9-BAA Qualified Service Agreement - Final 9.12.23 For BARC.docx

BUSINESS ASSOCIATE AGREEMENT WITH BROWARD COUNTY, FLORIDA

This Business Associate Agreement (“BAA”) is entered into between the undersigned entity (“Business Associate”) and Broward County, Florida (“County”).

RECITALS

A. Business Associate provides services related to the operation of certain activities/programs that involve the use or disclosure of Protected Health Information (“PHI”).

B. The operation of such activities/programs is subject to the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the American Recovery and Reinvestment Act of 2009 (“ARRA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and 42 C.F.R. Part 2.

C. HIPAA, ARRA, HITECH, and 42 C.F.R. Part 2 mandate that certain responsibilities of contractors with access to PHI be documented through a written agreement.

D. County and Business Associate desire to comply with the requirements of HIPAA, ARRA, HITECH, and 42 C.F.R. Part 2 and acknowledge their respective responsibilities.

Now, therefore, for good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

Section 1: Definitions

1.1 All terms used in this BAA not otherwise defined herein shall have the meanings stated in the Privacy and Security Rules, 45 C.F.R. Parts 160, 162, 164, 42 U.S.C. § 17921, and 42 C.F.R. Part 2.

1.2 “HIPAA Laws” means collectively HIPAA, ARRA, HITECH, 42 C.F.R. Part 2, and the related regulations and amendments.

1.3 “Penalties” as used in Section 4.21 below is defined as civil penalties that may be applied to the Business Associate and its workforce members by the Secretary (“Secretary”) of Health and Human Services (“HHS”). The amount of the penalties range depending on the type of violation. In determining penalties, the Secretary may take into account:

a. the nature and extent of the violation;

b. the nature and extent of harm resulting from such violation;

c. the degree of culpability of the covered entity or business associate;

d. the history of prior compliance with the administrative simplification provision including violations by the covered entity or business associate;

e. the financial condition of the covered entity or business associate; and

f. such other matters as justice may require.

1.4 “Master Agreement” means the separate, written, executed agreement between County and the Business Associate, if any, that involves the use or disclosure of PHI and that is identified on the signature page below.

1.5 When the term “PHI” is used in this BAA, it includes electronic Protected Health Information (also known as “EPHI”).

Section 2: Effective Dates

This BAA shall become effective the earliest of the following: (a) the effective date of the Master Agreement; (b) the date this BAA is executed by the Parties; or (c) the date Business Associate begins to receive PHI for purposes of this BAA (the “Effective Date”).

Section 3: Confidentiality

3.1 County and Business Associate shall comply with all federal and state laws governing the privacy and security of PHI.

3.2 ☒ If this box is checked, this BAA also constitutes a Qualified Service Organization Agreement, and County and Business Associate are required to comply with 42 C.F.R. Part 2 with respect to patient identifying information concerning substance use disorder treatment. Accordingly, information obtained by Business Associate relating to individuals who may have been diagnosed as needing, or who have received, substance use disorder treatment services shall be maintained and used only for the purposes intended under this BAA and in conformity with all applicable provisions of 42 C.F.R. Part 2. If necessary, Business Associate will resist any efforts in judicial proceedings to obtain access to PHI except as permitted by 42 C.F.R. Part 2.

Section 4: Obligations and Activities of Business Associate

Use and Disclosure of PHI

4.1 Business Associate shall not use or disclose PHI other than as permitted or required by this BAA or as required by law. Business Associate may:

a. Use and disclose PHI only as necessary to perform its obligations under the Master Agreement or this BAA, provided that such use or disclosure would not violate HIPAA Laws if done by County;

b. Use the PHI received in its capacity as a Business Associate of County for its proper management and administration and to fulfill any legal responsibilities of Business Associate;

c. Disclose PHI in its possession to a third party for the proper management and administration of Business Associate, or to fulfill any legal responsibilities of Business Associate, provided that the disclosure would not violate HIPAA Laws if made by County or is required by law, and Business Associate has received from the third party written assurances that (i) the information will be kept confidential and used or further disclosed only for the purposes for which it was disclosed to the third party or as required by law; (ii) the third party will notify Business Associate of any instances of which it becomes aware in which the confidentiality of the information may have been breached; and (iii) the third party has agreed to implement reasonable and appropriate steps to safeguard the information;

d. Use PHI to provide data aggregation activities relating to the operations of County; and

e. De-identify any and all PHI created or received by Business Associate under the Master Agreement or this BAA, provided that the de-identification conforms to the requirements of the HIPAA Laws.

4.2 Business Associate is prohibited from selling PHI, using PHI for marketing purposes, or attempting to re-identify any PHI information in violation of HIPAA Laws. Business Associate agrees to comply with the “Prohibition on Sale of Electronic Health Records or Protected Health Information,” as provided in Section 13405(d) of Subtitle D (Privacy) of ARRA, the “Conditions on Certain Contracts as Part of Health Care Operations,” as provided in Section 13406 of Subtitle D (Privacy) of ARRA, and related guidance issued by the Secretary from time to time.

4.3 Business Associate acknowledges that, effective on the Effective Date of this BAA, it shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. §§ 1320d-5 and 1320d-6, as amended, for failure to comply with any of the use and disclosure requirements of this BAA or any guidance issued by the Secretary from time to time with respect to such use and disclosure requirements.

Administrative, Physical, and Technical Safeguards

4.4 Business Associate shall implement the administrative safeguards set forth at 45 C.F.R. § 164.308, the physical safeguards set forth at 45 C.F.R. § 164.310, the technical safeguards set forth at 45 C.F.R. § 164.312, and the policies and procedures set forth at 45 C.F.R. § 164.316, to reasonably and appropriately protect the confidentiality, integrity, and availability of the PHI that it creates, receives, maintains, or transmits on behalf of County. Business Associate acknowledges that, effective on the Effective Date of this BAA, (a) the foregoing safeguards, policies, and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to County, and (b) Business Associate shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. §§ 1320d-5 and 1320d-6, as amended from time to time, for failure to comply with the safeguards, policies, and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements.

4.5 Business Associate shall require all of its subcontractors, agents, and other third parties that receive, use, transmit, maintain, store, or have access to PHI to agree, in writing, to the same restrictions, conditions, and requirements that apply to Business Associate pursuant to this BAA and the HIPAA Laws.

Access of Information; Amendment of Information; Accounting of Disclosures

4.6 Business Associate shall make available to County all PHI in designated record sets within ten (10) days after County’s request to enable County to meet the requirements under 45 C.F.R. § 164.524.

4.7 Business Associate shall make any amendments to PHI in a designated record set as directed or agreed to by County pursuant to 45 C.F.R. § 164.526, and in the time and manner reasonably designated by County.

4.8 Business Associate agrees to comply with an individual’s request to restrict the disclosure of their personal PHI in a manner consistent with 45 C.F.R. § 164.522, except where such use, disclosure, or request is required or permitted under applicable law.

4.9 Business Associate agrees that, when requesting, using, or disclosing PHI in accordance with 45 C.F.R. § 164.502(b)(1), such request, use, or disclosure shall be to the minimum extent necessary, including the use of a “limited data set” as defined in 45 C.F.R. § 164.514(e)(2), to accomplish the intended purpose of such request, use, or disclosure, as interpreted under related guidance issued by the Secretary from time to time.

4.10 Business Associate shall timely document such disclosures of PHI and maintain information related to such disclosures as would be required for County to respond to an individual for an accounting of disclosures of PHI in accordance with 45 C.F.R. § 164.528. Further, Business Associate shall provide to County an accounting of all disclosures of PHI during the term of this BAA within ten (10) days after termination of this BAA, or sooner if reasonably requested by County for purposes of any monitoring/auditing compliance with HIPAA Laws.

4.11 Business Associate shall provide County, or an individual under procedures approved by County, information and documentation collected in accordance with the preceding section to respond to an individual requesting an accounting for disclosures as provided under 45 C.F.R. § 164.528 or HIPAA Laws.

Notification of Breach

4.12 Business Associate shall notify County’s HIPAA Privacy Official at (954) 357-6500 of any impermissible access, acquisition, use, or disclosure of any Unsecured PHI (collectively and individually, a “Breach”) within twenty-four (24) hours after Business Associate discovering such Breach. “Unsecured PHI” shall refer to such PHI that is not secured through use of a technology or methodology specified by the Secretary that renders such PHI unusable, unreadable, or indecipherable to unauthorized individuals. A Breach of Unsecured PHI shall be treated as discovered by Business Associate as of the first day on which such Breach is known to the Business Associate or, by exercising reasonable diligence, would have been known to Business Associate, including any employee, officer, contractor, subcontractor, or other agent of Business Associate. In addition, Business Associate’s notification under this section shall comply in all respects with each applicable provision the HIPAA Rules and all related guidance issued by the Secretary or the delegate of the Secretary from time to time.

4.13 Business Associate shall submit a written report of a Breach to County within ten (10) business days after initial notification, which report shall document the following:

a. The identification of each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate, to have been accessed, acquired, used, or disclosed during the Breach;

b. A brief description of what occurred, including the date of the Breach, if known, and the date of the discovery of the Breach;

c. A description of the types of Unsecured PHI that were involved in the Breach (such as full name, social security number, date of birth, home address, account number, diagnosis, etc.);

d. A description of what is being done to investigate the Breach and to mitigate harm to individuals, and the reasonable and appropriate safeguards being taken to protect against future Breaches;

e. Any steps County or the individual(s) impacted by the Breach should take to protect themselves from potential harm resulting from the Breach;

f. Contact procedures for the Business Associate to enable individuals to ask questions or learn additional information, which may include, in the discretion of County, a toll-free telephone number, e-mail address, website, or postal address, depending upon the available contact information that Business Associate has for the affected individuals; and

g. Any other reasonable information requested by County.

4.14 County, in its sole discretion, will determine whether County or Business Associate shall be responsible to provide notification to individuals whose Unsecured PHI has been impermissibly accessed, acquired, used, or disclosed, as well as to the Secretary and the media. Such notification shall be provided as follows:

a. Notification will be by first-class mail, or by electronic mail, if the individual has specified notice in the manner as a preference.

b. Information may be posted on County’s and Business Associate’s website(s) where the Business Associate experienced, or is reasonably believed to have experienced, an impermissible access, acquisition, use, or disclosure of Unsecured PHI that compromised the security or privacy of more than ten (10) individuals when no other current information is available to inform such individuals.

c. Notice shall be provided to prominent media outlets with information on an incident where the Business Associate experienced an impermissible access, acquisition, use or disclosure of Unsecured PHI that compromised the security or privacy of more than five hundred (500) individuals within the same state or jurisdiction.

4.15 In the event of the impermissible access, acquisition, use, or disclosure of Unsecured PHI in violation of the HIPAA Laws, Business Associate bears the burden of demonstrating that all notification(s) required by Sections 4.10 through 4.12 (as applicable) were made, including evidence demonstrating the necessity of any delay, or that the use or disclosure did not constitute a Breach of Unsecured PHI.

4.16 Business Associate shall pay the costs of providing all notification(s) required by Sections 4.12 through 4.14 (as applicable) of this BAA.

Mitigation of Breach

4.17 Business Associate shall mitigate to the extent possible, at its own expense, any harmful effects that are known to Business Associate regarding any access, use, or disclosure of Unsecured PHI in violation of the requirements of this BAA or applicable law.

4.18 Business Associate shall take appropriate disciplinary action against any members of its workforce who use or disclose Unsecured PHI in any manner not authorized by this BAA or applicable law.

4.19 Business Associate shall have established procedures to investigate a Breach, mitigate losses, and protect against any future breaches, and shall provide such procedures and any specific findings of the investigation to County in the time and manner reasonably requested by County.

4.20 In the event of a Breach, Business Associate shall, in consultation with and at the direction of County, assist County in conducting a risk assessment of the Breach and mitigate, to the extent practicable, any harmful effects of such Breach known to Business Associate. Business Associate shall pay the costs for mitigating damages, including, but not limited to, the expenses for credit monitoring, if County determines that the Breach warrants such measures. The mitigation described in this section shall be in addition to, and not in lieu of, any other remedy County may have for the Breach, including, but not limited to, indemnification and any action for damages available to County under contract or at law or in equity.

4.21 Business Associate is liable to County for any civil penalties imposed on County under the HIPAA Laws in the event of a violation of the HIPAA Laws as a result of any practice, behavior, or conduct of Business Associate or its agents or employees.

4.22 The requirement to comply with the Notification of Breach and Mitigation of Breach sections of this BAA shall survive the expiration or earlier termination of this BAA.

Available Books and Records

4.23 Business Associate shall make its internal practices and books, related to the Master Agreement or the BAA, including all policies and procedures required by HIPAA Laws, available to the County Contract Administrator within five (5) business days after the Effective Date.

4.24 Business Associate shall make its internal practices, books, and records, including all policies and procedures required by HIPAA Laws, relating to the use and disclosure of PHI received from County or created or received on behalf of County, available to County or to the Secretary or its designee within five (5) business days after request for the purposes of determining Business Associate’s compliance with HIPAA Laws.

Section 5: Obligations of County

5.1 County shall notify Business Associate of any limitations in its notice of privacy practices in accordance with 45 C.F.R. § 164.520, to the extent that such limitation may affect the Business Associate’s use of PHI.

5.2 County shall notify Business Associate of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent that such changes may affect Business Associate’s use of PHI.

5.3 County shall notify Business Associate of any restriction to the use or disclosure of PHI to which County has agreed in accordance with 45 C.F.R. § 164.522, to the extent that such changes may affect Business Associate’s use of PHI.

5.4 County shall not request Business Associate use or disclose PHI in any manner that would not be permissible under the HIPAA Laws if done by County.

5.5 County may report, at least annually, any impermissible access, use, or disclosure of unsecured PHI by Business Associate to the Secretary as required by HIPAA Laws.

Section 6: Term and Termination

6.1 This BAA shall be effective upon the Effective Date, and shall terminate upon the later of (a) expiration or earlier termination of the Master Agreement, or (b) return or destruction of all PHI within the possession or control of the Business Associate as a result of the Master Agreement or this BAA.

6.2 Upon County’s knowledge of a material breach of this BAA by Business Associate, County may:

a. Provide an opportunity for Business Associate to cure the breach within the time for cure set forth in County’s written notice to Business Associate, and terminate if Business Associate does not cure the breach within the time specified by County; or

b. Immediately terminate this BAA and the Master Agreement if Business Associate has breached a material term of this BAA and a cure is not possible; or

c. If neither termination nor cure is feasible, County’s HIPAA Privacy Official shall report the violation to the Secretary of HHS.

6.3 Upon expiration or termination of the Master Agreement, Business Associate agrees, at County’s option, to return to County or destroy all PHI gathered, created, received, or processed pursuant to the Master Agreement or this BAA. No PHI related to the Master Agreement or this BAA will be retained by Business Associate, or a contractor, subcontractor, or other agent of Business Associate, unless retention is required by law and specifically permitted in writing by County.

6.4 If returning or destroying PHI is infeasible, Business Associate shall provide to County a written statement that it is infeasible to return or destroy the PHI and describe the conditions that make return or destruction of the PHI infeasible. Under that circumstance, Business Associate shall extend the protections of this BAA to the PHI retained and limit further uses and disclosures of such PHI to those purposes that make return or destruction infeasible, for so long as Business Associate maintains the PHI. Business Associate’s obligations under this section shall survive termination of this BAA.

Section 7: Miscellaneous

7.1 Amendment. County and Business Associate shall take such action as is necessary to amend this BAA for County to comply with the requirements of HIPAA Laws or other applicable law.

7.2 Interpretation. Any ambiguity in this BAA shall be resolved to permit County to comply with HIPAA Laws. Any inconsistency between the HIPAA Laws, as interpreted by the HHS, a court, or another regulatory agency with authority over the Parties, and this BAA shall be interpreted in favor of the HIPAA Laws as interpreted by the HHS, the court, or the regulatory agency. Any provision of this BAA that differs from the requirements of the HIPAA Laws, but is nonetheless permitted by the HIPAA Laws, shall be adhered to as stated in this BAA.

7.3 Florida Electronic Health Records Exchange Act. If Business Associate is a healthcare provider, as that term is used in Section 408.051(2), Florida Statutes, Business Associate shall comply with the requirements of the Florida Electronic Health Records Exchange Act (“FEHREA”), Section 408.051, Florida Statutes. The requirement to comply with this provision and FEHREA shall survive the expiration or earlier termination of this BAA.

7.4 Successors and Assignment. This BAA will be binding on the successors and assigns of County and Business Associate. However, this BAA may not be assigned, in whole or in part, without the written consent of the other Party. Any attempted assignment in violation of this provision shall be null and void.

7.5 Standard Agreement Terms and Conditions. If a Master Agreement exists between County and Business Associate, then the terms of the Master Agreement are expressly incorporated herein. If no such Master Agreement exists between County and Business Associate, then the following portions of the Broward County Standard Agreement Form (BCF 101), available at https://www.broward.org/Purchasing/Pages/StandardTerms.aspx, are hereby adopted and incorporated as if fully set forth herein:

a. Article 6, Sections 6.1 through Section 6.12;

b. Article 7;

c. Article 9;

d. Article 11, Sections 11.2 through Section 11.26, with the Business Associate’s contact information listed in the signature pages incorporated in Section 11.9, and incorporating the following contact information for County in Sections 11.3 and 11.9: Averill Dorsett, Broward County Privacy Officer, 115 S. Andrews, Avenue, (945) 357-6503, adorsett@broward.org.

[The remainder of this page is intentionally blank]

WHEREAS, the Parties have made and executed this Business Associate Agreement on the respective dates under each signature: Broward County, through its Board of County Commissioners, signing by its County Administrator, authorized to execute same, and Business Associate, signing by and through its _________________, duly authorized to execute same.

Master Agreement: ______________________________________________ (List agreement title and solicitation or contract number; if none, leave blank.)

BROWARD COUNTY

BROWARD COUNTY, by and through its County Administrator

By: ____________________________ County Administrator

____ day of ______________, 20__

Approved as to form by Andrew J. Meyers Broward County Attorney 115 South Andrews Avenue, Suite 423 Fort Lauderdale, Florida 33301 Telephone: (954) 357-7600

By: ____________________________ Karen Gordon (Date) Senior Assistant County Attorney

BUSINESS ASSOCIATE

Entity Name: __________________________

Signature: _____________________________

Print Name: ___________________________

Title: _________________________________

Date: _________________________________

Business Associate Contact information:

Contact person: ________________________

Address: ______________________________

Telephone: ____________________________

E-mail: ________________________________

Business Associate Agreement Page 1 of 2 image1.jpeg