Attachment D - Health Insurance Portability & Accountability Act.docx

Attachment D – Health Insurance Portability & Accountability Act (HIPAA) Drug Abuse Screenings - Acadiana Area Human Services District

(AAHSD)

RFx #3000025331

HIPAA BUSINESS ASSOCIATE ADDENDUM to PURCHASING CONTRACTS OR PURCHASE ORDERS:

This HIPAA Business Associate Addendum will be made a part of the purchasing contract or purchase order resulting from this solicitation in its entirety as Appendix I to the contract.

1. Acadiana Area Human Services District (AAHSD) is a Covered Entity, as that term is defined herein, because it functions as a health plan and as a health care provider that transmits health information in electronic form.

2. The Contractor is a Business Associate of Acadiana Area Human Services District (AAHSD), as that term is defined herein, because the Contractor either: (a) creates, receives, maintains, or transmits protected health information (PHI) for or on behalf of Acadiana Area Human Services District (AAHSD); or (b) provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services for Acadiana Area Human Services District (AAHSD) involving the disclosure of protected health information (PHI).

3. Definitions - As used in this addendum:

A. The term “HIPAA Rules” refers to the federal regulations known as the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules, found at 45 C.F.R. Parts 160 and 164, which were originally promulgated by the U. S. Department of Health and Human Services (DHHS) pursuant to the Health Insurance Portability and Accountability Act (“HIPAA”) of 1996 and were subsequently amended pursuant to the Health Information Technology for Economic and Clinical Health (“HITECH”) Act of the American Recovery and Reinvestment Act of 2009.

B. The terms “Business Associate”, “Covered Entity”, “disclosure”, “electronic protected health information” (“electronic PHI”), “health care provider”, “health information”, “health plan”, “protected health information” (“PHI”), “subcontractor”, and “use” have the same meaning as set forth in 45 C.F.R. § 160.103.

C. The term “security incident” has the same meaning as set forth in 45 C.F.R. § 164.304.

D. The terms “breach” and “unsecured protected health information” (“unsecured PHI”) have the same meaning as set forth in 45 C.F.R. § 164.402.

4. The Contractor and its agents, employees and subcontractors shall comply with all applicable requirements of the HIPAA Rules and shall maintain the confidentiality of all protected health information (PHI) obtained by them pursuant to the contract and addendum as required by the HIPAA Rules and by the contract and addendum.

5. The Contractor shall use or disclose health information protected health information (PHI) solely: (a) for meeting its obligations under the contract; or (b) as required by law, rule or regulation (including the HIPAA Rules) or as otherwise required or permitted by the contract and addendum.

6. The Contractor shall implement and utilize all appropriate safeguards to prevent any use or disclosure of protected health information (PHI) not required or permitted by the contract and addendum, including administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits on behalf of Acadiana Area Human Services District (AAHSD).

7. In accordance with 45 C.F.R. § 164.502(e) (1) (ii) and (if applicable) § 164.308(b) (2), the Contractor shall ensure that any agents, employees, subcontractors or others that create, receive, maintain, or transmit protected health information (PHI) on behalf of the Contractor agree to the same restrictions, conditions and requirements that apply to the Contractor with respect to such information, and it shall ensure that they implement reasonable and appropriate safeguards to protect such information. The Contractor shall take all reasonable steps to ensure that its agents’, employees’ or subcontractors’ actions or omissions do not cause the Contractor to violate the contract and addendum.

8. The Contractor shall, within 3 days of becoming aware of any use or disclosure of protected health information (PHI), other than as permitted by the contract and addendum, report such disclosure in writing to the Acadiana Area Human Services District (AAHSD) purchasing agent or contact person named in the purchase order or contract. Disclosures which must be reported by the Contractor include, but are not limited to, any security incident, any breach of unsecured protected health information (PHI), and any “breach of the security system” as defined in the Louisiana Database Security Breach Notification Law, La.R.S. 51:3071 et seq. At the option of Acadiana Area Human Services District (AAHSD), any harm or damage resulting from any use or disclosure which violates the contract and addendum shall be mitigated, to the extent practicable, either: (a) by the Contractor at its own expense; or (b) by Acadiana Area Human Services District (AAHSD), in which case the Contractor shall reimburse Acadiana Area Human Services District (AAHSD) for all expenses that Acadiana Area Human Services District (AAHSD) is required to incur in undertaking such mitigation activities.

9. To the extent that the Contractor is to carry out 1 or more of Acadiana Area Human Services District (AAHSD)’s obligations under 45 C.F.R. Part 164, Subpart E, the Contractor shall comply with the requirements of Subpart E that apply to Acadiana Area Human Services District (AAHSD) in the performance of such obligation(s).

10. The Contractor shall make available such information in its possession which is required for Acadiana Area Human Services District (AAHSD) to provide an accounting of disclosures in accordance with 45 CFR § 164.528. In the event that a request for accounting is made directly to the Contractor, the Contractor shall forward such request to the Acadiana Area Human Services District (AAHSD) within 2 days of such receipt. The Contractor shall implement an appropriate record keeping process to enable it to comply with the requirements of this provision. The Contractor shall maintain data on all disclosures of protected health information (PHI) for which accounting is required by 45 CFR § 164.528 for at least 6 years after the date of the last such disclosure.

11. The Contractor shall make protected health information (PHI) available to the Acadiana Area Human Services District (AAHSD) upon request in accordance with 45 CFR § 164.524.

12. The Contractor shall make protected health information (PHI) available to the Acadiana Area Human Services District (AAHSD) upon request for amendment and shall incorporate any amendments to protected health information (PHI) in accordance with 45 CFR § 164.526.

13. The Contractor shall make its internal practices, books, and records relating to the use and disclosure of protected health information (PHI) received from or created or received by the Contractor on behalf of Acadiana Area Human Services District (AAHSD) available to the Secretary of the U. S. Department of Health and Human Services (DHHS) for purposes of determining Acadiana Area Human Services District (AAHSD)’s compliance with the HIPAA Rules.

14. The Contractor shall indemnify and hold Acadiana Area Human Services District (AAHSD) harmless from and against any and all liabilities, claims for damages, costs, expenses and attorneys’ fees resulting from any violation of the addendum by the Contractor or by its agents, employees or subcontractors, without regard to any limitation or exclusion of damages provision otherwise set forth in the contract.

15. The parties agree that the legal relationship between Acadiana Area Human Services District (AAHSD) and the Contractor is strictly an independent Contractor relationship. Nothing in the contract and addendum shall be deemed to create a joint venture, agency, partnership, or employer-employee relationship between Acadiana Area Human Services District (AAHSD) and the Contractor.

16. Notwithstanding any other provision of the contract, Acadiana Area Human Services District (AAHSD) shall have the right to terminate the contract immediately if Acadiana Area Human Services District (AAHSD) determines that the Contractor has violated any provision of the HIPAA Rules or any material term of the addendum.

17. At the termination of the contract, or upon request of Acadiana Area Human Services District (AAHSD), whichever occurs first, the Contractor shall return or destroy (at the option of Acadiana Area Human Services District (AAHSD)) all protected health information (PHI) received or created by the Contractor that the Contractor still maintains in any extend the confidentiality protections of the contract to the information and limit further uses and disclosure to those purposes that make the return or destruction of the information infeasible.

THUS DONE AND SIGNED on the dates written below.

Acadiana Area Human Services District Date

Contractor Date