Attachment M - Business Associate Agreement for HIPPA.pdf

ATTACHMENT M

BUSINESS ASSOCIATE AGREEMENT FOR HIPPA

FDC-ITN-25-068

Operation and Management of Contractor-Operated Correctional Facilities

This Business Associate Agreement supplements and is made a part of this Agreement between the Florida Department of Corrections ("Department") and Click here to enter contractor name.

("Contractor"), (individually, a "Party" and collectively referred to as "Parties").

Whereas, the Department creates or maintains, or has authorized the Contractor to receive, create, or maintain certain Protected Health Information (“PHI,”) as that term is defined in 45 C.F.R. §164.501 and that is subject to protection under the Health Insurance Portability and Accountability Act of 1996, as amended. (“HIPAA”);

Whereas, the Department is a “Covered Entity” as that term is defined in the HIPAA implementing regulations, 45 C.F.R. Part 160 and Part 164, Subparts A, C, and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) and the Security Standards for the Protection of Electronic Protected Health Information (“Security Rule”);

Whereas, the Contractor may have access to PHI in fulfilling its responsibilities under its Contract with the Department;

Whereas, the Contractor is considered to be a “Business Associate” of a Covered Entity as defined in the Privacy Rule;

Whereas, pursuant to the Privacy Rule, all Business Associates of Covered Entities must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI; and

Whereas, the purpose of this Agreement is to comply with the requirements of the Privacy Rule, including, but not limited to, the Business Associate Contract requirements of 45 C.F.R.

§164.504(e).

Whereas, in regards to Electronic Protected Health Information as defined in 45 C.F.R. § 160.103, the purpose of this Agreement is to comply with the requirements of the Security Rule, including, but not limited to, the Business Associate Contract requirements of 45 C.F.R. §164.314(a).

Now, therefore, in consideration of the mutual promises and covenants contained herein, the Parties agree as follows:

1. Definitions Unless otherwise provided in this Agreement, any and all capitalized terms have the same meanings as set forth in the HIPAA Privacy Rule, HIPAA Security Rule or the Health Information Technology for Economic and Clinical Health (HITECH) Act. Contractor acknowledges and agrees that all PHI that is created or received by the Department and disclosed or made available in any form, including paper record, oral communication, audio recording, and electronic display by the Department or its operating units to Contractor or is created or received by Contractor on the Department’s behalf shall be subject to this Agreement.

2. Confidentiality Requirements

a) Contractor agrees to use and disclose PHI that is disclosed to it by the Department solely for meeting its obligations under its agreements with the Department, in accordance with the terms of this agreement, the Department's established policies rules, procedures and requirements, or as required by law, rule or regulation.

b) In addition to any other uses and/or disclosures permitted or authorized by this

Agreement or required by law, Contractor may use and disclose PHI as follows:

FDC-ITN-25-068

Operation and Management of Contractor-Operated Correctional Facilities

(1) if necessary for the proper management and administration of the Contractor and to carry out the legal responsibilities of the Contractor, provided that any such disclosure is required by law or that Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies Contractor of any instances of which it is aware in which the confidentiality of the information has been breached;

(2) for data aggregation services, only if to be provided by Contractor for the health care operations of the Department pursuant to any and all agreements between the Parties. For purposes of this Agreement, data aggregation services means the combining of PHI by Contractor with the PHI received by Contractor in its capacity as a Contractor of another covered entity, to permit data analyses that relate to the health care operations of the respective covered entities.

(3) Contractor may use and disclose PHI that Contractor obtains or creates only if such disclosure is in compliance with every applicable requirement of Section 164.504(e) of the Privacy Act relating to Contractor Contracts.

The additional requirements of Subtitle D of the HITECH Act that relate to privacy and that are made applicable to the Department as a covered entity shall also be applicable to Contractor and are incorporated herein by reference.

c) Contractor will implement appropriate safeguards to prevent use or disclosure of PHI other than as permitted in this Agreement. Further, Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of Electronic PHI that it creates, receives, maintains, or transmits on behalf of the Department. The Secretary of Health and Human Services and the Department shall have the right to audit Contractor’s records and practices related to use and disclosure of PHI to ensure the Department's compliance with the terms of the HIPAA Privacy Rule and/or the HIPAA Security Rule.

Further, Sections 164.308 (administrative safeguards). 164.310 (physical safeguards),

164.312 (technical safeguards), and 164.316 (policies and procedures and documentation requirements) of the Security Rule shall apply to the Contractor in the same manner that such sections apply to the Department as a covered entity. The additional requirements of the HITECH Act that relate to security and that are made applicable to covered entities shall be applicable to Contractor and are hereby incorporated by reference into this Business Associate Agreement.

d) Contractor shall report to Department any use or disclosure of PHI, which is not in compliance with the terms of this Agreement as well as any Security incident of which it becomes aware. Contractor agrees to notify the Department and include a copy of any complaint related to use, disclosure, or requests of PHI that the Contractor receives directly and use best efforts to assist the Department in investigating and resolving such complaints. In addition, Contractor agrees to mitigate, to the extent

FDC-ITN-25-068

Operation and Management of Contractor-Operated Correctional Facilities practicable, any harmful effect that is known to Contractor of a use or disclosure of PHI by Contractor in violation of the requirements of this Agreement.

Such report shall notify the Department of:

1) any Use or Disclosure of PHI (including Security Incidents) not permitted by this Agreement or in writing by the Department;

2) any Security Incident;

3) any Breach, as defined by the HITECH Act; or any other breach of a security system, or like system, as may be defined under applicable State law (Collectively a “Breach”).

4) any other breach of a security system, or like system, as may be defined under applicable State law (Collectively a “Breach”).

Contractor will without unreasonable delay, but no later than 72 hours after discovery of a Breach, send the above report to the Department.

Such report shall identify each individual whose PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed during any Breach pursuant to 42 U.S.C.A. § 17932(b). Such report will:

1) Identify the nature of the non-permitted or prohibited access, use, or disclosure, including the nature of the Breach and the date of discovery of the Breach.

2) Identify the PHI accessed, used or disclosed, and provide an exact copy or replication of that PHI.

3) Identify who or what caused the Breach and who accessed, used, or received the PHI.

4) Identify what has been or will be done to mitigate the effects of the Breach;

and

5) Provide any other information, including further written reports, as the Department may request.

e) In accordance with Section 164.504(e)(1)(ii) of the Privacy Rule, each party agrees that if it knows of a pattern of activity or practice of the other party that constitutes a material breach of or violation of the other party’s obligations under the Business Associate Agreement, the non-breaching party will take reasonable steps to cure the breach or end the violation, and if such steps are unsuccessful, terminate the Contract or arrangement if feasible. If termination is not feasible, the party will report the problem to the Secretary of Health and Human Services (federal government).

f) Contractor will ensure that its agents, including a subcontractor, to whom it provides PHI received from, or created by Contractor on behalf of the Department, agree to the same restrictions and conditions that, apply to Contractor, and apply reasonable and appropriate safeguards to protect such information. Contractor agrees to designate an appropriate individual (by title or name) to ensure the obligations of this agreement are met and to respond to issues and requests related to PHI. In addition, Contractor agrees to take other reasonable steps to ensure that its employees’ actions or omissions do not cause Contractor to breach the terms of this Agreement.

g) Contractor shall secure all PHI by a technology standard that renders PHI unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American

FDC-ITN-25-068

Operation and Management of Contractor-Operated Correctional Facilities

National Standards Institute and is consistent with guidance issued by the Secretary of Health and Human Services specifying the technologies and methodologies that render PHI unusable, unreadable, or indecipherable to unauthorized individuals, including the use of standards developed under Section 3002(b)(2)(B)(vi) of the Public Health Service Act, pursuant to the HITECH Act, 42 U.S.C. § 300jj-11, unless the Department agrees in writing that this requirement is infeasible with respect to particular data. These security and protection standards shall also apply to any of Contractor’s agents and subcontractors.

h) Contractor agrees to make available PHI so that the Department may comply with individual rights to access in accordance with Section 164.524 of the HIPAA Privacy Rule. Contractor agrees to make PHI available for amendment and incorporate any amendments to PHI in accordance with the requirements of Section 164.526 of the HIPAA Privacy Rule. In addition, Contractor agrees to record disclosures and such other information necessary, and make such information available, for purposes of the Department providing an accounting of disclosures, as required by Section 164.528 of the HIPAA Privacy Rule.

i) The Contractor agrees, when requesting PHI to fulfill its Contractual obligations or on the Department’s behalf, and when using and disclosing PHI as permitted in this Contract, that the Contractor will request, use, or disclose only the minimum necessary in order to accomplish the intended purpose.

3. Obligations of Department

a) The Department will make available to the Business Associate the notice of privacy practices (applicable to inmates under supervision, not to inmates) that the Department produces in accordance with 45 CFR 164.520, as well as any material changes to such notice.

b) The Department shall provide Business Associate with any changes in, or revocation of, permission by an Individual to use or disclose PHI, if such changes affect Business Associate’s permitted or required uses and disclosures.

c) The Department shall notify Business Associate of any restriction to the use or disclosure of PHI that impacts the business associate’s use or disclosure and that the Department has agreed to in accordance with 45 CFR 164.522 and the HITECH Act.

4. Termination

a) Termination for Breach - The Department may terminate this Agreement if the Department determines that the Vendor has breached a material term of this Agreement. Alternatively, the Department may choose to provide Contractor with notice of the existence of an alleged material breach and afford Contractor an opportunity to cure the alleged material breach. In the event Contractor fails to cure the breach to the satisfaction of the Department, the Department may immediately thereafter terminate this Agreement.

b) Automatic Termination - This Agreement will automatically terminate upon the termination or expiration of the original Contract between the Department and the Contractor.

c) Effect of Termination

FDC-ITN-25-068

Operation and Management of Contractor-Operated Correctional Facilities

(1) Termination of this agreement will result in termination of the associated Contract between the Department and the Contractor.

(2) Upon termination of this Agreement or the Contract, Contractor will return or destroy all PHI received from the Department or created or received by Contractor on behalf of the Department that Contractor still maintains and retain no copies of such PHI; provided that if such return or destruction is not feasible, Contractor will extend the protections of this Agreement to the PHI and limit further uses and disclosure to those purposes that make the return or destruction of the information infeasible.

5. Amendment - Both parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary to comply with the requirements of the HIPAA Privacy Rule, the HIPAA Security Rule, and the HITECH Act.

6. Interpretation - Any ambiguity in this Agreement shall be resolved to permit the Department to comply with the HIPAA Privacy Rule, the HIPAA Security Rule, and/or the HITECH Act.

7. Indemnification – The Contractor shall be liable for and agrees to be liable for, and shall indemnify, defend, and hold harmless the Department, its employees, agents, officers, and assigns from any and all claims, suits, judgments, or damages including court costs and attorneys’ fees arising out or in connection with any non-permitted or prohibited Use or Disclosure of PHI or other breach of this Agreement, whether intentional, negligent or by omission, by Contractor, or any subcontractor of Contractor, or agent, person or entity under the control or direction of Contractor. This indemnification by Contractor includes any claims brought under Title 42 USC §1983, the Civil Rights Act.

8. Miscellaneous - Parties to this Agreement do not intend to create any rights in any third parties. The obligations of Contractor under this Section shall survive the expiration, termination, or cancellation of this Agreement, or any and all other contracts between the parties, and shall continue to bind Contractor, its agents, employees, contractors, successors, and assigns as set forth herein for any PHI that is not returned to the Department or destroyed.