BUSINESS ASSOCIATE AGREEMENT (rev. 10-2019).pdf

(rev. 10-2019)

BUSINESS ASSOCIATE AGREEMENT

THIS BUSINESS ASSOCIATE AGREEMENT (“Agreement”) is made as of

_______________, 20__, by and between ___________________________ (“Contractor”) and the County of Orange (“County) (collectively, the Parties”).

BACKGROUND

The County and Contractor are parties to an agreement pursuant to which Contractor has agreed to perform certain services (“Services”) for or on behalf of the County, which Services may involve the use or disclosure of certain protected health information that is subject to protection under the Health Insurance

Portability and Accountability Act of 1996 (Public Law 104-191), as amended by the security provisions of the American Recovery and Reinvestment Act of 2009 (also known as the Health Information

Technology for Economic and Clinical Health Act, or the “HITECH Act,” as each may be further amended from time to time) (“HIPAA”), and their implementing regulations, 45 CFR Parts 160, 162, and 164

(collectively, “HIPAA Rules”).

This Agreement supplements the Underlying Agreement and is intended to satisfy the requirements for business associates agreements as set forth in the HIPAA Rules, which requires that the County, as a covered entity, receives adequate assurances that Contractor, as a business associate, will comply with certain obligations with respect to the protected health information received in the course of providing

Services to or on behalf of the County and that prohibit the disclosure to or use of protected health information by Contractor if such an agreement is not in place.

In consideration of the mutual promises and covenants herein, and for other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree as follows:

1. INCORPORATION. The background information set forth above is true and correct and is hereby incorporated into this Agreement as if set forth at length here.

2. DEFINITIONS.

a. General Definitions. The following terms used, but not otherwise defined in this Agreement shall have the same meaning as those terms in the HIPAA Rules: Breach, Data Aggregation, Designated

Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of

Privacy Practices, Protected Health Information, Electronic Protected Health Information, Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health

Information, and Use. Otherwise, to the extent terms are not defined herein, they shall be given their plain and ordinary meaning.

b. Specific Definitions.

i. Business Associate. “Business Associate” shall generally have the same meaning as the term

“business associate” at 45 CFR 160.103, and in reference to this Agreement the Contractor is the

Business Associate.

ii. Covered Entity. “Covered Entity” shall generally have the same meaning as the term “covered entity” at 45 CFR 160.103, and in reference to this Agreement the County is the Covered Entity.

iii. Underlying Agreement. “Underlying Agreement” shall mean that certain ________________, effective ________________, 20___, by and between the Parties, including any and all subsequent amendments thereto.

3. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATES. Business Associate agrees to comply with the provisions applicable to “business associates” imposed by HIPAA Rules, including the following:

a. Permitted Uses and Disclosures. Business Associate shall not Use or Disclose Protected Health

Information other than as permitted or required by this Agreement or as Required by Law.

b. Appropriate Safeguards. Business Associate shall use appropriate safeguards and comply with

Subpart C of 45 CFR Part 164, with respect to Electronic Protected Health Information, to prevent

Use or Disclosure of the Protected Health Information other than as provided for by this Agreement.

c. Reporting of Improper Access, Use, or Disclosure. Business Associate shall report in writing to

Covered Entity any Use or Disclosure of Protected Health Information not provided for by the

Underlying Agreement of which it becomes aware, including Breaches of Unsecured Protected

Health Information as required at 45 CFR 164.410, and any Security Incident of which it becomes aware without reasonable delay and in no case later than three (3) business days.

d. Business Associates Agents. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, Business Associate shall ensure that any Subcontractors that create, receive, maintain, or transmit Protected Health Information on behalf of the Business Associate, agree to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information.

e. Access to Protected Health Information. Business Associate shall make available Protected

Health Information in a Designated Record Set to the Covered Entity for inspection and copying within ten (10) business days of a request by Covered Entity to enable Covered Entity to satisfy

Covered Entity’s obligations under 45 CFR 164.524.

f. Amendment of Protected Health Information. Within ten (10) business days of receipt of a request from Covered Entity for an amendment of Protected Health Information or a record about an Individual contained in a Designated Record Set, Business Associate shall make such Protected

Health Information available to Covered Entity for amendment and incorporate any such amendment to enable Covered Entity to fulfill its obligations under the HIPAA Rules, including, but not limited to, 45 CFR §164.526. If any Individual requests an amendment of Protected Health

Information directly from Business Associate, Business Associate must notify Covered Entity in writing within ten (10) business days of the request. Any approval or denial of amendment of

Protected Health Information maintained by Business Associate shall be the responsibility of

Covered Entity.

g. Accounting Requirements. Business Associate must maintain the information required to provide an accounting of Disclosures as necessary to satisfy Covered Entity’s obligations under 45 CFR

164.528. Upon ten (10) business days written notice from Covered Entity to Business Associate, Business Associate shall make such accounting information available to Covered Entity. In the event that the request for an accounting is delivered directly to Business Associate, Business

Associate shall within five (5) business days of the request forward it to Covered Entity in writing.

It shall be Covered Entity’s responsibility to prepare and deliver the requested accounting to the individual.

h. Assistance in Litigation or Administrative Proceedings. Business Associate shall make itself, and any Subcontractors, employees, or agents assisting Business Associate in the performance of its obligations under the Underlying Agreement, available to Covered Entity, at no cost to Covered

Entity, to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against Covered Entity, its officials, employees or agents based upon a claimed violation of the HIPAA Rules, or other laws relating to security and privacy, except where Business

Associate, or its Subcontractor, employee, or agent is a named adverse party.

i. Secretary Access. Business Associate shall make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules. Business

Associate shall provide Covered Entity a copy of any Protected Health Information that Business

Associate provides to the Secretary concurrently with providing such Protected Health Information to the Secretary.

4. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE. Business Associate may only Use or Disclose Protected Health Information as follows:

a. Performance of Services. Except as otherwise limited in this Agreement, Business Associate may

Use or Disclose Protected Health Information to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the Underlying Agreement, provided that such Use or

Disclosure would not violate the HIPAA Rules if done by Covered Entity.

b. Required by Law. Business Associate may Use or Disclose Protected Health Information as

Required by Law.

c. Data Aggregation Services. Data Aggregation services involve the combining by Business

Associate of (i) Protected Health Information with (ii) Protected Health Information received by

Business Associate in its capacity as a business associate of another covered entity, to permit data analyses that relate to the healthcare operations of the respective covered entities. Except as otherwise limited in this Agreement, provided that the description of Services in the Underlying

Agreement contemplates the Business Associate providing Covered Entity Data Aggregation services, Business Associate may Use Protected Health Information to provide Data Aggregation services to Covered Entity as permitted by 45 CFR §164.504(e)(2)(i)(B).

d. Minimum Necessary. Business Associate agrees that it shall only Use and Disclose the minimum amount of Protected Health Information necessary for the accomplishment of the Business

Associate’s purpose in making Use or Disclosure of the Protected Health Information.

5. TERM AND TERMINATION.

a. Term. This Agreement shall be coterminous with the Underlying Agreement unless terminated earlier by Covered Entity for cause as authorized in paragraph (b) of this Section, whichever is sooner.

b. Termination for Cause.

i. Material Breach. A breach by Business Associate of any provision of this Agreement, as determined by Covered Entity, shall provide grounds for immediate termination of this

Agreement and the Underlying Agreement by Covered Entity.

ii. Judicial or Administrative Proceedings. Covered Entity may terminate the Underlying

Agreement, effective immediately, if (i) Business Associate is named as a defendant in a criminal proceedings for a violation of the HIPAA Rules or other security or privacy laws; or (ii) a finding or stipulation that the Business Associate has violated any standard or requirement of the HIPAA

Rules or other security or privacy laws is made in any administrative or civil proceeding in which

Business Associate has been joined.

c. Obligations of Business Associate Upon Expiration or Termination. Upon expiration of this

Agreement or termination of this Agreement for any reason, Business Associate, with respect to

Protected Health Information received from Covered Entity, or created, maintained, or received by

Business Associate on behalf of Covered Entity, shall:

i. Return or Destruction of Protected Health Information. Return to Covered Entity or, if agreed to in writing by Covered Entity, destroy all Protected Health Information in any form, whether received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity that the Business Associate, or its Subcontractors, still maintains. Business Associate shall retain no copies of the Protected Health Information. If

Covered Entity elects destruction of the Protected Health Information, Business Associate shall certify in writing to Covered Entity that such Protected Health Information has been destroyed.

ii. Appropriate Safeguards. If return or destruction is not feasible, as determined by Covered Entity, Business Associate shall extend the protections of Section 3 of this Agreement to such information and limit further Use of such Protected Health Information to those purposes that make the return or destruction of such Protected Health Information infeasible (45 CFR

164.504(e)(2)(ii)(J)) to prevent Use or Disclosure of the Protected Health Information, other than as provided for in this Section, for as long as Business Associate retains the Protected Health

Information.

6. VIOLATIONS. Any violation of this Agreement may cause irreparable harm to Covered Entity; and therefore, the Covered Entity may seek any legal remedy at law, in equity, or under this Agreement, available to it, including, but not limited to an injunction or specific performance for such harm, without bond, security or necessity of demonstrating actual damages.

7. INDEMNIFICATION. Business Associate shall indemnify, defend, and hold harmless Covered

Entity, including its officials, employees, and agents, against any and all claims, losses, liabilities, damages, costs, and other expenses (including, without limitation, reasonable attorneys’ fees and costs of litigation and/or settlement) resulting from, arising out of, or relating to, the acts or omissions of

Business Associate in connection with the representations, duties, and obligations of Business

Associate under this Agreement.

8. GENERAL PROVISIONS.

a. Notices. Any notices required or permitted to be sent hereunder will be in writing and will be sent certified mail, return receipt requested, or by a recognized international courier. Notices will be sent to the addresses of the respective Parties first set forth in the Underlying Agreement.

b. Regulatory References. A reference in this Agreement to a section in the HIPAA Rules means the section as in effect or as amended.

c. Interpretation. Any ambiguity in this Agreement shall be resolved to permit compliance with the

HIPAA Rules.

d. Conflicts. The provisions of this Agreement shall be interpreted as broadly as necessary to implement and comply with the HIPAA Rules. In the event of an inconsistency or conflict between the provisions of this Agreement and mandatory provisions of the HIPAA Rules, as amended, the

HIPAA Rules shall control. The provisions of this Agreement shall prevail over any provisions in the Underlying Agreement pertaining to HIPAA that may conflict or appear inconsistent with any provision of this Agreement.

e. No Third-Party Beneficiaries. Nothing express or implied in the Underlying Agreement is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate and their respective successors or assigns, any rights, remedies, obligations, or liabilities whatsoever.

f. Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary to ensure compliance with the requirements of the HIPAA Rules.

g. Disclaimer. Covered Entity makes no warranty or representation that compliance by Business

Associate with this Agreement or the HIPAA Rules will be adequate or satisfactory for Business

Associate’s own purposes. Business Associate is solely responsible for all decisions made by

Business Associate regarding the safeguarding of Protected Health Information.

h. Certification. To the extent that Covered Entity determines that an examination is necessary to comply with Covered Entity’s legal obligations pursuant to the HIPAA Rules relating to certification of its security practices, Covered Entity or its authorized agents or contractors, may, at the Covered Entity’s expense, examine Business Associate’s facilities, systems, procedures, and records as may be necessary for such agents or contractors to certify to Covered Entity the extent to which Business Associate’s security safeguards comply with the HIPAA Rules.

i. Survival. The respective rights and obligations of Business Associate and Covered Entity under the provisions of Sections 3(h), 3(i), 5(c), 6 and 7 of this Agreement shall survive the termination of this Agreement indefinitely.

j. Supersession. This Agreement supersedes and replaces any and all business associate agreements previously entered into by and between the Parties relating to the Underlying Agreement.

k. Governing Law; Venue. This Agreement shall be governed by the laws of the State of New York.

Any and all disputes involving this Agreement including the breach or alleged breach thereof may not be submitted to arbitration unless specifically agreed thereto in writing by the County Executive of the Covered Entity, but must instead only be heard in the Supreme Court of the State of New

York with venue in Orange County, or if appropriate, in the Federal District Court with venue in the Southern District of New York White Plains division.

BUSINESS ASSOCIATE: COVERED ENTITY:

BY: __________________________________ By: __________________________________

NAME: _______________________________ Stefan (“Steven”) M. Neuhaus

TITLE: _______________________________ County Executive

DATED: _____________________ DATED: _____________________