ESBD_369211_1722980413884_Attachment C.pdf

ATTACHMENT

BUSINESS ASSOCIATE AGREEMENT BETWEEN THE

BETWEEN THE

ALAMO AREA COUNCIL OF GOVERNMENTS AND

XXXXXXXXXX

This agreement ("AGREEMENT) is made by and between The Alamo Area Council of Governments ("AACOG") and XXXXXXXXXX ("BUSINESS ASSOCIATE") acting by and through its duly authorized officials.

Article 1: Contract Period

1.1 This Agreement is effective upon final execution by AACOG (the "Effective Date") and shall terminate when all Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) provided by AACOG to BUSINESS ASSOCIATE is destroyed (with required certification of destruction) or returned to AACOG, or, if it is not feasible for the return or destruction of all PHI and/or EPHI, safeguards are extended to such information in accordance with the termination provisions in this

AGREEMENT.

Article 2: Definitions

2.1 All terms used in this Agreement not otherwise defined in this Agreement have the same meaning as those terms in the Implementing Regulations. A reference to a section of an Implementing Regulation means the section as of the execution date of this AGREEMENT or as subsequently amended.

2.2 Electronic Protected Health Information (EPHI), for purposes of this AGREEMENT, has the meaning given at 45 CFR 160.103, limited to the information received by BUSINESS ASSOCIATE from AACOG.

2.3 Implementing Regulations are Title 45, Code of Federal Regulations, Parts 160, 162, and 164 (45 CFR 160, 45 CFR 162, and 45 CFR 164), as amended.

2.4 Privacy Rule shall mean the Standards for Privacy of Individually Identifiable Health

Information at 45 CFR 160 and 45 CFR 164, Subparts A and E.

2.5 Protected Health Information (PHI), for purposes of this AGREEMENT, has the meaning given at 45 CFR 160.103, limited to the information received by BUSINESS ASSOCIATE from AACOG.

2.6 Security Rule shall mean the Security Standards for the Protection of Electronic

Protected Health Information at 45 CFR 160 and 45 CFR 164, Subpart C.

Article 3: Background

3.1 Under the terms of this Agreement, AACOG will provide to BUSINESS ASSOCIATE certain PHI and/or EPHI for storage and possible destruction. BUSINESS ASSOCIATE must afford that PHI and/or EPHI special treatment and safeguards, as detailed in the Health Insurance Portability and Accountability Act of 1966 (HIPAA) and its Implementing Regulations, in conjunction with storage and destruction services provided to AACOG by BUSINESS ASSOCIATE.

Article 4: Permitted Uses and Disclosures by BUSINESS ASSOCIATE

4.1 BUSINESS ASSOCIATE shall have possession of PHI and/or EPHI furnished by

AACOG solely for purposes of secure storage and, a3 directed by AACOG, destruction. BUSINESS ASSOCIATE shall make no other use of PHI and/or EPHI provided by AACOG.

4.2 BUSINESS ASSOCIATE shall make no disclosure of any PHI and/or EPHI provided by AACOG.

4.3 BUSINESS ASSOCIATE shall destroy PHI and/or EPHI only upon direction by

AACOG and shall ensure documentation of each destruction in accordance with procedures and instructions which AACOG shall provide. Destruction and documentation shall, in all cases, be consistent with the guidelines at the Implementing Regulations.

Article 5: Obligations and Activities of BUSINESS ASSOCIATE

5.1 BUSINESS ASSOCIATE agrees not to use or disclose PHI and/or EPHI provided by, made available by, or created or received on behalf of AACOG other than as permitted by this AGREEMENT or required by law.

5.2 BUSINESS ASSOCIATE agrees to establish and maintain appropriate administrative, physical, and technical safeguards (consistent with the Implementing Regulations) to protect the confidentiality, integrity, and availability of PHI and/or EPHI stored at BUSINESS ASSOCIATE's facility. In providing these safeguards, BUSINESS ASSOCIATE shall pay particular attention to the requirements addressed in the Privacy Rule and the Security Rule.

5.3 BUSINESS ASSOCIATE agrees to establish and maintain policies and procedures for mitigation, to the extent practicable, of any harmful effect of a use or disclosure of PHI and/or EPHI by BUSINESS ASSOCIATE, its subcontractors, and its agents in violation of the requirements of this AGREEMENT or the HIPAA Implementing Regulations.

5.4 BUSINESS ASSOCIATE agrees to promptly, but in no case more than one (1) business day, report to AACOG:

a. Any use, disclosure, or breach of PHI and/or EPHI of which it becomes aware that is not provided for by this AGREEMENT.

b. Any security incident of which it becomes aware.

5.5 BUSINESS ASSOCIATE also agrees to provide the detailed notification required by

45 CFR 164.410 as quickly as practicable and in no case later than sixty (60) days after discovery of a breach, as described in 45 CFR 164.

5.6 BUSINESS ASSOCIATE agrees that it shall not allow storage of AACOG's PHI and/or EPHI with a subcontractor or agent without the advance, express, written permission of AACOG. BUSINESS ASSOCIATE further agrees that, prior to storing AACOG PHI and/or EPHI with a subcontractor or other agent, BUSINESS ASSOCIATE will, through a subcontract or other appropriate agreement, ensure that any subcontractor or other agent agrees to the same restrictions and conditions that apply through this AGREEMENT to BUSINESS ASSOCIATE with respect to AACOG's PHI and/or EPHI. That subcontract or other agreement shall:

a. Be executed prior to allowing use or disclosure to or by the agent.

b. Contain the same terms, conditions, and restrictions on use, disclosure, and safeguard of PHI and/or EPHI as are contained in this AGREEMENT.

c. Be approved as to form, conditions, and restrictions by AACOG prior to execution.

5.7 BUSINESS ASSOCIATE agrees, at the request of AACOG and with reasonable notice during BUSINESS ASSOCIATE's established business hours, to provide access to PHI and/or EPHI.

5.8 BUSINESS ASSOCIATE agrees to make internal practices, books, and records, (including policies and procedures) relating to safeguard of PHI and/or EPHI received from AACOG available to AACOG or the Department of Health and Human Services (DHHS) for the purposes of determining BUSINESS ASSOCIATE'S compliance with the Privacy Rule and/or Security Rule. AACOG will make these requests during BUSINESS ASSOCIATE'S regular business hours or as directed by DHHS.

5.9 BUSINESS ASSOCIATE agrees to return, or properly destroy, all PHI and/or EPHI received from AACOG once BUSINESS ASSOCIATE finishes providing services under this agreement or a succeeding agreement.

a. If BUSINESS ASSOCIATE destroys information, it must certify that destruction to AACOG in accordance with procedures and instructions which AACOG shall provide. Destruction and documentation shall, in all cases, be consistent with the guidelines provided in the Implementing Regulations.

b. BUSINESS ASSOCIATE may not unilaterally elect to destroy information that it must retain under Federal or State law or regulation.

c. BUSINESS ASSOCIATE must maintain required safeguards for all PHI and

EPHI received from AACOG for as long as BUSINESS ASSOCIATE has such information.

5.10 BUSINESS ASSOCIATE will develop and implement a procedure for sanctions to address violations, by employees, subcontractors, or agents, of the Privacy Rule, the Security Rule, or any other portion of the Implementing Regulations that deal with safeguard of PHI and EPHI.

Article 6: ownership of PHI and/or EPHI

6.1 All PHI and/or EPHI are and shall remain the property of AACOG.

6.2 BUSINESS ASSOCIATE agrees it acquires no title or rights to the information.

Article 7: Amendment

7.1 The Parties agree to take such action as is necessary to amend this Agreement as required to ensure compliance with applicable requirements of the HIPAA and its Implementing Regulations.

7.2 BUSINESS ASSOCIATE and AACOG shall enact any modifications to the time frame, character, provisions, or other obligations of the parties hereto by execution of a written amendment to the AGREEMENT.

Article 8: Termination

8.1 This Agreement may be terminated as follows:

a. By 30 day written notice of either party, which will also void any associated agreements;

b. For cause, upon AACOG's knowledge of a material breach or violation by

BUSINESS ASSOCIATE, its agents, or its subcontractors, in which case AACOG shall either:

1. Provide BUSINESS ASSOCIATE a reasonable opportunity to cure the breach or violation, and then terminate this AGREEMENT if BUSINESS ASSOCIATE does not cure the breach or violation within a time specified by AACOG; or

2. Immediately terminate this AGREEMENT and if the BUSINESS

ASSOCIATE breaches a material term of this AGREEMENT and a cure is not feasible in AACOG's opinion.

3. If neither termination nor cure is feasible, AACOG shall report the breach or violation to the Secretary of the Department of Health and Human Services.

c. Immediately, without opportunity for cure, if BUSINESS ASSOCIATE knew of a material breach or violation of its obligations under this AGREEMENT on its part, that of its agents, or that of its subcontractors and failed to immediately take reasonable steps to notify AACOG and cure the breach or violation.

8.2 Effect of Termination.

a. Except as provided in paragraph 8.2b of this section, upon termination of this AGREEMENT, for any reason, BUSINESS ASSOCIATE shall return or destroy (and so certify to destruction) all PHI and EPHI received from AACOG. This provision shall apply to all PHI and EPHI that BUSINESS ASSOCIATE, its subcontractors, and agents possess.

b. In the event BUSINESS ASSOCIATE determines that return or destruction of

PHI and EPHI is infeasible, BUSINESS ASSOCIATE shall provide AACOG, in writing, within seven business days of termination, notification of the condition(s) that make return or destruction not feasible. Upon such notification, BUSINESS ASSOCIATE shall continue to extend the safeguards of this AGREEMENT to such PHI and EPHI and continue to ensure no uses and disclosures of such PHI and EPHI for so long as BUSINESS ASSOCIATE maintains such PHI and EPHI.

Article 9: Survival of Terms

9.1 The respective rights and obligations of the BUSINESS ASSOCIATE under Articles 4, 5, 6, 8, 9, 10, 11, 12, and 15 of this AGREEMENT shall survive termination of this

AGREEMENT.

9.2 The duties and obligations imposed on BUSINESS ASSOCIATE for proper safeguards for PHI and EPHI under this Agreement will survive expiration of the AGREEMENT until all PHI and EPHI provided by AACOG to BUSINESS ASSOCIATE is destroyed (with required certification of destruction) or returned to

AACOG.

Article 10: Compliance with Laws, Representations, and Warranties

10.1 BUSINESS ASSOCIATE shall comply with all applicable federal, state, and local laws, statutes, ordinances, rules and regulations, and the orders and decrees of any courts or administrative bodies or tribunals in any manner affecting the performance of the AGREEMENT. When required, BUSINESS ASSOCIATE shall furnish AACOG with written documentation necessary to provide satisfactory proof of compliance.

This AGREEMENT shall be construed under the laws of the State of Texas.

BUSINESS ASSOCIATE represents and warrants that it has acquired all necessary permits and licenses to accomplish the objectives of this AGREEMENT, and BUSINESS ASSOCIATE shall bear the cost for all necessary permits and licenses.

10.2 AACOG represents and warrants that:

a. It will comply with all applicable federal, state, and local laws and regulations, including but not limited to applicable privacy laws

b. It has obtained any and all permits, licenses and third-party consents or approvals necessary in connection with the use of materials furnished by AACOG to BUSINESS ASSOCIATE and that it has the legal right to disclose such materials to BUSINESS ASSOCIATE in connection with the services to be performed under this Agreement

c. Any materials disclosed by AACOG to BUSINESS ASSOCIATE shall not violate or infringe upon the trademark, copyright, patent, or other intellectual property rights or rights of privacy or publicity of any third-party

d. It will not publish the work product or other deliverables in the public domain without the prior written consent of BUSINESS ASSOCIATE.

Article 11: Injunctive Relief

11.1 Notwithstanding any rights or remedies provided for in this AGREEMENT, AACOG retains all rights to seek injunctive relief to prevent or stop unauthorized use or disclosure of PHI and EPHI, or other violation of the HIPAA and its Implementing Regulations, by BUSINESS ASSOCIATE, its agent(s), subcontractor(s), or other third party that received information from BUSINESS ASSOCIATE.

Article 12: Indemnification; Limitation of Liability

12.1 BUSINESS ASSOCIATE shall indemnify, defend, and save harmless AACOG, its officers, employees, members, agents, and contractors from and against all claims, liabilities, costs, and damages, including reasonable attorneys' fees and expenses of litigation, arising out of or attributed, directly or indirectly, to BUSINESS ASSOCIATE's breach of any provision of this AGREEMENT or from any negligent act or omission of BUSINESS ASSOCIATE, its officers, employees, agents or contractors.

12.2 To the extent permitted by law. AACOG shall indemnify, defend, and hold harmless

BUSINESS ASSOCIATE, its affiliated companies, and each of their respective officers, directors, employees, and agents from and against all claims, liabilities, losses, damages, costs, and expenses of any kind, including reasonable attorneys' fees (whether incurred in defense of a claim against BUSINESS ASSOCIATE or in connection with a third-party claim, suit, or subpoena) arising out of:

a. AACOG's breach of any provision of this AGREEMENT;

b. Any negligent act or omission of AACOG, its officers, employees, agents, or contractors; or

c. The use of the Work Product by AACOG, or the conclusions drawn therefrom, except for claims arising from BUSINESS ASSOCIATE's negligence.

12.3 Neither party shall be liable to the other party for any incidental, indirect, special, or consequential damages, including loss of profit, arising out of, or in connection with, this AGREEMENT whether or not such party was advised of the possibility of such damage; provided, however, that the foregoing limitations shall not apply to any third-party claims arising out of either party's indemnification obligations. Liability under any claim made by AACOG shall not exceed the amount of fees paid by AACOG under this AGREEMENT.

Article 13: Legal Construction

13.1 In case one or more of the provisions contained in this Agreement shall for any reason be held invalid, illegal or unenforceable in any respect, such invalidity, illegality or unenforceability shall not affect any other provisions hereof and this AGREEMENT shall be construed as if such invalid, illegal, or unenforceable provisions had never been contained herein.

13.2 Any ambiguity in this AGREEMENT shall be resolved to permit AACOG to comply with the Privacy Rule and the Security Rule.

Article 14: Sole Agreement

14.1 This Agreement constitutes the only agreement between the parties hereto regarding

HIPAA compliance and supersedes any prior understandings or written or oral agreements respecting such subject matter.

Article 15: Resolution of Disputes

15.1 The Any controversy or claim arising out of or relating to this Agreement, or the breach thereof, shall first be subject to mediation before instituting any proceedings in any court having jurisdiction of the matters made the subject of this Agreement.

15.2 Neither party shall institute a proceeding in any court nor administrative agency to resolve a dispute between the parties before that party has sought to resolve the dispute through direct negotiation with the other party. If the dispute is not resolved within three weeks after a demand for direct negotiation, the parties shall attempt to resolve the dispute through mediation. If the parties do not promptly agree on a mediator, either party may request the State District Court of Bexar County, Texas, to appoint a mediator. If the mediator is unable to facilitate a settlement of the dispute within a reasonable period of time, as determined by the mediator, the mediator shall issue a written statement to that effect and the aggrieved party may then seek relief through legal process in the courts of Bexar County, Texas.

IN TESTIMONY HEREOF, the parties hereto have executed this AGREEMENT in duplicate counterparts by their duly authorized representatives.

Diane Rath XXXXXXXXXX Executive Director XXXXXXXXXX

AACOG

Date: Date: