Attachment_B_-_BAA_Business_Associate_Agreement.docx

Attachment B – BUSINESS ASSOCIATE AGREEMENT (BAA)

BUSINESS ASSOCIATE AGREEMENT

This BUSINESS ASSOCIATE AGREEMENT (“BAA” or “Agreement is entered into on this July 1, 2027 (“Effective Date”) between City of Phoenix and _________________________ (hereinafter referred to as “Business Associate”). (Covered Entity and Business Associate may each be referred to as a “Party,” and collectively, as the “Parties.”) Covered Entity and Business Associate are Parties to the underlying Cancer Screening Services ("Underlying Agreement") into which this BAA is incorporated as Attachment B, that contains express and implied mutual promises and covenants that in some instances will require the use or disclosure of Protected Health Information (“PHI”) (defined below) pursuant to the terms of this Agreement.

In consideration of the Parties’ continuing obligations as set forth in the Underlying Agreement, and other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree to the following:

I. Background and Purpose

(a) Covered Entity and Business Associate have entered into the Underlying Agreement, pursuant to which Business Associate will be providing Cancer Screening services on behalf of Covered Entity.

(b) Business Associate, in the course of its work for Covered Entity, will frequently perform duties on behalf of Covered Entity that may require the use or disclosure of PHI.

(c) Covered Entity has obligations to protect the privacy and security of PHI received its employees. Covered Entity is thus subject to and must comply with the provisions of the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act (Division A, Title XIII, and Division B, Title IV, of Pub. L. No. 111-5) (which was part of the American Recovery and Reinvestment Act of 2009 (“ARRA”) and relevant implementing regulations, including the Privacy Rule (defined below), the Security Rule (defined below), and the Breach Notification Rule (defined below). Covered Entity is further contractually required to pass such statutory and regulatory obligations on to its subcontractors, agents, and vendors, including entities such as Business Associate.

(d) _________________________ constitutes a Business Associate of Covered Entity (as such term is defined in the Code of Federal Regulations (“Regulations" or "C.F.R."), see 45 C.F.R § 160.103) and wishes to commence and/or continue its business relationship with Covered Entity.

(e) The Parties mutually intend that this Agreement between them will assure compliance with applicable provisions of law and regulation pertaining to the responsibilities of Business Associates of Covered Entities and the obligations that are properly imposed upon and undertaken by “downstream” subcontractors, vendors, or agents of such Business Associates.

(f) This Agreement replaces any existing Agreement or other terms and conditions entered into or agreed upon by the parties governing their respective rights and obligations under HIPAA, as amended, and/or its implementing rules and regulations.

II. Definitions

Terms used, but not otherwise defined, in this Agreement shall, as applicable, have the same meaning as the definitions for such terms in the federal regulations implementing HIPAA, as amended by HITECH provisions of ARRA, which is published in the C.F.R. at Title 45, Parts 160 and 164, as amended from time to time.

(a) “Breach” shall have the meaning given to such term in 45 C.F.R. § 164.402.

(b) “Breach Notification Rule” shall mean the final omnibus rule related to breach notification for unsecured protected health information at 45 C.F.R. Parts 160 and 164.

(c) “Business Associate” shall have the meaning given to such term in 45 C.F.R. § 160.103.

(d) “Covered Entity” shall have the meaning given to such term in 45 C.F.R. § 160.103.

(e) “Designated Record Set” shall have the meaning given to such term under the Privacy Rule at 45 C.F.R. § 164.501.

(f) “Discovery” shall mean the first day on which an event is known to Business Associate (including any person, other than the individual committing the breach, that is an employee, officer, or other agent of Business Associate), or should reasonably have been known to Business Associate, to have occurred.

(g) "Electronic Health Record" shall have the meaning given to such term in Section 13400 of the HITECH Act (42 U.S.C. § 17921).

(h) "Electronic Protected Health Information" or "EPHI" shall have the same meaning given to such term under the Security Rule at 45 C.F.R. § 160.103, including, but not limited to protected health information in electronic form that is created, received, maintained, or transmitted by the health care component of a Covered Entity.

(i) “HIPAA” or “Health Insurance Portability and Accountability Act of 1996” are those provisions set forth in Public Law 104-191 and its implementing rules and regulations.

(j) “HITECH Act” or “HITECH” or “Health Information Technology for Economic and Clinical Health Act” are those provisions set forth in Title XIII of the ARRA of 2009, Public Law 111-5 as enacted on February 17, 2009 and its implementing regulations.

(k) “Individual” shall have the meaning given to such term under the Privacy Rule at 45 C.F.R. § 160.103, and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g).

(l) “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information, codified at 45 C.F.R. Part 160 and Part 164, Subparts A and E.

(m) “Protected Health Information” or “PHI” shall have the meaning given to such term under the Privacy and Security Rules at 45 C.F.R. § 160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity.

(n) “Required by Law” shall have the meaning given to such term under the Privacy Rule at 45 C.F.R. § 164.103.

(o) “Secretary” shall mean the Secretary of the Department of Health and Human Services or his or her designee.

(p) “Security Breach” shall have the same meaning given to the term “breach of security” in Section 13407 of HITECH provisions of ARRA (42 U.S.C. § 17937).

(q) “Security Breach Compliance Date” means the date that is thirty (30) days after the Secretary published interim final regulations to carry out the provisions of Section 13402 of Subtitle D (Privacy) of ARRA, which date is September 24, 2009.

(r) “Security Incident” shall have the meaning given to such phrase under the Security Rule at 45 C.F.R. § 164.304.

(s) “Security Rule” shall mean the Security Standards for the Protection of Electronic Protected Health Information, codified at 45 C.F.R. Part 160 and Part 164, Subparts A and C.

(t) “Subcontractor” shall have the meaning given to such term under in 45 C.F.R. § 160.103.

(u) “Unsecured Protected Health Information” shall have the meaning given to such phrase under the Breach Notification Rule at 45 C.F.R. § 164.402.

(v) Other terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in have the same meaning as the definitions for such terms in the federal regulations implementing HIPAA, as amended by HITECH provisions of ARRA (which is published in the C.F.R. at Title 45, Parts 160 and 164), and/or the Privacy, Security, Enforcement & Breach Notification Final Omnibus Rule, as such rules and provisions are amended from time to time (collectively, the “HIPAA Rules”).

III.

Obligations and Activities of Business Associate

(a) Business Associate agrees not to use or disclose Protected Health Information other than as permitted by this BAA or as required by law. Business Associate acknowledges that, as of the Effective Date of this Agreement, it shall be liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. § 1320d-5 and § 1320d-6 (as amended from time to time), for failure to comply with any of the use and disclosure requirements of this Agreement and any guidance issued by the Secretary from time to time with respect to such use and disclosure requirements.

(b) Business Associate agrees that beginning on the Effective Date of this Agreement or the Security Breach Compliance Date, it will report to Covered Entity any Security Incidents required by HIPAA or HITECH, Security Breach of Unsecured PHI, or any use or disclosure of PHI not provided for by this Agreement without unreasonable delay, and in no case later than (1) the time period required by HIPAA or HITECH, (2) allowed in any applicable underlying contract, or (3) sixty (60) calendar days after Discovery of a Breach, whichever is earliest. Such notice shall include the identification of each individual whose Unsecured PHI has been or is reasonably believed by Business Associate, to have been, accessed, acquired, or disclosed during such Breach. In addition, Business Associate shall provide any additional information reasonably requested by Covered Entity for purposes of investigating the Breach. Business Associate’s notification of a Breach under this Section III(b) shall comply in all respects with each applicable provision of Section 13400 of Subtitle D (Privacy) of ARRA, 45 C.F.R. § 164.410, and any related guidance issued by the Secretary from time to time.

(c) Business Associate agrees that in accordance with 45 C.F.R. § 164.314(a)(2), it will comply with the applicable requirements of Part 164, Subpart C, including but not limited to (1) ensuring that any Subcontractors that create, receive, maintain, or transmit electronic protected health information on behalf of Business Associate agree to comply with the applicable requirements of Part 164, Subpart C by entering into a contract or other arrangement that complies with the HIPAA Rules, and (2) reporting to Covered Entity any Security Incident of which it becomes aware, including breaches of unsecured protected health information as required by 45 C.F.R. § 164.410.

(d) Business Associate agrees to mitigate, to the extent practicable, any harmful effect of any use or disclosure that is known to Business Associate to have occurred in violation of the terms of this BAA, including but not limited to compliance with all mitigation factors and other provisions listed at 45 C.F.R. § 160.408.

(e) Business Associate agrees to ensure that any of its agents or subcontractors to whom Business Associate provides Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, agree to the same restrictions and conditions that apply through this BAA to Business Associate with respect to such PHI, and agree to implement reasonable and appropriate safeguards to protect the confidentiality, integrity, and availability of Electronic Protected Health Information that it creates, receives, maintains, or transmits. With respect to Electronic Protected Health Information, Business Associate shall implement and comply with (and ensure that its subcontractors and agents implement and comply with) the security standards set forth at 45 C.F.R. § 164.306, administrative safeguards set forth at 45 C.F.R. § 164.308, the physical safeguards set forth at 45 C.F.R. § 164.310, the technical safeguards set forth at 45 C.F.R. § 164.312, and the policies and procedures set forth at 45 C.F.R. § 164.316 to reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic Protected Health Information that it creates, receives, maintains, or transmits on behalf of Covered Entity. Business Associate acknowledges that, as of the Effective Date of this Agreement, (i) the foregoing safeguard, policies and procedures requirements shall apply to Business Associate in the same manner that such requirements apply to Covered Entity, and (ii) Business Associate may be liable under the civil and criminal enforcement provisions set forth in 42 U.S.C. § 1320d-5 and § 1320d-6, as amended from time to time, for failure to comply with the safeguard, policies and procedures requirements and any guidance issued by the Secretary from time to time with respect to such requirements.

(f) Business Associate agrees that it shall keep such records and submit such compliance reports, in such manner and containing such information, as the Secretary may determine to be necessary to enable the Secretary to ascertain whether Covered Entity or Business Associate has complied or is complying with the applicable administrative simplification provisions, in accordance with 45 C.F.R. § 160.310(a).

(g) Business associate agrees that it shall cooperate with Covered Entity and the Secretary in the event that the Secretary undertakes an investigation or compliance review of the policies, procedures, or practices of Covered Entity or Business Associate to determine whether Covered Entity or Business Associate is complying with the applicable administrative simplification provisions, in accordance with 45 C.F.R. § 160.310(b).

(h) Business Associate agrees that it shall:

(1) In accordance with 45 C.F.R. § 160.310(c)(1), permit access by the Secretary during normal business hours to its facilities, books, records, accounts, and other sources of information, including protected health information, that are pertinent to ascertaining compliance with the applicable administrative simplification provisions. If the Secretary determines that exigent circumstances exist, such as when documents may be hidden or destroyed, Business Associate must permit access by the Secretary at any time and without notice.

(2) In accordance with 45 C.F.R. § 160.310(c)(2), if any information required of Business Associate under 45 C.F.R. § 160.310(c) is in the exclusive possession of any other agency, institution, or person and the other agency, institution, or person fails or refuses to furnish the information, Business Associate must so certify and set forth all efforts it has made to obtain the information.

(i) Business Associate agrees to make internal practices, books, and records, including policies and procedures and Protected Health Information, relating to the use and disclosure of Protected Health Information received from, or created or received by Business Associate on behalf of Covered Entity, available to Covered Entity and/or to the Secretary of the United States Department of Health and Human Services, within ten (10) business days of receiving such request, or at such other time as may be designated by the Secretary, for purposes of the Secretary determining Covered Entity's and/or Business Associate’s compliance with the Rule and the HITECH provisions of ARRA and related guidance as issued by the Secretary from time to time.

(j) Business Associate agrees that in accordance with 45 C.F.R. § 164.502(a)(4), it shall disclose protected health information (1) when required by the Secretary under Part 160, Subpart C to investigate or determine the Business Associate’s compliance with the HIPAA Rules, or (2) to Covered Entity, an Individual (or Individual’s designee), as necessary to satisfy Covered Entity’s obligations under 45 C.F.R. § 164.524(c)(2)(ii) and (3)(ii) with respect to an individual’s request for an electronic copy of PHI.

(k) Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual or an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. § 164.528 and the HITECH provisions of ARRA and related guidance as issued by the Secretary from time to time.

(l) Business Associate agrees to provide to Covered Entity or the Individual to whom PHI relates, upon request and within ten (10) business days of receiving such request, information collected in accordance with Section III(k) of this BAA and sufficient to constitute or permit Covered Entity to provide, a response to a request by the Individual for an accounting of disclosures of Protected Health Information in accordance with 45 C.F.R. § 164.528. In addition, with respect to information contained in an Electronic Health Record, Business Associate shall document, and maintain such documentation for three (3) years from date of disclosure, such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of information contained in an Electronic Health Record, as required by Section 13405(c) of Subtitle D (Privacy) of ARRA (42 U.S.C. § 17935), and related regulations issued by the Secretary from time to time.

(m) Business Associate agrees to provide access to Covered Entity or an Individual, as requested by or directed by Covered Entity, respectively, to Health Information in a Designated Record Set within ten (10) business days of such request, to meet the requirements under 45 C.F.R. §164.524 and Section 13405(e) of Subtitle D (Privacy) of ARRA (42 U.S.C. § 17935(e)), and related guidance issued by the Secretary from time to time.

(n) Business Associate agrees to promptly make any amendment(s) to Protected Health Information in a Designated Record Set that Covered Entity directs or agrees to pursuant to 45 C.F.R. § 164.526 at the request of Covered Entity or an Individual to whom the PHI pertains.

(o) Business Associate agrees, in accordance with 45 C.F.R. § 164.502(a)(5)(ii), that it shall not sell any PHI received from Covered Entity, except pursuant to written authorization and consent provided by Covered Entity to Business Associate that complies with the requirements of 45 C.F.R. § 164.508(a)(4).

(p) Business Associate agrees, in accordance with 45 C.F.R. § 160.316, that it shall not threaten, intimidate, coerce, harass, discriminate against, or take any other retaliatory action against any individual or other person for (1) filing a complaint under 45 C.F.R. § 160.306, (2) testifying, assisting, or participating in an investigation, compliance review, proceeding, or hearing under this part, or (3) opposing any act or practice made unlawful by the HIPAA Rules, provided the individual or person has a good faith belief that the practice opposed is unlawful, and the manner of opposition is reasonable and does not involve a disclosure of PHI in violation of Part 164, Subpart E.

IV. Permitted Uses and Disclosures by Business Associate

(1) Business Associate may use and/or disclose Protected Health Information provided or made available from Covered Entity only (1) to complete any and all services agreed to pursuant to the Underlying Agreement between the parties (and any corresponding Statement(s) of Work, as applicable), or (2) to perform functions, activities, or services for, or on behalf of Covered Entity as specified in the Underlying Agreement, provided that such use or disclosure would not violate the HIPAA Rules if done by Covered Entity, violate the terms of this Agreement, or violate the policies or procedures of Covered Entity.

(b) Except as otherwise limited in this BAA, Business Associate acknowledges that it shall request from Covered Entity and disclose to its affiliates, agents and subcontractors or other third parties, only (i) the information contained in a “Limited Data Set,” as such term is defined at 45 C.F.R. § 164.514(e)(2), or, (ii) if needed by Business Associate, the minimum necessary PHI to accomplish the intended purpose of such requests or disclosures. In all cases, Business Associate shall request and disclose Protected Health Information only in a manner that is consistent with this Agreement, all relevant HIPAA Rules, and guidance issued by the Secretary from time to time.

(c) Except as otherwise limited in this BAA, Business Associate may disclose Protected Health Information for the proper management and administration of the Business Associate, or for the management, prosecution, or defense of any legal proceeding which involves Business Associate (including but not limited to the disclosure of such PHI and/or ePHI to any law firm or expert that may be retained by or otherwise represent or assist Business Associate in any such lawsuit). Business Associate shall obtain reasonable assurances from the person or entity to whom the information is disclosed that (i) it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and (ii) the person or entity shall notify the Business Associate of any instances of which it is aware in which the confidentiality of the Protected Health Information has been breached.

(d) Except as otherwise limited in this BAA, Business Associate may, in accordance with 45 C.F.R. § 164.502(e)(1)(ii), disclose Protected Health Information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit Protected Health Information on its behalf, only if Business Associate obtains satisfactory assurances, through a business associate agreement that satisfies 45 C.F.R. § 164.504(e)(1)(i), that the subcontractor will appropriately safeguard the information.

(1) In accordance with 45 C.F.R. § 164.504(e)(1)(iii), in the event that Business Associate learns or knows of a pattern of activity or practice of a subcontractor that presently constitutes or previously constituted a material breach of the subcontractor’s obligation under the business associate agreement providing for the disclosure of PHI, Business Associate shall (A) promptly notify Covered Entity of such activity or practice, and (B) take prompt, reasonable steps to cure the breach or end the violation, as follows:

A. Provide an opportunity for subcontractor to cure the breach or end the violation within ten (10) days of receiving notice of the breach and/or violation. If such action does not successfully bring about cure of the breach or an end to the violation within the time specified by the Parties, Business Associate may terminate the BAA and the Underlying Agreement under which the subcontractor has access to, uses or discloses PHI on behalf of Business Associate and/or Covered Entity; or

B. Immediately terminate the BAA and the Underlying Agreement under which the subcontractor has access to, uses or discloses PHI on behalf of Business Associate and/or Covered Entity, if cure of the breach or causing the violation to end is not possible; or

C. If neither termination nor cure is feasible, Business Associate, under direction from Covered Entity, shall report the violation to the Secretary, as required by the HIPAA Rules, or other applicable laws, rules, or regulations.

(e) Except as otherwise limited in this BAA or the Underlying Agreement, Business Associate may use Protected Health Information to provide Data Aggregation services relating to the health care operations of Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).

(f) Business Associate may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 C.F.R. § 164.502(j)(1).

V. Obligations of Covered Entity

(a) Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose Protected Health Information, to the extent that such changes may affect Business Associate’s use or disclosure of Protected Health Information.

(b) Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information that Covered Entity has agreed to in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate’s use or disclosure of Protected Health Information.

(c) Permissible Requests by Covered Entity. Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by Covered Entity, except that this restriction is not intended, and shall not be construed, to limit Business Associate's capacity to use or disclose Protected Health Information for the proper management and administration of the Business Associate or to provide Data Aggregation services to Client, as provided for and expressly permitted under Section IV.(b), (d), and (e) of this BAA.

VI. Term and Termination

(a) Term. The Term of this BAA shall be effective on the Effective Date provided herein, and shall terminate when the contractual or other relationship between Covered Entity and Business Associate that involves or requires the receipt, creation, use, and/or disclosure of PHI by or to the Business Associate is terminated or ceases to exist, whichever is earlier.

(b) Termination for Cause. Upon Covered Entity obtaining knowledge of or reason to believe that a pattern of activity or practice by Business Associate that constitutes a material breach or violation of Business Associate’s obligations under this BAA, Covered Entity shall:

(1) Provide an opportunity for Business Associate to cure the breach or end the violation within ten (10) days of receiving notice of the breach and/or violation. If such action does not successfully bring about cure of the breach or an end to the violation within the time specified by the Parties, Covered Entity may terminate this BAA and the Underlying Agreement under which the Business Associate has access to, uses or discloses PHI on behalf of Covered Entity; or

(2) Immediately terminate this BAA and the Underlying Agreement under which the Business Associate has access to, uses or discloses PHI on behalf of Covered Entity, if cure of the breach or causing the violation to end is not possible; or

(3) If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary, as required by the HIPAA Rules, or other applicable laws, rules, or regulations.

(c) Obligations of Business Associate Upon Termination

(1) Except as provided in paragraph (2) of this subsection, upon termination of this BAA for any reason, Business Associate shall return to Covered Entity or destroy all Protected Health Information received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity. This provision shall also apply to Protected Health Information that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information.

(2) In the event that return or destruction of any Protected Health Information is not feasible, Business Associate shall extend the protections of this BAA to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protected Health Information.

VII. State Law

If state law applicable to the relationship between Business Associate and Covered Entity contains additional or more stringent requirements than federal law for Business Associates regarding any aspect of privacy or security, then Business Associate agrees to comply with the additional or more stringent standard contained in applicable state law.

VIII. Miscellaneous

(a) Regulatory References. A reference in this BAA to a section in the HIPAA Rules means the section as is presently in effect or amended.

(b) Amendment. This BAA may only be modified through a writing signed by the Parties and, thus, no oral modification hereof shall be permitted. Covered Entity and Business Associate agree to take such action as is necessary to amend this BAA from time to time as is necessary for Covered Entity to comply with the requirements of HIPAA or the Privacy, Security or Breach Notification Rules.

(c) Indemnification. Business Associate agrees to defend, indemnify and hold Covered Entity harmless from and against any and all penalties, claims, losses, liabilities or expenses (including without limitation attorneys' fees) which may arise, in whole or in part, out of a breach or violation by the Business Associate of its obligations under this BAA, the HIPAA Rules, or applicable law, rules, or regulations.

(d) Survival. The respective rights and obligations of Business Associate pursuant to this Agreement shall survive the termination of this Agreement.

(e) Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Entity comply with the HIPAA Rules.

(f) Notice.

1. To COVERED ENTITY. Any notice or reporting required under this BAA to be given to Covered Entity shall be made in writing to:

NAME:

TITLE:

ADDRESS1:

ADDRESS2:

PHONE:

EMAIL:

FAX:

2. To BUSINESS ASSOCIATE. Any notice or reporting required under this BAA to be given to Business Associate shall be made in writing to:

IN WITNESS WHEREOF, Covered Entity and Business Associate have caused this Business Associate Agreement to be executed by duly authorized officers.

By

Melinda Holguin Finance Director

By

Name _________________________ Title __________________________