ATTACHMENT 9.1.2 HIPAA BAA.docx

SC DEPARTMENT OF JUVENILE JUSTICE

Business Associate Agreement

THIS BUSINESS ASSOCIATE AGREEMENT (“Agreement”) is entered into as of the day of , ______, between NAME OF BUSINESS ASSOCIATE, ADDRESS OF BUSINESS ASSOCIATE (hereinafter referred to as “Business Associate”) and the South Carolina Department of Juvenile Justice, PO Box 21069 Columbia, SC 29221 (hereinafter referred to as the “Covered Entity”).

In consideration of the mutual promises and agreements set forth herein, Covered Entity and Business Associate do hereby contract and agree as follows:

1. DEFINITIONS

(a) “Breach” shall have the same meaning as the term “Breach” in 45 CFR § 164.402.

(b) “Business Associate” shall generally have the same meaning as the term “Business Associate” at 45 CFR §160.103, and in reference to the party to this agreement, shall mean NAME OF BUSINESS ASSOCIATE.

(c) “Compliance Date” shall have the same meaning as the term “Compliance Date” in

45 CFR § 160.103.

(d) “Covered Entity” shall generally have the same meaning as the term “Covered Entity” at 45 CFR §160.103, and in reference to the party to this agreement shall mean the South Carolina Department of Juvenile Justice (SCDJJ).

(e) “Data Aggregation” shall have the same meaning as the term “Data Aggregation” in

45 CFR § 164.501.

(f) “Designated Record Set” shall have the same meaning as the term “Designated Record Set” in 45 CFR § 164.501.

(g) “Electronic Protected Health Information” shall have the same meaning as “Electronic Protected Health Information” in 45 CFR §160.103.

(h) “HITECH Act” shall have the same meaning as the Health Information Technology for Economic and Clinical Health Act, as incorporated into the American Recovery and Reinvestment Act of 2009.

(i) “HIPAA Rules” shall mean the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

(j) “Individual” shall have the same meaning as the term “Individual” in 45 CFR §160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR § 164.502(g).

(k) “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR parts 160 and 164, subparts A and E.

(l) “Protected Health Information” or “PHI” shall have the same meaning as the term

SCDJJ BAA Revised ***** “Protected Health Information” in 45 CFR § 160.103, limited to the information created or received by Business Associate from, or on behalf of, Covered Entity.

(m) “Required By Law” shall have the same meaning as the term “Required By Law” in

45 CFR § 164.103.

(n) “Secretary” shall mean the Secretary of the Department of Health and Human Services or his or her designee.

(o) “Security Incident” shall have the same meaning as “Security Incident” in 45 CFR § 164.304.

(p) “Security Rule” shall mean the Security Standards and Implementation Specifications at 45 CFR Part 160 and 164, Subpart C.

(q) “Service Agreement” shall mean the agreement between NAME OF BUSINESS ASSOCIATE and SCDJJ.

(r) “Unsecured PHI” shall have the same meaning as the term “Unsecured Protected Health Information” in 45 CFR §164.402.

2. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE

(a) Business Associate agrees to use or disclose PHI only as permitted or required by this Agreement or as Required by Law. Business Associate is permitted to use and disclose PHI or Electronic PHI that it creates for, or receives from, Covered Entity or business associate of Covered Entity and to request PHI on behalf of Covered Entity as described in the Agreement, consistent with the HIPAA Rules. When requesting, using, or disclosing PHI, Business Associate shall restrict the request, use, or disclosure of said PHI to the minimum necessary to accomplish the intended purpose of the request, use, or disclosure.

(b) Business Associate agrees to provide access to Covered Entity, at the request of Covered Entity, to PHI in a Designated Record Set in order to meet the requirements under 45 CFR § 164.524.

(c) Business Associate agrees to make available PHI for amendment and incorporate any amendment(s) to PHI in a Designated Record Set that the Covered Entity directs or agrees to pursuant to 45 CFR §164.526 at the request of Covered Entity, within thirty (30) days of a written request by Covered Entity.

(d) Business Associate agrees to make internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI received from, or created or received by, Business Associate on behalf of Covered Entity available to the Covered Entity or the Secretary, within thirty (30) days of a written request by the Covered Entity or the Secretary, for the purpose of permitting the Secretary to determine Covered Entity's compliance with the HIPAA Rules.

(e) Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an

Individual for an accounting of disclosures of PHI in accordance with 45 CFR §164.528 and to make available to Covered Entity, within thirty (30) days of a written request by Covered Entity, the information required to provide such an accounting to an individual. Business Associate will comply with mandates regarding individuals’ rights under the HITECH Act, including rights to access and accounting of disclosures. Such information shall be made available in an electronic format where directed by the Covered Entity. In addition, Business Associate shall include, within its accounting, disclosures for payment and health care operations purposes where such recording or accounting is required by the HITECH Act and as of the effective date for this provision of the HITECH Act. The covered Entity shall provide any additional information to the extent required by the HITECH Act and any accompanying regulations.

(f) Business Associate shall make information available directly to an individual within thirty

(30) days, when that individual so requests, if such information is required to be disclosed.

(g) Business Associate agrees to develop, implement, maintain, and use administrative, technical, and physical safeguards that reasonably and appropriately protect the privacy, confidentiality, integrity, and availability of Covered Entity’s electronic and paper PHI that Business Associate creates, receives, maintains, or transmits on Covered Entity’s behalf, as required by the HIPAA Rules and as required by the HITECH Act. Business Associate shall also develop and implement policies and procedures and meet the HIPAA Rules’ documentation requirements as required by the HITECH Act.

(h) In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate agrees to ensure that any agent, including a subcontractor, to whom Business Associate provides PHI, agrees in writing, to abide by the same restrictions, conditions, and requirements that apply to Business Associate with respect to PHI and to implement appropriate safeguards to protect it.

(i) Business Associate agrees to notify Covered Entity within two (2) business days of becoming aware of any use or disclosure of PHI not provided for by the Agreement or of any security incident resulting in the successful unauthorized access, use, disclosure, modification or destruction of information or interference with system operations in an information system or resulting in any “Breach” of “Unsecured Protected Health Information,” as required by 45 CFR 164.410.

(j) Business Associate will provide written notice of the HIPAA Breach of Unsecured PHI, on behalf of Covered Entity, without unreasonable delay but no later than sixty (60) calendar days following the date the HIPAA Breach of Unsecured PHI is discovered or such later date as is authorized under 45 CFR § 164.412 to each Individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, used, or disclosed as a result of the HIPAA Breach. For purposes of this paragraph, a HIPAA Breach shall be treated as discovered as of the first day on which the HIPAA Breach is known or should reasonably have been known to Business Associate (including any person, other than the one committing the HIPAA Breach, which is an employee, officer, or other agent of Business Associate).

The content, form, and delivery of such written notice shall comply in all respects with 45 CFR § 164.404(c)-(d).

If the HIPAA Breach of Unsecured PHI involves less than five hundred (500) individuals, Business Associate will maintain a log or other documentation of the HIPAA Breach of Unsecured PHI which contains such information as would be required to be included if the log were maintained by Covered Entity pursuant to 45 CFR § 164.408, and provide such log to Covered Entity within five (5) business days of Covered Entity’s written request.

Additionally, upon request by the Covered Entity, Business Associate shall notify the Secretary of its breach of unsecured protected health information pursuant to 45 C.F.R. § 164.408

(k) Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Agreement.

(l) Business Associate agrees to maintain appropriate clearance procedures and provide supervision to ensure that its workforce follows Business Associate’s security procedures.

(m) Business Associate agrees to provide appropriate training for its staff to ensure that its staff complies with the HIPAA Rules and the requirements of the HITECH Act.

(n) Business Associate agrees to implement appropriate security incident procedures and provide training to its applicable staff sufficient to detect and analyze security incidents.

(o) Business Associate agrees to maintain a current contingency plan in case of an emergency, as required by 45 CFR §164.308.

(p) Business Associate agrees, as appropriate, to maintain an emergency access plan to ensure that the PHI it holds on behalf of Covered Entity is available when needed, as required by 45 CFR §164.312.

(q) Business Associate agrees to implement appropriate storage, disposal and reuse procedures to protect any PHI that Business Associate holds for Covered Entity.

(r) Business Associate agrees to provide appropriate backup of the PHI that Business Associate holds for Covered Entity, as required by 45 CFR §164.308.

(s) Business Associate agrees to have in place appropriate authentication and access controls to safeguard the PHI that Business Associate holds for Covered Entity.

(t) Business Associate agrees to make use of encryption, as appropriate, when transmitting PHI over the Internet.

(u) Business Associate agrees to retain the documentation required by this agreement for six years from the date of its creation or the date when it last was in effect, whichever is later.

(v) Business Associate agrees not to engage in any sale (as defined in the HIPAA Rules) of

PHI.

(w) With respect to PHI, Business Associate shall abide by any marketing restrictions established by Section 13406 of the HITECH Act.

(x) With respect to PHI, Business Associate shall abide by any fundraising restrictions established by Section 13406 of the HITECH Act.

3. PERMITTED USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION BY BUSINESS ASSOCIATE

(a) Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI to perform functions, activities or services for, or on behalf of, Covered Entity, as specified in the Service Agreement, provided that such use or disclosure would not violate the HIPAA Rules if done by Covered Entity.

(b) Except as otherwise limited in this agreement, Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

(c) Except as otherwise limited in this agreement, Business Associate may disclose PHI for the proper management and administration of the Business Associate if the disclosures are Required By Law; or if Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the PHI will remain confidential and will be used or further disclosed only as Required By Law or only for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

(d) Except as otherwise limited in this agreement, Business Associate may use PHI to provide Data Aggregation services to Covered Entity as permitted by 45 CFR § 164.504(e)(2)(i)(B).

(e) Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with §164.502(j)(1).

4. OBLIGATIONS OF COVERED ENTITY

Covered Entity shall notify Business Associate of any limitations in its notice(s) of privacy practices in accordance with 45 CFR § 164.520, to the extent that such limitations may affect Business Associate's use or disclosure of PHI.

5. PERMISSIBLE REQUESTS BY COVERED ENTITY

Covered Entity shall not request that Business Associate use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Covered Entity, except Business Associate may use or disclose PHI for data aggregation or management and administrative activities of Business Associate.

6. TERM AND TERMINATION

(a) Term.

The Term of this Agreement and the obligations herein shall be deemed effective as of the Compliance Date or the date of execution of this Agreement, whichever date is later, and shall terminate when all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or if it is not feasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions in this Section.

(b) Termination for Cause.

Upon either Party’s (the Non-Breaching Party’s) knowledge of a material breach by the other party (the Breaching Party), the Non-Breaching Party may:

(1) Provide an opportunity for the Breaching Party to cure the material breach or end the violation and terminate this Agreement if the Breaching Party does not cure the material breach or end the violation within the reasonable time specified by the Non-Breaching Party; or

(2) If neither termination nor cure is feasible, the Non-Breaching Party may report the violation to the Secretary. Failure by the Non-Breaching Party to exercise its rights to terminate under this provision shall not be construed as a waiver of its rights to terminate, rescind or revoke the services herein in case of any subsequent breach.

(c) Effect of Termination.

(1) Except as provided in paragraph (2) of this section, upon termination of this Agreement, for any reason, Business Associate shall return or destroy all PHI from Covered Entity or created or received by Business Associate on behalf of Covered Entity. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate.

(2) In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible, including the need to retain PHI for audit, justification of work product or compliance with other applicable law. Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI.

7. MISCELLANEOUS

(a) Definitions. All terms that are used but not otherwise defined in this Agreement shall have the meaning specified under HIPAA, including its statute, regulations, and other official government guidance.

(b) Independent Contractor. The relationship between the parties will solely be that of independent contractors engaged in the operation of their own respective businesses.

(c) Third Party Beneficiaries. The parties agree that there are no intended third-party beneficiaries under this Agreement.

(d) Regulatory References. A reference in this Agreement to a section in the HIPAA Rules and/or HITECH Act means the section as in effect, or as amended, and for which compliance is required.

(e) Amendment. The parties agree to take such action as is necessary to amend this Agreement as is necessary to comply with the requirements of the HIPAA Rules and other applicable law or regulation.

(f) Survival. The respective rights and obligations of Business Associate under Section 6 (c) of this Agreement shall survive the termination of this Agreement.

(g) Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits Covered Entity and Business Associate to comply with the applicable requirements under HIPAA and other applicable law or regulation.

IN WITNESS WHEREOF, the parties have signed this Agreement on the date indicated below.

NAME OF BUSINESS ASSOCIATE SOUTH CAROLINA Department of Juvenile Justice

By:

By:

(Signature) (Signature)

NAME: NAME: (Type or Print Name) (Type or Print Name)

TITLE: _________________________ TITLE:

DATE:

DATE: