Attachment_F_-_Business_Associate_Agreement.pdf

ATTACHMENT F - BUSINESS ASSOCIATE AGREEMENT

Washington County (“Covered Component”) and Contractor (“Business Associate”) have entered into one or more agreements (“Services Agreement”) pursuant to which Business Associate is providing services to Covered Component that require the disclosure and use of Protected Health Information (“PHI”) as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). This agreement (“Agreement”) sets forth the terms and conditions pursuant to which PHI that is provided by, or created, transmitted, maintained or received by, the Business Associate from or on behalf of Covered Component, will be handled between Business Associate and Covered Component and with third parties during the term of each Services Agreement and after its termination.

ARTICLE 1. Terms

1.1 Terms used, but otherwise not defined, in this Agreement shall have the same meaning as those terms in 45 CFR Parts 160, 162 and 164 (HIPAA Regulations), and as amended.

1.2 Individual. “Individual” shall mean the person who is the subject of the PHI.

1.3 Protected Health Information (PHI), as defined in the Privacy Rule, shall mean any PHI received, used, created, transmitted, maintained or disclosed by Business Associate from or on behalf of Covered Component or to provide a service to the Covered Component.

1.4 Secretary. "Secretary" shall mean the Secretary of the Department of Health and Human Services or his/her designee.

ARTICLE 2. Obligations and Activities of Business Associate

Business Associate shall:

2.1 Not create, receive, maintain, use or disclose PHI other than as permitted or required by this Agreement or as provided by law. Business Associate shall create, transmit, receive, maintain, use or disclose only the minimum necessary PHI to fulfill its obligations to Covered Component or as otherwise imposed by law.

2.2 Use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 (Security Rules) with respect to electronic protected health information, to prevent use or disclosure of the PHI other than as provided for by this Agreement.

2.3 Mitigate, to the extent practicable and without unreasonable delay, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate, its subcontractors or agents in violation of this Agreement or HIPAA regulations.

Revised 1.2026

2.4 Report to Covered Component any use or disclosure of PHI or other data and security breaches by Business Associate or its subcontractors not provided for by this Agreement or permitted under HIPAA regulations of which it becomes aware. Report must:

2.4.1 Be in writing and provide an individual’s contact information if needed for Covered Component’s follow up communications,

2.4.2 Be made to Covered Component without unreasonable delay and no later than five (5) calendar days after discovery of the breach. A breach is considered discovered as of the first day on which the breach is known, or reasonably should have been known, to Business Associate, subcontractor of Business Associate, or any employee, officer or agent of Business Associate, other than the individual committing the breach,

2.4.3 Include the Individuals whose unsecured PHI has been, or is reasonably believed to have been, the subject of a breach and the types of PHI involved,

2.4.4 Include the date of the breach and date of discovery of the breach,

2.4.5 Include description of what Business Associate is doing to investigate the breach, to mitigate loss, and to protect against any further or future breaches,

2.4.6 Provide all information necessary for Covered Component to notify impacted Individuals under 45 CFR 164.404 without unreasonable delay after Business Associate’s discovery of the breach, and

2.4.7 Provide any and all information, including preparation of reports or notices, needed for Covered Component to provide notification required under 45 CFR 164.406 and 164.408, as required or requested by Covered Component.

2.5 Ensure that any agent, including a subcontractor, to whom it provides PHI agrees to the same restrictions, conditions, and requirements that apply through this Agreement to Business Associate with respect to such information.

2.6 Provide Covered Component with access to PHI in a designated record set, at the request of Covered Component, within five (5) business days of request or, as reasonably directed by Covered Component, to an Individual to meet the requirements under 45 CFR § 164.524 and applicable state law. Business Associate must forward any request for access received directly from Individual to Covered Component within two (2) business days of receipt.

2.7 Make any amendment(s), or add a statement of disagreement from the Individual, to PHI in a designated record set that the Covered Component directs or agrees to pursuant to 45 CFR § 164.526 at the request of Covered Component or an Individual. Such amendment(s) shall be made within thirty (30) calendar days of the request of the Covered Component or Individual. Business Associate must forward any request for amendment received directly from Individual to Covered Component within two (2) business days of receipt.

Any approval or denial of amendment of PHI maintained by Business Associate or its agents or subcontractors shall be the responsibility of Covered Component.

2.8. To the extent that Business Associate is to carry out one or more of Covered Component’s obligations under Subpart E of 45 CFR Part 164 (Privacy Rules), comply with the requirements of Subpart E that apply to the Covered Component in the performance of such obligations.

2.9 Make internal practices, books, and records, including policies and procedures relating to the use and disclosure of PHI, available to the Secretary or Covered Component within the time frame designated by the Secretary or Covered Component, for purposes of determining compliance with HIPAA regulations. Business Associate shall provide to Covered Component a copy of any documentation that Business Associate provides to the Secretary at the same time as providing such documentation to the Secretary.

2.10 Document such disclosures of PHI and information related to such disclosures as are required for Covered Component to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528 and provide an accounting within fifteen (15) business days of direction to do so from Covered Component. Business Associate must forward any request for accounting of disclosures received directly from Individual to Covered Component within two (2) business days of receipt.

2.11 Forward to Covered Component within two (2) business days of receipt of any request for restrictions or confidential communications under 45 CFR 164.522 received directly from Individual. Business Associate must process any agreed upon request in the time and manner specified by Covered Component.

2.12 Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any electronic protected health information that it creates, receives, maintains, or transmits on behalf of Covered Component pursuant to Subpart C of 45 CFR Part 164 (Security Rules).

2.13 Ensure that any agent, including a subcontractor to whom it provides electronic protected health information agrees to implement reasonable and appropriate safeguards to protect it.

2.14 Ensure that all staff, volunteers, and subcontractors who provide service under this Agreement shall complete an annual HIPAA awareness training to understand and adhere to required confidentiality practices.

2.15 Report to Covered Component, any Security Incident of which it becomes aware. Notwithstanding the foregoing, Security Incidents shall not include, without limitation, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denial of service attacks, and any combination of the above, so long as no such incident results in unauthorized access, use or disclosure of PHI.

2.16 Comply and require its subcontractors and agents to comply with each applicable requirement of the HIPAA Electronic Transactions Rule under 45 CFR Parts 160 and 162 and of any operating rules adopted by the U.S.

Department of Health and Human Services (HHS) with respect to the standard transactions if Business Associate conducts in whole or part electronic transactions on behalf of Covered Component for which HHS has established standards.

2.17 Shall defend and indemnify Covered Component from all civil actions and monetary penalties imposed as a result of a breach or violation of HIPAA by Business Associate and shall reimburse Covered Component for all of Covered Component’s costs associated with notification requirements of HIPAA because or related to a breach by Business Associate.

2.17.1 Business Associate may control the defense or settlement of any claim subject to Business Associate’s obligations set forth in this section. However, neither Business Associate nor any attorney engaged by Business Associate may defend the claim in the name of the County, nor purport to act as legal representative of the County or any of its officers, employees or agents, without first receiving from the County, in a form and manner determined appropriate by Washington County Counsel, authority to act as legal counsel for the County. Nor may Business Associate settle any claim on behalf of County without the approval of the County. The County may, at its election and expense, assume its own defense and settlement in the event the County determines Business Associate is prohibited from defending the County, or is inadequately defending the County’s interests, or in County’s determination any important governmental principle is at issue and the County desires to assume its own defense.

Business Associate shall not be entitled to any compensation or reimbursement for the defense or settlement of any claim under this section.

ARTICLE 3. Permitted Uses and Disclosures by Business Associate

3.1 Business Associate is authorized to create, receive, maintain, transmit, use or disclose PHI for the express purpose(s) described in the underlying Services Agreement, provided that nothing in this Agreement authorizes Business Associate to create, receive, transmit, maintain, use or disclose PHI in violation of HIPAA Regulations or any more stringent state law provisions.

3.2 Except as otherwise allowed for in this Article 3, Business Associate may not use or disclose PHI in a manner that would violate Subpart E of CFR Part 164 (Privacy Rules) if done by Covered Component.

3.3 Except as otherwise limited in this Agreement, Business Associate may use and disclose PHI:

3.3.1 For the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

3.3.2 For the proper management and administration of the Business Associate, provided that disclosures are Required By Law, or Business Associate obtains, in writing, reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person immediately notifies, in writing, the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

3.3.3 For Data Aggregation services relating to health care operations of Covered Component as required by Covered Component.

3.4 Business Associate may use or disclose PHI as Required by Law.

3.5 Business Associate assures Covered Component that Business Associate will safeguard all PHI according to the terms of this Agreement and HIPAA Regulations.

3.6 Business Associate may use and disclose PHI to de-identify information in accordance with 45 CFR §

164.514 if included in the Services Agreement.

ARTICLE 4. Obligations of Covered Component

4.1 Upon request by the Business Associate, Covered Component shall provide Business Associate with a copy of its Notice of Privacy Rights, and any amendments, to the extent that they may affect Business Associate’s creation, maintenance, transmission, receipt, use or disclosure of PHI.

4.2 Covered Component shall notify Business Associate of any restrictions, changes in, or revocation of, permission by Individual to receipt, use or disclosure of PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI.

ARTICLE 5. Permissible Requests by Covered Component

5.1 Covered Component shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Subpart E of CFR Part 164 (Privacy Rules) if done by Covered Component unless the Business Associate will use or disclose PHI for data aggregation or management and administrative activities of Business Associate.

ARTICLE 6. Term and Termination

6.1 Term. This Agreement shall be effective upon execution and shall terminate when the Services Agreement terminates or on the date either party terminates for cause as authorized in Section 6.2 of this Agreement.

6.2 Termination for Cause. Upon the Covered Component’s or Business Associate’s knowledge of a material breach by the other party, the Covered Component or Business Associate may either:

a. Provide an opportunity for the breaching party to cure the breach or end the violation and terminate this Agreement and the Services Agreement(s) if the breaching party does not cure the breach or end the violation within ten (10) business days. The breaching party shall notify, in writing, the actions taken to cure the breach or end the violation; or

b. Immediately terminate this Agreement and the Services Agreement(s) if the breaching party has breached a material term of this Agreement and cure is not feasible.

6.3 Effect of Termination

a. Except as provided in paragraph (b) of this section, upon termination of this Agreement, for any reason, Business Associate shall return or destroy all PHI received from Covered Component or created or received by Business Associate on behalf of Covered Component. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate. Business Associate and subcontractors or agents shall retain no copies of the PHI.

b. In the event that Business Associate determines that returning or destroying the PHI is infeasible, and Covered Component agrees, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI. If Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall retain only that PHI which is necessary for the Business Associate to continue its proper management and administration or to carry out its legal responsibilities, and Business Associate shall return the remaining PHI that the Business Associate still maintains, or destroy such material if agreed to by the covered component. If Business Associate retains any information, it shall continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information to prevent use or disclosure of the protected health information, other than as provided for in this Section, for as long as business associate retains the protected health information, nor shall Business Associate use or disclose the protected health information retained by business associate other than for the purposes for which such protected health information was retained and subject to the same conditions set out at Article 3, which applied prior to termination;

and return to covered entity [or, if agreed to by covered entity, destroy] the protected health information retained by business associate when it is no longer needed by business associate for its proper management and administration or to carry out its legal responsibilities. The requirements of this section also apply to any subcontractor or agent of Business Associate.

c. If it is infeasible for the Business Associate to obtain, from a subcontractor or agent, any PHI in the possession of the subcontractor or agent, the Business Associate shall require the subcontractor or agent to agree to extend any and all protections, limitations, and restrictions contained in this Agreement to the subcontractor’s or agent’s use and/or disclosure of any PHI retained after the termination of this Agreement, and to limit any further uses and/or disclosures to the purposes that make the return or destruction of the PHI infeasible

ARTICLE 7 Miscellaneous

7.1 Amendment. Covered Component and Business Associate shall take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Component to comply with the requirements of the HIPAA Regulations and the Health Insurance Portability and Accountability Act of 1996, Pub. L. No.

104-191.

7.2 Survival. The respective rights and obligations of Business Associate under Section 6.3 of this Agreement shall survive the termination of this Agreement.

7.3 Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Component to comply with the HIPAA Regulations.

7.4 Other Laws. Nothing herein shall be construed as authorizing either party to fail to comply with any other applicable law relating to health care records, as provided in the preemption provisions of 45 CFR 160. §§ 201-.205.