Business-Associate-Agreement-July-2020_Word Format.docx

BUSINESS ASSOCIATE AGREEMENT

This Business Associate Agreement (“Agreement”) is entered into by the Board of Regents of the University of Wisconsin System, an agency of the State of Wisconsin, on behalf of the Health Care Component of the University of Wisconsin-Madison (“UW-Madison” or “Covered Entity”), and the “Business Associate” identified below. UW-Madison and Business Associate may each be individually referred to as a “Party” and collectively referred to as the “Parties.”

Business Associate: Name: Address:

Contact Person / Title:

Phone: Fax: Email:

This Agreement shall be deemed effective as of the date signed by both Parties.

This Agreement is intended to govern the manner in which the Business Associate uses and discloses protected health information (“PHI”) obtained from or on behalf of UW-Madison, a covered entity under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

Both Parties are committed to using and disclosing protected health information in compliance with the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) and Security Standards for the Protection of Electronic Protected Health Information (“Security Rule”) under HIPAA (at 45 CFR Parts 160 and 164). The definitions set forth in the Privacy Rule and the Security Rule are incorporated by reference into this Agreement (45 CFR §§ 160.103, 164.103, 164.304 and 164.501). In addition, both Parties agree to use and disclose protected health information as required in the Health Information Technology for Economic and Clinical Health Act (“HITECH”) provisions of the American Recovery and Reinvestment Act of 2009.

The Parties mutually agree to the following provisions:

1. Permitted Uses or Disclosures of Protected Health Information

1.1 Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI disclosed to it by UW-Madison to perform the following health care operations related services as a business associate, provided that such use or disclosure would not violate the HIPAA Privacy or Security Rule if made by UW-Madison:

[Add specific description of services to be provided by Business Associate; include reference to any underlying contractual agreement(s) by contract date, contract name/number, or project number where possible.]

1.2 Except as otherwise limited in this Agreement, Business Associate may use PHI, if necessary, for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate.

1.3 Except as otherwise limited in this Agreement, Business Associate may disclose PHI, if necessary, for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate if:

13.1 Such disclosures are required by law, or

1.3.2 Business Associate obtains reasonable assurances, evidenced by written Agreement, from the person to whom the information is disclosed that: (i) the information will remain confidential and will be used or further disclosed only as required by law or for the purpose for which it was disclosed to the person; and (ii) the person will notify the Business Associate, who shall in turn promptly notify Covered Entity in the manner described in in Subsection 2.4, of any instances of unauthorized uses or disclosures of PHI.

1.4 Business Associate shall use or disclose only the minimally necessary PHI, in accordance with 45 CFR §164.502(b), for any permitted use or disclosure under this Agreement.

2. Obligations of Business Associate

2.1 Uses or Disclosures of PHI. Business Associate will neither use nor disclose PHI other than as permitted or required by this Agreement, as otherwise authorized in writing by UW- Madison, or as required by law.

2.2 Safeguards for PHI and Compliance with HIPAA Security Rule.

2.2.1 Business Associate will employ appropriate administrative, technical, and physical safeguards and comply with Subpart C of 45 CFR Part 164 to prevent the use or disclosure of PHI other than as provided in this Agreement.

2.2.2 Business Associate will provide a written report regarding any security incidents, as defined in 45 CFR § 164.304, of which it becomes aware, including breaches of unsecured PHI as required by 45 CFR § 164.410, to UW-Madison’s HIPAA Privacy Officer, in the manner described in subsection 2.4., below.

2.2.3 With respect to PHI that is created, received, maintained or transmitted electronically under this Agreement, Business Associate also will comply with the following sections of the HIPAA Security Rule:

2.2.3.1 45 CFR §164.308, Administrative Safeguards

2.2.3.2 45 CFR §164.310, Physical Safeguards

2.2.3.3 45 CFR §164.312, Technical Safeguards

2.2.3.4 45 CFR §164.316, Policies and Procedures and Documentation Requirements

2.3 Mitigate Harmful Effect. In consultation with UW-Madison, Business Associate will mitigate, to the extent possible, any harmful effect that is known to Business Associate related to the inappropriate use or disclosure of PHI.

2.4 Reporting Unauthorized Uses or Disclosures. Business Associate will provide a written report regarding any unauthorized uses or disclosures of PHI (including breaches as defined at 45 CFR §164.402) to UW-Madison’s HIPAA Privacy Officer without unreasonable delay and in no case later than five (5) business days upon discovery thereof. For purposes of this Agreement, discovery means the first day on which such unauthorized use or disclosure is known to the Business Associate (including any person who is an employee, officer, or other agent of Business Associate) or should reasonably have been known to such Business Associate (or person) to have occurred. The written report shall:

2.4.1 Identify the PHI used or disclosed, and the nature of the use or disclosure (including the identification of each individual whose unsecured PHI has, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during the unauthorized use or disclosure);

2.4.2 Provide the date of the occurrence and the date of the discovery of the occurrence;

2.4.3 Identify what measures the Business Associate proposes to take to mitigate any harm resulting from such unauthorized use or disclosure, and what Business Associate will do to prevent similar unauthorized uses or disclosures in the future; and

2.4.4 Be sent, return-receipt or delivery confirmation requested, to: UW-Madison HIPAA Privacy Officer 361 Bascom Hall, 500 Lincoln Drive Madison, WI 53706 hipaa@wisc.edu

With a copy to: [Add UW contact person]

2.5 Subcontractors. Business Associate will ensure that any subcontractors that create, receive, maintain, or transmit electronic PHI on behalf of Business Associate agree to comply with the terms of this Agreement, with Subpart C of 45 CFR Part 164, and with the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information.

2.6 Access to Individual’s PHI. If Business Associate maintains information that is part of a designated record set, as defined in the Privacy Rule, Business Associate will make this information available to UW-Madison or at UW-Madison’s direction, to the individual, within fifteen (15) business days of request from UW-Madison or by some later date as mutually agreed upon by the Parties. Business Associate will make this access available as necessary for UW-Madison to meet its obligations under 45 CFR § 164.524.

2.7 Amendment of PHI. If Business Associate maintains information that is part of a designated record set, Business Associate shall make this information available to UW-Madison for amendment and shall incorporate any amendments to this information within fifteen (15) business days of such request, or by some later date as mutually agreed upon by the Parties. Business Associate will facilitate these amendments as necessary for UW-Madison to meet its obligations under 45 CFR § 164.526.

2.8 Information Necessary for Accounting of Disclosures. Business Associate shall maintain an ongoing log of any disclosures of PHI it makes to any other person or entity, required for accounting as specified in section 45 CFR 164.528. This log shall include the name and address of the person or organization receiving the information, a description of the information disclosed, and the reason why the information was disclosed. Business Associate will make this log available to UW-Madison as necessary for UW-Madison to meet its obligations under 45 CFR § 164.528.

2.9 Resources Necessary for HHS Secretary Determinations. Business Associate shall make internal procedures, books, and records relating to the use and disclosure of PHI received from UW-Madison, or created or received on behalf of UW-Madison available to the Secretary of the Department of Health and Human Services (“Secretary”) for purposes of determining UW-Madison’s compliance with the Privacy Regulation. Business Associate shall provide UW-Madison with copies of any information it has made available to the Department of Health and Human Services.

2.10 Sanctions. Business Associate shall implement and enforce a policy regarding sanctions for any employee, agent, or subcontractor who violates the terms of this Agreement.

3. Obligations of UW-Madison

3.1 Upon request, UW-Madison shall provide Business Associate with the notice of privacy practices that UW-Madison provides to patients in accordance with 45 CFR § 164.520.

3.2 UW-Madison shall provide Business Associate with any changes in, or revocation of, permission by an individual to the use or disclosure PHI, if such changes affect Business Associate’s permitted or required uses or disclosures.

3.3 UW-Madison shall notify Business Associate of any restrictions to the use or disclosure of PHI that UW-Madison has agreed to in accordance with 45 CFR § 164.522.

4. Termination of the Agreement

4.1 Either Party may terminate this Agreement upon 30 (thirty) days written notice.

4.2 This Agreement automatically terminates upon completion by Business Associate of the service specified in Section 1, above.

4.3 UW-Madison may terminate this Agreement with Business Associate if it determines that Business Associate has breached a material term of this Agreement. Before termination, UW-Madison may choose to:

4.3.1 Provide Business Associate with thirty (30) days written notice of the existence of an alleged material breach; and

4.3.2 Afford Business Associate an opportunity to cure said material breach upon mutually agreeable terms.

5. Destruction of Protected Health Information upon End of Agreement

5.1 Within a mutually agreed upon period of time after termination, cancellation, expiration, or other conclusion of this Agreement, Business Associate shall, if appropriate or feasible, return or destroy all PHI received from, or created on behalf of, UW-Madison that Business Associate maintains in any form. Business Associate shall employ method of destruction mutually agreed upon by the Parties.

5.2 In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide notice to UW-Madison of the conditions that make the return or destruction infeasible. Upon mutual agreement of the Parties that the return or destruction of PHI is infeasible, Business Associate may continue to use such PHI for those purposes that make the return or destruction infeasible and shall continue to protect such PHI as required under this Agreement for so long as the Business Associate maintains such PHI.

6. Amendment to Agreement to Comply with HIPAA

Upon the effective date of any amendment to final regulations promulgated by the U.S. Department of Health and Human Services with respect to PHI, this Agreement will automatically amend such that the obligations it imposes on the Business Associate remain in compliance with applicable regulations.

7. Miscellaneous

7.1 Any Notices delivered to Covered Entity or to Business Associate shall be sent, return-receipt or delivery confirmation requested, to:

UW-Madison HIPAA Privacy Officer 361 Bascom Hall, 500 Lincoln Drive Madison, WI 53706 hipaa@wisc.edu

With a copy to: [Add UW contact person]

With a copy to Business Associate at the address provided above.

7.2 Regulatory References. A reference in this Agreement to a section in the Privacy Rule or in the Security Rule means the section as in effect or as amended.

7.3 Transferability. Neither party’s interest under this Agreement may be transferred or assigned or assumed by any other party, in whole or in part, without the prior written consent of the other party to the Agreement.

7.4 Hold Harmless. To the extent allowable under applicable law, Covered Entity and Business Associate shall each be responsible for their own acts and/or omissions and those of their officers, employees, and agents in the performance of this Agreement.

7.5 Governing Law. This Agreement shall be governed by and interpreted in accordance with the laws of the State of Wisconsin.

7.6 Interpretation. Any ambiguity in this Agreement shall be resolved to permit UW-Madison to comply with HIPAA regulations applicable to Covered Entities.

[Proceed to Following Page for Signatures]

IN WITNESS THEREOF, each of the undersigned has caused this Agreement to be duly executed in its name and on its behalf effective as of the date signed by the Parties.

BOARD OF REGENTS OF THE UNIVERSITY OF WISCONSIN SYSTEM

By:

Print Name:

Print Title:

Date:

Approved/Acknowledged by:

Agreement should be approved/acknowledged by someone from the involved UW-Madison Department or Program

By:

Print Name:

Print Title:

Print Department/Program:

Date:

BUSINESS ASSOCIATE

By:

Print Name:

Print Title:

Date:

Business Assoc Agreement (July 2020) image1.png