Contract_Addendum_A_-_Business_Associate_Agreement.pdf

ADDENDUM A

Business Associate Addendum

This Business Associate Addendum (the “Addendum”) is entered into by and between the Ohio Department of Developmental Disabilities ("Agency") and Contractor.

Whereas, Agency and Contractor are parties to an agreement entered into contemporaneously herewith (“Underlying Agreement”); and

Whereas, Agency, pursuant to the Underlying Agreement, provides Contractor with certain individually identifiable protected health information that is necessary for Contractor to perform the services called for in the Underlying Agreement and is subject to protection under the Health Insurance Portability and Accountability Act of 1996(“HIPAA”) and the Standards for Privacy of Individually Identifiable Health Information and Security Standards for the Protection of Electronic Protected Health Information, 45 C.F.R. Part 160 and Part 164 (“Rules”); and Subtitle D of the Hitech Act, American Recovery and Reinvestment Act of 2009; and

Whereas, the parties purpose for entering into this Addendum is to comply with the requirements of applicable laws and regulations, including but not limited to HIPAA, Hitech, and the Rules.

NOW, THEREFORE, in consideration of the forgoing and the promises and mutual covenants contained herein, the parties agree as follows:

1. Definitions. Unless otherwise provided in this Addendum, capitalized terms shall have the same meaning as set forth in the Rules.

2. Duties and Responsibilities of Contractor:

A. Contractor acknowledges and agrees that all protected health information (the “PHI”), as defined by the Rules, provided to Contractor by Agency is confidential and the property of Agency without regard to medium of storage or method of transmission of such information. Contractor agrees to keep all PHI confidential.

B. Except as otherwise limited in this Addendum, Contractor may use or disclose PHI necessary to perform functions, activities, or services for, or on behalf of, Agency as specified in the Underlying Agreement or for the proper management and administration of Contractor, provided that such use or disclosure would not violate the Rules if done by Agency.

C. Contractor agrees to take reasonable steps necessary to protect the security and confidentiality of PHI so as to enable Agency to comply with HIPAA, Hitech, the Rules and other laws relating to the privacy and security of PHI, which are now in force or which may hereafter be in force, including, without limitation, the following actions:

(1.) use or disclose PHI only as permitted or required by the Underlying Agreement and this

Addendum, or as Required by Law; and

(2.) use appropriate safeguards to prevent use or disclosure of the PHI other than as provided for by the Underlying Agreement and this Addendum; and

(3.) implement reasonable processes to detect unauthorized disclosures of PHI and train its work force regarding these processes; and

(4.) to the extent practicable, mitigate any harmful effect that is known to Contractor of a use or disclosure of PHI by Contractor in violation of the requirements of the Underlying Agreement or this Addendum; and

(5.) promptly and in no case later than 10 days after discovery, report in writing to Agency any use or disclosure of the PHI not provided for by the Underlying Agreement or this Addendum, of which Contractor becomes aware. Contractor shall provide such other available information to Agency to enable it to notify individuals as required by Hitech; and

(6.) require any contractors or agents, including subcontractors, to whom Contractor provides PHI received from, or created or received by Contractor on behalf of Agency, to agree to the same restrictions and conditions that apply to Contractor pursuant to this Addendum; and

(7.) make its internal practices (including policies and procedures), books, and records relating to the use and disclosure of PHI received from, or created or received by Contractor on behalf of Agency, available to the Secretary of the Department of Health and Human Services (the “Secretary”) for purposes of determining Covered Entities compliance with the Rules. Contractor shall provide Agency with a copy of any PHI that Contractor provides to the Secretary concurrently with providing such PHI to the Secretary; and

(8.) within fifteen (15) days of receiving a written request from Agency, provide to Agency the information necessary for the Agency to make an accounting of disclosures of PHI about an Individual as necessary for Agency to comply with 45 C.F.R. 164.528; and

(9.) make available information necessary for Agency to respond to an Individual's request for access to PHI about them as is necessary for Agency to comply with 45 C.F.R. 164.524. Such information shall be made available within ten (10) ten days of receiving a written request from Agency for such information. In the event an Individual contacts Contractor, or its agents or subcontractors, directly requesting access to PHI, Contractor will not grant access to PHI but will notify Agency in writing within five (5) business days of such contact; and

(10.) within fifteen (15) days of receiving a written request from Agency, incorporate any amendments or corrections to PHI as necessary for Agency to comply with 45 C.F.R. 164.526. In the event an Individual contacts Contractor, or its agents or subcontractors, directly about making amendment to PHI, Contractor will not make any amendments to PHI but will notify Agency in writing within five (5) business days of such contact.

3. Security Rule Provisions. Contractor agrees to the following additional obligations in order that Agency may meet its obligations under HIPAA Security Rule, 45 C.F.R. Part 164, Subpart C, with respect to electronic PHI:

A. Contractor will employ appropriate administrative, technical, and physical safe guards to protect the confidentiality, integrity, and availability of the electronic PHI that it creates, receives, maintains, or transmits on behalf of Agency.

B. Contractor will Report to Agency any Security Incident of which it becomes aware.

C. Contractor will ensure that any agent, including a subcontractor, to whom it provides such electronic

PHI agrees to implement reasonable and appropriate safeguards to protect it.

4. Breach of Unsecured PHI. If Contractor discovers any Breach of Unsecured PHI (as the terms “Breach” and Unsecured” PHI” or “Unsecured Protected Health Information” are defined in 45 C.F. R. 164.402) that it accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses on behalf of Agency, then in accordance with 45 C.F.R. §164.410, Contractor shall notify Agency of such Breach in writing without unreasonable delay and in no event later than ten (10) days after discovery of such Breach, which written notice shall include, to the extent possible, the identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed during such Breach. In addition, Contractor shall provide Agency with the following information, to the extent available at the time initial notice to Agency is provided, or promptly thereafter as such information becomes available:

A. A brief description of what happened, including the date of the Breach and the date of the discovery of the Breach.

B. A description of the type of PHI that was involved (e.g., name, Social Security Number, procedure, diagnosis, treatment, etc.).

C. A brief description of the steps that Contractor is taking to investigate, mitigate harm, and protect against further Breaches.

5. Termination. Agency may immediately terminate the Underlying Agreement, including this Addendum, by giving Contractor written notice of termination, if Agency determines that Contractor has violated a material term of this Addendum. Alternatively, Agency may in its sole discretion provide an opportunity for Contractor to cure the breach and end the violation. If Contractor fails to cure the breach to the satisfaction of Agency, the Agency may immediately thereafter terminate the Underlying Agreement.

Termination of the Underlying Agreement shall result in the termination of this Addendum.

Contractor agrees that upon termination of the Underlying Agreement, it will return or destroy all PHI received from, or created or received on behalf of Agency, that Contractor still maintains in any form and retain no copies of such information. This provision shall apply to PHI that is in the possession of Contractor and any subcontractors or agents of Contractor. In the event that returning or destroying the PHI is infeasible, as determined by Agency, Contractor agrees to extend the protections of the Underlying Agreement and this Addendum to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Contractor maintains such PHI.

6. Amendment. It is the intent of the parties that the Underlying Agreement and this Addendum comply with the requirements of HIPAA, Hitech, and the Rules. Any ambiguity in the Underlying Agreement or this Addendum shall be resolved to permit Agency to comply with HIPAA and the Rules. If necessary, the parties agree to use good faith efforts to amend the Underlying Agreement and this Addendum from time to time as is necessary for Agency to be in compliance with HIPAA and regulations promulgated thereunder.

7. Survival. The obligations of the Contractor under this Addendum shall survive the expiration or termination of the Underlying Agreement and this Addendum.

8. No Third Party Beneficiaries. Nothing express or implied in this Addendum is intended to confer, nor shall confer, upon any person other than the parties, and their permitted successors and assigns if any, rights, remedies, obligations or liabilities whatsoever.

9. Miscellaneous: As amended by this Addendum, the Underlying Agreement and all its terms and conditions shall remain in full force and effect.