Attachment C - HIPAA BAA - Pages 1-2.pdf

Attachment C - HIPAA BAA RFx 3000026305 TITLE: Enteral Feeding Supplies - LDH

HIPAA Business Associate Addendum

This HIPAA Business Associate Addendum is hereby made a part of this contract in its entirety as Attachment C to the contract.

1. The Louisiana Department of Health (“LDH”) is a Covered Entity, as that term is defined herein, because it functions as a health plan and as a health care provider that transmits health information in electronic form.

2. Contractor is a Business Associate of LDH, as that term is defined herein, because contractor either: (a) creates, receives, maintains, or transmits PHI for or on behalf of LDH; or (b) provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services for LDH involving the disclosure of PHI.

3. Definitions: As used in this addendum – A. The term “HIPAA Rules” refers to the federal regulations known as the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules, found at 45 C.F.R. Parts 160 and 164, which were originally promulgated by the U. S. Department of Health and Human Services (DHHS) pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”) of 1996 and were subsequently amended pursuant to the Health Information Technology for Economic and Clinical Health (“HITECH”) Act of the American Recovery and Reinvestment Act of 2009.

B. The terms “Business Associate”, “Covered Entity”, “disclosure”, “electronic protected health information” (“electronic PHI”), “health care provider”, “health information”, “health plan”, “protected health information” (“PHI”), “subcontractor”, and “use” have the same meaning as set forth in 45 C.F.R. § 160.103.

C. The term “security incident” has the same meaning as set forth in 45 C.F.R. § 164.304.

D. The terms “breach” and “unsecured protected health information” (“unsecured PHI”) have the same meaning as set forth in 45 C.F.R. § 164.402.

4. Contractor and its agents, employees and subcontractors shall comply with all applicable requirements of the

HIPAA Rules and shall maintain the confidentiality of all PHI obtained by them pursuant to this contract and addendum as required by the HIPAA Rules and by this contract and addendum.

5. Contractor shall use or disclose PHI solely: (a) for meeting its obligations under the contract; or (b) as required by law, rule or regulation (including the HIPAA Rules) or as otherwise required or permitted by this contract and addendum.

6. Contractor shall implement and utilize all appropriate safeguards to prevent any use or disclosure of PHI not required or permitted by this contract and addendum, including administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of LDH.

7. In accordance with 45 C.F.R. § 164.502(e)(1)(ii) and (if applicable) § 164.308(b)(2), contractor shall ensure that any agents, employees, subcontractors or others that create, receive, maintain, or transmit PHI on behalf of contractor agree to the same restrictions, conditions and requirements that apply to contractor with respect to such information, and it shall ensure that they implement reasonable and appropriate safeguards to protect such information. Contractor shall take all reasonable steps to ensure that its agents’, employees’ or subcontractors’ actions or omissions do not cause contractor to violate this contract and addendum.

8. Contractor shall, within 3 days of becoming aware of any use or disclosure of PHI, other than as permitted by this contract and addendum, report such disclosure in writing to the person(s) named in section 14 (Terms of Payment), page 1 of the CF-1. Disclosures which must be reported by contractor include, but are not limited to, any security incident, any breach of unsecured PHI, and any “breach of the security system” as defined in the Louisiana Database Security Breach Notification Law, La.R.S. 51:3071 et seq. At the option of LDH, any harm or damage resulting from any use or disclosure which violates this contract and addendum shall be mitigated, to the extent practicable, either: (a) by contractor at its own expense; or (b) by LDH, in which case contractor shall reimburse LDH for all expenses that LDH is required to incur in undertaking such mitigation activities.

9. To the extent that contractor is to carry out one or more of LDH’s obligations under 45 C.F.R. Part 164, Subpart E, contractor shall comply with the requirements of Subpart E that apply to LDH in the performance of such obligation(s).

10. Contractor shall make available such information in its possession which is required for LDH to provide an accounting of disclosures in accordance with 45 CFR § 164.528. In the event that a request for accounting is made directly to contractor, contractor shall forward such request to LDH within 2 days of such receipt.

Contractor shall implement an appropriate record keeping process to enable it to comply with the requirements of this provision. Contractor shall maintain data on all disclosures of PHI for which accounting is required by 45 CFR § 164.528 for at least 6 years after the date of the last such disclosure.

11. Contractor shall make PHI available to LDH upon request in accordance with 45 CFR § 164.524.

Attachment C - HIPAA BAA RFx 3000026305 TITLE: Enteral Feeding Supplies - LDH

12. Contractor shall make PHI available to LDH upon request for amendment and shall incorporate any amendments to PHI in accordance with 45 CFR § 164.526.

13. Contractor shall make its internal practices, books, and records relating to the use and disclosure of PHI received from or created or received by contractor on behalf of LDH available to the Secretary of the U. S.

DHHS for purposes of determining LDH’s compliance with the HIPAA Rules.

14. Contractor shall indemnify and hold LDH harmless from and against any and all liabilities, claims for damages, costs, expenses and attorneys’ fees resulting from any violation of this addendum by contractor or by its agents, employees or subcontractors, without regard to any limitation or exclusion of damages provision otherwise set forth in the contract.

15. The parties agree that the legal relationship between LDH and contractor is strictly an independent contractor relationship. Nothing in this contract and addendum shall be deemed to create a joint venture, agency, partnership, or employer-employee relationship between LDH and contractor.

16. Notwithstanding any other provision of the contract, the State shall have the right to terminate the contract immediately if LDH determines that contractor has violated any provision of the HIPAA Rules or any material term of this addendum.

17. At the termination of the contract, or upon request of LDH, whichever occurs first, contractor shall return or destroy (at the option of LDH) all PHI received or created by contractor that contractor still maintains in any form and retain no copies of such information; or if such return or destruction is not feasible, contractor shall extend the confidentiality protections of the contract to the information and limit further uses and disclosure to those purposes that make the return or destruction of the information infeasible.