DMH Flex Business Associate Terms and Conditions.doc

Department of Mental Health – Division of Child, Youth, and Family Services

Flexible Support Services Request For Response

DMH Document Number: DMH #2019-FLEX-3066-02

DMH Business Associate Agreement

PART I.

GENERAL PROVISIONS

Section 1. Department. The Department of Mental Health (Department) is a Covered Entity under the Health Insurance Portability and Accountability Act (HIPAA) and therefore subject to the HIPAA Privacy and Security Rules. It is also an agency of the Commonwealth of Massachusetts and subject to the Fair Information Practices Act (FIPA), M.G.L. c. 66A; M.G.L. c. 93H and State confidentiality requirements governing the records of the Department (M.G.L c. 123, §36; 104 CMR 27.17 & 28.09).

Section 2. Business Associate. The Contractor when providing services to the Department pursuant to the contract awarded under the Department of Mental Health – Division of Child, Youth, and Family Services Flexible Support Services Request For Response DMH Document Number: DMH #2019-FLEX-3066-02, issued in August, 2018, to which this DMH Business Associate Agreement (Business Associate Agreement) is attached and incorporated into by reference (hereinafter the RFR and the resulting contract are referred to as the “Contract”), is a Business Associate of the Department as the term is defined in 45 CFR 160.103. Contract for this purpose shall include any Statement of Works that are entered into between the Department and the Contractor, pursuant to the terms of the Contract.

Section 3. Business Associate Agreement. This Business Associate Agreement is intended to protect the privacy and security of all Personal Data, including Protected Health Information, that the Contractor may receive from and/or create on behalf of the Department in the performance of its duties and responsibilities under the Contract, and to ensure that the Department complies with the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HIPAA Privacy and Security Rules, 45 CFR Parts 160 and 164, and the HITECH Act; the Fair Information Practices Act (FIPA), M.G.L. c. 66A; M.G.L. c. 93H and State confidentiality requirements governing the records of the Department (M.G.L c. 123, §36; 104 CMR 27.17 & 28.09).

Section 4. Definitions.

Except as otherwise defined in this Agreement, capitalized terms used in this Agreement shall be construed in a manner consistent with the HIPAA Privacy and Security Rules, The Fair Information Practices Act, and other applicable state or federal privacy or confidentiality laws.

“Breach” means the acquisition, access, Use, or Disclosure, of unsecured Protected Health Information, Personal Data, in a manner not permitted under HIPAA or other applicable state or federal privacy or confidentiality laws and which compromises the security or privacy of the PHI.

“Data Subject” means an individual to whom Personal Data or Protected Health Information refers.

“Electronic Media” means:

· Electronic storage media including memory devices in computers (hard drives) and any removable/transportable digital memory medium, such as magnetic tape or disk, optical disk, or digital memory card; or

· Transmission media used to exchange information already in electronic storage media. Transmission media include, for example, the internet (wide-open), extranet (using internet technology to link a business with information accessible only to collaborating parties), leased lines, dial-up lines, private networks, and the physical movement of removable/transportable electronic storage media. Faxes sent directly from one fax machine to another, person-to-person telephone calls, video teleconferencing, and messages left on voice-mail are not considered transmission media. However, any faxes sent from a computer, including those made by a fax-back system, are considered transmission media.

“Electronic Protected Health Information” (EPHI) means PHI that is created, accessed, stored, or transmitted by electronic media.

“HIPAA” collectively means the administrative simplification provision of the Health Insurance Portability and Accountability Act enacted by the Federal Government, and its implementing regulations, including the Privacy Rule, the Breach Notification Rule, and the Security Rule, as amended from time to time, including the Health Information Technology For Economics and Clinical Health (“HITECH’) Act and the modifications to the HIPAA Privacy, Security, Enforcement and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act.

“Personal Data” (PD) means any information in any medium concerning an individual, which because of name, identifying number, mark or description can be associated with a particular individual. Protected Health Information and Electronic Protected Health Information as defined herein, constitute subsets of Personal Data.

“Privacy Rule” means the privacy regulations set forth in 45 CFR Parts 160 and 164 and as amended.

“Protected Health Information” (PHI) means information in any form or medium that relates to the past, present or future, physical or mental condition of an individual; the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe it can be used to identify the individual, that the Contractor receives, creates or uses under the Contract. The terms “Protected Health Information” and “PHI” apply to the original data and to any data derived or extracted from the original data. PHI includes EPHI and is a subset of Personal Data.

“Required By Law” means a mandate contained in law that compels an entity to make a Use or Disclosure of protected health information and that is enforceable in a court of law.

“Secretary” means the Secretary for the U.S. Office of Health and Human Services or designee.

“Security Rule” means the Security standards for the protection of EPHI as set forth at 45 CFR Parts 160, 162 and 164 and as amended.

“Security Incident” means the attempted or successful unauthorized access, Use, Disclosure, modification, or destruction of information or interference with system operations in an information system.

PART II

OBLIGATIONS OF CONTRACTOR

Section 1. Compliance with State and Federal Law. The Contractor acknowledges that in the performance of the Contract, it may receive PHI.

The Contractor further acknowledges that by accepting the PHI it becomes a “holder” within the meaning of M.G.L. c. 66A and that it must comply with the requirements of that law in addition to HIPAA. It also acknowledges that it must comply with all other applicable state or federal laws governing the privacy or security of any PHI received or created under the Contract. This includes, but is not limited to: the State confidentiality requirements governing the records of the Department’s (M.G.L. c. 123 §36; 104 CMR 27.16 and 28.09), M.G.L. c. 93H and implementing regulations at 201 CMR 17.00.

Section 2. Ownership of PHI. The Contractor shall at all times recognize the Department is the owner of the PHI. As owner of the PHI, the Department may have control over the access, Use, Disclosure and disposition of the PHI.

Section 3. Agreements with Third Parties. The Contractor shall not engage a subcontractor or agent to receive PHI related to the Contract without prior authorization from the Department. If the Department authorizes the Contractor in advance to engage such a subcontractor or agent, the Contractor shall obtain and maintain a written agreement with such subcontractor or agent, whereby the subcontractor or agent agrees to be bound by the same restrictions, terms and conditions that apply to the Contractor pursuant to this Business Associate Agreement with respect to such PHI, including, but not limited to, implementing reasonable and appropriate safeguards to protect the information. All provisions of the Business Associate Agreement apply to all such PHI, whether in the possession of the Contractor or any subcontractor or agent. The Contractor is responsible for ensuring each subcontractor’s or agent’s compliance with all applicable provisions of the Contract. Upon request, the Contractor shall provide the Department with a copy of the written terms between the Contractor and the subcontractor or agent.

Section 4. Compliance with Use and Disclosure Provisions. In addition to Part III, below, the Contractor agrees to comply with the Use and Disclosure provisions of HIPAA as established in 45 CFR §164.502(e)(2) and the requirements of §164.504(e) shall apply to the Contractor in the same way they apply to the Department.

Section 5. Appropriate Security Safeguards. The Contractor shall use appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity and availability of PHI (including, but not limited to, complying with Subpart C of 45 CFR Part 164 with respect to electronic PHI). The Contractor shall maintain and implement written policies and procedures addressing these safeguards and to prevent any unauthorized Use or Disclosure PHI.

Section 6. Non-Secure Transmissions Prohibited. The Contractor agrees that it will not transmit the PHI over any unsecured network or over any wireless communication device without the prior written permission of the designated representative of the Department. Transmissions over the Internet must be limited to the secure transmission protocols and methods specified by DMH, including, but not limited to the use of “Secure Mail.”

Section 7. Reporting of Breach or Security Incident. The Contractor shall notify the Department’s Privacy Officer both orally and in writing within three days following the discovery of any Breach of PHI, including, but not limited to, any Use or Disclosure of unsecured PHI not permitted by the Contract or any Security Incident involving or potentially involving the Department’s PHI. The contact information for the Department’s Privacy Officer is:

Privacy Officer

Legal Division

Department of Mental Health

25 Staniford Street

Boston, MA 02114

Ph (617) 626-8160

Fax (617) 626-8242

DMHPrivacyOfficer@MassMail.state.ma.us

The Contractor shall cooperate in the Department’s Breach analysis procedures, including risk assessment, if requested. To the extent possible, the notice shall include (1) a description of what happened, including the date of the incident and the date of discovery; (2) the nature and extent of the PHI involved, the type of identifies and the likelihood of re-identification; (3) the unauthorized person who used the information or to whom the Disclosure was made; (4) whether the information was actually acquired or reviewed; (5) the extent to which the risk to the information has been mitigated; (6) in the case of a Breach, the identity of each individual whose PHI has been, or is reasonably believed by the Contractor to have been acceded, acquired Used, or Disclosed; and (7) what the Contractor is doing to investigate the breach, to mitigate harm to the individual, and to protect against any further breaches. The Contractor shall provide the Department with any other available information that may be required or requested.

Section 8. Responsibility for Breach Notification. The Contractor shall pay the full cost of breach notification for any notification required under HIPAA or M.G.L. c. 93H, for any breach for which the Contractor, its agents or employees is responsible or any breach that occurred through its information system(s), whether the notice is given by the Department or the Contractor.

Section 9. Mitigation. The Contractor must investigate all occurrences reported to the Department pursuant to Part II, Section 7 and to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of its Use or Disclosure of PHI in violation of the Contract or any security breach. The Contractor shall in consultation with the Department take measures that the Department deems appropriate to recover the PHI and prevent a future breach of the confidentiality and security of the PHI. The Contractor shall report to the Department the results of all mitigation actions taken. Nothing in this Section will be deemed to waive any of the Department’s legal rights or remedies that arise from the Contractor’s unauthorized Use or Disclosure of the PHI or security breach.

Section 10. Red Flags Rule. Where applicable, and at the direction of the Department, the Contractor shall implement and maintain appropriate identity theft management programs in compliance with the federal Red Flags Rule.

Section 11. Notice of Request for Data. The Contractor agrees to notify the Department Privacy Officer promptly, but no later than one business day of the Contractor’s receipt of any legal request, court order, or subpoena for PHI. To the extent that the Department decides to assume responsibility for challenging the validity of such requests, the Contractor agrees to cooperate fully with the Department in such challenge as set forth in Part III.

Section 12. Access to PHI. The Contractor must take such reasonable measures as the Department determines are necessary for the Department to satisfy its obligations under 45 CFR 164.525-164.528 and M.G.L. c. 66A. These actions include, but are not limited to, the following:

A. Department’s Access to PHI. Within five (5) business days of the Department making a request, the Contractor must provide the Department with access to or copies of any PHI that it maintains pursuant to this Agreement.

B. Amendments. Within five (5) business days of the Department making a request, the Contractor must make available to the Department PHI for amendment purposes and it shall incorporate any amendments that are made to the PHI in accordance with 45 CFR 164.526.

Section 13. Accounting of Disclosures. The Contractor must document all Disclosures of PHI and information related to such Disclosure in a manner sufficient to enable the the Department to comply with its obligations to respond to a request for an accounting of Disclosures of PHI under 45 CFR 164.528 or other obligations under HIPAA. The Contractor shall provide sufficient information to the Department in a time and manner designated by the Department, promptly upon request, to enable the Department to respond to a request for an accounting of Disclosures of PHI or to meet its other obligations under HIPAA.

Section 14. Access by Secretary to Records. The Contractor shall make available to the Department or the Secretary its internal practices, books, and records including policies and procedures relating to the Use and Disclosure of the PHI received from the Department, or created or received by the Contractor on behalf of the Department as well as policies and procedures relating to the confidentiality and security of the data. The Department or the Secretary shall determine the time and manner for making such material available for purposes of the Secretary determining the Department’s compliance with the Privacy and Security Rules.

Section 15. Prohibition on the Sale of PHI or Electronic Health Records. The Contractor shall comply with 45 CFR § 164.502(a)(5), which relates to the prohibition of the sale of electronic health records and PHI.

Section 16 Indemnification. The Contractor shall indemnify, defend and hold harmless the Department from and against all claims, actions, damages, losses, liabilities, fines, penalties, costs or expenses (including, without limitation, reasonable attorneys’ fees) suffered by the Department arising from or in connection with any breach of this Business Associate Agreement, or any negligent or wrongful acts or omissions in connection with this Business Associate Agreement, by the Contractor or by its employees, directors, officers, subcontractors, or agents.

PART III.

PERMITTED USES AND DISCLOSURES BY THE CONTRACTOR

Section 1. Uses and Disclosures of PHI. The Contractor agrees to Use or Disclose PHI that it receives from and/or creates or receives on behalf of the Department only as specified in this Part III.

Section 2. For Contract Purposes. The Contractor may Use or Disclose PHI, or create PHI on behalf of the Department, only as follows:

A. To Perform the Contract. The Contractor may use or disclose PHI, or create PHI on behalf of the Department, as is necessary for the Contractor to administer or perform the functions, activities and services that are required to satisfy its obligations under the Contract, pursuant to the terms of the Contract.. This shall include providing the Secretary and the Department with full access to such PHI for purposes of auditing the performance of the Contractor under the Contract and as the Department determines is otherwise necessary for the payment for or reimbursement of those services; and/or (3) health care operations. Operations shall include reporting to the Department to fulfill state or federal reporting requirements.

B. For Management and Administration. The Contractor may use PHI that it receives from and/or creates or receives on behalf of the Department for the proper management and administration of the Contractor as provided for by 45 CFR § 164.504(e)(4), provided that such use complies with the requirements of the Contract and the applicable Statement of Works(s` including, but not limited to this Business Associate Agreement, and all other applicable state or federal privacy or confidentiality laws.

C. As Required By law. Contractor may Use or Disclose PHI as Required By Law; provided, however, that, if a Disclosure is to be made pursuant to a subpoena or judicial or administrative order, the Contractor’s must first notify the Department of the receipt the subpoena or judicial or administrative order to disclose PHI and if the Department decides to assume responsibility for challenging the validity of such subpoena or order, the Contractor agrees to cooperate with Department in such challenge. In addition, if a Disclosure is being made as it is Required by Law, the Contractor must obtain reasonable assurances from the person to whom the PHI is Disclosed that the information will remain confidential and used or further disclosed only as Required by Law or for the purposes for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the PHI has been breached.

D. Use and Disclosure Limitations. Notwithstanding anything in this Part III to the contrary, the Contractor may not Use or Disclose PHI received or created by it in performing its duties and responsibilities under the Contract if:

1.

The Use or Disclosure would violate HIPAA if done by the Department.

2.

The Use or Disclosure would conflict with a statement made in the Department of Mental Health Notice of Privacy Practices, which may be changed from time to time. A current copy of the Privacy Notice may be found on the Department’s Internet Site (www.Mass.gov/eohhs/gov/departments/dmh/).

3.

The Use or Disclosure would conflict with a restriction on Use or Disclosure of PHI to which the Department agreed pursuant to 45 CFR § 164.522 and of which the Department informed the Contractor of in writing.

The Contractor agrees that it shall not conduct any research utilizing the PHI received from the Department or created or derived from the contracted data for research purposes without application to and the written approval of the Department Central Office Research Review Committee (its Institutional Review Board) for the specific research.

Section 3. Minimum Necessary. The Contractor agrees to take reasonable steps to limit the amount of PHI Used and/or Disclosed pursuant to this Part III to the minimum necessary to achieve the purpose of the Use and Disclosure.

PART IV

OBLIGATIONS OF THE DEPARTMENT

Section 1. Notice of Privacy Practices. The Department shall notify the Contractor of any limitation(s) in its Notice of Privacy Practices in accordance with 45 CFR § 164.520, to the extent that such limitation may affect the Contractor’s Use or Disclosure of PHI.

Section 2. Revocation of Permission to Use PHI. The Department shall notify the Contractor of any changes in, or revocation of, permission by an individual to Use or Disclose PHI, to the extent that such changes may affect the Contractor’s Use or Disclosure of PHI.

Section 3. Restriction to Use or Disclose PHI. The Department shall notify the Contractor of any restriction to the Use or Disclosure of PHI that the Department has agreed to in accordance with 45 CFR § 164.522, to the extent that such changes may affect the Contractor’s Use or Disclosure of PHI.

Section 4. Notice of Changes and Restrictions. The Department shall notify the Contractor of any changes in, or revocation of, permission by an individual to Use or Disclose PHI, to the extent such changes affect the Contractor’s permitted or required Uses and Disclosures. Such notification shall include any restriction that the Department has agreed to in accordance with 45 CFR § 164.522. If the Contractor receives a request to restrict the Disclosure of PHI directly from an Individual, the Contractor shall notify the Department of such request and the Department shall be responsible for making the determination, in accordance with the Privacy Rule, as to whether the Contractor shall comply with the Individual's request.

Section 5. The Department shall not request the Contractor to Use or Disclose PHI in any manner that would not be permissible under HIPAA if done by a covered Entity (unless permitted by HIPAA for a Contractor).

PART V

TERMINATION OR COMPLETION OF CONTRACT WITH THE CONTRACTOR

Section 1. Termination Upon Breach of Confidentiality or Security Provisions Applicable to PHI. The Department may terminate the Contract immediately upon written notice, if the Department determines, in its sole discretion, that the Contractor has materially breached any of its obligations regarding PHI. Prior to terminating this Contract as permitted above, the Department, in its sole discretion, may provide an opportunity for the Contractor to cure the breach or end the violation. If such an opportunity is provided, but cure is not feasible, or the Contractor fails to cure the breach or end the violations within a time period set by the Department, the Department may terminate the Contract immediately upon written notice.

Section 2. Termination is Not Feasible. In the event that termination of this Contract is not feasible, in the Department’s sole discretion, the Contractor hereby acknowledges that the Department will have the right to report this breach to the Secretary, notwithstanding any other provisions of this Business Associate Agreement to the contrary.

Section 3. Effect of Termination or Completion of the Contract.

A. The Contractor agrees that within 14 days of the termination or completion of the Contract, it will return or destroy, at the Department’s direction and according to standards approved by the Department, any and all PHI that it maintains in any form, including PHI that is in the possession of its subcontractors or agents and will retain no copies of the PHI.

B. Notwithstanding the foregoing, to the extent that the Department agrees that if it is not feasible to return or destroy such PHI, all protections pertaining to any PHI covered by the Contract shall remain in force and the Contractor will limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such PHI.

PART VI

MISCELLANEOUS PROVISIONS

Section 1. Regulatory References. A reference in this Business Associate Agreement to a section of the Privacy or Security Rule means the section as now in effect or if subsequently amended as amended.

Section 2. Survival. The obligations of the Contractor under Parts III and V of this Business Associate Agreement shall survive the termination of the Contract.

Section 3. Amendment. The Contractor and the Department agree to negotiate an amendment to the Contract (and this Business Associate Agreement) to the extent necessary to allow either party to comply with any amendments to the Privacy or Security Rules or the Standards for Electronic Transactions.

Section 4. Remedies. Nothing in this Business Associate Agreement shall be construed to waive or limit any of the Department’s legal rights or remedies that may arise from the Contractor’s unauthorized use or disclosure of PHI or security breach. The Department’s exercise or non-exercise of any authority in the Contract (including this Business Associate Agreement) including, for example, any rights of inspection or approval of privacy or security practices or approval of subcontractors, shall not relieve the Contractor of any obligations as set forth in the Contract nor be construed as a waiver of any of the Contractor’s obligations, or as an acceptance of any unsatisfactory practices, or privacy or security failures by the Contractor.

Section 5. Interpretation. Any ambiguity in this Business Associate Agreement shall be resolved to permit the Department to comply with HIPAA’s Privacy or Security Rules, M.G.L. c. 66A, M.G.L. c. 93 H, and any other law pertaining to the privacy or security of PHI.

Section 6. No Third Party Beneficiaries. Nothing expressed or implied in this Business Associate Agreement is intended to confer, nor shall anything herein confer, upon any person or entity, other than the Department and the Contractor any rights, remedies, obligations or liabilities whatsoever. None of the provisions of this Business Associate Agreement are intended to create, nor will they be deemed to create any relationship between the parties other than that of independent parties contracting with each other solely for the purposes of effecting the provisions of the Contract.

Section 7. Waiver. No change, waiver or discharge of any liability or obligation under this Business Associate Agreement on any one or more occasions shall be deemed a waiver of performance of any continuing or other obligation, or shall prohibit enforcement of any obligation on any other occasion.

� Hereinafter this Business Associate Agreement shall use the reference “PHI” to conform to the terms of the HIPAA Privacy Rule. However, to the extent that Contractor holds any PD, as defined by M.G.L. c. 66A, which does not constitute PHI, the PD shall also be covered under all the terms of this Agreement that refer to PHI.

PAGE