Attachment H-1.pdf

Rev. 04/01/16 Attachment H-1

Health Insurance Portability and Accountability Act of 1996 (HIPAA) Business Associate Agreement

A. General:

For purposes of this Contract, Contractor is County's business associate and will comply with the obligations set forth below and under HIPAA. Contractor and County agree to amend this Contract if necessary to allow County to comply with the requirements of HIPAA and its implementing regulations.

B. Definitions:

Terms used, but not otherwise defined in this Section, will have the same meaning as those terms in 45 CFR 160.103, 164.103, 164.402 and 164.501. A reference to a regulation means the section as in effect or as amended, and for which compliance is required.

Breach: as defined in 45 CFR 164.402 and includes the unauthorized acquisition, access, use, or disclosure of Protected Health Information (PHI) that compromises the security or privacy of such information.

Designated Record Set: as defined in 45 CFR 164.501.

Individual: as defined in 45 CFR 160.103 and includes a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule: the standards for privacy at 45 CFR Part 160 and Part 164, subpart A and E.

Protected Health Information (PHI): means any information created for or received from County under the Contract from which the identity of an Individual can reasonably be determined, and includes, but is not limited to, all of the information within the statutory meaning of “Protected Health Information” in 45 CFR 160.103.

Required by Law: as defined in 45 CFR 164.103.

Secretary: the Secretary of the U.S. Department of Health and Human Services (HHS) or designee.

Security Rule: the Standards for Security of Individually Identifiable Health Information at 45 CFR Part 160 and Part

164, subpart A and C.

Unsecured Protected Health Information: PHI that is not secured through the use of a technology or methodology specified by the Secretary in guidance or as otherwise defined in 45 CFR 164.402.

C. Contractor's Obligations:

1. Contractor agrees to not use or disclose Protected Health Information (PHI) other than as permitted or required by this Contract or as Required or Permitted by Law. Contractor further agrees to use or disclose PHI only on behalf of, or to provide services to, the County in fulfilling Contractor's obligations under this Contract, and to not make uses or disclosures that would violate the Privacy Rule if done by County or violate the minimum necessary standard as described below.

2. When using, disclosing, or requesting PHI, Contractor agrees to make reasonable efforts to limit the PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request, in accordance with 45 CFR 164.514(d), with the following exceptions:

a) disclosures to or requests by a health care provider for treatment

b) disclosures made to the Individual about his or her own PHI

c) uses or disclosures authorized by the Individual

d) disclosures made to the Secretary in accordance with the HIPAA Privacy Rule

e) uses or disclosures that are Required by Law, and

f) uses or disclosures that are required for compliance with the HIPAA Transaction Rule.

3. Contractor is directly responsible for full compliance with the requirements of the HIPAA Privacy Rule and Security Rule to the same extent as County.

4. Contractor agrees to use appropriate safeguards to prevent use or disclosure of the PHI other than as provided for by this Contract.

5. Contractor agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic PHI that it creates, receives, maintains, or transmits on behalf of the County as required by 45 CFR 164 Subpart C.

6. Contractor agrees to immediately notify County of any known or suspected incident or complaint involving PHI, including use or disclosure of PHI in violation of or not provided for by this Contract of which it becomes aware.

Attachment H-1 HIPAA Business Associate Agreement Page 1 of 3

7. Contractor shall immediately notify County of a Breach of Unsecured PHI of which Contractor (or Contractor’s employee, subcontractor, officer or agent) knows or should have known of through the exercise of reasonable diligence. Contractor’s notification to County must:

a) Be in writing and provide an individual’s contact information if needed for County’s follow up communications,

b) Be made to County without unreasonable delay and no later than 30 calendar days after discovery of the

Breach. A Breach is considered discovered as of the first day on which the Breach is known, or reasonably should have been known, to Contractor, subcontractor of Contractor, or any employee, officer or agent of Contractor, other than the individual committing the Breach,

c) Include the Individuals whose Unsecured PHI has been, or is reasonably believed to have been, the subject of a Breach and the types of PHI involved,

d) Include the date of the Breach and date of discovery of the Breach,

e) Include description of what Contractor is doing to investigate the Breach, to mitigate loss, and to protect against any further or future Breaches,

f) Provide all information necessary for County to notify impacted Individuals under 45 CFR 164.404 without unreasonable delay after Contractor’s discovery of the Breach, and

g) Provide any and all information, including preparation of reports or notices, needed for County to provide notification required under 45 CFR 164.406 and 164.408, as required or requested by County.

8. Contractor agrees to mitigate, to the extent practicable and without unreasonable delay, any harmful effect that is known to Contractor of a use or disclosure of PHI or Breach of Unsecured PHI by Contractor in violation of the requirements of this Contract or HIPAA.

9. Contractor agrees to ensure that any agent, including a subcontractor, to whom it provides PHI received from, or created or received by Contractor on behalf of County, agrees in writing to the same restrictions and conditions that apply through this Contract to Contractor with respect to such information in accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2).

10. Contractor agrees to provide access to PHI about an Individual contained in a Designated Record Set within the time, manner, form and format specified in Individual’s or County’s request as necessary to satisfy the County’s obligations under 45 CFR 164.524. If an Individual requests access to information directly from Contractor, Contractor agrees to forward the request to County within 2 working days of receipt. County will be responsible for any denials of requested PHI.

11. Contractor agrees to make any amendments to PHI in a Designated Record Set that the County directs or agrees to pursuant to 45 CFR 164.526 within the time and manner specified in County’s request. Contractor shall not respond directly to requests from Individuals for amendments to their PHI in a Designated Record Set.

Contractor agrees to forward the request to County within 2 working days of receipt.

12. Contractor agrees to make internal practices, books and records, including policies and procedures and PHI, relating to the use and disclosure of PHI received from, or created, maintained or received by Contractor on behalf of County available to County or Secretary upon request of County or Secretary, in a time and manner designated by the County or the Secretary for purposes of the Secretary determining County’s compliance with

HIPAA.

13. Contractor agrees to document disclosures of PHI and information related to such disclosures as required for County to respond to a request by an Individual for an accounting of disclosure of PHI in accordance with 45 CFR

164.528. Contractor will make available, at a minimum, the following information: (i) the date of the disclosure, (ii) the name of the entity or person who received the PHI, and if known, the address of such entity or person, (iii) a brief description of the PHI disclosed, and (iv) a brief statement of the purpose of such disclosure which includes an explanation of the basis for such disclosure. Contractor agrees to implement an appropriate record keeping process to comply with this Section.

14. Contractor agrees to provide County or an Individual, within the time and manner specified in the request from County or Individual, information under Item 13 of this Section, to permit County to respond to a request by an Individual for an accounting of disclosure of PHI in accordance with 45 CFR 164.528.

15. Contractor must forward to County within 2 working days of receipt any request for restriction or confidential communications as described under 45 CFR 164.522 received from an Individual. Contractor must process such request in the time and manner as directed by County.

16. If Contractor conducts in whole or part electronic transactions on behalf of County for which HHS has established standards, Contractor will comply and require its subcontractors and agents to comply, with each applicable requirement of the HIPAA Electronic Transactions Rule under 45 CFR Parts 160 and 162 and of any operating rules adopted by HHS with respect to the standard transactions.

Attachment H-1 HIPAA Business Associate Agreement Page 2 of 3

D. Termination:

1. Notwithstanding any other termination provisions in this Contract, County may terminate this Contract in whole or in part upon 5 working days written notice to Contractor if the Contractor breaches any provision contained in this Contract and fails to cure the breach to County’s satisfaction within the 5 working day period; provided, however, that in the event termination is not feasible County may report the breach to the Secretary.

2. Upon termination of this Contract for any reason, Contractor will extend the protections of this Contract to any PHI that Contractor is required to retain under any provision of this Contract. The terms of this Contract shall remain in effect until all of the PHI provided by County to Contractor, or created or received by Contractor on behalf of County, is destroyed or returned to County, or, if it is infeasible to return or destroy PHI as agreed upon by County, protections are extended to such information, in accordance with the termination provisions in this Section.

3. The obligations of Contractor under this Section D shall survive termination of the Contract.

E. Remedies in Event of Breach: Contractor recognizes that irreparable harm will result to County, and to County business, in the event of breach by Contractor of any of the covenants and assurances contained in this Contract. As such, in the event of breach of any of the covenants and assurances contained in Section C above, County will be entitled to enjoin and restrain Contractor from any continued violation of Section C. Furthermore, in the event of breach of Section C by Contractor, County is entitled to reimbursement and indemnification from Contractor for County's reasonable attorneys’ fees and expenses and costs, including notices the County is required to give as a result of any Breach of Unsecured PHI, that were reasonably incurred as a result of Contractor's breach. The remedies contained in this Section E are in addition to (and do not supersede) any action for damages and/or any other remedy County may have for breach of any part of this Contract.

This provision in Section E shall survive termination of the Contract.

F. Interpretation: Any ambiguity in this Contract shall be resolved in favor of a meaning that permits County to comply with HIPAA and its implementing regulations.

Attachment H-1 HIPAA Business Associate Agreement Page 3 of 3