Business_Associate_Agreement_-_Blank_Draft.docx

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement ("Agreement") is entered into effective _______(the Effective Date"), by ("Business Associate"), on the one hand, and City of Edinburg ("Covered Entity"), with reference to the following recitals:

RECITALS

WHEREAS, Covered Entity is an employee welfare benefit plan that provides health care to the employees of City of Edinburg;

WHEREAS, Business Associate is a third party administrator providing services to the Covered Entity;

WHEREAS, Business Associate's services are required and have been retained in connection with the administration of the benefits offered by Covered Entity;

WHEREAS, in the course of providing services to Covered Entity, Business Associate may perform functions or activities involving the use or disclosure of PHI pertaining to participants and beneficiaries of Covered Entity;

WHEREAS, the Secretary of Health and Human Services has issued regulations requiring a contract between Covered Entity and Business Associate in order to protect against the unauthorized use and disclosure of PHI by Business Associate;

NOW, THEREFORE, in consideration of the mutual promises and covenants contained in this Agreement and other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

I. DEFINITIONS

a. Breach. "Breach" shall have the same meaning as the term "Breach" in 45 CFR §164.402.

b. Professional Services Agreement. "Professional Services Agreement" shall mean any agreement between Business Associate and Covered Entity either executed contemporaneously with, or already in effect at the time of execution of, this Agreement for the provision of services by the Business Associate on behalf of the Covered Entity.

c. Individual. "Individual" shall have the same meaning as the term "individual" in 45 CFR §160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CPR § 164.502(g).

d. Notification Procedures. "Notification Procedures" shall mean those procedures required to be taken by the Business Associate in the event of a Breach of Unsecured PHI under 45 CFR §164.410.

e. PHI. "PHI" shall mean "Protected Health Information" as defined in 45 CFR §160.103, limited to the information created or received by Business Associate from or on behalf of Covered Entity.

g. Required By Law. "Required By Law" shall have the same meaning as the term "required by law" in 45 CFR §164.103.

h. Secretary. "Secretary" shall mean the Secretary of the Department of Health and Human Services or his designee.

i. Standards for Security and Privacy. "Standards for Security and Privacy" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Parts 160 and 164.

j. Undefined Terms. Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the Standards for Security and Privacy.

k. Unsecured PHI. "Unsecured PHI" shall mean "unsecured protected health information" as defined in 45 CFR §164.402.

II. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE

a. Business Associate agrees to not use or disclose PHI other than as permitted or required by the Professional Service Agreement or as Required by Law.

b. Business Associate agrees to use appropriate administrative, technical, and physical safeguards to prevent use or disclosure of the PHI other than as provided for by this Agreement. Business Associate agrees to reasonably safeguard PHI from any intentional or unintentional use of disclosure in violation of this Agreement and the Standards for Security and Privacy. Business Associate agrees to reasonably safeguard PHI to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure.

c. Business Associate agrees to comply with the Notification Procedures in the case of Breach. If expediency warrants, Business Associate will notify Covered Entity within 5 business days of any Breach.

d. Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides PHI received from, or created or received by Business Associate on behalf of, Covered Entity agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information.

e. Business Associate agrees to make available to Covered Entity or to the Secretary all internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity. This information will be provided within thirty (30) days, or such other time designated by the Secretary, of receiving a written request stating that the information is required to determine the Covered Entity's compliance with the Standards for Security and Privacy. As used in this term, "internal practices, books and records" include policies and procedures for protection of PHI.

f. Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR §164.528.

g. Business Associate agrees to provide to Covered Entity or an Individual, in time and manner within thirty (30) days of receiving written request, information collected in accordance with Section f of this Agreement, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528.

h. Business Associate agrees to be familiar and comply with any applicable state privacy laws which are more stringent than the Standards for Security and Privacy.

i. Business Associate agrees to be familiar and comply with any record retention requirements applicable to either Business Associate or Covered Entity and contained in any federal or state law or regulation, including the Employee Retirement Income Security Act of 1974.

j. Business Associate agrees to provide Covered Entity, or its designated agent, during regular business hours, with access to the records of Business Associate for the purpose of conducting Standards for Security and Privacy compliance audits. For this purpose Business Associate will make available internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of, Covered Entity.

k. Business Associate agrees not to use PHI for any independent purpose or any purpose not specifically authorized by the terms of this Agreement and the Standards for Security and Privacy.

l. Business Associate agrees to comply, to the extent they do not conflict with the Standards for Security and Privacy, with the terms and provisions of Covered Entity's plan document.

m. Business Associate is permitted to create, receive, maintain, or transmit electronic PHI on Covered Entity's behalf, but agrees to appropriately safeguard the electronic PHI ("ePHI") as required by 45 CPR§§ 164.306, 164.308(b), & 164.314(a). Business Associate shall (i) implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the ePHI that it creates, receives, maintains, or transmits on behalf of Covered Entity; (ii) ensure that any agent, including a subcontractor, to whom it provides such information agrees to implement reasonable and appropriate safeguards to protect it; and (iii) report to Covered Entity any security incident of which it becomes aware.

n. Business Associate is permitted to electronically transmit PHI it creates, receives, or maintains, but agrees to do so pursuant to the Electronic Data Interchange regulations issued by the Centers for Medicare and Medicaid Services.

III. PERMIITED USES AND DISCLOSURES BY BUSINESS ASSOCIATE

General Use and Disclosure Provisions. Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in Professional Service Agreement with Principle Medical Supplies, provided that such use or disclosure would not violate the Standards for Security and Privacy if done by Covered Entity or the minimum necessary policies and procedures of the Covered Entity.

IV. OBLIGATIONS OF COVERED ENTITY

a. Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45 CPR§ 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI.

b. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by Individual to use or disclose PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI.

c. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CPR § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of PHI.

V. PERMISSIBLE REQUESTS BY COVERED ENTITY

Covered Entity shall not request that Business Associate use or disclose PHI in any manner that would not be permissible under the Standards for Security and Privacy if done by Covered Entity.

VI. TERM AND TERMINATION

a. Term. The Term of this Agreement shall begin as of the Effective Date, and shall terminate when all PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity.

b. Termination for Cause. If Covered Entity determines that Business Associate has violated a material term of this agreement, Covered Entity shall provide Business Associate with an opportunity to cure the breach or end the violation. If Business Associate does not cure the breach or end the violation without unreasonable delay (in no event shall such cure period extend beyond sixty (60) days) Covered Entity shall terminate this agreement.

c. Effect of Professional Service Agreement Termination.

(i) Except as provided in subsection (ii) below, upon termination of the Professional Service Agreement, for any reason, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the PHI.

(ii) Destruction of information created or received by Business Associate on behalf of Covered Entity is permitted only in the event such destruction does not conflict with record retention requirements contained in federal or state law, including the Internal Revenue Code or En1ployee Retirement Income Security Act of 1974. In the event that Business Associate determines that returning or destroying the PHI is not permitted or is infeasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI.

VII. MISCELLANEOUS

a. Regulatory References. A reference in this Agreement to a section in the Standards for Security and Privacy means the section as in effect or as amended.

b. Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessa1y for Covered Entity to comply with the requirements of the Standards for Security and Privacy and the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191. This Agreement may not be amended except by a writing signed by both parties.

c. Survival. The respective rights and obligations of Business Associate under Section VI(c) of this Agreement shall survive the termination of this Agreement.

d. Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with the Standards for Security and Privacy.

e. Counterparts. This Agreement may be executed in counterparts which, taken together, shall constitute the whole of this Agreement between the parties.

f. Assignment. This Agreement shall be binding upon and shall inure to the benefit of the parties and their respective successors, heirs, and assigns.

g. Conferring Rights or Remedies. Except as may be expressly set forth herein, the parties do not intend to confer any rights or remedies upon any person other than the parties to this Agreement.

h. Counsel. Each party to this Agreement has had the opportunity to consult with counsel of its choice as to the form and content of this Agreement and the advisability of executing it. The normal rule of construction to the effect that any ambiguities are to be resolved against the drafting party will not be employed in any interpretation of this Agreement.

i. Attorneys' Fees and Costs. Except as otherwise specifically provided by law, all legal and other costs and expenses incurred in connection with this Agreement and the transactions contemplated hereby, including without limitation legal and accounting fees, shall be paid by the party incurring such expenses. In the event of any litigation or arbitration between the parties respecting or arising out of this Agreement, the prevailing party shall be entitled to recover reasonable attorneys' fees and costs, whether or not any litigation proceeds to final judgment or determination.

j. Authorized Signature. Each party has authorized its undersigned representative whose signature appears below to execute this Agreement on that party's behalf.

k. Notices. Any notice, demand, or request given in accordance with this Agreement shall be given by personal delivery; by messenger delivery; by facsimile transmission; by placing said notice in the United States mail, registered or first-class, postage prepaid; or by sending such notice via an overnight courier service. Notice shall be deemed given when delivered to a party, when the facsimile transmission occurs, or on the date when said notice is deposited in the United States mail, postage prepaid. The current mailing addresses and facsimile numbers where notice may be served upon the parties are:

For Business Associate:

For Covered Entity:

City of Edinburg 415 West University Drive Edinburg TX 78541

Any change of address or facsimile will be delivered to the other party within thirty (30) days of the change.

I. Indemnification. To the extent allowed by law, each party shall indemnify, defend, and hold harmless the other party, as well as its affiliates, agents, officers, employees, plan sponsors, plan administrators, directors, and shareholders, from and against any and all claims, suits, hearings, actions, damages, liabilities, fines, penalties (including any civil penalties under the Standards for Security and Privacy), costs, losses, or expenses, including reasonable attorneys' fees, caused by or resulting from any breach of this Agreement, including but not limited to any misconduct, error, omission, or other unauthorized act by the party in the performance of obligations under this Agreement, or by the party's affiliates, agents, officers, employees, sponsors, directors, and shareholders, except to the extent that such alleged misconduct, act, error, omission, or other unauthorized or improper act is primarily attributable to another party to this Agreement.

m. Severability. Whenever possible, each provision of this Agreement shall be interpreted in such a manner as to be effective and valid under applicable law, but if any provision of this Agreement shall be prohibited or invalid under such law, such provision shall be ineffective to the extent of such prohibition or invalidity without invalidating the remainder of such provision or the remaining provisions of this Agreement, each of which shall continue to be valid and binding upon the parties.

n. Waiver. A waiver by any party of any of the terms and conditions of this Agreement in any one instance shall not be deemed or construed to be a waiver of such term or condition for the future, or of any subsequent breach thereof, nor shall it be deemed a waiver of performance of any other obligation hereunder.

IN WITNESS WHEREOF, the parties have executed this Agreement effective as of the day and year above written.

COVERED ENTITY:

City Of Edinburg

Myra L. Ayala Date City Manager

BUSINESS ASSOCIATE:

Date

Date

Date

Approved as to form:

JOSEPHINE R. SOLIS, CITY ATTORNEY

BY: _____________________________

Josephine R. Solis, City Attorney image1.png