Business Associate Agreement BAA Addendum.docx

COMMONWEALTH OF PENNSYLVANIA

DEPARTMENT OF MILITARY AND VETERANS AFFAIRS

Health Insurance Portability and Accountability Act (HIPAA) Compliance Business Associate Agreement / Addendum

This Agreement is made and entered between the Commonwealth of Pennsylvania, Department of Military and Veterans Affairs, Fort Indiantown Gap, Annville, PA 17003-5002 (hereinafter called “Covered Entity” or “DMVA”) and The awarded contractor (hereinafter called “Business Associate.”)

WITNESSETH:

WHEREAS, the Covered Entity operates state veterans’ homes, which provide long-term care to eligible veterans and their spouses; and WHEREAS, in connection with the operation of the veterans’ homes, the Covered Entity collects and maintains Protected Health Information (hereinafter called “PHI”); and WHEREAS, the Covered Entity has entered into an undertaking (services agreement or other contract, purchase order, agreement or arrangement) with the Business Associate which involves use or disclosure of PHI maintained by Covered Entity in the course of its operations of the state veterans’ homes; and, WHEREAS, the parties intend to protect the privacy and security of certain Protected Health Information (PHI) to which Business Associate may have access in order to provide goods or services to or on behalf of Covered Entity, in accordance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Pub. L. No. 111-5 (Feb. 17, 2009), the HIPAA Privacy Rule (Privacy Rule), 45 C.F.R. Parts 160 and 164, and the HIPAA Security Rule (Security Rule), 45 C.F.R. Parts 160, 162 and 164, and all other applicable laws; and WHEREAS, Business Associate may receive PHI from Covered Entity, or may create or obtain PHI from other parties for use on behalf of Covered Entity, which PHI can be used or disclosed only in accordance with this Agreement and the standards established by applicable laws; and WHEREAS, Business Associate may receive PHI from Covered Entity, or may create or obtain PHI from other parties for use on behalf of Covered Entity that is in electronic form, which PHI must be handled in accordance with this Agreement and the standards established by HIPAA and the Security Rule and other applicable laws; and NOW, THEREFORE, in consideration of the undertaking between the parties and the payments or other recompense provided thereby the parties, agreeing to be legally bound, hereby incorporate the foregoing Whereas clauses as material provisions of this agreement and covenant and agree as follows::

1. Definitions.

a. “Business Associate” shall have the meaning given to such term under the Privacy and Security Rules, including but not limited to, 45 C.F.R. §160.103.

b. “Commonwealth party” means the Commonwealth of Pennsylvania, its agencies, officials, employees, including, but not limited to the Department of Military and Veterans Affairs and the state veterans’ homes operated by DMVA (known collectively for purposes of this agreement as “DMVA” or the “Covered Entity.”)

c. “Covered Entity” shall have the meaning given to such term under the Privacy and Security Rules, including, but not limited to, 45 C.F.R. §160.103.

d. “HIPAA” shall mean the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191.

e. “Privacy Rule” shall mean the standards for privacy of individually identifiable health information in 45 C.F.R. Parts 160 and 164.

f. “Protected Health Information” or “PHI” means any information, transmitted or recorded in any form or medium; (i) that relates to the past, present or future physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual, and (ii) that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual, and shall have the meaning given to such term under HIPAA and the HIPAA Regulations in 45 C.F.R. Parts 160, 162 and 164, including, but not limited to 45 C.F.R. §164.501.

g. "Required By Law" shall have the same meaning as the term "required by law" in 45 CFR § 164.103.

h. “Security Rule” shall mean the security standards in 45 C.F.R. Parts 160, 162 and 164.

i. Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 C.F.R. Parts 160, 162 and 164.

2. Stated Purposes For Which Business Associate May Use Or Disclose PHI. The Parties hereby agree that Business Associate shall be permitted to use and/or disclose PHI provided by or obtained on behalf of Covered Entity for purposes stated in Exhibit A, except as otherwise stated in this Agreement.

NO OTHER DISCLOSURES OF PHI OR OTHER INFORMATION ARE PERMITTED.

3. BUSINESS ASSOCIATE OBLIGATIONS:

a) Limits On Use And Further Disclosure Established By Agreement And Law. Business Associate hereby agrees that the PHI provided by, or created or obtained on behalf of Covered Entity shall not be further used or disclosed other than as permitted or required by this Agreement or as required by law.

b) Appropriate Safeguards. Business Associate shall establish and maintain appropriate safeguards to prevent any use or disclosure of PHI other than as provided for by this Agreement. Appropriate safeguards shall include implementing administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic PHI that is created, received, maintained, or transmitted on behalf of the Covered Entity.

c) Reports Of Improper Use Or Disclosure. Business Associate hereby agrees that it shall report to the Covered Entity Privacy Officer, or designee, within two (2) business days of discovery any use or disclosure of PHI not provided for or allowed by this Agreement. Business Associate agrees to conduct reasonable diligence to discover improper use or disclosure of PHI.

f) Right of Access To PHI. Business Associate hereby agrees to allow an individual who is the subject of PHI maintained in a designated record set, to have access to and copy that individual’s PHI within five (5) business days of receiving a written request from the Covered Entity. Business Associate shall provide PHI in the format requested, unless it cannot readily be produced in such format, in which case it shall be provided in standard hard copy. If any individual requests from Business Associate or its agents or subcontractors access to PHI, Business Associate shall notify Covered Entity of same within five (5) business days. Business associate shall further conform with and meet all of the requirements of 45 C.F.R. §164.524 and other applicable laws.

g) Amendment and Incorporation Of Amendments. Within five (5) business days of receiving a request from Covered Entity for an amendment of PHI maintained in a designated record set, Business Associate shall make the PHI available and incorporate the amendment to enable Covered Entity to comply with 45 C.F.R. §164.526 and other applicable laws. If any individual requests an amendment from Business Associate or its agents or subcontractors, Business Associate shall notify Covered Entity within five (5) business days.

h) Provide Accounting of Disclosures. Business Associate agrees to maintain a record of all disclosures of PHI in accordance with 45 C.F.R. §164.528 and other applicable laws. Such records shall include, for each disclosure, the date of the disclosure, the name and address of the recipient of the PHI, a description of the PHI disclosed, the name of the individual who is the subject of the PHI disclosed, the purpose of the disclosure, and shall include disclosures made on or after the date that is six (6) years prior to the request, whichever is later. Business Associate shall make such record available to the individual or the Covered Entity within five (5) business days of a request for an accounting of disclosures.

i) Access to Books and Records. Business Associate hereby agrees to make its internal practices, books, and records relating to the use or disclosure of PHI received from, or created or received by Business Associate on behalf of the Covered Entity, available to the Secretary of Health and Human Services or designee for purposes of determining compliance with the HIPAA Privacy Regulations.

j) Return or Destruction Of PHI. At termination of this Agreement, Business Associate hereby agrees to return or destroy all PHI provided by or obtained on behalf of Covered Entity. Business Associate agrees not to retain any copies of the PHI after termination of this Agreement. If return or destruction of the PHI is not feasible, Business Associate agrees to extend the protections of this Agreement to limit any further use or disclosure until such time as the PHI may be returned or destroyed. If Business Associate elects to destroy the PHI, it shall certify to Covered Entity that the PHI has been destroyed.

k) Maintenance of PHI. Notwithstanding Section 5(j) of this Agreement, Business Associate and its subcontractors or agents shall retain all PHI throughout the term of the Agreement and shall continue to maintain the information required under §5(h) of this Agreement for a period of six (6) years after termination of the Agreement, unless Covered Entity and Business Associate agree otherwise.

l) Mitigation Procedures. Business Associate agrees to establish and to provide to Covered Entity upon request, procedures for mitigating, to the maximum extent practicable, any harmful effect from the use or disclosure of PHI in a manner contrary to this Agreement or the Privacy Rule. Business Associate further agrees to mitigate any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of this Agreement or the Privacy Rule.

m) Sanction Procedures. Business Associate agrees that it shall develop and implement a system of sanctions for any employee, subcontractor or agent who violates this Agreement or other applicable laws.

n) Grounds for Breach. Any non-compliance by Business Associate with this Agreement or the Privacy or Security Rules will automatically be considered to be a breach of the Agreement, if Business Associate knew or reasonably should have known of such non-compliance and failed to immediately take reasonable steps to cure the non-compliance.

o) Termination by Commonwealth. Business Associate authorizes termination of this Agreement by the Covered Entity if the Covered Entity determines, in its sole discretion, that the Business Associate has violated a material term of this Agreement.

p) Failure to Perform Obligations. In the event Business Associate fails to perform its obligations under this Agreement, Covered Entity may immediately discontinue providing PHI to Business Associate. Covered Entity may also, at its option, require Business Associate to submit to a plan of compliance, including monitoring by Covered Entity and reporting by Business Associate, as Covered Entity in its sole discretion determines to be necessary to maintain compliance with this Agreement and applicable law.

q) Privacy Practices. The Covered Entity will provide and Business Associate shall immediately begin using any applicable form, including but not limited to, any form used for Notice of Privacy Practices, Accounting for Disclosures, or Authorization, upon the effective date designated by the Program or Department. The Covered Entity retains the right to change the applicable privacy practices, documents and forms. The Business Associate shall implement changes as soon as practicable, but not later than 45 days from the date of notice of the change.

r) Indemnification. Business Associate expressly agrees that it will indemnify, save harmless and defend the Covered Entity and any Commonwealth party connected with the Covered Entity from and against all claims, demands, civil penalties, monetary or other damages, or any liability whatsoever, arising out of or related to any breach by the Business Associate of the requirements of this agreement, any failure to make required breach notifications or any violation of any privacy or security requirements with regard to PHI of applicable laws and regulations

4. OBLIGATIONS OF COVERED ENTITY:

a) Provision of Notice of Privacy Practices. Covered Entity shall provide Business Associate with the notice of privacy practices that the Covered Entity produces in accordance with applicable laws, as well as changes to such notice.

b) Permissions. Covered Entity shall provide Business Associate with any changes in, or revocation of, permission by individual to use or disclose PHI of which Covered Entity is aware, if such changes affect Business Associate’s permitted or required uses and disclosures.

c) Restrictions. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that the Covered Entity has agreed to in accordance with 45 C.F.R. §164.522 and other applicable laws, to the extent that such restriction may affect Business Associate’s use or disclosure of PHI.

d) Limitation of Liability. Nothing in this agreement shall be construed to waive the sovereign immunity of the Commonwealth of Pennsylvania, its agencies, officials, and employees, including the Covered Entity, or to subject any Commonwealth party to any liability not expressly authorized by law.

Exhibit A

Permitted Uses and Disclosures Protected Health Information

a) Except as otherwise limited in this Agreement, Business Associate may use or disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the undertaking (Services Agreement, other agreement, purchase order or other arrangement) provided that such use or disclosure would not violate the Privacy Rule if done by Covered Entity or the minimum necessary policies and procedures of the Covered Entity and further provided that such use is in accordance with the security rule and all other applicable requirements. In addition to the uses specifically and expressly authorized by the undertaking between the Covered Entity and the Business Associate, the following uses of PHI by the Business Associate are authorized to the extent, and only to the extent, authorized by applicable law, privacy rule, security rule and regulations:

b) Except as otherwise limited in this Agreement or as provided by law or regulation, Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

c) Except as otherwise limited in this Agreement or by law or regulation, Business Associate may disclose PHI for the proper management and administration of the Business Associate, provided that disclosures are required by law, and authorized by applicable law or regulation.

d) Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR § 164.502(j)(1).

e) Business Associate may use PHI for additional purposes as follows:

(List permitted uses and disclosures not covered by services agreement, other agreement, purchase order or other arrangement or write “NONE” below.)

DMVA Business Associate Agreement/Addendum (2010) Page 8