Attachment H-2.pdf

Rev 04/01/16

Attachment H-2

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

Business Associate and 42 CFR Part 2 Qualified Service Organization Agreement

A. General.

For purposes of this Contract, Contractor is County's business associate and will comply with the obligations set forth below and under HIPAA. Further, County operates certain federally-funded substance abuse treatment programs directly subject to 42 CFR Part 2 and will transmit information about Individuals in a program subject to 42 CFR Part 2 under the Contract. Therefore, Contractor is also a Qualified Service Organization as defined under 42 CFR § 2.11 for the purpose of the Contract. Contractor and County agree to amend this Contract if necessary to allow County to comply with the requirements of HIPAA and its implementing regulations and 42 CFR Part 2.

B. Definitions.

Terms used, but not otherwise defined in this Contract, will have the same meaning as those terms in 45 CFR 160.103, 164.103, 164.402, 164.501 and 42 CFR Part 2. A reference to a regulation means the section as in effect or as amended, and for which compliance is required.

1. Breach: as defined in 45 CFR 164.402 and includes the unauthorized acquisition, access, use, or disclosure of

Protected Health Information (PHI) that compromises the security or privacy of such information.

2. Designated Record Set: as defined in 45 CFR 164.501.

3. Individual: as defined in 45 CFR 160.103 and includes a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g). Also includes a patient in a program subject to 42 CFR Part 2.

4. Privacy Rule: the standards for privacy at 45 CFR Part 160 and Part 164, subpart A and E.

5. Protected Health Information (PHI): means any information created for or received from County under the Contract from which the identity of an Individual can reasonably be determined, and includes, but is not limited to, all of the information within the statutory meaning of “Protected Health Information” in 45 CFR 160.103.

6. Required by Law: as defined in 45 CFR 164.103.

7. Secretary: the Secretary of the U.S. Department of Health and Human Services (HHS) or designee.

8. Security Rule: the Standards for Security of Individually Identifiable Health Information at 45 CFR Part 160 and Part

164, subpart A and C.

9. Unsecured Protected Health Information: PHI that is not secured through the use of a technology or methodology specified by the Secretary in guidance or as otherwise defined in 45 CFR 164.402.

C. Contractor's Obligations.

1. Contractor agrees to not use or disclose Protected Health Information (PHI) other than as permitted or required by this Contract or as required or permitted by law. Contractor further agrees to use or disclose PHI only on behalf of, or to provide services to, the County in fulfilling Contractor's obligations under this Contract, and to not make uses or disclosures that would violate the Privacy Rule or 42 CFR Part 2 if done by County or violate the minimum necessary standard as described below.

2. When using, disclosing, or requesting PHI, Contractor agrees to make reasonable efforts to limit the PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure or request, in accordance with 45 CFR 164.514(d), with the following exceptions:

a) disclosures to or requests by a health care provider for treatment, except for drug & alcohol treatment information, for which a specific written consent is required;

b) disclosures made to the Individual about his or her own PHI;

c) uses or disclosures authorized by the Individual;

d) disclosures made to the Secretary in accordance with the HIPAA Privacy Rule;

e) uses or disclosures that are Required by Law; and

f) uses or disclosures that are required for compliance with the HIPAA Transaction Rule.

3. Contractor is directly responsible for full compliance with the requirements of 42 CFR Part 2 and the HIPAA Privacy Rule and Security Rule to the same extent as County.

4. Contractor agrees to use appropriate safeguards to prevent use or disclosure of the PHI other than as provided for by this Contract.

5. Contractor agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic PHI that it creates, receives, maintains, or transmits on behalf of the County as required by 45 CFR 164 Subpart C.

6. Contractor agrees to immediately notify County of any known or suspected incident or complaint involving PHI, including use or disclosure of PHI in violation of or not provided for by this Contract of which it becomes aware.

7. Contractor shall immediately notify County of a Breach of Unsecured PHI of which Contractor (or Contractor’s employee, subcontractor, officer or agent) knows or should have known of through the exercise of reasonable diligence. Contractor’s notification to County must:

a) Be in writing and provide an individual’s contact information if needed for County’s follow up communications;

Attachment H-2 HIPAA Joint Business and 42 CFR Part 2 Agreement Page 1 of 3

b) Be made to County without unreasonable delay and no later than 30 calendar days after discovery of the Breach. A Breach is considered discovered as of the first day on which the Breach is known, or reasonably should have been known, to Contractor, subcontractor of Contractor, or any employee, officer or agent of Contractor, other than the individual committing the Breach;

c) Include the Individuals whose Unsecured PHI has been, or is reasonably believed to have been, the subject of a Breach and the types of PHI involved;

d) Include the date of the Breach and date of discovery of the Breach;

e) Include description of what Contractor is doing to investigate the Breach, to mitigate loss, and to protect against any further or future Breaches;

f) Provide all information necessary for County to notify impacted Individuals under 45 CFR 164.404 without unreasonable delay after Contractor’s discovery of the Breach; and

g) Provide any and all information, including preparation of reports or notices, needed for County to provide notification required under 45 CFR 164.406 and 164.408, as required or requested by County.

8. Contractor agrees to mitigate, to the extent practicable and without unreasonable delay, any harmful effect that is known to Contractor of a use or disclosure of PHI or Breach of Unsecured PHI by Contractor in violation of the requirements of this Contract or HIPAA.

9. Contractor agrees to ensure that any agent, including a subcontractor, to whom it provides PHI that is received from County, or created or received by Contractor on behalf of County, agrees in writing to the same restrictions and conditions that apply through this Contract to Contractor with respect to such information in accordance with 45 CFR 164.502(e)(1)(ii), 164.308(b)(2), and 42 CFR Part 2.

10. Contractor agrees to provide access to PHI about an Individual contained in a Designated Record Set within the time, manner, form and format specified in Individual’s or County’s request as necessary to satisfy the County’s obligations under 45 CFR 164.524. If an Individual requests access to information directly from Contractor, Contractor agrees to forward the request to County within 2 working days of receipt. County will be responsible for any denials of requested

PHI.

11. Contractor agrees to make any amendments to PHI in a Designated Record Set that the County directs or agrees to pursuant to 45 CFR 164.526 within the time and manner specified in County’s request. Contractor shall not respond directly to requests from Individuals for amendments to their PHI in a Designated Record Set. Contractor agrees to forward the request to County within 2 working days of receipt.

12. Contractor agrees to make internal practices, books and records, including policies and procedures relating to the use and disclosure of PHI received from, or created, maintained or received by Contractor on behalf of County available to County or Secretary upon request of County or Secretary, in a time and manner designated by the County or the Secretary for purposes of the Secretary determining County’s compliance with HIPAA.

13. Contractor agrees to document disclosures of PHI and information related to such disclosures as required for County to respond to a request by an Individual for an accounting of disclosure of PHI in accordance with 45 CFR 164.528.

Contractor will make available, at a minimum, the following information: (i) the date of the disclosure, (ii) the name of the entity or person who received the PHI, and if known, the address of such entity or person, (iii) a brief description of the PHI disclosed, and (iv) a brief statement of the purpose of such disclosure which includes an explanation of the basis for such disclosure. Contractor agrees to implement an appropriate record keeping process to comply with this Section.

14. Contractor agrees to provide County or an Individual, within the time and manner specified in the request from County or Individual, information under Item 13 of this Section, to permit County to respond to a request by an Individual for an accounting of disclosure of PHI in accordance with 45 CFR 164.528.

15. Contractor must forward to County within 2 working days of receipt any request for restriction or confidential communications as described under 45 CFR 164.522 received from an Individual. Contractor must process such request in the time and manner as directed by County.

16. If Contractor conducts in whole or part electronic transactions on behalf of County for which HHS has established standards, Contractor will comply and require its subcontractors and agents to comply, with each applicable requirement of the HIPAA Electronic Transactions Rule under 45 CFR Parts 160 and 162 and of any operating rules adopted by HHS with respect to the standard transactions.

17. Contractor acknowledges that in receiving, storing, processing, or otherwise using any PHI or other information from the 42 CFR Part 2 program about the Individual in the program, it is fully bound by the provisions of the federal regulations governing Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2.

18. Contractor shall resist any effort in a judicial proceeding to obtain access to PHI or other information pertaining to Individuals of a 42 CFR Part 2 program except as expressly provided for in 42 CFR Part 2. Contractor shall immediately notify County if such request is received.

D. Termination.

1. Notwithstanding any other termination provisions in this Contract, County may terminate this Contract in whole or in part upon 5 working days written notice to Contractor if the Contractor breaches any provision contained in this Contract and fails to cure the breach to County’s satisfaction within the 5 working day period; provided, however, that in the event termination is not feasible County may report the breach to the Secretary.

2. Upon termination of this Contract for any reason, Contractor will extend the protections of this Contract to any PHI that Contractor is required to retain under any provision of this Contract. The terms of this Contract shall remain in effect until all of the PHI provided by County to Contractor, or created or received by Contractor on behalf of County, is destroyed or returned to County, or, if it is infeasible to return or destroy PHI as agreed upon by County, Attachment H-2 HIPAA Joint Business and 42 CFR Part 2 Agreement Page 2 of 3 protections are extended to such information, in accordance with the termination provisions in this Section.

3. The obligations of Contractor under this Section D shall survive termination of the Contract.

E. Remedies in Event of Breach.

Contractor recognizes that irreparable harm will result to County, and to County business, in the event of breach by Contractor of any of the covenants and assurances contained in this Contract. As such, in the event of breach of any of the covenants and assurances contained in Section C above, County will be entitled to enjoin and restrain Contractor from any continued violation of Section C. Furthermore, in the event of breach of Section C by Contractor, County is entitled to reimbursement and indemnification from Contractor for County's reasonable attorneys’ fees and expenses and costs, including notices the County is required to give as a result of any Breach of Unsecured PHI, that were reasonably incurred as a result of Contractor's breach. The remedies contained in this Section E are in addition to (and do not supersede) any action for damages and/or any other remedy County may have for breach of any part of this Contract. This provision in Section E shall survive termination of the Contract.

F. Interpretation.

Any ambiguity in this Contract shall be resolved in favor of a meaning that permits County to comply with HIPAA and its implementing regulations and 42 CFR Part 2.

Attachment H-2 HIPAA Joint Business and 42 CFR Part 2 Agreement Page 3 of 3