Contract_Addendum_A_-_Business_Associate_Agreement__ViaquestDODD_.docx

ADDENDUM A

Business Associate Addendum

This Business Associate Addendum (the “Addendum”) is entered into by and between the Ohio Department of Developmental Disabilities (DODD) and ViaQuest.

Whereas, DODD and ViaQuest are parties to an agreement entered into contemporaneously herewith (“Underlying Agreement”); and

Whereas, ViaQuest, pursuant to the Underlying Agreement, provides DODD with certain individually identifiable protected health information that is necessary for the parties to perform the services called for in the Underlying Agreement and is subject to protection under the Health Insurance Portability and Accountability Act of 1996(“HIPAA”) and the Standards for Privacy of Individually Identifiable Health Information and Security Standards for the Protection of Electronic Protected Health Information, 45 C.F.R. Part 160 and Part 164 (“Rules”); and Subtitle D of the Hitech Act, American Recovery and Reinvestment Act of 2009; and

Whereas, the parties purpose for entering into this Addendum is to comply with the requirements of applicable laws and regulations, including but not limited to HIPAA, Hitech, and the Rules.

NOW, THEREFORE, in consideration of the forgoing and the promises and mutual covenants contained herein, the parties agree as follows:

1. Definitions. Unless otherwise provided in this Addendum, capitalized terms shall have the same meaning as set forth in the Rules.

2. Duties and Responsibilities of DODD:

A. DODD acknowledges and agrees that all protected health information (the “PHI”), as defined by the Rules, provided to DODD by ViaQuest is confidential and the property of ViaQuest without regard to medium of storage or method of transmission of such information. DODD agrees to keep all PHI confidential.

B. Except as otherwise limited in this Addendum, DODD may use or disclose PHI necessary to perform functions and activities as specified in the Underlying Agreement or for the proper management and administration of ViaQuest, provided that such use or disclosure would not violate the Rules if done by ViaQuest.

C. DODD agrees to take reasonable steps necessary to protect the security and confidentiality of PHI so as to enable ViaQuest to comply with HIPAA, Hitech, the Rules and other laws relating to the privacy and security of PHI, which are now in force or which may hereafter be in force, including, without limitation, the following actions:

(1.) use or disclose PHI only as permitted or required by the Underlying Agreement and this Addendum, or as Required by Law; and

(2.) use appropriate safeguards to prevent use or disclosure of the PHI other than as provided for by the Underlying Agreement and this Addendum; and

(3.) implement reasonable processes to detect unauthorized disclosures of PHI and train its work force regarding these processes; and

(4.) to the extent practicable, mitigate any harmful effect that is known to DODD of a use or disclosure of PHI by DODD in violation of the requirements of the Underlying Agreement or this Addendum; and

(5.) promptly and in no case later than 10 days after discovery, report in writing to ViaQuest any use or disclosure of the PHI not provided for by the Underlying Agreement or this Addendum, of which DODD becomes aware. DODD shall provide such other available information to ViaQuest to enable it to notify individuals as required by Hitech; and

(6.) require any contractors or agents, including subcontractors, to whom DODD provides PHI received from, or created or received from ViaQuest to agree to the same restrictions and conditions that apply to DODD pursuant to this Addendum; and

(7.) make its internal practices (including policies and procedures), books, and records relating to the use and disclosure of PHI received from, or created or received by DODD from ViaQuest, available to the Secretary of the Department of Health and Human Services (the “Secretary”) for purposes of determining Covered Entities compliance with the Rules. DODD shall provide ViaQuest with a copy of any PHI that DODD provides to the Secretary concurrently with providing such PHI to the Secretary; and

(8.) within fifteen (15) days of receiving a written request from ViaQuest, provide to ViaQuest the information necessary for the ViaQuest to make an accounting of disclosures of PHI about an Individual as necessary for ViaQuest to comply with 45 C.F.R. 164.528; and

(9.) make available information necessary for ViaQuest to respond to an Individual's request for access to PHI about them as is necessary to comply with 45 C.F.R. 164.524. Such information shall be made available within ten (10) ten days of receiving a written request from ViaQuest. In the event an Individual contacts DODD, or its agents or subcontractors, directly requesting access to PHI, DODD will not grant access to PHI but will notify ViaQuest in writing within five (5) business days of such contact; and

(10.) within fifteen (15) days of receiving a written request from ViaQuest, incorporate any amendments or corrections to PHI as necessary for ViaQuest to comply with 45 C.F.R. 164.526. In the event an Individual contacts DODD, or its agents or subcontractors, directly about making amendment to PHI, DODD will not make any amendments to PHI but will notify ViaQuest in writing within five (5) business days of such contact.

3. Security Rule Provisions. DODD agrees to the following additional obligations in order that ViaQuest may meet its obligations under HIPAA Security Rule, 45 C.F.R. Part 164, Subpart C, with respect to electronic PHI:

A. DODD will employ appropriate administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of the electronic PHI that it creates, receives, maintains, or transmits on behalf of ViaQuest.

B. DODD will Report to ViaQuest any Security Incident of which it becomes aware.

C. DODD will ensure that any agent, including a subcontractor, to whom it provides such electronic PHI agrees to implement reasonable and appropriate safeguards to protect it.

4. Breach of Unsecured PHI. If DODD discovers any Breach of Unsecured PHI (as the terms “Breach” and Unsecured” PHI” or “Unsecured Protected Health Information” are defined in 45 C.F. R. 164.402) that it accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses on behalf of ViaQuest, then in accordance with 45 C.F.R. §164.410, DODD shall notify ViaQuest of such Breach in writing without unreasonable delay and in no event later than ten (10) days after discovery of such Breach, which written notice shall include, to the extent possible, the identification of each Individual whose Unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, or disclosed during such Breach. In addition, DODD shall provide ViaQuest with the following information, to the extent available at the time initial notice to ViaQuest is provided, or promptly thereafter as such information becomes available:

A. A brief description of what happened, including the date of the Breach and the date of the discovery of the Breach.

B. A description of the type of PHI that was involved (e.g., name, Social Security Number, procedure, diagnosis, treatment, etc.).

C. A brief description of the steps that DODD is taking to investigate, mitigate harm, and protect against further Breaches.

5. Termination. DODD agrees that upon termination of the Underlying Agreement, it will return or destroy all PHI received from, or created or received on behalf of ViaQuest, that DODD still maintains in any form and retain no copies of such information. This provision shall apply to PHI that is in the possession of DODD and any subcontractors or agents of DODD. In the event that returning or destroying the PHI is infeasible, DODD agrees to extend the protections of the Underlying Agreement and this Addendum to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as DODD maintains such PHI.

6. Amendment. It is the intent of the parties that the Underlying Agreement and this Addendum comply with the requirements of HIPAA, Hitech, and the Rules. Any ambiguity in the Underlying Agreement or this Addendum shall be resolved to permit ViaQuest to comply with HIPAA and the Rules. If necessary, the parties agree to use good faith efforts to amend the Underlying Agreement and this Addendum from time to time as is necessary for ViaQuest to be in compliance with HIPAA and regulations promulgated thereunder.

7. Survival. The obligations of the DODD under this Addendum shall survive the expiration or termination of the Underlying Agreement and this Addendum.

8. No Third Party Beneficiaries. Nothing express or implied in this Addendum is intended to confer, nor shall confer, upon any person other than the parties, and their permitted successors and assigns if any, rights, remedies, obligations or liabilities whatsoever.

9. Miscellaneous: As amended by this Addendum, the Underlying Agreement and all its terms and conditions shall remain in full force and effect.