Attachment 6 - Compliance with HIPAA and HITECH.docx

Attachment 6 - Compliance with HIPAA and HI-TECH

Compliance with HIPAA (Health Insurance Portability and Accountability Act Of 1996) and HI- TECH (Health Information Technology for Economic and Clinical Health Act of 2009) Definitions:

The following terms used in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices, Protected Health Information (PHI), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

(a) Business Associate. “Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR 160.103, and in this Agreement may refer to Contractor or its subcontractor(s), to the extent Contractor or its subcontractor(s) create, receive, maintain, or transmit protected health information on behalf of ITS.

(b) Covered Entity. By entering into this Agreement, ITS does not affirm that it necessarily meets the definition of a “Covered Entity” or a "Business Associate" under the HIPAA statute, and rather affirms that ITS may in a given instance be acting as a "conduit" or in another capacity providing services to other entities, some of which themselves may be covered entities. But to the extent ITS is deemed to be covered by HIPAA or HI-TECH, the parties agree the term "Covered Entity" in this Agreement shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103.

(c) HIPAA Rules. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

Protected Health Information Obligations and Activities of Contractor

To the extent Contractor or its subcontractor(s) create, receive, maintain, or transmit protected health information on behalf of ITS pursuant to their responsibilities under this Agreement, Contractor agrees that it is subject to, will abide by, and will require in writing its subcontractors to similarly abide by, the following requirements applicable to Business Associates under HIPAA, agreeing to:

(a) Not to use or disclose protected health information other than as permitted or required by the Agreement or as required by law;

(b) Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by the Agreement;

(c) Report to ITS within ten (10) business days or fewer any use or disclosure of protected health information not provided for by this Agreement of which it becomes aware. In no event shall Contractor exceed the timeframe for reporting to ITS breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware. Contractor shall provide ITS all information reasonably requested by ITS concerning any breach. Contractor shall also provide the following information to ITS upon first instance of the notification of breach: the identification of each individual whose unsecured protected health information has been, or is reasonably believed by Contractor, to have been, accessed, acquired, used, or disclosed during the breach.

(d) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of Contractor agrees in writing to the same restrictions, conditions, and requirements that apply to Contractor with respect to such information;

(e) Make available protected health information in a designated record set to ITS, in a manner to be prescribed by ITS within a reasonable timeframe not to exceed fifteen (15) days, absent extenuating circumstances, as necessary to satisfy obligations which ITS or the entities it provides services to reasonably believe applicable to them under 45 CFR 164.524. In the event Contractor or its subcontractor(s) receive any request for such protected health information directly from an individual, Contractor shall refer such request to ITS within a reasonable timeframe not to exceed ten (10) business days.

(f) Make any amendment(s) to protected health information in a designated record set as directed by ITS pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy obligations that ITS reasonably believes it has under 45 CFR 164.526, in the manner as prescribed by ITS and within twenty

(20) business days of such request. In the event Contractor or its subcontractor(s) receive any request to amend a data set directly from an individual, Contractor shall refer such request to ITS within a reasonable timeframe not to exceed ten (10) business days;

(g) Maintain and make available the information required to provide an accounting of disclosures to ITS as necessary to satisfy obligations that ITS reasonably believes it has under 45 CFR 164.528, in the manner as prescribed by ITS and within ten (10) business days of such request. In the event Contractor or its subcontractor(s) receive any request for an accounting of disclosures directly from an individual, Contractor shall refer such request to ITS within a reasonable timeframe not to exceed ten (10) business days;

(h) To the extent the Contractor or its subcontractor(s) are to carry out one or more obligation(s) ITS may have under Subpart E of 45 CFR Part 164, in performing such obligations, comply with the requirements of Subpart E that apply to ITS; and

(i) Make either Contractor's or its subcontractor(s)', or both, internal practices, books, and records available to the Secretary of the Department of Health and Human Services and the Chief Information Officer of ITS, or his or her designee, for purposes of determining compliance with the HIPAA and HI-TECH Rules.

Permitted Uses and Disclosures of Protected Health Information by Contractor and its Subcontractor(s)

(a) Contractor and its subcontractor(s) may only use or disclose protected health information as necessary to perform the services set forth in this Agreement, provided however, that if de-identified information can be used in lieu of individually identifiable health information with the same effect, Contractor and its subcontractor(s) shall use de-identified information in their performance of this Agreement in accordance with 45 CFR 164.514(a)-(c).

(b) Contractor and its subcontractor(s) may use or disclose protected health information as required by law.

(c) Contractor and its subcontractor(s) agree to make only those uses, disclosures and requests for protected health information that are consistent with the minimum necessary policies and procedures of ITS or the entity(ies) for whom ITS provides services which entail the creation, reception, maintenance, or transmittal of protected health information.

(d) Contractor and its subcontractor(s) may not use or disclose protected health information in a manner that would violate Subpart E of 45 CFR Part 164 except as may be provided for in this Agreement or for the proper management and administration of Contractor or its subcontractor(s), including the carrying out of the Contractor's or its subcontractor(s)' legal responsibilities.

Term and Termination

(a) Termination for cause under HIPAA or HI-TECH. The Term of this Agreement shall be as described elsewhere in the "Term" section of this agreement. Among the other reasons for which ITS may terminate this Agreement prior to the end of its Term date for cause, ITS may terminate this Agreement if ITS determines the Contractor or its subcontractor(s) have violated a material term of this HIPAA and HI-TECH Compliance section of the Agreement, and Contractor or its subcontractor(s) have not cured the breach or ended the violation within any time that has been specified by ITS.

(b) Contractor's and its Subcontractor(s)' Obligations Upon Termination. Upon termination of this Agreement for any reason, Contractor and its subcontractor(s) shall return to ITS, transfer to another of ITS' contractors as directed by ITS, or, if agreed to by ITS on an individual case-by-case basis, destroy all protected health information received from ITS, or created, maintained, or received by the Contractor and its subcontractor(s) on behalf of ITS, that the Contractor and its subcontractor(s) still maintain in any form. Contractor and its subcontractor(s) shall retain no copies of the protected health information. Contractor understands and agrees and will require of its subcontractor(s) in writing that Contractor and its subcontractor(s) are required to receive written approval from ITS prior to the return, transfer or destruction of any protected health information.

(c) Survival. Contractor's and its subcontractor(s)' obligations under this HIPAA and HI-TECH Compliance section of this Agreement shall survive the termination of this Agreement.

Miscellaneous

(a) Regulatory References. A reference in this Agreement to a section in the HIPAA or HI-TECH Rules means the section as in effect or as amended.

(b) Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for compliance with the requirements of the HIPAA or HI-TECH Rules and any other applicable law.

(c) Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with the HIPAA or HI-TECH Rules.

(d) Sub-contractors. Contractor shall require any subcontractors that it uses that create, receive, maintain, or transmit protected health information on behalf of ITS under this Agreement to conform to these HIPAA and HI-TECH Compliance requirements in addition to any other security, privacy, or applicable terms of this Agreement.

Contractor By:

Signature

Title

Name Date Subcontractor By:

Signature

Title

Name Date