Information Technology for Economic and Clinical

Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Pub. L. No. 111-5 (Feb. 17, 2009).

E. “Privacy Rule” shall mean the standards for privacy of individually identifiable health information in 45 C.F.R. Parts 160 and 164, as amended, and related agency guidance.

F. “Protected Health Information” or “PHI” shall have the meaning given to such term under HIPAA, the HITECH Act and applicable regulations and agency guidance, limited that which relates to or arises from the Agreement..

G. “Security Rule” shall mean the security standards in 45 C.F.R. Parts 160, 162 and 164, as amended, and related agency guidance.

Standard_Appendices(AppendixCC) Rev 3_12, Rev 11_14, Rev 6_19, Rev 8_21, Rev 7_25

H. “Unsecured PHI” shall mean PHI that is not secured through the use of a technology or methodology as specified in HITECH regulations and agency guidance or as otherwise defined in the HITECH Act.

I. The following terms used in this BAA shall have the meaning given to such terms under HIPAA, the HITECH Act and applicable regulations and agency guidance: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

2. Stated Purposes For Which Business Associate May Use Or Disclose PHI. The Parties hereby agree that Business Associate shall be permitted to use and/or disclose PHI provided by or obtained on behalf of Covered Entity for the following stated purposes, except as otherwise stated in this Agreement.

NO OTHER DISCLOSURES OF PHI OR OTHER INFORMATION ARE PERMITTED.

3. BUSINESS ASSOCIATE OBLIGATIONS:

A. Limits On Use And Further Disclosure Established By Agreement And Law.

Business Associate hereby agrees that the PHI provided by, or created or obtained on behalf of Covered Entity shall not be further used or disclosed other than as permitted or required by the Agreement or as required by law and agency guidance.

B. Appropriate Safeguards. Business Associate shall establish and maintain appropriate safeguards to prevent any use or disclosure of PHI other than as provided for by this Agreement. Appropriate safeguards shall include implementing administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic PHI that is created, received, maintained, or transmitted on behalf of the Covered Entity and limiting use and disclosure to applicable Minimum Necessary requirements as set forth in applicable federal and state statutory and regulatory requirements and agency guidance. Such safeguards shall include, without limitation, a reasonable security risk assessment and mitigation process, pursuant to which it prepares written reports. Business Associate shall provide to Covered Entity a copy of Business Associate’s current risk assessment and mitigation report or reports upon request.

C. Reports Of Improper Use Or Disclosure. Business Associate hereby agrees that it shall report to HIPAA Compliance Officer at 4990 State Road, Suite 101, Drexel Hill, PA 19026, within two (2) days of discovery any use or disclosure of PHI not provided for or allowed by this Agreement.

D. Reports Of Security Incidents. In addition to following the breach notification requirements in section 13402 of the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH Act”) and related regulations, agency guidance and other applicable federal and state laws, Business Associate shall report to HIPAA Compliance Officer at 4990 State Road, Suite 101, Drexel Hill, PA 19026, within two (2) days of discovery any Security Incident of which it becomes aware.

E. Breach Notification and Indemnification. Upon the occurrence of any incident requiring notice under Subsection 3.C or 3.D of this BAA, Business Associate shall perform a risk assessment as contemplated by the HIPAA rules and guidance to determine whether the incident resulted in a Breach of Unsecured PHI. Business Associate shall include in the any notice provided to Covered Entity under Subsection

Standard_Appendices(AppendixCC) Rev 3_12, Rev 11_14, Rev 6_19, Rev 8_21, Rev 7_25

3.C or 3.D of this BAA (i) a summary of such risk assessment and (ii) Business Associate’s conclusions with respect thereto sufficient for Covered Entity to determine whether a Breach of Unsecured PHI has occurred and to provide notification to such individuals pursuant to the Breach Notification Rule. Business Associate shall provide Covered Entity with any additional information regarding such incident reasonably requested by Covered Entity to comply with the HIPAA Rules. Covered Entity may elect, at its own discretion, to provide or direct Business Associate to provide the notification to individuals. Within five (5) days after receipt of written notice from Covered Entity, Business Associate shall, at its own cost, provide the notification of a Breach of Unsecured PHI to individuals as required by the Breach Notification Rule and applicable guidance thereunder. In advance of providing such notification, Business Associate shall provide a copy of the proposed notification or notifications to be provided to the individuals and incorporate any reasonable changes thereto requested by Covered Entity. Business Associate shall further comply with all applicable federal and state breach notification requirements. Business Associate shall indemnify the Covered Entity for costs (including, without limitation, costs related to individual notification and reasonable attorneys’ fees) associated with any Security Incident or incident involving the acquisition, access, use or disclosure of PHI in a manner not permitted under federal or state law and agency guidance which Security Incident or other incident (i) arises from any act or omission of Business Associate or any Subcontractor; or (ii) occurs with respect to any PHI while in the possession, custody or control of Business Associate or any Subcontractor.

F. Subcontractors And Agents. Business Associate hereby agrees that any time PHI is provided or made available to any Subcontractors or agents, Business Associate shall provide only the Minimum Necessary PHI for the purpose of the covered transaction and shall first enter into a subcontract or contract with the Subcontractor or agent that contains the same terms, conditions and restrictions on the use and disclosure of PHI as contained in this BAA.

G. Right Of Access To PHI. At no cost to Covered Entity, Business Associate hereby agrees to allow an individual who is the subject of PHI maintained in a designated record set, to have access to and provide to him or her a copy of that individual’s PHI within ten

(10) business days of receiving a written request from the Covered Entity or the individual. Business Associate shall provide PHI to the extent and in the manner required by 45 C.F.R. §164.524 and other applicable federal and state law and agency guidance. If Business Associate maintains an electronic health record, Business Associate must provide the PHI in electronic format if requested. If any individual requests from Business Associate or its agents or Subcontractors access to PHI.

Business Associate shall notify Covered Entity of same no less than five (5) days in advance of allowing such individual access to such designated record set. Business Associate shall further conform with and meet all of the requirements of 45 C.F.R.

§164.524 and other applicable laws, including the HITECH Act and related regulations, and agency guidance.

H. Amendment And Incorporation Of Amendments. At no cost to Covered Entity, within five (5) business days of receiving a request from Covered Entity for an amendment of PHI maintained in a designated record set, Business Associate shall make the PHI available and incorporate the amendment to enable Covered Entity to comply with 45 C.F.R. §164.526, applicable federal and state law, including the HITECH Act and related regulations, and agency guidance. If any individual requests an amendment from Business Associate or its agents or Subcontractors, Business Associate shall notify

Standard_Appendices(AppendixCC) Rev 3_12, Rev 11_14, Rev 6_19, Rev 8_21, Rev 7_25

Covered Entity no less than five (5) days in advance of responding to incorporating any requested amendment or otherwise responding to such request. .

I. Provide Accounting Of Disclosures. Business Associate agrees to maintain a record of all disclosures of PHI in accordance with 45 C.F.R. §164.528 and other applicable laws and agency guidance, including the HITECH Act and related regulations. Such records shall include, for each disclosure, the date of the disclosure, the name and address of the recipient of the PHI, a description of the PHI disclosed, the name of the individual who is the subject of the PHI disclosed, and the purpose of the disclosure.

Business Associate shall make such record available to the individual or the Covered Entity within five (5) business days of a request for an accounting of disclosures.

Business Associate shall notify Covered Entity of any such request it receives directly from an Individual no less than five (5) days in advance of providing such accounting to the individual.

J. Requests For Restriction. Business Associate shall comply with requests for restrictions on disclosures of PHI about an individual if the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for treatment purposes), and the PHI pertains solely to a health care item or service for which the service involved was paid in full out-of-pocket. For other requests for restriction, Business Associate shall otherwise comply with the Privacy Rule, as amended, and other applicable statutory and regulatory requirements and agency guidance.

K. Access To Books And Records. Business Associate hereby agrees to make its internal practices, books, and records relating to the use or disclosure of PHI received from, or created or received by Business Associate on behalf of the Covered Entity, available to the Secretary of Health and Human Services or designee and/or Covered Entity for purposes of determining compliance with applicable laws and agency guidance.

L. Return Or Destruction Of PHI. At termination of this BAA, Business Associate shall return or destroy all PHI provided by or obtained on behalf of Covered Entity. Business Associate agrees not to retain any copies of the PHI after termination of this BAA. If return or destruction of the PHI is not feasible, Business Associate agrees to extend the protections of this BAA to limit any further use or disclosure until such time as the PHI may be returned or destroyed. Upon termination of this BAA, Business Associate shall notify Covered Entity in writing regarding its plans for post-termination treatment of PHI, including without limitation return, destruction or ongoing maintenance of all PHI. If Business Associate elects to destroy the PHI, it shall certify to Covered Entity that the PHI has been destroyed.

M. Maintenance Of PHI. Notwithstanding Section 3.L of this BAA, Business Associate and its Subcontractors or agents shall retain all PHI throughout the term of the BAA and shall continue to maintain the information required under the various documentation requirements of this BAA (such as those in §3(h)) for a period of six (6) years after termination of the Agreement, unless Covered Entity and Business Associate agree otherwise.

N. Mitigation Procedures. Business Associate agrees to establish and to provide to Covered Entity upon request, procedures for mitigating, to the maximum extent practicable, any harmful effect from the use or disclosure of PHI in a manner contrary to this BAA or the Privacy Rule, as amended. Business Associate further agrees to mitigate any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of this BAA or applicable laws and agency guidance.

Standard_Appendices(AppendixCC) Rev 3_12, Rev 11_14, Rev 6_19, Rev 8_21, Rev 7_25

O. Term. The Term of this Agreement shall be effective on the date of execution of the Agreement, and shall terminate on the date of termination of the Agreement between the or on the date covered entity terminates for cause as authorized in paragraph (b) of this Section, whichever is sooner.

P. Termination for Cause. Notwithstanding any other provision of this BAA or the Agreement to the contrary, Covered Entity shall have the right to terminate this BAA and the Agreement if covered entity determines Business Associate has violated a material term of this BAA and Business Associate has failed to cure such breach within thirty days after written notice from Covered Entity.

Q. Failure To Perform Obligations. In the event Business Associate fails to perform its obligations under this BAA, Covered Entity may immediately discontinue providing PHI to Business Associate. Covered Entity may also, at its option, require Business Associate to submit to a plan of compliance, including monitoring by Covered Entity and reporting by Business Associate, as Covered Entity in its sole discretion determines to be necessary to maintain compliance with this BAA and applicable laws and agency guidance. Covered Entity’s rights and remedies under this Subsection 3.Q are in addition to, and shall not restrict, limit or abridge, any other rights or remedies of Covered Entity under this BAA or the Agreement.

P. Privacy Practices. Upon execution of this BAA, Business Associate shall provide to Covered Entity a copy of its Notice of Privacy Practices and other forms that Business Associate intends to utilize with respect to individuals under the Agreement. Business Associate shall incorporate any changes thereto reasonably requested by Covered Entity. Business Associate shall promptly utilize any related forms or notices relating to compliance with the HIPAA Rules and guidance as directed by Covered Entity. Covered Entity retains the right make reasonable changes to such forms The Business Associate shall implement changes as soon as practicable, but not later than 45 days from the date of notice of the change.

4. OBLIGATIONS OF COVERED ENTITY:

A. Provision of Notice of Privacy Practices. Covered Entity shall provide Business Associate with the Notice of Privacy Practices that the Covered Entity produces in accordance with applicable law and agency guidance as well as changes to such notice.

B. Permissions. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by individual to use or disclose PHI of which Covered Entity is aware, if such changes affect Business Associate’s permitted or required uses and disclosures.

C. Restrictions. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that the Covered Entity has agreed to in accordance with 45 C.F.R. §164.522 and other applicable laws and applicable agency guidance, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.