Attachment A.pdf

Page 1 (Revised 11/30/18)

HIPAA BUSINESS ASSOCIATE AGREEMENT

BETWEEN

SOUTH CAROLINA DEPARTMENT OF DISABILITIES & SPECIAL NEEDS

AND

(insert name)

I. PURPOSE:

The South Carolina Department of Disabilities and Special Needs (COVERED ENTITY) and

(Add Name) (BUSINESS

ASSOCIATE) wish to enter in to this Agreement for the purpose of protecting the privacy of individually identifiable health information under the Health Insurance Portability and

Accountability Act of 1996 (HIPAA) in performing the functions, activities, or services for, or on behalf of, COVERED ENTITY as specified in the Agreement between the parties dated through .

II. DEFINITIONS: (Terms used, but not defined shall have the same meaning as those terms in the HIPAA Privacy Rule and the HIPAA Security Rule.)

a. Business Associate: “Business Associate” shall generally have the same meaning as the term “business associate” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean (Insert Name of Business Associate)

b. Covered Entity: “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to the party to this agreement, shall mean The South Carolina Department of Disabilities and Special

Needs (DDSN).

c. Individual: means the same as “individual” in 45 CFR § 164.501 and includes a person who qualifies as a personal representative in accordance with 45 CFR §

164.502(g).

d. HIPAA Rules: “HIPAA Rules” shall mean the Privacy, Security, Breach

Notification, and Enforcement Rules at 45 CFR Part 160, 162 and Part 164.

e. Protected Health Information (PHI): means the same as “protected health information” in 45 CFR § 164.501, limited to information created/received by

BUSINESS ASSOCIATE from /on behalf of COVERED ENTITY.

f. Required by Law: means the same as “required by law” in 45 CFR § 164.501, and other law applicable to the PHI disclosed pursuant to this Agreement.

g. Secretary: means the Secretary of the Department of Health and Human Services or designee.

Page 2 (Revised 11/30/18)

III. BUSINESS ASSOCIATE AGREES TO:

a. Not use or disclose PHI other than as permitted or required by the Agreement or as Required by Law.

b. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic PHI, to prevent use or disclosure of PHI other than as provided for by the Agreement;

c. Mitigate to the extent practicable, any harmful effect known to BUSINESS

ASSOCIATE if BUSINESS ASSOCIATE uses/disclosures PHI in violation of this Agreement.

d. Report to COVERED ENTITY any use or disclosure of PHI not provided for by the Agreement of which it becomes aware, including breaches of unsecured PHI as required at 45 CFR 164.410, and any security incident of which it becomes aware within one (1) business day and before notifying any other entity;

e. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the BUSINESS ASSOCIATE agree to the same restrictions, conditions, and requirements that apply to the BUSINESS ASSOCIATE with respect to such information;

f. If the BUSINESS ASSOCIATE has PHI in a Designated Record, provide access at the request of COVERED ENTITY, and in the time and manner designated by

COVERED ENTITY, to PHI in a Designated Record Set, to COVERED ENTITY or, as directed by COVERED ENTITY, to an Individual in order to meet the requirements under 45 CFR § 164.524.

g. If the BUSINESS ASSOCIATE has PHI in a Designated Record Set, make any amendment(s) to PHI in a Designated Record Set that the COVERED ENTITY directs or agrees to pursuant to 45 CFR § 164.526 at the request of COVERED

ENTITY or an Individual, and in the time and manner designated by COVERED

ENTITY.

h. Make internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI received from, or created or received by BUSINESS ASSOCIATE on behalf of, COVERED ENTITY available to the COVERED ENTITY, or at the request of the COVERED

ENTITY to the Secretary, in a time and manner designated by the COVERED

ENTITY or the Secretary, for purposes of the Secretary determining COVERED

ENTITY's compliance with the HIPAA Rules.

i. Document such disclosures of PHI and information related to such disclosures as would be required for COVERED ENTITY to respond to a request by an

Page 3 (Revised 11/30/18)

Individual for an accounting of disclosures of PHI in accordance with 45 CFR §

164.528.

j. Provide to COVERED ENTITY or an Individual, in time and manner designated by COVERED ENTITY, information collected in accordance with Section III.i of this Agreement, to permit COVERED ENTITY to respond to a request by an

Individual for an accounting of disclosures of PHI in accordance with 45 CFR §

164.528.

IV. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE:

a. Except as limited in this Agreement, BUSINESS ASSOCIATE may use PHI to perform functions, activities, or services for, or on behalf of, COVERED

ENTITY as specified in the agreement noted in I., provided that such use would not violate Subpart E of 45 CFR Part 164 if done by COVERED ENTITY or the

COVERED ENTITY’s minimum necessary policies and procedures. Unless otherwise permitted in this Agreement, in the Agreement noted in I. above or as

Required by Law, BUSINESS ASSOCIATE may not disclose or re-disclose PHI except to COVERED ENTITY.

b. Except as limited in this Agreement, BUSINESS ASSOCIATE may use or disclose PHI for the proper internal management and administration of the

BUSINESS ASSOCIATE or to carry out the legal responsibilities of the

BUSINESS ASSOCIATE, as needed for BUSINESS ASSOCIATE to provide services to COVERED ENTITY under the above noted Agreement.

c. Except as limited in this Agreement, BUSINESS ASSOCIATE may use PHI to provide Data Aggregation services to COVERED ENTITY as permitted by 42

CFR § 164.504(e)(2)(i)(B).

d. BUSINESS ASSOCIATE may use PHI to report violations of law to appropriate

Federal and State authorities, consistent with § 164.502(j)(1).

V. SAFEGUARDING INFORMATION:

a. The BUSINESS ASSOCIATE shall safeguard the use and disclosure of information on service users in accordance with: 42 CFR Part 431, Subpart F, “Safeguarding Information on Applicants and Recipients under Title XIX” and S.

C. Code Ann. § 44-20-340, the Health Insurance Portability and Accountability

Act of 1996, as amended, the Family Education Rights and Privacy Act (FERPA, 34 CFR Part 99), and DDSN’s directives concerning confidentiality, data protection, and privacy.

b. BUSINESS ASSOCIATE will be required to sign this HIPAA Business

Associates Agreement to ensure compliance with the Health Insurance Portability

Page 4 (Revised 11/30/18) and Accountability Act of 1996, as amended and the Family Education Rights and

Privacy Act (FERPA, 34 CFR Part 99).

c. In the event that the BUSINESS ASSOCIATE has a security incident that poses a threat to the security of Personally Identifiable Information (PII), Protected Health

Information (PHI), sensitive information, resources and/or COVERED ENTITY’s operations, the BUSINESS ASSOCIATE shall provide notification to COVERED

ENTITY’s Information Security Officer and/or Data Privacy Officer of the incident within one (1) business day and before notifying any other entity.

d. The BUSINESS ASSOCIATE shall cooperate with COVERED ENTITY by immediately performing activities as directed to mitigate any harmful effects as a result of wrongful use or disclosure of confidential information. The BUSINESS

ASSOCIATE shall submit a Corrective Action Plan regarding the wrongful use or disclosure within 14 calendar days of notifying COVERED ENTITY, data has been compromised. The BUSINESS ASSOCIATE, as directed by COVERED

ENTITY, will provide one (1) year of credit monitoring services to affected service users.

e. In the event of any use or disclosure of confidential information that is in violation of this Agreement or any other federal, state, or local law, the

BUSINESS ASSOCIATE shall provide notification to COVERED ENTITY’s

Information Security Officer and/or Data Privacy Officer within one (1) business day and before notifying any other entity. “Confidential information” is defined as any and all non-public, medical, financial, and personal information in any form (written, oral, visual or electronic) possessed or obtained. Confidential information includes all information labeled in writing by either party as confidential, information identified as confidential at the time of disclosure, information commonly regarded as confidential in the health care industry and/or is PHI as defined in the Health Insurance Portability and Accountability Act of

1996, as amended.

VI. COVERED ENTITY Shall:

a. Notify BUSINESS ASSOCIATE of any limitation(s) in its notice of privacy practices of COVERED ENTITY in accordance with 45 CFR § 164.520, to the extent that such limitation may affect BUSINESS ASSOCIATE’S use or disclosure of PHI.

b. Notify BUSINESS ASSOCIATE of any changes in, or revocation of, permission by Individual to use or disclose PHI, to the extent that such changes may affect

BUSINESS ASSOCIATE’S use or disclosure of PHI.

c. Notify BUSINESS ASSOCIATE of any restriction to the use/disclosure of PHI that COVERED ENTITY has agreed to in accordance with 45 CFR § 164.522, to

Page 5 (Revised 11/30/18) the extent that such restriction may affect BUSINESS ASSOCIATE’S use/disclosure of PHI.

d. Not request BUSINESS ASSOCIATE to use or disclose PHI in any manner that would not be permissible under the HIPAA Rules if done by COVERED

ENTITY.

VII. TERM AND TERMINATION:

a. This Agreement is effective upon signing and shall terminate when all of the PHI provided by COVERED ENTITY to BUSINESS ASSOCIATE, or created or received by BUSINESS ASSOCIATE on behalf of COVERED ENTITY, is returned to COVERED ENTITY, or, if it is infeasible to return PHI, protections are extended to such PHI in accord with the termination provisions in this Section.

Alternatively, COVERED ENTITY may request that BUSINESS ASSOCIATE destroy all such PHI upon termination of this Agreement rather than returning

PHI to the COVERED ENTITY. BUSINESS ASSOCIATE shall provide written documentation of such destruction. The requirement to return or destroy such

PHI will apply to all subcontractors of BUSINESS ASSOCIATE. BUSINESS

ASSOCIATE will be responsible for recovering and returning to COVERED

ENTITY, or destroying, any PHI from such subcontractors. If BUSINESS

ASSOCIATE cannot obtain the PHI from any subcontractor, BUSINESS

ASSOCIATE will so notify COVERED ENTITY and will require that such subcontractors directly return PHI to COVERED ENTITY or otherwise destroy such PHI, subject to the terms of this Section.

b. Upon COVERED ENTITY’s knowledge of a material breach by BUSINESS

ASSOCIATE, COVERED ENTITY shall:

1. Provide an opportunity for BUSINESS ASSOCIATE to cure the breach or end the violation and terminate this Agreement and the above identified agreement if BUSINESS ASSOCIATE does not cure the breach or end the violation within the time specified by COVERED ENTITY; OR

2. Immediately terminate this Agreement and the above identified

Agreement if BUSINESS ASSOCIATE has breached a material term of this Agreement and cure is not possible; OR

3. If neither termination nor cure is feasible, COVERED ENTITY shall report the violation to the Secretary.

c. Obligations of Business Associate Upon Termination

Except as provided in paragraph (1) below, upon termination of this Agreement for any reason, BUSINESS ASSOCIATE, with respect to PHI received from COVERED

Page 6 (Revised 11/30/18)

ENTITY, or created, maintained, or received by BUSINESS ASSOCIATE on behalf of

COVERED ENTITY, shall:

1. Retain only that PHI which is necessary for BUSINESS ASSOCIATE to continue its proper management and administration or to carry out its legal responsibilities;

2. Return to COVERED ENTITY or, if agreed to by COVERED ENTITY, destroy the remaining PHI that the BUSINESS ASSOCIATE still maintains in any form;

3. Continue to use appropriate safeguards and comply with Subpart C of 45

CFR Part 164 with respect to electronic PHI to prevent use or disclosure of the PHI, other than as provided for in this Section, for as long as

BUSINESS ASSOCIATE retains the PHI;

4. Not use or disclose the PHI retained by BUSINESS ASSOCIATE other than for the purposes for which such PHI was retained and subject to the same conditions set out at Subpart E of 45 CFR Part 164 which applied prior to termination; and

5. Return to COVERED ENTITY or, if agreed to by COVERED ENTITY, destroy the PHI retained by BUSINESS ASSOCIATE when it is no longer needed by BUSINESS ASSOCIATE for its proper management and administration or to carry out its legal responsibilities.

VIII. MISCELLANEOUS:

a. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

b. The Parties agree to amend this Agreement as necessary to comply with HIPAA and other applicable law.

c. The rights and obligations of BUSINESS ASSOCIATE under Section VI. c shall survive the termination of this Agreement.

d. Any ambiguity in this Agreement shall be resolved to permit COVERED

ENTITY to comply with HIPAA Rules.

COVERED ENTITY BUSINESS ASSOCIATE

Pat Maley Date Date

Deputy Director

South Carolina Department of

Disabilities and Special Needs