Attachment C - Business Associate Agreement.docx

ATTACHMENT C – SAMPLE BUSINESS ASSOCIATE AGREEMENT

(If Contractor already has a BAA established – submit copy with your response as Attachment C)

BUSINESS ASSOCIATE AGREEMENT BETWEEN THE DEPARTMENT OF VETERANS AFFAIRS, VETERANS HEALTH ADMINISTRATION AND [CONTRACTOR NAME: ]

1. Whereas, (Business Associate) provides services to the Department of Veterans Affairs (VA) Veterans Health Administration (VHA) (Covered Entity), and

Whereas, in order for Business Associate to provide services to the Covered Entity, the Covered Entity discloses to the Business Associate Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Title 45 Code of Federal Regulations (CFR) Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information ("Privacy Rule"), and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard ("Security Rule"); and

Whereas, the VA VHA is a "Covered Entity" as that term is defined in the HIPAA implementing regulations, 45 CFR 160.103, and

Whereas, , as a recipient of PHI from Covered Entity in order to provide services to Covered Entity, is a "Business Associate" of Covered Entity as the term "Business Associate" is defined in the HIPAA implementing regulations, 45 CFR 160.103; and

Whereas, pursuant to the Privacy and Security Rules, all Business Associates of Covered Entities must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI; and

Whereas, the purpose of this Business Associate Agreement (BAA) is to comply with the requirements of the Privacy and Security Rules, including, but not limited to, the BAA requirements at 45 CFR 164.308(b), 164.314(a), 164.502(e), and 164.504(e), and as may be amended.

2. NOW, THEREFORE, the Covered Entity and Business Associate agree as follows:

a. Definitions. Unless otherwise provided in this BAA, capitalized terms and phrases that are defined in the Privacy and Security Rules have the same meanings as set forth in the Privacy and Security Rules. When the phrase "Protected Health Information" and the abbreviation "PHI" are used in this BAA, they include the phrase "Electronic Protected Health Information" and the abbreviation "EPHI."

b. Ownership of PHI. PHI provided by Covered Entity to Business Associate and its agents and subcontractors, or gathered by them on behalf of the Covered Entity, under this BAA are the property of Covered Entity.

c. Scope of Use and Disclosure by Business Associate of PHI

(1) The Business Associate is permitted to make Use and Disclosure of PHI that is disclosed to it by Covered Entity, or received by Business Associate on behalf of Covered Entity, as necessary to perform its obligations under all applicable agreements and this BAA with covered entity, provided that the Covered Entity may make such Use or Disclosure under the Privacy and Security Rules, and the Use or Disclosure complies with the Covered Entity's minimum necessary policies and procedures.

(2) Unless otherwise limited herein, in addition to any other Uses and/or Disclosures permitted or authorized by this BAA or Required by Law, Business Associate may:

(a) Use the PHI in its possession for its proper management and administration and to fulfill any legal responsibilities of Business Associate.

(b) Make a Disclosure of the PHI in its possession to a third-party for the purpose of the Business Associate's proper management and administration or to fulfill any legal responsibilities of the Business Associate; provided, however, that the Disclosure is permitted by the Privacy Rule if made by the Covered Entity, or Required by Law; and provided further that where the Disclosure is not permitted by the Privacy Rule, or required by law, the Business Associate has received from the third-party written assurances that:

i. The information will be held confidentially and Used or further Disclosed only as Required By Law or for the purposes for which it was disclosed to the third-party; and

ii. The third-party will notify the Business Associate of any instances of which it becomes aware in which the confidentiality of the information has been breached.

(c) Engage in Data Aggregation activities, consistent with the Privacy Rule.

(d) De-identify any and all PHI created or received by the Business Associate under this BAA; provided that the de-identification conforms to the requirements of the Privacy Rule.

d. Obligations of the Business Associate. In connection with its Use and Disclosure of PHI under this BAA, the Business Associate agrees that it will:

(1) Use or make further Disclosure of PHI only as permitted or required by the Privacy Rule, or this BAA, or as Required by Law.

(2) Ensure any employee of the Business Associate, contractor, subcontractor, or agent of the Business Associate receives at least annual privacy training that conforms to the requirements of VHA Privacy Training.

(3) Ensure any employee of the Business Associate, contractor, subcontractor, or agent of the Business Associate, receives at least annual security awareness training that conforms to the requirements of the Department of Veterans Affairs (VA) Office of Cyber and Information Security Training.

(4) Use reasonable and appropriate safeguards to prevent Use or Disclosure of PHI other than as provided by this BAA.

(5) To the extent practicable, mitigate any harmful effect of a Use or Disclosure of PHI by the Business Associate in violation of this BAA that is known to the Business Associate.

(6) Maintain a system or process to account for any Security Incident, Privacy Incident, or Use or Disclosure of PHI not provided for by this BAA of which the Business Associate becomes aware.

(7) Within 24 hours of the Business Associate first becoming aware of a HIPAA Electronic Transactions and Code Sets, Privacy, Security or Standard Identifier Incident, or Use or Disclosure of PHI not provided for by this BAA, the Business Associate must notify the Covered Entity and promptly provide a report to Covered Entity.

(a) An incident is considered any physical, technical, or personal activity or event that increases the Covered Entity’s risk to inappropriate or unauthorized use or disclosure of PHI or causes the Covered Entity to be considered non-compliant with the Administrative Simplification provisions of HIPAA as determined by the Department of Health and Human Services.

(b) Notification must be made by the Business Associate to the responsible contracting officer and to the Director, VHA HIPAA Program Management Office (PMO) (by telephone, 202-254-0385, or secure fax) of any HIPAA Electronic Transactions and Code Sets, Privacy, Security or Standard Identifier Incident, or Use or Disclosure of PHI not provided for by this BAA.

(c) Within 10 business days of an initial notification of such incident, a written report of the incident is to be submitted to the VHA HIPAA PMO. This documentation must include a detailed description of the incident, the mitigation procedures that were implemented to lessen its impact, and the processes (reasonable and appropriate safeguards) that were established to prevent the incident from reoccurring. This report is to be documented as a letter, and is to be sent to:

Director, VHA HIPAA PMO Department of Veterans Affairs - Veterans Health Administration Chief Business Office (16) 810 Vermont Avenue, NW, Mailstop 161 Washington, DC 20420 Phone: 202-254-0385 Fax: 202-254-0396. Hipaa.pmo@va.gov

(8) Require contractors, subcontractors, or agents to whom the Business Associate provides PHI received from the Covered Entity to agree to the same restrictions and conditions that apply to the Business Associate pursuant to this BAA, including implementation of reasonable and appropriate safeguards to protect PHI.

(9) Make available to the Secretary of Health and Human Services, the Business Associate’s internal practices, books and records, including policies and procedures, relating to the Use or Disclosure of PHI for purposes of determining Covered Entity’s compliance with the Privacy and Security Rules, subject to any applicable legal privileges.

(10) If the Business Associate maintains PHI in a Designated Record Set, maintain the information necessary to document the Disclosures of PHI sufficient to make an accounting of those Disclosures as required under the Privacy rule and the Privacy Act, Title 5 United States Code (U.S.C.) 552a, and within 10 days of receiving a request from Covered Entity, make available the information necessary for the Covered Entity to make an accounting of Disclosures of PHI about an individual in the Designated Record Set or Covered Entity’s Privacy Act System of Records.

(11) If the Business Associate maintains PHI in a Designated Record Set or Privacy Act System of Records, within 10 days of receiving a written request from Covered Entity, make available PHI in the Designated Record Set or System of Records necessary for Covered Entity to respond to individuals’ requests for access to PHI about them that is not in the possession of Covered Entity.

(12) If the Business Associate maintains PHI in a Designated Record Set or Privacy Act System of Records, within 10 days of receiving a written request from the Covered Entity, incorporate any amendments or corrections to the PHI in the Designated Record Set, or System of Records in accordance with the Privacy Rule and Privacy Act;

(13) Not make any Uses or Disclosures of PHI that the Covered Entity would be prohibited from making.

(14) Utilize only contractors, subcontractors, or agents who are physically located within a jurisdiction subject to the laws of the United States. The Business associate must ensure that it does not use or disclose PHI received from Covered Entity in any way that will remove the PHI from such jurisdiction.

(15) When the Business Associate is uncertain whether it may make a particular Use or Disclosure of PHI in performance of this BAA, consult with the Covered Entity before making the Use or Disclosure.

(16) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality and integrity, and availability of the PHI that the Business Associate receives, maintains, or transmits on behalf of the Covered Entity as required by the Privacy and Security Rules.

(17) Provide satisfactory assurances that the confidentiality, integrity, and availability of the PHI, which it receives, creates, transmits or maintains, is reasonably and appropriately protected.

(18) Provide satisfactory assurances that any agent, including a subcontractor, to whom it provides such information agrees to implement reasonable and appropriate safeguards to protect the data.

(19) Upon completion of the applicable contract(s) or agreement(s), return or destroy the PHI gathered, created, received, or processed during the performance of the contract(s) or agreement(s), and that no data will be retained by the Business Associate, or any agents or subcontractors of the Business Associate. The Business Associate must ensure that all PHI has been returned to the Covered Entity or destroyed. If immediate return or destruction of all data is not possible, the Business Associate must ensure that all PHI retained is safeguarded to prevent unauthorized Uses or Disclosures. Until the Business Associate has assurance, the Covered Entity may withhold 15 percent of the final payment of the contract(s) or agreement(s).

e. Obligations of Covered Entity. The Covered Entity agrees that it:

(1) Has obtained, and will obtain, from Individuals any consents, authorizations, and other permissions necessary or required by laws applicable to the Covered Entity for the Business Associate and the Covered Entity to fulfill their obligations under this BAA.

(2) Will promptly notify the Business Associate in writing of any restrictions on the Use and Disclosure of PHI about Individuals that the Covered Entity has agreed to, which may affect the Business Associate’s ability to perform its obligations under this BAA;

(3) Will promptly notify the Business Associate in writing of any change in, or revocation of, permission by an Individual to use or disclose PHI, if such a change or revocation may affect the Business Associate’s ability to perform its obligations under this BAA.

f. Material Breach of the BAA. Upon the Covered Entity’s determination of a material breach of this BAA by the Business Associate, the Covered Entity must provide an opportunity for the Business Associate to cure the breach; and if a cure is not possible, the Covered Entity must report the violation to the Secretary of Health and Human Services.

g. Termination

(1) Termination for Cause. Upon the Covered Entity’s knowledge of a material breach by the Business Associate, the Covered Entity must:

(a) Provide an opportunity for the Business Associate to cure the breach, or if the Business Associate does not cure the breach or end the violation within the time specified by Covered Entity, then terminate this Agreement and underlying contract(s).

(b) Immediately terminate this Agreement and underlying contract(s) if the Business Associate has breached a material term of this Agreement and cure is not possible.

(c) If neither termination nor cure is feasible, the Covered Entity must report the violation to the Secretary of Health and Human Services.

(d) Terminate this BAA, if appropriate, upon review as defined in subparagraph 2m of this BAA.

(2) Automatic Termination. This Agreement will automatically terminate upon completion of the Business Associate’s duties under all underlying agreements or by mutual written agreement to terminate underlying agreements.

(3) Effect of Termination. Termination of this Agreement will result in cessation of activities by the Business Associate, and any agents or subcontractors of the Business Associate involving PHI under this Agreement.

h. Amendment. The Business Associate and the Covered Entity agree to take such action as is necessary to amend this BAA for the Covered Entity to comply with the requirements of the Privacy and Security Rules, or other applicable law.

i. No Third-party Beneficiaries. Nothing expressed or implied in this BAA is intended to confer, nor shall anything herein confer, upon any person other than the parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities whatsoever.

j. Other Applicable Law. This BAA does not, and is not intended to, abrogate any responsibilities of the parties under any other applicable law.

k. Effect of Agreement. With respect solely to the subject matter herein, in the case of any conflict in terms between this BAA and any other previous agreement or addendum between the parties, the terms of this BAA control, supersede, and nullify any conflicting terms as they relate to the parties in a business associate relationship.

l. Effective Date. This BAA becomes effective on .

m. Review Date. The provisions of this BAA will be reviewed by the Covered Entity after substantive changes to the underlying agreement to determine the applicability of the agreement based on the relationship of the parties at the time of review.

Department of Veterans Affairs Veterans Health Administration

By: By:

Name: Name:

Title: Title:

Date: Date: